12208 matches found
CVE-2026-66824 Stored Cross-Site Scripting via Unsafe Capture Tree JSON Embedding
A stored cross-site scripting vulnerability existed in the capture tree visualization page. The application embedded the serialized capture tree directly into an inline JavaScript block using the Jinja safe filter. Because the tree data can contain values derived from captured and potentially...
Exploit for Deserialization of Untrusted Data in Facebook React
Tìm hiểu về React Server Components và giao thức Flight REac...
react2shell-burp v0.1.1
React2Shell RCE Scanner and Validator CVE-2025-55182 Creator: j0lt Collaborator: https://github.com/shashank18 A Burp Suite extension that detects and validates the React2Shell vulnerability CVE-2025-55182 — a pre-authentication remote code execution flaw in React Server Components. The extension...
gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options
A flaw was found in GitPython where it fails to properly sanitize dangerous Git options. This vulnerability allows an attacker to inject arbitrary commands when using functions like Repo.archive and git.lsremote, potentially leading to arbitrary code execution. Additionally, functions such as...
EUVD-2026-48794
In the Linux kernel, the following vulnerability has been resolved: tipc: fix out-of-bounds read in broadcast Gap ACK blocks A broadcast PROTOCOL/STATEMSG can carry a Gap ACK blocks record in its data area. tipcgetgapackblks only verifies that the record's len field is self-consistent with its...
GHSA-8Q49-2H5H-434X FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller
Summary The OpenAPI adapter's spec-change poller OpenApiSpecPoller re-fetched the configured spec url on a timer using a raw global fetch, bypassing the SSRF guard safeFetch / assertUrlSafe that OpenAPIToolGenerator.fromURL applies to the initial spec load. As a result, the pinning/DNS-resolution...
GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
Summary The fix for GHSA-rwj8-pgh3-r573 stopped Repo.clonefrom from running caller-supplied URLs through os.path.expandvars, but it guarded only that one caller. Remote.create — reached from the public Repo.createremote and its Remote.add alias — still passes an attacker-influenceable URL through...
Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete
Summary An end-user injection in Budibase's MongoDB datasource lets any BASIC app user bypass the builder's query-level access controls. Builders scope MongoDB reads per-user with bindings like "email": " currentUser.email " so each app user only sees their own rows. Because the binding is...
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Overview Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' via the AuthXMLUtils.createCustomCallback process. An attacker can execute arbitrary code on the server by sending a crafted XML element to the /authservic...
GO-2026-5492 Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy...
GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution
Summary GitPython's checkunsafeoptions guard the control introduced by CVE-2026-42215 / GHSA-2f96 and hardened since can be bypassed for every guarded method clone/clonefrom, fetch/pull/push, lsremote, itercommits, blame, archive by smuggling an option token inside the VALUE of a single-character...
GHSA-R9MR-M37C-5FR3 GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution
Summary GitPython's checkunsafeoptions guard the control introduced by CVE-2026-42215 / GHSA-2f96 and hardened since can be bypassed for every guarded method clone/clonefrom, fetch/pull/push, lsremote, itercommits, blame, archive by smuggling an option token inside the VALUE of a single-character...
Arbitrary Argument Injection
Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Arbitrary Argument Injection via the checkunsafeoptions process. An attacker can execute arbitrary commands by smuggling a malicious option token inside the value of a...
GHSA-6P8H-3WGX-97GF GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks
Summary GitPython's unsafegitcloneoptions denylist omits --template. git clone --template= copies /hooks/ into the new repository and runs them post-checkout fires during clone, so a caller who can influence clone options can achieve arbitrary command execution in the default...
GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)
Summary Diffable.diff forwards kwargs straight into diff/difftree with no checkunsafeoptions guard. Diffable is mixed into Commit, Tree, IndexFile, and Submodule, giving a broad surface. git diff --output= writes real patch content to an attacker-chosen path, enabling arbitrary file overwrite. Ro...
GHSA-FJR4-X663-MWXC GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)
Summary Diffable.diff forwards kwargs straight into diff/difftree with no checkunsafeoptions guard. Diffable is mixed into Commit, Tree, IndexFile, and Submodule, giving a broad surface. git diff --output= writes real patch content to an attacker-chosen path, enabling arbitrary file overwrite. Ro...
Prototype Pollution
Overview mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution in the schema path getter Schema.getSchema during update casting, which follows a proto-prefixed dotted path...
GHSA-9XWG-3R6F-JCX2 PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path
Summary The b64 extension inlines images referenced by as base64 data URIs. When resolving the src path it joins it onto the configured basepath with os.path.normpath and opens the result directly, with no check that the resolved path stays inside basepath. A src containing ../ sequences, or an...
Prototype Pollution
Overview @sveltejs/kit is a SvelteKit framework and CLI Affected versions of this package are vulnerable to Prototype Pollution in the file input deletion path in remote-function forms when arbitrary user-controlled path names are accepted for input fields of type file. An attacker can remove...