Regular Expression Denial of Service (ReDoS)

Overview @tiptap/core is a headless rich text editor Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS through the Pandoc-style parseAttributes helper in packages/core/src/utilities/markdown/attributeUtils.ts and the shortcode attribute parser in...

GHSA-CRVJ-82CR-HJCX Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Summary Hono's query parsing does not stop at the URL fragment: a ? appearing after a is treated as the start of a query string. As a result, the application can read request parameters that no other component involved in handling the request can see. Details A fragment is never part of the query...

Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Summary Hono's query parsing does not stop at the URL fragment: a ? appearing after a is treated as the start of a query string. As a result, the application can read request parameters that no other component involved in handling the request can see. Details A fragment is never part of the query...

NPM: Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

NPM: Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials vulnerability discovered by ? in WordPress Npm hono versions 4.13.5...

GHSA-6H8R-XR42-GP59 xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content

Summary xmldom's parser silently accepts a not-well-formed end tag whose valid name is followed by trailing content — e.g. . The element is closed, the trailing content is discarded, and no error is reported, even though the XML end-tag production allows only optional whitespace after the name an...

EUVD-2026-69225

xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content...

xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content

Summary xmldom's parser silently accepts a not-well-formed end tag whose valid name is followed by trailing content — e.g. . The element is closed, the trailing content is discarded, and no error is reported, even though the XML end-tag production allows only optional whitespace after the name an...

NPM: xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content

NPM: xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...

xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

Summary On the @xmldom/xmldom 0.8.x line, parsing an XML end tag whose name is followed by a long run of whitespace and then a non-whitespace character triggers quadratic-time regular-expression backtracking ReDoS, so a single small crafted end tag stalls the Node.js event loop. It is reachable...

GHSA-X4FP-J954-R2F4 xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

Summary On the @xmldom/xmldom 0.8.x line, parsing an XML end tag whose name is followed by a long run of whitespace and then a non-whitespace character triggers quadratic-time regular-expression backtracking ReDoS, so a single small crafted end tag stalls the Node.js event loop. It is reachable...

EUVD-2026-69234

xmldom: Quadratic-time parsing via the malformed-input recovery path — parseElementStartPart re-scan and normalize adjacent-text merge...

EUVD-2026-69227

xmldom: HTML raw-text closing-tag case mismatch causes output amplification...

GHSA-F2FP-RGF2-35CP HTTPX2: Quadratic SSE line buffering can cause CPU denial of service

Summary HTTPX2's Server-Sent Events SSE parser repeatedly copied and rescanned buffered text when a server split one unterminated line across many response chunks. The total work grows quadratically with the length of the line. An attacker-controlled or compromised SSE endpoint can exploit this...

CVE-2026-82537

Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a command string with an allowlisted word...

CVE-2026-82537 Roo-Code 3.54.0 Auto-Approve Bypass via Shell Parser Word-Boundary Mismatch

Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a command string with an allowlisted word...

CVE-2026-82537

Roo-Code through version 3.54.0 contains an auto-approve bypass vulnerability caused by a word-boundary mismatch in comment handling between the approval gate's shell parser and bash . An attacker can craft a command string pairing an allowlisted word with a hash character, separator, and a denie...

CVE-2026-82537 Roo-Code 3.54.0 Auto-Approve Bypass via Shell Parser Word-Boundary Mismatch

Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a command string with an allowlisted word...

EUVD-2026-74040

Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability in the shell command parsing logic that allows attackers to execute denied shell commands by exploiting the omission of the bash pipe operator from the command parser's operator token set. Attackers can craft a command line wit...

CVE-2026-82536

Roo-Code through version 3.54.0 contains an auto-approve bypass in its shell command parsing logic. The root cause is the omission of the bash pipe operator (specifically the stderr-redirecting pipe) from the parser's operator token set. An attacker can craft a command line combining an allowlist...

CVE-2026-82054

A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total allocation size,...