CVE-2026-13210: Incorrect Authorization

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to access CI/CD variables outside their intended environment scope due to improper input...

CVE-2026-91939: Deserialization of Untrusted Data

Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize without allowedclasses restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads ...

EUVD-2026-77687

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the HTTP server started by allure serve and allure open uses URI.getPath in Commands.setUpServer in allure-commandline/src/main/java/io/qameta/allure/Commands.java and passes the...

CVE-2026-59960

Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or ref values from GITHUBHEADREF or ARGOSBRANCH can flow through config.branch and getMergeBaseCommitSha when hasRemoteContentAccess is false. The gitFetch and...

CVE-2026-59960 Argos JavaScript: CI Branch Name OS Command Injection in @argos-ci/core

Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or ref values from GITHUBHEADREF or ARGOSBRANCH can flow through config.branch and getMergeBaseCommitSha when hasRemoteContentAccess is false. The gitFetch and...

@argos-ci/cli (>=0.1.0, <=5.1.0), @argos-ci/cypress (>=1.3.0, <=7.0.7) +5 more potentially affected by CVE-2026-59960 via @argos-ci/core (>=0.1.0, <=6.2.0)

@argos-ci/core NPM version =0.1.0, =0.1.0, =1.3.0, =1.0.0-alpha.0, =0.1.0, =0.0.2-canary.12, =1.0.2, =2.1.1, =2.1.13 Source cves: CVE-2026-59960 Source advisory: MEND:CVE-2026-59960...

CVE-2026-59960

@argos-ci/core versions prior to 6.2.1 contain an OS Command Injection (CWE-78) in the gitFetch() and gitMergeBase() functions within packages/core/src/ci-environment/git.ts. When a project has hasRemoteContentAccess: false (the default without a Git provider integration), attacker-controlled bra...

EUVD-2026-77641

Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or ref values from GITHUBHEADREF or ARGOSBRANCH can flow through config.branch and getMergeBaseCommitSha when hasRemoteContentAccess is false. The gitFetch and...

CVE-2026-59960 Argos JavaScript: CI Branch Name OS Command Injection in @argos-ci/core

Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or ref values from GITHUBHEADREF or ARGOSBRANCH can flow through config.branch and getMergeBaseCommitSha when hasRemoteContentAccess is false. The gitFetch and...

CVE-2026-59960 Argos JavaScript: CI Branch Name OS Command Injection in @argos-ci/core

Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or ref values from GITHUBHEADREF or ARGOSBRANCH can flow through config.branch and getMergeBaseCommitSha when hasRemoteContentAccess is false. The gitFetch and...

Astra Linux – Vulnerability in Linux, Linux 5.10

The FireWire subsystem in the Linux kernel up to version 5.14.13 has a buffer overflow issue related to the drivers/media/FireWire/firedtv-avc.c and drivers/media/FireWire/firedtv-ci.c files. This issue arises due to improper handling of bounds checking by the avccapmt function...

CVE-2026-59960: Improper Neutralization of Special Elements used in an OS Command

Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or ref values from GITHUBHEADREF or ARGOSBRANCH can flow through config.branch and getMergeBaseCommitSha when hasRemoteContentAccess is false. The gitFetch and...

CVE-2026-89066 OS command injection in the task synthesis component in projen

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project...

EUVD-2026-76151

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project...

CVE-2026-89066: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project...

PT-2026-89909

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project...

GHSA-4X45-GXVP-6283 @argos-ci/core: CI Branch Name OS Command Injection

CI Branch Name OS Command Injection in @argos-ci/core Summary @argos-ci/[email protected] passes attacker-controlled CI branch/ref strings directly into an execSync template literal in packages/core/src/ci-environment/git.ts:89. When a CI project has hasRemoteContentAccess: false, the Argos upload flow...

@argos-ci/cli (>=5.0.0, <=5.1.0), @argos-ci/cypress (>=7.0.0, <=7.0.7) +2 more potentially affected by CVE-2026-59960 via @argos-ci/core (>=6.0.0, <=6.2.0)

@argos-ci/core NPM version =6.0.0, =5.0.0, =7.0.0, =7.0.0, =6.0.0, =6.0.8 Source cves: CVE-2026-59960 Source advisory: GHSA-4X45-GXVP-6283...

@argos-ci/cli (>=5.0.0, <=5.1.0), @argos-ci/cypress (>=7.0.0, <=7.0.7) +2 more potentially affected by CVE-2026-59960 via @argos-ci/core (>=6.0.0, <=6.2.0)

@argos-ci/core NPM version =6.0.0, =5.0.0, =7.0.0, =7.0.0, =6.0.0, =6.0.8 Source cves: CVE-2026-59960 Source advisory: OSV:GHSA-4X45-GXVP-6283...

@argos-ci/core: CI Branch Name OS Command Injection

CI Branch Name OS Command Injection in @argos-ci/core Summary @argos-ci/[email protected] passes attacker-controlled CI branch/ref strings directly into an execSync template literal in packages/core/src/ci-environment/git.ts:89. When a CI project has hasRemoteContentAccess: false, the Argos upload flow...