Malicious code in internal-renderers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 278909ae8921ad2d06b0c033a34470a00adb33d3853e3793c8d9c473a362ad1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18484 Malicious code in internal-renderers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 278909ae8921ad2d06b0c033a34470a00adb33d3853e3793c8d9c473a362ad1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in internal-renderers

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2026-116797

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers copy the cells.renderer.attributes and cells.editMode.renderer.attributes maps to input or select elements with raw setAttribute calls. An attacker who controls column...

CVE-2026-116797

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers copy the cells.renderer.attributes and cells.editMode.renderer.attributes maps to input or select elements with raw setAttribute calls. An attacker who controls column...

EUVD-2026-112281

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers copy the cells.renderer.attributes and cells.editMode.renderer.attributes maps to input or select elements with raw setAttribute calls. An attacker who controls column...

CVE-2026-118274

A vulnerability has been found in a2ui-project a2ui up to 0.10.6. Affected by this issue is some unknown functionality of the file renderers/webcore/src/v09/rendering/generic-binder.ts of the component Binder. The manipulation leads to resource consumption. The attack can be initiated remotely. T...

EUVD-2026-111537

A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the file renderers/webcore/src/v09/rendering/data-context.ts of the component data-context Resolver. Such manipulation leads to resource consumption. The attack may be performed from...

CVE-2026-118271

The a2ui-project a2ui library (versions up to 0.10.6 ) is vulnerable to a resource consumption vulnerability via the data-context Resolver component. The issue originates from an unknown function within the file renderers/web_core/src/v0_9/rendering/data-context.ts. This flaw allows for remote ma...

CVE-2026-116797: Improper Neutralization of Input During Web Page Generation

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers copy the cells.renderer.attributes and cells.editMode.renderer.attributes maps to input or select elements with raw setAttribute calls. An attacker who controls column...

PT-2026-129088

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers copy the cells.renderer.attributes and cells.editMode.renderer.attributes maps to input or select elements with raw setAttribute calls. An attacker who controls column...

A2UI information disclosure vulnerability

Versions A2UI 0.10.6 and earlier contain an information disclosure vulnerability. This vulnerability stems from improper handling of the DataContext.dispatchExpressionError function in the file renderers/webcore/src/v09/rendering/data-context.ts within the Error Handler component. As a result,...

PT-2026-105078

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was th...

CVE-2026-100640

SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote...

CVE-2026-100640 SiYuan before v3.8.4 Clipboard Data Disclosure via IPC

SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote...

CVE-2026-100640 SiYuan before v3.8.4 Clipboard Data Disclosure via IPC

SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote...

CVE-2026-100640 SiYuan before v3.8.4 Clipboard Data Disclosure via IPC

SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote...

CVE-2026-100640: Exposure of Sensitive Information to an Unauthorized Actor

SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote...

CVE-2026-91121

The Discourse open-source discussion platform is vulnerable to trusted-HTML injection in versions prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0 . The root cause is that attacker-controlled upload filenames used in chat message excerpts are rendered as unescaped HTML . An attacker capable of...

CVE-2026-92213: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/webcore/src/v09/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulation of the argument primaryColor results in injection. The attack is possible t...