GHSA-CQ8V-F236-94QC vulnerabilities

Vulnerabilities for packages: buck2, berg, sdp-k8s-injector, uv, just, biome, sccache, sqlx, shadowsocks-rust, mdbook, pgcat, vector, atuin, netavark, zizmor, ruff, cargo-c, wadm, samply, py3-xet-core, kdash, mountpoint-s3, wasmcloud, wasmtime, zola, rye, yazi, parseable, starship, zellij,...

GHSA-CQ8V-F236-94QC vulnerabilities

Vulnerabilities for packages: cargo-c, atuin, linkerd-network-validator, shadowsocks-rust, biome, sentry-cli, samply, ntpd-rs, vector, yazi, ruff, wasmcloud, mdbook, virtiofsd, sqlx, chaos-tproxy, zizmor, cargo-audit, wadm, starship, rav1e, hurl, watchexec, pixi, zellij, nushell, zed, rye,...

EUVD-2025-18116

Malicious code in bioql PyPI...

GHSA-V33J-V3X4-42QG Regex literal in Hurl files are not escaped when exported to HTML, allowing injections

Given this Hurl file: regex.hurl: GET https://foo.com HTTP 200 Asserts jsonpath "$.body" matches // When exported to HTML: $ hurlfmt --out html regex.hurl GET https://foo.com HTTP 200 Asserts jsonpath "$.body" matches // The regex literal // is not escaped: // When opened in a browser, the code i...

Regex literal in Hurl files are not escaped when exported to HTML, allowing injections

Given this Hurl file: regex.hurl: GET https://foo.com HTTP 200 Asserts jsonpath "$.body" matches // When exported to HTML: $ hurlfmt --out html regex.hurl GET https://foo.com HTTP 200 Asserts jsonpath "$.body" matches // The regex literal // is not escaped: // When opened in a browser, the code i...

PT-2025-26514 · Crates.Io · Hurl

Given this Hurl file: regex.hurl: GET https://foo.com HTTP 200 Asserts jsonpath "$.body" matches // When exported to HTML: $ hurlfmt --out html regex.hurl GET https://foo.com HTTP 200 Asserts jsonpath "$.body" matches // The regex literal // is not escaped: // When opened in a browser, the code i...