ROS-20260713-73-0049

The vulnerability of the Repo.clonefrom, Remote.fetch, Remote.pull, and Remote.push functions in the GitPython library for interacting with git repositories is related to the failure to implement measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to...

PT-2026-59096

Summary The compliance-trestle library's remote fetching cache mechanism HTTPSFetcher and SFTPFetcher constructs the local cache file path from the URL path component without sanitizing path traversal sequences ../. When a remote OSCAL profile references a URL with traversal in its path, the HTTP...

FTP Fetch, Linux Command Shell, Reverse TCP Stager

Fetch and execute a x86 payload from an FTP server. Spawn a command shell staged. Connect back to the attacker Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

Malicious code in vite-pwa-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bab1e251883a8eceecc27c935ed05352375d438c1efbbd8727f2b13a766409d0 Package vite-pwa-config impersonates the popular vite-plugin-pwa antfu — the README instructs users to import configJson from vite-plugin-pwa, and...

Malicious code in chain-chai-await (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53dc585524bcc3e64a107006ba8c763591b071bb174c7acadd716b6e99ac1c34 The package presents itself as a pino-compatible logger exports pino, mirrors pino's lib/ layout with...

MAL-2026-10053 Malicious code in chai-secure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4253b6520b80bd3c3ee724b9766c67a3a2d7abe074ee57e15d5b9b270bf74f55 chai-secure masquerades as a Chai plugin offering JWT/XSS/SQLi assertion helpers, but on every require/import of the package, index.js unconditionall...

PYSEC-2026-2000 Universal Tool Calling Protocol (UTCP) client library for Python vulnerable to Trust Boundary Violation through Manual JSON specification

The vulnerability arises when a client fetches a tools’ JSON specification, known as a Manual, from a remote Manual Endpoint. While a provider may initially serve a benign manual e.g., one defining an HTTP tool call, earning the clients’ trust, a malicious provider can later change the manual to...

UBUNTU-CVE-2026-50134

Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did not re-validate intermediate URLs on HTTP 3xx redirects. An allowed server or an attacker controlling its DNS or response could therefore redirect t...

PYSEC-2026-553 TorchServe Server-Side Request Forgery vulnerability

Impact Remote Server-Side Request Forgery SSRF Issue: TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity of the system and...

MAL-2026-6539 Malicious code in db-query-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4928f7d380b79104d997e7666603726873158508c38d2c75a90c7529dd196be3 The package presents itself as a database query helper but index.js defines a method queryDBConnect that base64-decodes a hardcoded URL pointing to...

MAL-2026-6533 Malicious code in react-dynamic-table-compenent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c55ead8b66faca1e08b2babafa252da2371b535c010a5c14d8b0d0e2a44aadf8 Package name misspells 'component' as 'compenent', a one-letter typosquat of react-dynamic-table-component. The package's postinstall script runs nod...

CVE-2026-47389

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, when using Ruby versions older than 3.4, PrivateAddressCheck.privateaddress? returns false for IPv4-mapped IPv6 addresses ::ffff:a.b.c.d corresponding to some private IPv4 addresses,...

Malicious code in @zynkit/probe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f7da2d08466718d66bb9a80478987eab5041e19ee53f80d6968e6dc3069edf2 No concrete indicators of installer-side harm were observed in this package version. No lifecycle scripts performing remote fetch-and-execute, no...

MAL-2026-6314 Malicious code in @zynkit/probe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f7da2d08466718d66bb9a80478987eab5041e19ee53f80d6968e6dc3069edf2 No concrete indicators of installer-side harm were observed in this package version. No lifecycle scripts performing remote fetch-and-execute, no...

MAL-2026-6306 Malicious code in @gleamkit/probe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aaef237007e5d89031d334bf56a29892c7d6103aba9563b040556eea20ef2cfa No suspicious behaviors were detected in this package. There are no lifecycle scripts performing remote fetches, no credential or environment scrapin...

MAL-2026-6221 Malicious code in chai-assert-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb347379535c0ea9895e1dc8dd2f20b1fd092b8e62b433bfbd49b2ac1bff2f72 Package name and metadata impersonate the 'chai' assertion library reuses chai's contributors, description, and a 'chaiassert.com' homepage, but the...

Malicious code in jwtmode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b59454613cc025e514269f55b41a9da6a5da1db70e73e583bc79d97727e9528a On require'jwtmode', decode.js immediately invokes getThirdCookie, which performs an HTTP GET to https://jsonkeeper.com/b/AZ9ZF, takes the response...

MAL-2026-5930 Malicious code in bubblestr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7831cb93037b6f364e2174f6d4fb64b38bac958e54f3653b8a70810681972172 package.json declares "postinstall": "node index.js", and index.js is a heavily obfuscated single-file script RC4+base64 string-array with rotating...

Malicious code in bubblestr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7831cb93037b6f364e2174f6d4fb64b38bac958e54f3653b8a70810681972172 package.json declares "postinstall": "node index.js", and index.js is a heavily obfuscated single-file script RC4+base64 string-array with rotating...

MAL-2026-5902 Malicious code in chai-as-tokenized (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55c10da182a0c79ca5eb0f85c6b2e334b7ee4e90946dfcc34feb44e80afa4485 Package name impersonates chai-as-promised, and the README is a copy of pino's documentation, but the actual code is a remote-code-execution dropper...