virtualenv: Venv configuration readback can reinterpret path boundaries

Summary The venv creator reads the standard library's generated pyvenv.cfg with splitlines and merges all resulting keys over virtualenv's configuration. Line-boundary characters from destination data can therefore become configuration structure before output sanitization. Anthropic's OSS Scanner...

GHSA-QMX5-4P3X-WVQF virtualenv: Venv configuration readback can reinterpret path boundaries

Summary The venv creator reads the standard library's generated pyvenv.cfg with splitlines and merges all resulting keys over virtualenv's configuration. Line-boundary characters from destination data can therefore become configuration structure before output sanitization. Anthropic's OSS Scanner...

NPM: vm2: NodeVM custom resolution bypasses external path boundaries

NPM: vm2: NodeVM custom resolution bypasses external path boundaries vulnerability discovered by ? in WordPress Npm vm2 versions = 3.12.1...

SUSE CVE-2026-58043

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This...

CVE-2026-33490

A flaw was found in H3, a minimal HTTP framework. The mount method, responsible for routing requests to sub-applications, incorrectly uses a simple string comparison to check path prefixes. This allows a remote attacker to craft a URL that bypasses the intended path segment boundary. Consequently...

H3 Security Vulnerabilities

H3 is an open-source HTTP framework developed by H3. Versions of H3 prior to 2.0.2-rc.17 contained security vulnerabilities. These vulnerabilities stemmed from the use of the startsWith method for checking paths, without verifying the boundaries of path segments. This could lead to middleware...