External Control of File Name or Path

Overview pnpm is a Fast, disk space efficient package manager Affected versions of this package are vulnerable to External Control of File Name or Path through the patch-remove process. An attacker can cause deletion of arbitrary files outside the intended directory by crafting a patch entry that...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path through the patch-remove process. An attacker can cause deletion of arbitrary files outside the intended directory by crafting a patch entry that resolves outside the configured patches directory...

GHSA-72R4-9C5J-MJ57 pnpm: `patch-remove` could delete project-selected files outside the patches directory

Summary The patch-remove deletion-scope issue tracked as GHSA-72r4-9c5j-mj57 / CAND-PNPM-030 has been addressed in pnpm. A crafted patch entry could resolve outside the configured patches directory and cause pnpm patch-remove to delete an arbitrary reachable file. This patch validates the...

External Control of File Name or Path

Overview @pnpm/fs.symlink-dependency is a Symlink a dependency to nodemodules Affected versions of this package are vulnerable to External Control of File Name or Path via the lockfile alias handling process. An attacker can overwrite files or directories outside the intended nodemodules director...

External Control of File Name or Path

Overview @pnpm/installing.deps-resolver is a Resolves dependency graph of a package Affected versions of this package are vulnerable to External Control of File Name or Path via the lockfile alias handling process. An attacker can overwrite files or directories outside the intended nodemodules...

External Control of File Name or Path

Overview @pnpm/installing.deps-installer is a Fast, disk space efficient installation engine Affected versions of this package are vulnerable to External Control of File Name or Path via the lockfile alias handling process. An attacker can overwrite files or directories outside the intended...

External Control of File Name or Path

Overview pnpm is a Fast, disk space efficient package manager Affected versions of this package are vulnerable to External Control of File Name or Path via the lockfile alias handling process. An attacker can overwrite files or directories outside the intended nodemodules directory by crafting a...

External Control of File Name or Path

Overview @pnpm/installing.deps-restorer is a Fast installation using only pnpm-lock.yaml Affected versions of this package are vulnerable to External Control of File Name or Path via the lockfile alias handling process. An attacker can overwrite files or directories outside the intended nodemodul...

GHSA-QVQC-4C52-X6QP regclient may leak authentication credentials to external blob stores

Credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs for foreign blobs. Example attack A malicious registry serves an OCI image...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the urls field in the layer descriptor. An attacker can obtain authentication credentials by serving a manifest with a urls entry pointing to an attacker-controlled host and causing the client to...

regclient may leak authentication credentials to external blob stores

Credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs for foreign blobs. Example attack A malicious registry serves an OCI image...

CVE-2026-57234

A flaw was found in Nokogiri, an XML and HTML library for Ruby. The NONET parse option, intended to prevent external resource fetching, was not correctly enforced in the JRuby implementation of Nokogiri::XML::Schema. This oversight could allow a specially crafted XML schema to fetch external...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: frankenphp-8.4, etcd, frankenphp-8.3, snyk-cli, argo-workflows-fips, cloudbeat, tekton-pipelines-fips, gitlab-rails-ce, kots, calico-fips, mattermost, external-secrets-operator-fips, argocd-image-updater-fips, skaffold-fips, kyverno-fips, seaweedfs-rocksdb,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: skaffold, terraform-provider-tls, gatus, mattermost, spire-server, opentofu, steampipe, k9s, wal-g, cert-manager, kaf, sops, caddy, snyk-cli, mods, vault-benchmark, prometheus, falcoctl, tkn, external-secrets-operator, zarf, cluster-api-azure-controller, tflint,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: telegraf, gitea, skaffold, flux-image-automation-controller, external-dns, kots, mattermost, nerdctl, loki, istio, trivy-operator, kine, spire-server, kubescape, zot, argocd-image-updater, osv-scanner, helm, k9s, cert-manager, aactl, chisel, fscrypt, kaf, minio,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: skaffold, mattermost, spire-server, opentofu, k9s, cert-manager, kaf, caddy, snyk-cli, prometheus, external-secrets-operator, zarf, wolfictl, kine, osv-scanner, docker-cli-buildx, apko, syft, gptscript, aactl, go-discover, nfpm, gitlab-kas,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: telegraf, kots, external-dns, mattermost, nerdctl, loki, istio, kine, spire-server, zot, docker-cli-buildx, helm, cert-manager, aactl, fscrypt, kaf, minio, opentelemetry-collector, containerd, gitlab-kas, flux, rancher, snyk-cli, prometheus-operator, k3s, prometheus,...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path through the rootfs symlink during image extraction. An attacker can gain unauthorized access to sensitive files and perform arbitrary file creation or modification on the host by importing a special...

CVE-2026-47205

CVE-2026-47205 affects Envoy’s ext_authz HTTP filter. From 1.36.0 through 1.36.9, 1.37.5, and 1.38.3, a Use-After-Free (UAF) occurs when processing per-route authorization overrides concurrently with rapid downstream disconnects. The vulnerable flow creates a transient per-route client and reallo...

CVE-2026-47205 Envoy: ext_authz Use-After-Free during Stream Teardown with Per-Route Overrides

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.36.0 until 1.36.9, 1.37.5, and 1.38.3, a Use-After-Free UAF vulnerability leading to a sudden segmentation fault exists in Envoy's extauthz HTTP filter when processing per-route authorization overrides...