CVE-2026-0775

npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploi...

CVE-2026-0775

npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploi...

CVE-2026-0775 npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability

npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploi...

CVE-2026-0775: Incorrect Permission Assignment for Critical Resource

npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploi...

PT-2026-6352

Duplicate Advisory This advisory has been withdrawn because describes a dependency bump and therefore, per CVE CNA rule 4.1.12, is a duplicate of GHSA-34x7-hfp2-rc4v/CVE-2026-24842. Additionally, per https://github.com/npm/cli/issues/8939issuecomment-3862719883, npm cli should not be listed as an...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the /api/v1/index/retrieve endpoint. An attacker can scan internal network resources by sending GET requests to retrieve a public key. Since only GET requests are allowed for this endpoint, it is not...

agentic-dev-boilerplate (1.1.2), agentiva (>=0.1.0, <=0.1.5) +89 more potentially affected by CVE-2025-71176 via pytest (>=9.0.0, <=9.0.2)

pytest PYPI version =9.0.0, =0.1.0, =0.5.0rc4, =1.0.5, =1.0.83, =25.11.27, =0.2.0, =0.9.78, =1.70.2, =1.1.0, =13.0.10, =13.0.13 and more Source cves: CVE-2025-71176 Source advisory: GHSA-6W46-J5RX-G56G...

genhtml-markdown (>=1.0.8, <=1.0.9), j2s3 (>=1.0.0, <=1.0.2) +4 more potentially affected by CVE-2025-71176 via pytest (3.8.0)

pytest PYPI version 3.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - genhtml-markdown =1.0.8, =1.0.0, =1.0.0, =0.10.0, =1.15.7, =1.15.10 Source cves: CVE-2025-71176 Source advisory: OSV:GHSA-6W46-J5RX-G56G...

fsai-pottery (>=0.0.0, <=3.1.3), legalopsrag (>=0.1.0, <=0.7.0) +5 more potentially affected by CVE-2025-71176 via pytest (7.1.0)

pytest PYPI version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - fsai-pottery =0.0.0, =0.1.0, =2.4.20, =0.0.1, =6.0.0rc0, =0.1.2.2, =0.2.1 Source cves: CVE-2025-71176 Source advisory: OSV:GHSA-6W46-J5RX-G56G...

mold-cli (>=0.0.1, <=0.0.2), pygrest (1.1.0) +3 more potentially affected by CVE-2025-71176 via pytest (4.1.1)

pytest PYPI version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - mold-cli =0.0.1, =1.0.0, =0.100.2rc4, =0.100.2 - regexgen 1.0.0 Source cves: CVE-2025-71176 Source advisory: OSV:GHSA-6W46-J5RX-G56G...

algorin-cli (>=0.0.1, <=0.21.0), areaaa (0.0.1) +63 more potentially affected by CVE-2025-71176 via pytest (8.1.1)

pytest PYPI version 8.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - algorin-cli =0.0.1, =0.1.18, =0.0.1, =32.1.0, =0.0.0, =0.0.1, =0.5.1, =0.1.0, =1.0.0, =1.0.17 and more Source cves: CVE-2025-71176 Source advisory:...

Azure Linux 3.0 Security Update: dcos-cli (CVE-2020-26160)

The version of dcos-cli installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2020-26160 advisory. - jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with...

Azure Linux 3.0 Security Update: gh (CVE-2025-48938)

The version of gh installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-48938 advisory. - go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has...

@akashic/akashic-cli (>=2.16.49, <=2.17.21), @akashic/akashic-cli-export (>=1.8.28, <=1.9.17) +251 more potentially affected by CVE-2025-13465 via lodash.unset (>=4.0.2, <=4.5.2)

lodash.unset NPM version =4.0.2, =2.16.49, =1.8.28, =1.2.1, =1.8.4, =8.0.0, =1.0.75, =0.0.2, =0.1.0, =1.31.9, =0.0.4, =0.6.0 and more Source cves: CVE-2025-13465 Source advisory: GHSA-XXJR-MMJV-4GPG...

@backstage/backend-app-api (>=0.0.0-nightly-20220908030128, <=1.4.0-next.1), @backstage/backend-common (>=0.0.0-nightly-20201012104, <=0.0.0-nightly-20240917021806) +170 more potentially affected by CVE-2026-24047 via @backstage/cli-common (>=0.0.0-nightly-2021612205, <=0.1.16)

@backstage/cli-common NPM version =0.0.0-nightly-2021612205, =0.0.0-nightly-20220908030128, =0.0.0-nightly-20201012104, =0.0.0-nightly-20220908030128, =0.0.0-nightly-20240116021644, =0.0.0-nightly-20231025021459, =0.0.0-nightly-20220908030128, =0.0.0-nightly-2021101322257,...

@backstage/backend-app-api (>=0.0.0-nightly-20220908030128, <=1.4.0-next.1), @backstage/backend-common (>=0.0.0-nightly-20201012104, <=0.0.0-nightly-20240917021806) +170 more potentially affected by CVE-2026-24047 via @backstage/cli-common (>=0.0.0-nightly-202153022114, <=0.1.16)

@backstage/cli-common NPM version =0.0.0-nightly-202153022114, =0.0.0-nightly-20220908030128, =0.0.0-nightly-20201012104, =0.0.0-nightly-20220908030128, =0.0.0-nightly-20240116021644, =0.0.0-nightly-20231025021459, =0.0.0-nightly-20220908030128, =0.0.0-nightly-2021101322257,...

@backstage/backend-app-api (>=0.0.0-nightly-20220908030128, <=1.4.0-next.1), @backstage/backend-common (>=0.0.0-nightly-20201012104, <=0.0.0-nightly-20240917021806) +170 more potentially affected by CVE-2026-24047 via @backstage/cli-common (>=0.0.0-nightly-202153022114, <=0.1.16)

@backstage/cli-common NPM version =0.0.0-nightly-202153022114, =0.0.0-nightly-20220908030128, =0.0.0-nightly-20201012104, =0.0.0-nightly-20220908030128, =0.0.0-nightly-20240116021644, =0.0.0-nightly-20231025021459, =0.0.0-nightly-20220908030128, =0.0.0-nightly-2021101322257,...

data-pipelines-cli (>=0.31.0, <=0.32.0), pytoil (>=0.36.0, <=0.38.1) potentially affected by CVE-2026-23986 via copier (7.0.1)

copier PYPI version 7.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - data-pipelines-cli =0.31.0, =0.36.0, =0.38.1 Source cves: CVE-2026-23986 Source advisory: OSV:GHSA-4FQP-R85R-HXQH...

dialogy (>=0.2.3, <=0.9.20), flexlate-dev (>=0.1.0, <=0.19.0) +2 more potentially affected by CVE-2026-23986 via copier (5.1.0)

copier PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - dialogy =0.2.3, =0.1.0, =0.1.0, =0.1.0, =0.2.0 Source cves: CVE-2026-23986 Source advisory: OSV:GHSA-4FQP-R85R-HXQH...

entangled-cli (>=2.0.0, <=2.0.2), flet (>=0.10.0, <=0.11.0) +9 more potentially affected by CVE-2026-23986 via copier (8.3.0)

copier PYPI version 8.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - entangled-cli =2.0.0, =0.10.0, =0.10.0, =0.1.1, =0.1.10, =0.7.1, =0.12.5, =4.1.0b1, =4.3.0b3, =4.1.0b1, =4.1.0b1, =4.3.4rc3 Source cves:...