GHSA-QGW5-7J4F-FG97 Nuclei: Local File Read via Workflow File-Protocol Gate Bypass

A vulnerability in Nuclei's workflow template loader allows file: protocol templates to execute without the -file flag, bypassing a security gate that is meant to prevent local file reads on the scanner host. Affected Component The issue is in the workflow template loading path. The main template...

Nuclei: Local File Read via Workflow File-Protocol Gate Bypass

A vulnerability in Nuclei's workflow template loader allows file: protocol templates to execute without the -file flag, bypassing a security gate that is meant to prevent local file reads on the scanner host. Affected Component The issue is in the workflow template loading path. The main template...

CVE-2026-76804

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a...

CVE-2026-76804

The vulnerability scanner Nuclei contains a flaw in its workflow template loading path, affecting versions 3.0.0 through 3.10.0 . The issue arises because the workflow loader fails to enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. Consequently,...

CVE-2026-76804 Nuclei: Local File Read via Workflow File-Protocol Gate Bypass

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a...

EUVD-2026-84554

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a...

CVE-2026-76804 Nuclei: Local File Read via Workflow File-Protocol Gate Bypass

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a...

CVE-2026-92811

browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container...

CVE-2026-92811 browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass

browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container...

CVE-2026-92811 browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass

browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container...

CVE-2026-92811 browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass

browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container...

CVE-2026-92811

browserless versions 1.44.0 through 2.56.7 contain a file protocol restriction bypass in its Playwright websocket endpoints. Despite the ALLOW_FILE_PROTOCOL setting defaulting to false, authenticated token holders can navigate Playwright-driven browsers to file:// scheme URLs, enabling arbitrary ...

CVE-2026-92811: Exposure of Sensitive Information to an Unauthorized Actor

browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container...

Astra Linux – Vulnerability in Firefox

If temporary “one-time” permissions, such as the ability to use the Camera, are granted to a document loaded using a file: URL, those permissions persist in that tab for all other documents loaded from the same file: URL. This is potentially dangerous if the local files come from different source...

Astra Linux – Vulnerability in Firefox

A compromised web child process could disable web security opening restrictions, resulting in a new child process being spawned within the file:// context. With a reliable exploit primitive, this new process could be exploited again, leading to arbitrary file reading. This vulnerability affects...

GHSA-72R2-7MFR-5XR9 NLTK: FileSystemPathPointer.open() sandbox check is dead code — arbitrary file read via file:// protocol

Summary There's a logic bug in FileSystemPathPointer.open inside nltk/data.py that makes the sandbox check permanently inert. The guard condition is always False — meaning any file the process can read is accessible by passing a file:// URL to nltk.data.load. --- Details In nltk/data.py,...

NLTK: FileSystemPathPointer.open() sandbox check is dead code — arbitrary file read via file:// protocol

Summary There's a logic bug in FileSystemPathPointer.open inside nltk/data.py that makes the sandbox check permanently inert. The guard condition is always False — meaning any file the process can read is accessible by passing a file:// URL to nltk.data.load. --- Details In nltk/data.py,...

CVE-2026-19913

A flaw was found in the Kaltura HTML5 player mwEmbed / html5lib. An unauthenticated, remote attacker can exploit improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter, used for backend requests, accepts non-HTTP schemes such as file://. When an exception or error...

CVE-2026-53580 Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature

Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and reads the referenced local file with no path validation, allowing any authenticated user to disclose arbitrary files...

Directory Traversal

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Directory Traversal via the FileSystemPathPointer.open function. An attacker can access arbitrary files accessible to the process user by...