3374 matches found
GHSA-5XP3-2W67-427V n8n: Git Node Clone and Push Operations Bypass File Sandbox
Impact An authenticated user with permission to create or modify workflows could supply a local filesystem path as the source repository in the Git node's Clone operation, or as the target repository in the Push operation, bypassing the N8NRESTRICTFILEACCESSTO file sandbox. This allowed the...
n8n: Git Node Clone and Push Operations Bypass File Sandbox
Impact An authenticated user with permission to create or modify workflows could supply a local filesystem path as the source repository in the Git node's Clone operation, or as the target repository in the Push operation, bypassing the N8NRESTRICTFILEACCESSTO file sandbox. This allowed the...
Malicious code in chalk-plus-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5351482f03a50cab8a28b6aa7c992c960a55c6889634d2a04bb86a157ac18d1 Package is published under a name riding the popular chalk color-output library but its source tree, README, main entry lib/nodemailer.js, and lib...
Malicious code in chalk-plus-ts (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08276c56353501373a202d28f6af6ee2a7c0b20d28a07d99c4c16309df46269c package.json declares postinstall=node lib/utils/index.js, which spawns a detached child process running lib/utils/smtp-connection/index.js. That...
MAL-2026-5608 Malicious code in claimora (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b785b842f24aeae0e20157784b17a8bff7003e72575ac9a3aa9cbeb550a5c92 claimora impersonates the jsonwebtoken library auth0: package.json sets author to "auth0", points repository at a non-existent...
CVE-2026-42305
Dulwich is a pure-Python implementation of the Git file formats and protocols. Versions starting with 0.10.0 and prior to 1.2.5 have an arbitrary file write leading to remote code execution when cloning or checking out a malicious Git repository on Windows. Dulwich's path-element validator accept...
CVE-2026-52726 Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload
Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.23.2 and prior to version 1.2.5, dulwich.porcelain.submoduleupdate, and by extension porcelain.clone..., recursesubmodules=True, materializes attacker-controlled submodule paths from a crafted...
CVE-2026-52726
Technical details about CVE-2026-52726 are not publicly provided in the supplied documents; monitor for updates.
CVE-2026-42305 Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows
Dulwich is a pure-Python implementation of the Git file formats and protocols. Versions starting with 0.10.0 and prior to 1.2.5 have an arbitrary file write leading to remote code execution when cloning or checking out a malicious Git repository on Windows. Dulwich's path-element validator accept...
EUVD-2026-36181
Dulwich is a pure-Python implementation of the Git file formats and protocols. Versions starting with 0.10.0 and prior to 1.2.5 have an arbitrary file write leading to remote code execution when cloning or checking out a malicious Git repository on Windows. Dulwich's path-element validator accept...
CVE-2026-41978
Permission control vulnerability in the clone module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...
CVE-2026-11572
Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to improper sanitisation of user input for git shell commands directly invoked with exec method by cloneWithGit and fetchRefs functions. An attacker can execute arbitrary operating syst...
EulerOS 2.0 SP13 : git (EulerOS-SA-2026-2331)
According to the versions of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Git for Windows is the Windows port of Git. Prior to 2.53.02, it is possible to obtain a user's NTLM hash by tricking them into cloning from a...
CVE-2026-41978
Permission control vulnerability in the clone module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...
CVE-2026-11572
The CVE-2026-11572 entry concerns the npm package degit. Affected versions are degit before 2.8.6, versions 3.0.0 to before 3.3.1, where user input used to construct git shell commands is directly passed to exec() in _cloneWithGit() and fetchRefs(). This improper sanitisation enables a remote att...
CVE-2026-11572
Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to improper sanitisation of user input for git shell commands directly invoked with exec method by cloneWithGit and fetchRefs functions. An attacker can execute arbitrary operating syst...
EUVD-2026-35323
Permission control vulnerability in the clone module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...
CVE-2026-41978
Permission control vulnerability in the clone module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...
CVE-2026-41978
The CVE-2026-41978 entry documents a permission-control vulnerability in the clone module with potential confidentiality impact. CVSS v3.1 metrics indicate a MEDIUM severity (4.4), LOCAL attack vector, LOW confidentiality impact, and REQUIREMENT for user interaction. No exploit details or remedia...