PYSEC-2026-2015 vLLM vulnerable to remote code execution via transformers_utils/get_config

Summary vllm has a critical remote code execution vector in a config class named NemotronNanoVLConfig. When vllm loads a model config that contains an automap entry, the config class resolves that mapping with getclassfromdynamicmodule... and immediately instantiates the returned class. This...

JLSEC-2026-657 Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions

Summary When Deno was run in BYONM mode nodeModulesDir: "manual", the module resolver did not validate that a package's resolved entrypoint stayed within its nodemodules// directory. A malicious package.json whose main field contained .. segments was able to resolve to an arbitrary path on disk,...

GHSA-968W-XFQW-VP9Q Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions

Summary When Deno was run in BYONM mode nodeModulesDir: "manual", the module resolver did not validate that a package's resolved entrypoint stayed within its nodemodules// directory. A malicious package.json whose main field contained .. segments was able to resolve to an arbitrary path on disk,...

Malicious code in ort-type-test-module-resolution (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-41589 Malicious code in ort-type-test-module-resolution (npm)

--- -= Per source details. Do not edit below this line.=-...

Security Bulletin: Potential module resolution error in DataPower Operator

Summary IBM has addressed a potential build-time issue. This did not affect product code, but may have been detected in customer scans. Vulnerability Details CVEID:CVE-2022-23773 DESCRIPTION: An unspecified error with not treating branches with semantic-version names as releases in cmd/go in Gola...