gha-lab-b16a4f3554

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of qgis/QGIS at commit...

QGIS GIS if_nullptr_null_str() Disclosure

The vulnerability of the ifnullptrnullstr function in QGIS GIS software is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow a malicious actor to disclose protected information...

DEBIAN-CVE-2026-104140

QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 OGC API Features HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer...

CVE-2026-104140

QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 OGC API Features HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer...

CVE-2026-104140

QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 OGC API Features HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer...

UBUNTU-CVE-2026-104140

QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 OGC API Features HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer...

CVE-2026-104140 QGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute values

QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 OGC API Features HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer...

CVE-2026-104140 QGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute values

QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 OGC API Features HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer...

CVE-2026-104140

QGIS Server is vulnerable to a Stored Cross-Site Scripting (XSS) flaw in the WFS3 (OGC API Features) HTML responses. The root cause is the lack of HTML escaping for feature attribute values processed via QgsServerOgcApiHandler::htmlDump and the if_nullptr_null_str callback. An attacker can inject...

CVE-2026-104140: Improper Neutralization of Input During Web Page Generation

QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 OGC API Features HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer...

[SECURITY] Fedora 45 Update: qgis-4.2.2-2.fc45

Geographic Information System GIS manages, analyzes, and displays databases of geographic information. QGIS supports shape file viewing and editing, spatial data storage with PostgreSQL/PostGIS, projection on-the-fly, map composition, and a number of other features via a plugin interface. QGIS al...

qgis-deployment-toolbelt (0.40.0) potentially affected by unknown CVE via dulwich (0.24.6)

dulwich PYPI version 0.24.6 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - qgis-deployment-toolbelt 0.40.0 Source cves: unknown CVE Source advisory: OSV:GHSA-8MCX-5RQC-VHMF...

edu-segmentation (>=0.0.88, <=0.0.115), qgis-deployment-toolbelt (>=0.17.0, <=0.23.0) +1 more potentially affected by unknown CVE via dulwich (0.21.3)

dulwich PYPI version 0.21.3 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - edu-segmentation =0.0.88, =0.17.0, =0.23.0 - vocode 0.1.104 Source cves: unknown CVE Source advisory: OSV:GHSA-8MCX-5RQC-VHMF...

grimoirelab (>=1.9.1rc1, <=1.9.2), infrahub-server (>=1.6.0b0, <=1.8.0b0) +3 more potentially affected by unknown CVE via dulwich (0.22.7)

dulwich PYPI version 0.22.7 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - grimoirelab =1.9.1rc1, =1.6.0b0, =0.1.2, =0.36.2, =0.8.0b4, =0.9.0rc1 Source cves: unknown CVE Source advisory: OSV:GHSA-8MCX-5RQC-VHMF...

perceval-mozilla (>=0.3.2rc1, <=0.3.2rc2), qgis-deployment-toolbelt (>=0.8.0, <=0.10.0) potentially affected by unknown CVE via dulwich (0.20.35)

dulwich PYPI version 0.20.35 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - perceval-mozilla =0.3.2rc1, =0.8.0, =0.10.0 Source cves: unknown CVE Source advisory: OSV:GHSA-8MCX-5RQC-VHMF...

grimoirelab (>=1.6.0rc1, <=1.7.0), qgis-deployment-toolbelt (>=0.34.5, <=0.36.0) +2 more potentially affected by unknown CVE via dulwich (0.22.1)

dulwich PYPI version 0.22.1 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - grimoirelab =1.6.0rc1, =0.34.5, =0.6.0rc3, =0.1.0, =0.3.4 Source cves: unknown CVE Source advisory: OSV:GHSA-8MCX-5RQC-VHMF...

grimoirelab (>=1.9.0rc1, <=1.9.0), qgis-deployment-toolbelt (0.36.1) potentially affected by unknown CVE via dulwich (0.22.6)

dulwich PYPI version 0.22.6 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - grimoirelab =1.9.0rc1, =1.9.0 - qgis-deployment-toolbelt 0.36.1 Source cves: unknown CVE Source advisory: OSV:GHSA-8MCX-5RQC-VHMF...

aptos-verify (1.0.4), kit-big-data-to-do-list (>=1.1.0, <=1.3.0) +3 more potentially affected by unknown CVE via dulwich (0.21.6)

dulwich PYPI version 0.21.6 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - aptos-verify 1.0.4 - kit-big-data-to-do-list =1.1.0, =0.103.0, =0.27.0, =1.0.0, =1.3.1 Source cves: unknown CVE Source advisory:...

grimoirelab (>=1.6.0rc1, <=1.7.0), qgis-deployment-toolbelt (>=0.34.5, <=0.36.0) +2 more potentially affected by unknown CVE via dulwich (0.22.1)

dulwich PYPI version 0.22.1 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - grimoirelab =1.6.0rc1, =0.34.5, =0.6.0rc3, =0.1.0, =0.3.4 Source cves: unknown CVE Source advisory: OSV:GHSA-35MR-4567-66VG...

perceval-mozilla (>=0.3.2rc1, <=0.3.2rc2), qgis-deployment-toolbelt (>=0.8.0, <=0.10.0) potentially affected by unknown CVE via dulwich (0.20.35)

dulwich PYPI version 0.20.35 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - perceval-mozilla =0.3.2rc1, =0.8.0, =0.10.0 Source cves: unknown CVE Source advisory: OSV:GHSA-35MR-4567-66VG...