Important: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.15.1 release.

Red Hat Web Terminal Operator 1.15.1 has been released. The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed...

Important: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.16.1 release.

Red Hat Web Terminal Operator 1.16.1 has been released. The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed...

Important: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.12.1 release.

Red Hat Web Terminal Operator 1.12.1 has been released. The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed...

Important: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.11.1 release.

Red Hat Web Terminal Operator 1.11.1 has been released. The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed...

CVE-2026-9323

The urwid web display backend urwid/display/web.py generates web session identifiers urwidid in Screen.start by concatenating two random.randrange109 calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of PRNG state, and t...

EUVD-2026-45381

The urwid web display backend urwid/display/web.py generates web session identifiers urwidid in Screen.start by concatenating two random.randrange109 calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of PRNG state, and t...

CVE-2026-56741 JLine: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal Geometry

JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS in TelnetIO.java:856-879 reads client-supplied...

CVE-2026-56741

JLine3 Telnet server's remote-telnet module did not bound NAWS-terminal dimensions, reading width/height as 16-bit values and passing 65535x65535 to setTerminalGeometry. This allowed an unauthenticated remote attacker to induce repeated heavy rendering, causing CPU exhaustion Denial of Service. A...

CVE-2026-59117

Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code over a network...

CVE-2026-59117 Windows Terminal Remote Code Execution Vulnerability

...

CVE-2026-59117

Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code over a network...

CVE-2026-59117 Windows Terminal Remote Code Execution Vulnerability

...

CVE-2026-59117

CVE-2026-59117 concerns an integer overflow/wraparound in Windows Terminal that enables remote code execution over a network. The NVD/CVE records confirm a network attack vector with high impact (C/H/I/A all high) and a required user interaction, but the provided documents do not specify affected...

GHSA-WG4W-WR5Q-6VJC Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection

Summary The terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shellexec. After the fix for GHSA-9643-6xjp-vx57 which added $ to the blocklist, the characters | single pipe, backtick, and the newline byte 0x0A remain...

Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection

Summary The terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shellexec. After the fix for GHSA-9643-6xjp-vx57 which added $ to the blocklist, the characters | single pipe, backtick, and the newline byte 0x0A remain...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via incomplete sanitization of user-supplied commands in the terminal process. An attacker can execute arbitrary operating system commands as the web server user by injecting shell metacharacters such as single pipe |,...

GHSA-9643-6XJP-VX57 Pheditor has an authenticated terminal command whitelist bypass

Summary Pheditor 2.0.4 has an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINALCOMMANDS values, then passes the full command string to shellexec. Shell command substitution such as $ is not blocked...

Pheditor has an authenticated terminal command whitelist bypass

Summary Pheditor 2.0.4 has an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINALCOMMANDS values, then passes the full command string to shellexec. Shell command substitution such as $ is not blocked...

MAL-2026-10725 Malicious code in agentto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cd82c93e5f7bc0005dec9fbf18f01ec45bb6e6d2fb97bad2479c0209a7414bf [email protected] opens a WebSocket to the hardcoded server wss://link.agentto.net and routes terminal. RPC frames received from that server into a...

MAL-2026-10705 Malicious code in @agent-link/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3a178213d6597e731a313e9ec92f5b2afb8b955e3205500fa67ff6dc1ca989c The package spawns a local PTY /bin/bash on POSIX, powershell.exe on Windows via node-pty and wires it to a WebSocket connection that defaults to...