CLEANSTART-2024-EW02482 github

Security vulnerability affects the apptainer package. github...

GHSA-3Q6V-R5MR-HXV8 league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan

Summary league/commonmark's GitHub Flavored Markdown Table extension registers TableStartParser as a block-start parser. While a paragraph is the active block, the core block parser calls TableStartParser::tryStart on every non-blank line. Its first action fetches the entire growing paragraph...

AI Coding Agents Exposed 13,000 Internal Images, Including Billing Records, on GitHub

AI coding agents asked to share screenshots of code changes for review have put internal company images in public GitHub repositories, security company Glow said. Its researchers found more than 13,000 internal images from developers at over 300 organizations, including customer billing records a...

CVE-2026-102906

A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function childprocess.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The...

MAL-2026-17319 Malicious code in bfox-build-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cae53348f8261653938b39ae3cb79101baff666c4216ecaeb635e34b42ba8293 At install time, setup.py harvests the installer's GitHub credential and uses it to modify the installer's own repository. The script reads...

Malicious code in bfox-build-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cae53348f8261653938b39ae3cb79101baff666c4216ecaeb635e34b42ba8293 At install time, setup.py harvests the installer's GitHub credential and uses it to modify the installer's own repository. The script reads...

CVE-2026-102906

The 0xshariq github-mcp-server is vulnerable to an OS command injection in the Git Remove MCP Tool component. The flaw exists within the child_process.exec function of the src/github.ts file, where manipulation of the File argument allows for remote code execution. The exploit is publicly availab...

CVE-2026-102906 0xshariq github-mcp-server Git Remove MCP Tool github.ts child_process.exec os command injection

A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function childprocess.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The...

EUVD-2026-89579

A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function childprocess.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The...

CVE-2026-102906 0xshariq github-mcp-server Git Remove MCP Tool github.ts child_process.exec os command injection

A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function childprocess.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The...

CVE-2026-102906 0xshariq github-mcp-server Git Remove MCP Tool github.ts child_process.exec os command injection

A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function childprocess.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The...

PT-2026-103000

A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function child process.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The...

CVE-2026-102906: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function childprocess.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The...

The Blue Agent POV: Investigating Multi-Platform Data Exfiltration Across AWS and GitHub

See how the Blue Agent investigated a multi-platform attack in minutes, following evidence across AWS and GitHub to uncover compromised credentials, stolen source code, and custom data exfiltration tooling...

Linux Distros Unpatched Vulnerability : CVE-2026-54160

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. Prior to commits...

How we found 24 Android vulnerabilities using our open source AI security agent

With the rise of AI in the security space, our team created the GitHub Security Lab Taskflow Agent as a way for security researchers to easily automate, package, and share the AI prompts and workflows that they find effective for their work. In this blog post, I'll share how I created auditing...

CVE-2026-54160

Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. Prior to commits 658b24e and 1aa31d1, the GitHub Actions script used to prepare NUT tarballs and update GitHub Checks statuses and PR comments about it was...

CVE-2026-54160

Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. Prior to commits 658b24e and 1aa31d1, the GitHub Actions script used to prepare NUT tarballs and update GitHub Checks statuses and PR comments about it was...

UBUNTU-CVE-2026-54160

Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. Prior to commits 658b24e and 1aa31d1, the GitHub Actions script used to prepare NUT tarballs and update GitHub Checks statuses and PR comments about it was...

CVE-2026-54160

The Network UPS Tools (NUT) software contains a vulnerability in its GitHub Actions script used for the make-dist workflow. Due to a misconfiguration that mixed privileged code (a write-scoped GITHUB_TOKEN ) with untrusted inputs from PR source branches, a malicious pull request from a fork could...