Security Bulletin: Security vulnerabilities were found in IBM Verify Identity Access Digital Credentials (CVE-2025-48387, CVE-2025-5889)

Summary Security vulnerabilities were addressed in IBM Verify Identity Access Digital Credentials Vulnerability Details CVEID:CVE-2025-48387 DESCRIPTION: tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside...

jupyter-jupyterlab-templates-0.5.2-2.1 on GA media (moderate)

jupyter-jupyterlab-templates-0.5.2-2.1 on GA media Announcement ID: openSUSE-SU-2025:15274-1 Rating: moderate Cross-References: CVE-2025-5889 CVSS scores: CVE-2025-5889 SUSE : 2.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2025-5889 SUSE : 2...

jupyter-bqplot-jupyterlab-0.5.44-10.1 on GA media (moderate)

jupyter-bqplot-jupyterlab-0.5.44-10.1 on GA media Announcement ID: openSUSE-SU-2025:15269-1 Rating: moderate Cross-References: CVE-2025-5889 CVSS scores: CVE-2025-5889 SUSE : 2.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2025-5889 SUSE : 2...

python311-pydata-sphinx-theme-0.16.1-1.1 on GA media (moderate)

python311-pydata-sphinx-theme-0.16.1-1.1 on GA media Announcement ID: openSUSE-SU-2025:15279-1 Rating: moderate Cross-References: CVE-2025-5889 CVSS scores: CVE-2025-5889 SUSE : 2.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2025-5889 SUSE : 2...

jupyter-nbdime-7.0.2-20.1 on GA media (moderate)

jupyter-nbdime-7.0.2-20.1 on GA media Announcement ID: openSUSE-SU-2025:15276-1 Rating: moderate Cross-References: CVE-2025-5889 CVSS scores: CVE-2025-5889 SUSE : 2.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2025-5889 SUSE : 2 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:...

jupyter-nbclassic-1.3.1-1.1 on GA media (moderate)

jupyter-nbclassic-1.3.1-1.1 on GA media Announcement ID: openSUSE-SU-2025:15275-1 Rating: moderate Cross-References: CVE-2025-5889 CVSS scores: CVE-2025-5889 SUSE : 2.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2025-5889 SUSE : 2...

python-furo-doc-2024.8.6-3.1 on GA media (moderate)

python-furo-doc-2024.8.6-3.1 on GA media Announcement ID: openSUSE-SU-2025:15270-1 Rating: moderate Cross-References: CVE-2025-5889 CVSS scores: CVE-2025-5889 SUSE : 2.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2025-5889 SUSE : 2...

jupyter-plotly-6.1.2-1.1 on GA media (moderate)

jupyter-plotly-6.1.2-1.1 on GA media Announcement ID: openSUSE-SU-2025:15278-1 Rating: moderate Cross-References: CVE-2025-5889 CVSS scores: CVE-2025-5889 SUSE : 2.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2025-5889 SUSE : 2 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N...

jupyter-panel-1.7.1-1.1 on GA media (moderate)

jupyter-panel-1.7.1-1.1 on GA media Announcement ID: openSUSE-SU-2025:15277-1 Rating: moderate Cross-References: CVE-2025-5889 CVSS scores: CVE-2025-5889 SUSE : 2.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2025-5889 SUSE : 2 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N...

CVE-2025-5889 vulnerabilities

Vulnerabilities for packages: renovate, opensearch-dashboards, eslint, vitess, npm, kubeflow-pipelines, tileserver-gl, jupyter-base-notebook, rancher-api-ui, pulumi, code-server, sqlpad, node-gyp, lerna, langfuse, py3-jupyterlab, ts-patch, prism, argo-workflows, kubeflow-centraldashboard...

CVE-2025-5889 vulnerabilities

Vulnerabilities for packages: tileserver-gl-fips, emsdk, opensearch-dashboards-fips, drupal, tileserver-gl, lerna, kubeflow-pipelines, langfuse-fips, opensearch-dashboards, py3-jupyterlab, kibana, foxx-cli, wazuh-dashboard, gitlab-rails-ce-fips, tensorflow-cpu-jupyter, pulumi, npm,...

jo-cli (1.0.2) potentially affected by CVE-2025-5889 via brace-expansion (3.0.0)

brace-expansion NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on brace-expansion and may be impacted: - jo-cli 1.0.2 Source cves: CVE-2025-5889 Source advisory: OSV:GHSA-V6H2-P8H4-QCJW...

kydra (>=1.0.10, <=1.0.11) potentially affected by CVE-2025-5889 via brace-expansion (4.0.0)

brace-expansion NPM version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on brace-expansion and may be impacted: - kydra =1.0.10, =1.0.11 Source cves: CVE-2025-5889 Source advisory: OSV:GHSA-V6H2-P8H4-QCJW...

@alfresco/adf-testing (6.0.0-A.2-8258), @genexus/ngx-aws-deploy (5.2.1) +5 more potentially affected by CVE-2025-5889 via brace-expansion (>=2.0.0, <=2.0.1)

brace-expansion NPM version =2.0.0, =1.16.0, =1.0.1, =0.0.20, =15.0.0 - fluid-webdriver 1.1.2 - nx-cargo 1.0.0-alpha.2 Source cves: CVE-2025-5889 Source advisory: OSV:GHSA-V6H2-P8H4-QCJW...

@algolia/coquille (>=0.0.2, <=0.0.13), @candlelabs/sdk (>=1.0.1, <=1.0.2) +27 more potentially affected by CVE-2025-5889 via brace-expansion (>=1.1.0, <=1.1.11)

brace-expansion NPM version =1.1.0, =0.0.2, =1.0.1, =0.0.1, =0.1.0, =1.0.0, =1.0.0, =0.0.3, =0.0.1, =0.1.0 and more Source cves: CVE-2025-5889 Source advisory: OSV:GHSA-V6H2-P8H4-QCJW...

CVE-2025-5889

creationtimestamp| type| source ---|---|--- 2025-06-09 19:48:08+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/17746 2026-02-05 14:55:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3me4niaiey32j 2026-03-03 21:14:12+00:00| seen|...

AZL-63692 CVE-2025-5889 affecting package nodejs-nodemon 2.0.3-5

A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely...

CVE-2025-5889

A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely...

CVE-2025-5889

The CVE-2025-5889 entry concerns juliangruber brace-expansion prior to 4.0.1. The vulnerability affects the expand function in index.js, causing inefficient regular expression complexity. It may be exploitable remotely and exploitation is described as difficult but publicly disclosed. Upgrading t...

@algolia/coquille (>=0.0.2, <=0.0.13), @candlelabs/sdk (>=1.0.1, <=1.0.2) +27 more potentially affected by CVE-2025-5889 via brace-expansion (>=1.1.0, <=1.1.11)

brace-expansion NPM version =1.1.0, =0.0.2, =1.0.1, =0.0.1, =0.1.0, =1.0.0, =1.0.0, =0.0.3, =0.0.1, =0.1.0 and more Source cves: CVE-2025-5889 Source advisory: MEND:CVE-2025-5889...