WS-2026-0013

OpenAI Codex CLI: unsafe auto-approval of git commands. The 'safe command' allowlist trusted git subcommands show/diff/log/branch by name only, ignoring arguments, so crafted invocations bypassed the approval/sandbox boundary. Vectors: git show/diff/log --output arbitrary file write;...

Fedora 44 : vultr-cli (2026-ce174cdc78)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-ce174cdc78 advisory. Automatic update for vultr-cli-3.8.0-1.fc44. Changelog Wed Feb 4 2026 Major Hayden - 3.8.0-1 - Update to 3.8.0 - Fixes CVE-2025-11065: go-viper/mapstructure...

React Native Community CLI remote command execution

Added: 02/04/2026 Background React Native is a framework for building mobile JavaScript applications. React Native Community CLI is a collection of command line tools that help developers build React Native mobile applications. Problem A vulnerability in React Native Community CLI when running wi...

Hackers Exploit Metro4Shell RCE Flaw in React Native CLI npm Package

Threat actors have been observed exploiting a critical security flaw impacting the Metro Development Server in the popular "@react-native-community/cli" npm package. Cybersecurity company VulnChecksaid it first observed exploitation of CVE-2025-11953 aka Metro4Shell on December 21, 2025. With a...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/haxcms-nodejs (>=0.0.2, <=25.0.0) +3 more potentially affected by CVE-2026-25521 via locutus (>=2.0.14, <=2.0.32)

locutus NPM version =2.0.14, =0.1.3, =0.0.2, =11.0.2, =2.1.1, =1.0.66, =1.0.72 Source cves: CVE-2026-25521 Source advisory: OSV:GHSA-RXRV-835Q-V5MH...

GO-2026-4393 Rancher CLI skips TLS verification on Rancher CLI login command in github.com/rancher/rancher

Rancher CLI skips TLS verification on Rancher CLI login command in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

@backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260123025240, <=0.0.0-nightly-20260126030220), @techdocs/cli (>=0.0.0-nightly-20260123025240, <=0.0.0-nightly-20260126030220) potentially affected by CVE-2026-25153 via @backstage/plugin-techdocs-node (1.14.0)

@backstage/plugin-techdocs-node NPM version 1.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-techdocs-node and may be impacted: - @backstage/plugin-techdocs-backend =0.0.0-nightly-20260123025240, =0.0.0-nightly-20260123025240,...

cli-pipeline (1.5.114), medikit (0.5.20) potentially affected by CVE-2026-1703 via pip (10.0.0b2)

pip PYPI version 10.0.0b2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - cli-pipeline 1.5.114 - medikit 0.5.20 Source cves: CVE-2026-1703 Source advisory: OSV:GHSA-6VGW-5PG2-W6JP...

hyperpod-elastic-agent (>=1.1.0, <=1.1.3), jupyter-quant (>=2509.1.0, <=2510.1.0) +5 more potentially affected by CVE-2026-1703 via pip (25.2.0)

pip PYPI version 25.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - hyperpod-elastic-agent =1.1.0, =2509.1.0, =0.1.0, =0.20.0, =3.13.0, =3.13.0, =3.14.0 Source cves: CVE-2026-1703 Source advisory: OSV:GHSA-6VGW-5PG2-W6JP...

biome-text (3.3.0), elemeno-ai-sdk (>=0.0.8, <=0.2.4) +5 more potentially affected by CVE-2025-10279 via mlflow (1.20.2)

mlflow PYPI version 1.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - biome-text 3.3.0 - elemeno-ai-sdk =0.0.8, =0.0.1, =0.2.1.2, =0.1.5, =2.5.1a1, =0.0.1, =0.0.48 Source cves: CVE-2025-10279 Source advisory:...

Rancher CLI skips TLS verification on Rancher CLI login command

Impact A vulnerability has been identified within Rancher Manager, where using self-signed CA certificates and passing the -skip-verify flag to the Rancher CLI login command without also passing the –cacert flag results in the CLI attempting to fetch CA certificates stored in Rancher’s setting...

GHSA-MC24-7M59-4Q5P Rancher CLI skips TLS verification on Rancher CLI login command

Impact A vulnerability has been identified within Rancher Manager, where using self-signed CA certificates and passing the -skip-verify flag to the Rancher CLI login command without also passing the –cacert flag results in the CLI attempting to fetch CA certificates stored in Rancher’s setting...

appel-geocode (>=0.1.1, <=1.1.0), bamboo-lib (>=0.0.37, <=0.0.39) +3 more potentially affected by CVE-2025-69662 via geopandas (0.5.1)

geopandas PYPI version 0.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on geopandas and may be impacted: - appel-geocode =0.1.1, =0.0.37, =0.0.1, =0.0.13 Source cves: CVE-2025-69662 Source advisory: OSV:GHSA-6497-PRX7-GPMQ...

appel-geocode (>=0.1.1, <=1.1.0), bamboo-lib (>=0.0.37, <=0.0.39) +3 more potentially affected by CVE-2025-69662 via geopandas (0.5.1)

geopandas PYPI version 0.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on geopandas and may be impacted: - appel-geocode =0.1.1, =0.0.37, =0.0.1, =0.0.13 Source cves: CVE-2025-69662 Source advisory: OSV:PYSEC-2026-62...

@vltpkg/cli-sdk (>=1.0.0-rc.1, <=1.0.0-rc.9), @vltpkg/config (>=1.0.0-rc.1, <=1.0.0-rc.9) +8 more potentially affected by CVE-2026-24909 via @vltpkg/tar (>=1.0.0-rc.1, <=1.0.0-rc.9)

@vltpkg/tar NPM version =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.9 Source cves: CVE-2026-24909 Source advisory: OSV:GHSA-GF2C-JWCJ-X929...

@vltpkg/cli-sdk (>=1.0.0-rc.1, <=1.0.0-rc.9), @vltpkg/config (>=1.0.0-rc.1, <=1.0.0-rc.9) +8 more potentially affected by CVE-2026-24909 via @vltpkg/tar (>=1.0.0-rc.1, <=1.0.0-rc.9)

@vltpkg/tar NPM version =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.9 Source cves: CVE-2026-24909 Source advisory: GHSA-GF2C-JWCJ-X929...

browserstack-cypress-cli (>=1.14.1, <=1.36.3) potentially affected by CVE-2025-57283 via browserstack-local (>=1.5.1, <=1.5.4)

browserstack-local NPM version =1.5.1, =1.14.1, =1.36.3 Source cves: CVE-2025-57283 Source advisory: SNYK:JS-BROWSERSTACKLOCAL-15149317...

@vltpkg/cli-sdk (>=1.0.0-rc.1, <=1.0.0-rc.9), @vltpkg/config (>=1.0.0-rc.1, <=1.0.0-rc.9) +8 more potentially affected by CVE-2026-24909 via @vltpkg/tar (>=1.0.0-rc.1, <=1.0.0-rc.9)

@vltpkg/tar NPM version =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.9 Source cves: CVE-2026-24909 Source advisory: SNYK:JS-VLTPKGTAR-15127281...

@vltpkg/cli-sdk (>=0.0.0-7, <=1.0.0-rc.9), @vltpkg/config (>=0.0.0-19, <=1.0.0-rc.9) +9 more potentially affected by CVE-2026-24909 via @vltpkg/tar (>=0.0.0-0.1730239248325, <=1.0.0-rc.9)

@vltpkg/tar NPM version =0.0.0-0.1730239248325, =0.0.0-7, =0.0.0-19, =0.0.0-0.1730239248325, =0.0.0-7, =0.0.0-0.1730239248325, =0.0.0-0.1730239248325, =0.0.0-4, =0.0.0-7, =0.0.0-10, =0.0.0-26, =0.0.1-pre.1, =1.2.0 Source cves: CVE-2026-24909 Source advisory: MEND:CVE-2026-24909...

Malicious code in tailwind-components-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3916984542c5471332406155adc38fde3d254e8748b6e65caa1b9680663602c The package tailwind-components-cli was found to contain malicious code. Source: ghsa-malware...