Security Bulletin: Security vulnerabilities were found in IBM Verify Identity Access Digital Credentials (CVE-2025-48387, CVE-2025-5889)

Summary Security vulnerabilities were addressed in IBM Verify Identity Access Digital Credentials Vulnerability Details CVEID:CVE-2025-48387 DESCRIPTION: tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside...

python-furo-doc-2024.8.6-3.1 on GA media (moderate)

python-furo-doc-2024.8.6-3.1 on GA media Announcement ID: openSUSE-SU-2025:15270-1 Rating: moderate Cross-References: CVE-2025-5889 CVSS scores: CVE-2025-5889 SUSE : 2.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2025-5889 SUSE : 2...

python311-pydata-sphinx-theme-0.16.1-1.1 on GA media (moderate)

python311-pydata-sphinx-theme-0.16.1-1.1 on GA media Announcement ID: openSUSE-SU-2025:15279-1 Rating: moderate Cross-References: CVE-2025-5889 CVSS scores: CVE-2025-5889 SUSE : 2.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2025-5889 SUSE : 2...

jupyter-plotly-6.1.2-1.1 on GA media (moderate)

jupyter-plotly-6.1.2-1.1 on GA media Announcement ID: openSUSE-SU-2025:15278-1 Rating: moderate Cross-References: CVE-2025-5889 CVSS scores: CVE-2025-5889 SUSE : 2.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2025-5889 SUSE : 2 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N...

jupyter-panel-1.7.1-1.1 on GA media (moderate)

jupyter-panel-1.7.1-1.1 on GA media Announcement ID: openSUSE-SU-2025:15277-1 Rating: moderate Cross-References: CVE-2025-5889 CVSS scores: CVE-2025-5889 SUSE : 2.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2025-5889 SUSE : 2 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N...

jupyter-bqplot-jupyterlab-0.5.44-10.1 on GA media (moderate)

jupyter-bqplot-jupyterlab-0.5.44-10.1 on GA media Announcement ID: openSUSE-SU-2025:15269-1 Rating: moderate Cross-References: CVE-2025-5889 CVSS scores: CVE-2025-5889 SUSE : 2.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2025-5889 SUSE : 2...

jupyter-jupyterlab-templates-0.5.2-2.1 on GA media (moderate)

jupyter-jupyterlab-templates-0.5.2-2.1 on GA media Announcement ID: openSUSE-SU-2025:15274-1 Rating: moderate Cross-References: CVE-2025-5889 CVSS scores: CVE-2025-5889 SUSE : 2.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2025-5889 SUSE : 2...

jupyter-nbdime-7.0.2-20.1 on GA media (moderate)

jupyter-nbdime-7.0.2-20.1 on GA media Announcement ID: openSUSE-SU-2025:15276-1 Rating: moderate Cross-References: CVE-2025-5889 CVSS scores: CVE-2025-5889 SUSE : 2.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2025-5889 SUSE : 2 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:...

jupyter-nbclassic-1.3.1-1.1 on GA media (moderate)

jupyter-nbclassic-1.3.1-1.1 on GA media Announcement ID: openSUSE-SU-2025:15275-1 Rating: moderate Cross-References: CVE-2025-5889 CVSS scores: CVE-2025-5889 SUSE : 2.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2025-5889 SUSE : 2...

CVE-2025-5889 vulnerabilities

Vulnerabilities for packages: argo-workflows, tileserver-gl, py3-jupyterlab, eslint, rancher-api-ui, ts-patch, kubeflow-centraldashboard, prism, vitess, lerna, pulumi, opensearch-dashboards, npm, kubeflow-pipelines, sqlpad, langfuse, node-gyp, renovate, tensorflow-cpu-jupyter, code-server...

CVE-2025-5889 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, nextcloud-server, py3-jupyterlab, ts-patch, renovate, tensorflow-cpu-jupyter, npm, arangodb, langfuse-fips, vitess, emsdk, graalvm, rancher-api-ui, tileserver-gl-fips, code-server, argo-workflows, drupal, kibana, eslint, gitlab-rails-ce, pulumi...

@algolia/coquille (>=0.0.2 <=0.0.13), @candlelabs/sdk (>=1.0.1 <=1.0.2) +20 more potentially affected by CVE-2025-5889 via brace-expansion (>=1.1.0 <=1.1.11)

brace-expansion NPM version =1.1.0, =0.0.2, =1.0.1, =0.0.1, =0.1.0, =1.0.0, =1.0.0, =1.1.1, =1.0.3-dev.20180316T104657Z.4a84a30, =1.1.0 and more Source cves: CVE-2025-5889 Source advisory: OSV:GHSA-V6H2-P8H4-QCJW...

@alfresco/adf-testing (=6.0.0-A.2-8258), @genexus/ngx-aws-deploy (=5.2.1) +6 more potentially affected by CVE-2025-5889 via brace-expansion (>=2.0.0 <=2.0.1)

brace-expansion NPM version =2.0.0, =1.16.0, =1.0.1, =0.0.20, =15.0.0 - fluid-webdriver =1.1.2 - nx-cargo =1.0.0-alpha.2 Source cves: CVE-2025-5889 Source advisory: OSV:GHSA-V6H2-P8H4-QCJW...

kydra (>=1.0.10 <=1.0.11) potentially affected by CVE-2025-5889 via brace-expansion (=4.0.0)

brace-expansion NPM version =4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on brace-expansion and may be impacted: - kydra =1.0.10, =1.0.11 Source cves: CVE-2025-5889 Source advisory: OSV:GHSA-V6H2-P8H4-QCJW...

CVE-2025-5889

creationtimestamp| type| source ---|---|--- 2025-06-09 19:48:08+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/17746 2026-02-05 14:55:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3me4niaiey32j 2026-03-03 21:14:12+00:00| seen|...

AZL-63692 CVE-2025-5889 affecting package nodejs-nodemon 2.0.3-5

A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely...

CVE-2025-5889

A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely...

CVE-2025-5889

The CVE-2025-5889 entry concerns juliangruber brace-expansion prior to 4.0.1. The vulnerability affects the expand function in index.js, causing inefficient regular expression complexity. It may be exploitable remotely and exploitation is described as difficult but publicly disclosed. Upgrading t...

CVE-2024-5889

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘country’ parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2020-5889

On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, in BIG-IP APM portal access, a specially crafted HTTP request can lead to reflected XSS after the BIG-IP APM system rewrites the HTTP response from the untrusted backend server and sends it to the client...