CVE-2026-40897

CVE-2026-40897 Math.js 表达式解析器中的远程代码执行 ★ CVE-2026-40897 Math.js 远程代码执行 PoC ★ https://github.com/user-attachments/assets/8c394039-f00a-4875-991a-fb5f40bc6898 概述 CVE-2026-40897 是 Math.js 表达式解析器中的一个沙箱绕过导致远程代码执行 漏洞。 isSafeProperty 过滤器仅检查来自用户表达式的属性访问，而不检查来自内部代码路径的访问。通过 toJSON 泄露 ArrayNode 的内部数组并覆盖其...

CVE-2026-40897

CVE-2026-40897 Remote Code Execution in Math.js Expression Parser ★ CVE-2026-40897 Remote Code Execution in Math.js PoC ★ https://github.com/user-attachments/assets/8c394039-f00a-4875-991a-fb5f40bc6898 Overview CVE-2026-40897 is a Sandbox Bypass leading to Remote Code Execution vulnerability in...

EUVD-2026-75041

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...

CVE-2026-83530

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...

CVE-2026-74783

Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger ...

GHSA-JP7M-XCGX-57QM n8n: External Secrets Permission Bypass via Expression Parser Mismatch

Impact Due to a mismatch between the static validation check and the runtime expression engine, an authenticated user with credential create or update permissions, but without the externalSecret:list scope, could embed external secret references into credentials in forms the validation did not...

n8n: External Secrets Permission Bypass via Expression Parser Mismatch

Impact Due to a mismatch between the static validation check and the runtime expression engine, an authenticated user with credential create or update permissions, but without the externalSecret:list scope, could embed external secret references into credentials in forms the validation did not...

Duplicate Advisory: External Secrets Permission Bypass via Expression Parser Mismatch

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jp7m-xcgx-57qm. This link is maintained to preserve external references. Original Description n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability in external secrets...

GHSA-Q6MX-QVHP-FQMG Duplicate Advisory: External Secrets Permission Bypass via Expression Parser Mismatch

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jp7m-xcgx-57qm. This link is maintained to preserve external references. Original Description n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability in external secrets...

CVE-2026-59259 n8n - Permission Bypass via Expression Parser Mismatch in External Secrets

n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability in external secrets handling caused by a mismatch between the static validation check and the runtime expression engine. An authenticated user with credential create or update permissions but without the...

CVE-2026-59259 n8n - Permission Bypass via Expression Parser Mismatch in External Secrets

n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability in external secrets handling caused by a mismatch between the static validation check and the runtime expression engine. An authenticated user with credential create or update permissions but without the...

cve-2026-40985 - MEDIUM - Data Binding Vulnerability in Spring Web Flow with Unified EL Parser

cve-2026-40985 - MEDIUM - Data Binding Vulnerability in Spring Web Flow with Unified EL Parser...

CVE-2026-48593

CVE-2026-48593 describes an uncontrolled resource consumption in oban_web’s cron rendering. The issue arises in the Elixir CronExpr describe/1 rendering path where unbounded cron ranges (e.g., 1-100000000) are parsed by parse_range/1 without bounds checks, then expand_dom_parts/1 and expand_dow_p...

PT-2026-42692

Name of the Vulnerable Software and Affected Versions Twig versions prior to 3.15.0 Description The obj.expr dynamic-attribute syntax allows the attribute to be an arbitrary expression. When the receiver is self or any % import % alias and the parenthesised expression is a string literal, the...

CVE-2026-41139

A flaw was found in math.js, an extensive math library for JavaScript and Node.js. This vulnerability allows an attacker to execute arbitrary JavaScript code by exploiting the expression parser. This could lead to a complete compromise of the system where math.js is used...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview mathjs is a math library for JavaScript and Node.js. It features a flexible expression parser with support for symbolic computation, comes with a large set of built-in functions and constants, and offers an integrated solution to work with diff. Affected versions of this package are...

CVE-2026-41139

Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0...

CVE-2026-41139

Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0...

CVE-2026-41139 Unsafe array index getter in mathjs

Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0...

CVE-2026-41139

CVE-2026-41139 affects mathjs: Unsafe array index getter in the expression parser allows arbitrary JavaScript execution. The issue was present from version 13.1.0 up to before 15.2.0 and has been patched in 15.2.0. Impact is high (CVSSv3.0: 8.8, network attack vector, user interaction: none, priv...