MAL-2026-13466 Malicious code in wormgpt-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 534ea1156519b64249657c1495faacdb3cc5d8e250a00e0dc2f8fd4e991af61c The package's bin entries wormgpt-cli, wormgpt, deepholegpt, wgpt map to bin/victim.js, which silently spawns a detached implant on any invocation...

CVE-2026-64655 GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...

CVE-2026-64655 GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...

CVE-2026-64654 GitHub CLI: Terminal escape sequence injection in multiple `gh` commands

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that...

CVE-2026-64654

GitHub CLI (gh) prior to v2.97.0 is affected by a terminal escape sequence injection across multiple gh commands due to lack of neutralization for externally supplied content (gist, API, PRs, releases, codespace, etc.). An attacker who can influence that content can embed escape sequences that ar...

MAL-2026-13476 Malicious code in sui-migration-audit-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cde60caa9a24d7775679269b1c468e4d2aa850e819104cd66c25dde8fb6931af Package [email protected] contains 2 scanned files. No install-time lifecycle hooks, credential access, network exfiltration, dropper,...

CVE-2026-64653

CVE-2026-64653 affects GitHub CLI (gh) prior to version 2.97.0, where certain HTTP request URLs interpolated unescaped variable path components, enabling path traversal to targeted API endpoints or resources. The underlying issue is in how path components were incorporated into requests without p...

CVE-2026-64653 GitHub CLI: Unescaped variable components in request URLs could allow path traversal

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resourc...

CVE-2026-64653

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resourc...

CVE-2026-64653 GitHub CLI: Unescaped variable components in request URLs could allow path traversal

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resourc...

CVE-2026-64652 GitHub CLI: Partial token disclosure in `gh auth status` output

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output tha...

CVE-2026-64652 GitHub CLI: Partial token disclosure in `gh auth status` output

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output tha...

EUVD-2026-54087

A vulnerability was detected in NocteDefensor LudusMCP up to 1.0.24. This affects the function executeArbitraryCommand/executeCommand of the file src/ludusMCP/cliWrapper.ts of the component luduscliexecute. Performing a manipulation of the argument command/args results in command injection. The...

CVE-2026-19047 NocteDefensor LudusMCP ludus_cli_execute cliWrapper.ts executeCommand command injection

A vulnerability was detected in NocteDefensor LudusMCP up to 1.0.24. This affects the function executeArbitraryCommand/executeCommand of the file src/ludusMCP/cliWrapper.ts of the component luduscliexecute. Performing a manipulation of the argument command/args results in command injection. The...

Malicious code in @xiaohhhh1/canvas-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a34add291ef7584aec7041449cb2e80d36ae98f93c2725e1aa018707e3334119 On bin start, @xiaohhhh1/canvas-agent opens an outbound WebSocket to the hardcoded relay wss://canvas.xiaohhhh1.com/api/agent-relay and treats inboun...

OPENSUSE-SU-2026:11471-1 tekton-cli-0.46.0-1.1 on GA media

These are all security issues fixed in the tekton-cli-0.46.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-69207 vulnerabilities

Vulnerabilities for packages: librechat, gemini-cli, kibana, wazuh-dashboard-fips, langfuse, wazuh-dashboard, langfuse-fips...

GHSA-8J4G-W8FX-2239 vulnerabilities

Vulnerabilities for packages: librechat, gemini-cli, kibana, wazuh-dashboard-fips, langfuse, wazuh-dashboard, langfuse-fips...

Important: Red Hat Security Advisory: RHTAS 1.4.3 - Tech Preview Release Of the Go based Model Transparency CLI

The Tech Preview release of the Go based RHTAS Model Transparency CLI image. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.4 The Go based RHTAS Model Transparency CLI image can be used to sign and verify AI/M...

Important: Red Hat Security Advisory: RHTAS 1.4.3 - CLI Stack Release

The 1.4.3 release of the RHTAS CLIs. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.4 The RHTAS CLI Stack images for RHTAS 1.4.3...