Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling

Fix: PR 7906 ether/etherpad. A set of medium/low hardening fixes: - Weak RNG for tokens CWE-330: author/session/readonly IDs were generated with Math.random client and server. Now use crypto.getRandomValues. - Login timing / no failure delay CWE-208/CWE-307: the OIDC interaction login used a...

GHSA-92HR-GMR6-H8CP Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling

Fix: PR 7906 ether/etherpad. A set of medium/low hardening fixes: - Weak RNG for tokens CWE-330: author/session/readonly IDs were generated with Math.random client and server. Now use crypto.getRandomValues. - Login timing / no failure delay CWE-208/CWE-307: the OIDC interaction login used a...

ANT-2026-CAH7XGSQ · lua · stack-overflow

stack-overflow low Severity Claude low · Security research firm low · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Anvil Security. ANT-2026-CAH7XGSQ: stack-overflow C stack exhaustion via unbounded...

ANT-2026-FW0V6SAJ · dhis2-core · SQL Injection

sql-injection high CVE-2026-55084 Severity Claude high · Security research firm high · Maintainer - REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ophion Security. ANT-2026-FW0V6SAJ: SQL Injection via Unquoted Column Name in SqlView Filter Parameter...

GHSA-M6JG-WR9M-CG2F uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability

Summary Path Traversal vulnerability in hook filename handling allows attackers to access and manipulate arbitrary files outside the hooks directory via directory escape sequences like passwd. Details File: hooks.go Lines 135-160 hookFileName := args0 // User input not validated hookFile =...

CVE-2026-55062

The uniget CLI's hooks.go (lines 135-160) concatenates user-supplied hook filenames directly into a path without sanitizing ../ sequences. An attacker can run ./uniget hooks edit --type=pre-install "../../../../etc/passwd" to read or overwrite arbitrary files outside the hooks directory. A proof-...

uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability

Summary Path Traversal vulnerability in hook filename handling allows attackers to access and manipulate arbitrary files outside the hooks directory via directory escape sequences like passwd. Details File: hooks.go Lines 135-160 hookFileName := args0 // User input not validated hookFile =...

CVE-2026-55061

The uniget CLI is vulnerable to command injection in hooks.go at line 199, where strings.Split(editor, " ") naively parses the EDITOR/UNIGET_EDITOR environment variable without shell escaping. An attacker can set EDITOR to a value like "/path/to/wrapper && id && echo", causing arbitrary command e...

uniget CLI has an EDITOR Command Injection

Summary The uniget CLI has a command injection vulnerability in hooks.go line 199 where strings.Spliteditor, " " naively parses the EDITOR environment variable without respecting shell syntax. An attacker can set EDITOR="/path/to/wrapper && id && echo" which gets split into separate arguments,...

GHSA-QMCQ-XW74-W667 uniget CLI has an EDITOR Command Injection

Summary The uniget CLI has a command injection vulnerability in hooks.go line 199 where strings.Spliteditor, " " naively parses the EDITOR environment variable without respecting shell syntax. An attacker can set EDITOR="/path/to/wrapper && id && echo" which gets split into separate arguments,...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +289 more potentially affected by unknown CVE via vm2 (>=3.0.0, <=3.11.5)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves: unknown CVE...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +289 more potentially affected by unknown CVE via vm2 (>=3.0.0, <=3.11.5)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves: unknown CVE...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +289 more potentially affected by unknown CVE via vm2 (>=3.0.0, <=3.11.5)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves: unknown CVE...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +289 more potentially affected by unknown CVE via vm2 (>=3.0.0, <=3.11.5)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves: unknown CVE...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +289 more potentially affected by CVE-2026-47698 via vm2 (>=3.0.0, <=3.11.5)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +289 more potentially affected by CVE-2026-47698 via vm2 (>=3.0.0, <=3.11.5)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +289 more potentially affected by CVE-2026-47686 via vm2 (>=3.0.0, <=3.11.5)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +289 more potentially affected by CVE-2026-47686 via vm2 (>=3.0.0, <=3.11.5)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +289 more potentially affected by CVE-2026-47683 via vm2 (>=3.0.0, <=3.11.5)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +289 more potentially affected by CVE-2026-47683 via vm2 (>=3.0.0, <=3.11.5)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...