cve-2025-55182-react2shell_reproduction

CVE-2025-55182 — React2Shell CVSS 10.0 치명적Critical | React Server Components의 비인증 원격 코드 실행 중국 위협 행위자에 의해 발견되었습니다. 중국 연계China-nexus APT 그룹에 의해 활발히 악용되고 있습니다. 개요 "React2Shell"로 명명된 이 취약점은 React Server ComponentsRSC "Flight" 프로토콜의 안전하지 않은 역직렬화를 통해 비인증 원격 코드 실행을 가능하게 합니다. 악용은 간단하며 인증이 필요하지 않습니다. 기술적 ...

CVE-2026-0776

CVE-2026-0776 - Élément de chemin de recherche non contrôlé du client Discord Résumé Ce dépôt documente la CVE-2026-0776, un problème d'exécution locale de code affectant le client de bureau Discord sur Windows. La vulnérabilité est liée à un comportement non sécurisé de résolution de modules dan...

PYSEC-2026-2015 vLLM vulnerable to remote code execution via transformers_utils/get_config

Summary vllm has a critical remote code execution vector in a config class named NemotronNanoVLConfig. When vllm loads a model config that contains an automap entry, the config class resolves that mapping with getclassfromdynamicmodule... and immediately instantiates the returned class. This...

JLSEC-2026-657 Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions

Summary When Deno was run in BYONM mode nodeModulesDir: "manual", the module resolver did not validate that a package's resolved entrypoint stayed within its nodemodules// directory. A malicious package.json whose main field contained .. segments was able to resolve to an arbitrary path on disk,...

GHSA-968W-XFQW-VP9Q Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions

Summary When Deno was run in BYONM mode nodeModulesDir: "manual", the module resolver did not validate that a package's resolved entrypoint stayed within its nodemodules// directory. A malicious package.json whose main field contained .. segments was able to resolve to an arbitrary path on disk,...

Malicious code in ort-type-test-module-resolution (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-41589 Malicious code in ort-type-test-module-resolution (npm)

--- -= Per source details. Do not edit below this line.=-...

Security Bulletin: Potential module resolution error in DataPower Operator

Summary IBM has addressed a potential build-time issue. This did not affect product code, but may have been detected in customer scans. Vulnerability Details CVEID:CVE-2022-23773 DESCRIPTION: An unspecified error with not treating branches with semantic-version names as releases in cmd/go in Gola...