pgadmin4-9.10-CVE-2025-13780

pgadmin4 9.11 元命令过滤器命令执行 摘要 pgAdmin 在修复 Issue 9320 时引入的 PLAIN 恢复元命令过滤器，在 SQL 文件以 UTF-8 字节顺序标记 EF BB BF 或其他特殊序列开头时无法检测到元命令。该实现的过滤器使用函数 hasmetacommands，该函数通过正则表达式扫描原始字节。该正则表达式未将这些字节视为可忽略，因此诸如 ! 的元命令仍未被检测到。当 pgAdmin 使用 --file 调用 psql 时，psql 会去除这些字节并执行命令。这可能导致在恢复操作过程中执行远程命令。 此绕过影响在提交...

AZL-89399 CVE-2026-9516 affecting package perl-Cpanel-JSON-XS 4.39-1

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decodejson advances the input scalar's string pointer past the mark with SvPVset and restores it only on the normal return...

CVE-2026-9516

CVE-2026-9516 affects Cpanel::JSON::XS for Perl prior to 4.41. A UTF-8 BOM prefixed input with a throwing decode filter callback can cause the decoder to skip restoration of the input pointer, leaving the scalar with an offset pointer. When the scalar is freed, the allocator may receive an invali...

PT-2026-45892

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.41 Description An issue exists where providing input prefixed with a UTF-8 Byte Order Mark BOM can lead to a denial of service. When the decode json function processes a 3-byte UTF-8 BOM, it advances the...

The return of the BOM

There's nothing new in Brazilian cybercriminals trying out new ways to stay under the radar. It's just that this time around the bad guys have started using a method that was reported in the wild years ago. Russian gangs used this technique to distribute malware capable of modifying the hosts fil...