CVE-2026-78177 TanStack devtools-vite Development Devtools Event Bus package-manager.ts installPackage os command injection

A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command...

CVE-2026-78177 TanStack devtools-vite Development Devtools Event Bus package-manager.ts installPackage os command injection

A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command...

EUVD-2026-64694

A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command...

CVE-2026-78177 TanStack devtools-vite Development Devtools Event Bus package-manager.ts installPackage os command injection

A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command...

CVE-2026-78177

TanStack devtools-vite 0.7.0 is affected by an OS command injection vulnerability in the installPackage function within packages/devtools-bundler-core/src/package-manager.ts (component: Development Devtools Event Bus). The root cause is unsanitized handling of the packageName argument, allowing a...

PT-2026-79809

A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command...

CVE-2026-78177: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command...

CVE-2026-53766

creationtimestamp| type| source ---|---|--- 2026-08-17 22:35:16+00:00| published-proof-of-concept| https://github.com/ChromeDevTools/chrome-devtools-mcp/security/advisories/GHSA-8qf9-62x2-82pp 2026-08-18 02:33:46+00:00| seen| https://gist.github.com/alon710/259d2014ae004d0972fa015a9b341f1e...

browser-ipc-cdp (>=2.0.0, <=3.13.0), chrome-devtools-mcp-docker (>=0.1.5, <=0.1.7) +1 more potentially affected by CVE-2026-53766 via chrome-devtools-mcp (0.25.0)

chrome-devtools-mcp NPM version 0.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on chrome-devtools-mcp and may be impacted: - browser-ipc-cdp =2.0.0, =0.1.5, =1.0.1, =1.0.9 Source cves: CVE-2026-53766 Source advisory: OSV:GHSA-8QF9-62X2-82PP...

chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots

Summary I originally reported this through Google Bug Hunters. The Google Bug Hunters team said this is in OSS VRP scope but not reward-eligible due to the project tier, and asked me to file an issue or PR directly with this repository. I am reporting it privately here first because it is an...

EUVD-2026-39104

chrome-devtools-mcp: validatePath does not canonicalize symlinks before enforcing roots...

NPM: chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots

NPM: chrome-devtools-mcp: validatePath does not canonicalize symlinks before enforcing roots vulnerability discovered by ? in WordPress Npm chrome-devtools-mcp versions = 0.24.0, = 1.0.1...

GHSA-8QF9-62X2-82PP chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots

Summary I originally reported this through Google Bug Hunters. The Google Bug Hunters team said this is in OSS VRP scope but not reward-eligible due to the project tier, and asked me to file an issue or PR directly with this repository. I am reporting it privately here first because it is an...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-101096)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101096 advisory. Information disclosure in the Framework component in DevTools. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird...

Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers

Cybersecurity researchers have detailed a post-exploitation technique that enables the Chrome DevTools Protocol CDP inside a running Google Chrome or Microsoft Edge process on Windows, allowing an operator to access cookies, saved data, and authenticated browser sessions. The technique assumes th...

Malicious code in debug-proxy-chrome-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7a0986932a47f49b162ea0438acfd0b6293e027e8ac2da46eb1221c5d52646c [email protected] declares a postinstall hook "postinstall": "node install.js" that automatically executes on npm install. install.js...

firefox: thunderbird: Information disclosure in the Framework component in DevTools

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the Framework component in DevTools...

firefox: thunderbird: Information disclosure in the Framework component in DevTools

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the Framework component in DevTools...

firefox: thunderbird: Information disclosure in the Framework component in DevTools

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the Framework component in DevTools...

firefox: thunderbird: Information disclosure in the Framework component in DevTools

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the Framework component in DevTools...