36519 matches found
EUVD-2026-36284
KanaDojo contains a command injection vulnerability that allows an attacker with pull request access to execute arbitrary shell commands by inserting shell metacharacters into the version or changes fields of patchNotesData.json, which are interpolated unsanitized into a childprocess.execSync cal...
CVE-2026-48547
KanaDojo contains a command injection vulnerability that allows an attacker with pull request access to execute arbitrary shell commands by inserting shell metacharacters into the version or changes fields of patchNotesData.json, which are interpolated unsanitized into a childprocess.execSync cal...
CVE-2026-48547 KanaDojo < 0.1.18 Command Injection via patchNotesData.json in release.yml
KanaDojo contains a command injection vulnerability that allows an attacker with pull request access to execute arbitrary shell commands by inserting shell metacharacters into the version or changes fields of patchNotesData.json, which are interpolated unsanitized into a childprocess.execSync cal...
CVE-2026-48546
KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute arbitrary code by exploiting the explicit passing of the global require function into a Node.js vm.runInNewContext sandbox context in the issue-auto-respond.yml workflow. Attackers can submit a pull...
EUVD-2026-36273
KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute arbitrary code by exploiting the explicit passing of the global require function into a Node.js vm.runInNewContext sandbox context in the issue-auto-respond.yml workflow. Attackers can submit a pull...
CVE-2026-48546
KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute arbitrary code by exploiting the explicit passing of the global require function into a Node.js vm.runInNewContext sandbox context in the issue-auto-respond.yml workflow. Attackers can submit a pull...
CVE-2026-48546 KanaDojo < 0.1.18 Sandbox Escape RCE via messages.cjs
KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute arbitrary code by exploiting the explicit passing of the global require function into a Node.js vm.runInNewContext sandbox context in the issue-auto-respond.yml workflow. Attackers can submit a pull...
Sensitive Cookie in HTTPS Session Without "Secure" Attribute
Overview Affected versions of this package are vulnerable to Sensitive Cookie in HTTPS Session Without "Secure" Attribute in the setSessionCookie process. An attacker can access sensitive session information by intercepting cookies transmitted over unsecured channels. Remediation There is no fixe...
CVE-2026-48039
creationtimestamp| type| source ---|---|--- 2026-06-11 13:28:29+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-9gw6-46qc-99vr 2026-08-08 03:00:26+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msk3ddwnin2e 2026-08-08 03:00:33+00:00| seen|...
CVE-2026-47781
creationtimestamp| type| source ---|---|--- 2026-06-11 13:25:28+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-qq6c-99pv-prvf...
GHSA-RJ8Q-PRQP-JWFG vulnerabilities
Vulnerabilities for packages: libcrypto3-2.34...
GHSA-5PG7-F6XV-J6M4 vulnerabilities
Vulnerabilities for packages: libcrypto3-2.34, openssl...
MAL-2026-5641 Malicious code in goreleaser-run (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2733e0c086915d44eb8c971575087d9260bf1133d62da63920b578cf7e60c30 Package impersonates the legitimate goreleaser tool name goreleaser-run, homepage spoofed to https://goreleaser.org; goreleaser is not officially...
Malicious code in goreleaser-run (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2733e0c086915d44eb8c971575087d9260bf1133d62da63920b578cf7e60c30 Package impersonates the legitimate goreleaser tool name goreleaser-run, homepage spoofed to https://goreleaser.org; goreleaser is not officially...
MAL-2026-5542 Malicious code in india-map-react (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1de9d093e23698e3ad3f0336a7619bd43049d1f62b822744733a48060b51a4a package.json declares a postinstall hook that runs curl -skL...
Malicious code in india-map-react (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1de9d093e23698e3ad3f0336a7619bd43049d1f62b822744733a48060b51a4a package.json declares a postinstall hook that runs curl -skL...
CVE-2026-48547: Improper Neutralization of Special Elements used in an OS Command
KanaDojo contains a command injection vulnerability that allows an attacker with pull request access to execute arbitrary shell commands by inserting shell metacharacters into the version or changes fields of patchNotesData.json, which are interpolated unsanitized into a childprocess.execSync cal...
PT-2026-48720
Name of the Vulnerable Software and Affected Versions KanaDojo affected versions not specified Description A command injection issue exists where an attacker with pull request access can execute arbitrary shell commands. This occurs when shell metacharacters are inserted into the version or chang...
CVE-2026-48546: Protection Mechanism Failure
KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute arbitrary code by exploiting the explicit passing of the global require function into a Node.js vm.runInNewContext sandbox context in the issue-auto-respond.yml workflow. Attackers can submit a pull...
Uncontrolled Recursion
Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in the MVG decoder when processing a crafted file due to a missing depth or visited-set check. An attacker can cause a denial of service by supplying a specially crafted MVG file that triggers a stack overflow...