Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the processing of reference names in dotgit. An attacker can modify or overwrite files outside the intended reference storage by supplying specially crafted reference names containing path traversal sequences. Th...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the processing of reference names in dotgit. An attacker can modify or overwrite files outside the intended reference storage by supplying specially crafted reference names containing path traversal sequences. Th...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the processing of reference names in dotgit. An attacker can modify or overwrite files outside the intended reference storage by supplying specially crafted reference names containing path traversal sequences. Th...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the processing of reference names in dotgit. An attacker can modify or overwrite files outside the intended reference storage by supplying specially crafted reference names containing path traversal sequences. Th...

CVE-2026-71557 go-git: Malicious reference names may modify files outside the reference storage

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...

CVE-2026-71557

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack in worktreefs.go and worktree.go are vulnerable to symlink traversal in filesystem-backed worktrees. An attacker can modify or overwrite files outside the intended worktree by placing a symlink in the tree and then...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack in worktreefs.go and worktree.go are vulnerable to symlink traversal in filesystem-backed worktrees. An attacker can modify or overwrite files outside the intended worktree by placing a symlink in the tree and then...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack in worktreefs.go and worktree.go are vulnerable to symlink traversal in filesystem-backed worktrees. An attacker can modify or overwrite files outside the intended worktree by placing a symlink in the tree and then...

CVE-2026-71556

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted reposito...

Malicious code in dolyame-ui-progressline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e109a79a8ebbb2a7d21a37668b162bc92a5602ad24e7db6b6ce711f5cee152f6 On require, index.js loads shim.js which fetches a platform-specific binary from hardcoded Cloudflare Workers endpoints...

Malicious code in devplatform-stylelint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d5c417e542790e2e91860f8383960eecead75556b747c0fdc91227c3228f514 The package is published as 'devplatform-stylelint-config' with description 'environment config reader' and exposes a trivial ConfigLoader from...

MAL-2026-13569 Malicious code in dolyame-ui-flatcorners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ae65f4eadd80905a644647c6f15aee082d428bf5812632a29015eccc924bf1b On require/import of the package, both adapter.js and the advertised main module lib/telemetry.js download an OS-specific binary from obfuscated...

Malicious code in dolyame-ui-overridestyles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38d2bc1cbc6567633387613915ff6d5637770cfa636a8d0ec14c99ef91b73a72 On require of the package, compat.js invokes a setup routine that downloads a platform-specific binary from Cloudflare Workers hosts assembled by...

MAL-2026-13506 Malicious code in dolyame-ui-inputbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c05d783314187af31df2f0152cc2809660ec45808c3e5f38071e8bfe7ac08dd6 On require of the package, index.js loads loader.js and lib/telemetry.js, both of which act as remote-binary droppers. Hostnames and dangerous API...

CVE-2026-54208

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into existing files on the server with attacker-controlled content. This is possible because user input is written directly to files without proper...

CVE-2026-54208 TeamDavid: Arbitrary File Write leading to Stored XSS

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into existing files on the server with attacker-controlled content. This is possible because user input is written directly to files without proper...

CVE-2026-54208

The CVE affects Tobit Laboratories AG TeamDavid’s Webbox. An unauthenticated attacker can exploit an arbitrary file-write flaw (via unsafely written user input) to create/write files (e.g., .htm) containing JavaScript, triggering stored XSS when a user accesses the file. The issue affects TeamDav...

CVE-2026-54208

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into existing files on the server with attacker-controlled content. This is possible because user input is written directly to files without proper...

EUVD-2026-54439

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into existing files on the server with attacker-controlled content. This is possible because user input is written directly to files without proper...