External Control of File Name or Path

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to External Control of File Name or Path via the forwarding of unguarded options in the checkout and create functions. An attacker can overwrite arbitrary files or read...

MAL-2026-11514 Malicious code in lifestyle-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 804725b6316960d5192b9b46ab823b4bd67f5b15774d1acf1a770a57cfbae84b On require of lifestyle-test-utils, index.js loads ext.js which selects a platform-specific asset, downloads a binary from one of three Cloudflare...

PT-2026-67557

Name of the Vulnerable Software and Affected Versions Microsoft Edge for Android affected versions not specified Description An issue exists where external control of a file name or path allows an unauthorized attacker to disclose information locally. Recommendations At the moment, there is no...

CVE-2026-66310: External Control of File Name or Path

External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally...

CVE-2026-65802: External Control of File Name or Path

External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network...

MAL-2026-11459 Malicious code in community-published (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90e9bda1a7ca0f5b1083fe65572c94f131306fd5323f731cf79422d51c567f8a lib/report.js imports childprocess, fs, https, and os, invokes execSync and fs.readFileSync to collect host and file data, gathers identifiers via...

Malicious code in create-remotion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d31c0780d44a66914255959e786d3ef18ae49763037a2d714a0a610ef1cc1187 lib/report.js imports childprocess, fs, https, and os and collects host identity and environment data via os.hostname, os.userInfo, execSync..., and...

MAL-2026-11471 Malicious code in maximumsats-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6163cb4abd0ceee120100e4ce84e0e12bff00348ee3b55ad338d7d1d3adca47d lib/report.js gathers the developer's email queried via gh api user/emails, git config user.email, /.gitconfig, npm config, and environment variables...

Microsoft Edge for Android Information Disclosure Vulnerability

External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network...

Microsoft Edge for Android Information Disclosure Vulnerability

External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally...

MAL-2026-11382 Malicious code in socketi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f02e02642c533799ed96fac51f973f65097eb5b870dc1a0ea47e2fdcbb70893 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ethers.jsonn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acfd52ff30b26f15be66cbf87a098dde096288d776d0be4ecd555ac81e229f81 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rshell (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5111add8e3d97e54c2903e39496ddb07c74aa68af8e7f0f1bee761c320dd7ebb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11362 Malicious code in qserver (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f38e6b7e00f8dcf90ed3683783ed77c81e4eb0a457d33656b14194048625301 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11318 Malicious code in ideascloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b720d727d5e8a440d3cf4d8f6674d2352e864352fcd9958f2f95f291af734368 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in scol (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea99a3f3b1743882b257e9f10fe8ce5575c81f7ce1a439fb5a4da12ead9b1e5a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zcas (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5d5014de4102b1c6d4a4f5b01f55b1dda65bf7585bbb6adf3d89bce7967964c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11330 Malicious code in malxios (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3cadf321b289a01aebfd33821cffbdeeaa827aa5bf4c110eacdf26b6b7654197 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in maalxios (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f5c4c2541793c51a8a3384c2f177f415582471318bfde6971e70a8bc4f630ac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in chalk-buttons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec33c573b26dcd167feb75548bd7774af7a912c448fd08f624bead6e22deff13 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...