goshs has ACL Bypass & Path Traversal

Summary sendFile derives the served filename from the raw request path while opening the file from the cleaned path, so appending a trailing slash empties the derived name and defeats both the never-serve rule for the ACL file and the block list. Finding Medium: trailing-slash ACL and hidden-file...

GHSA-964W-F6GJ-5236 goshs has ACL Bypass & Path Traversal

Summary sendFile derives the served filename from the raw request path while opening the file from the cleaned path, so appending a trailing slash empties the derived name and defeats both the never-serve rule for the ACL file and the block list. Finding Medium: trailing-slash ACL and hidden-file...

CVE-2026-54659 Pagy I18n locale option is not validated before being used in a file path

Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as .yml path components, allowing untrusted params:locale values with absolute paths or ../ sequences to create a file...

CVE-2026-54659

Pagy (Ruby gem) contains a vulnerability in the I18n locale handling prior to 43.5.6: Pagy::I18n.locale= stores locale values verbatim and later uses them as .yml path components, enabling untrusted params[:locale] values with absolute paths or ../ sequences to probe file existence/readability of...

EUVD-2026-50088

Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as .yml path components, allowing untrusted params:locale values with absolute paths or ../ sequences to create a file...

CVE-2026-54659

Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as .yml path components, allowing untrusted params:locale values with absolute paths or ../ sequences to create a file...

GHSA-2XMW-F8J8-WFXC Pagy I18n locale option is not validated before being used in a file path

Summary Pagy::I18n.locale= did not validate its argument before using it as a path component to load the matching dictionary file .yml. An application that assigns untrusted input to the locale — e.g. the common pattern Pagy::I18n.locale = params:locale — let that input influence which file Pagy...

Pagy I18n locale option is not validated before being used in a file path

Summary Pagy::I18n.locale= did not validate its argument before using it as a path component to load the matching dictionary file .yml. An application that assigns untrusted input to the locale — e.g. the common pattern Pagy::I18n.locale = params:locale — let that input influence which file Pagy...

skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source

Impact skilo add installs a skill by recursively copying the skill directory into the target skills directory. The copy routine copydirall classified each entry with std::fs::DirEntry::filetype — which does not follow symlinks — and then copied non-directory entries with std::fs::copy, which does...

GHSA-6XX4-9WP6-65P7 skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source

Impact skilo add installs a skill by recursively copying the skill directory into the target skills directory. The copy routine copydirall classified each entry with std::fs::DirEntry::filetype — which does not follow symlinks — and then copied non-directory entries with std::fs::copy, which does...

GHSA-VJ5C-M527-MPFF Style Dictionary - Prototype Pollution in convertTokenData utility function

Impact Prototype pollution. A malicious user can create a token array key: 'proto.foo', value: 'malicious' , when processed by convertTokenData utility function, it will pollute the Object.prototype globally where .foo will equal key: 'proto.foo', value: 'malicious' . This has been confirmed with...

EUVD-2026-38640

Style Dictionary - Prototype Pollution in convertTokenData utility function...

NPM: Style Dictionary - Prototype Pollution in convertTokenData utility function

Prototype Pollution in convertTokenData utility function vulnerability discovered by ? in WordPress Npm style-dictionary versions = 4.3.0, 5.4.4...

Style Dictionary - Prototype Pollution in convertTokenData utility function

Impact Prototype pollution. A malicious user can create a token array key: 'proto.foo', value: 'malicious' , when processed by convertTokenData utility function, it will pollute the Object.prototype globally where .foo will equal key: 'proto.foo', value: 'malicious' . This has been confirmed with...

openhole-server vulnerable to path traversal via URL-decoded request path

Summary openhole-server forwarded the URL-decoded request path r.URL.Path to tunnel clients instead of the original request-target. Percent-encoded dot-segments %2e and separators %2f were decoded to ../ and / before reaching the local service. Go's ServeMux rejects literal ../ paths, but...

GHSA-FH2F-XFXC-Q9CC openhole-server vulnerable to path traversal via URL-decoded request path

Summary openhole-server forwarded the URL-decoded request path r.URL.Path to tunnel clients instead of the original request-target. Percent-encoded dot-segments %2e and separators %2f were decoded to ../ and / before reaching the local service. Go's ServeMux rejects literal ../ paths, but...

CVE-2026-54650 openhole-server vulnerable to path traversal via URL-decoded request path

openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/publicproxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath, allowing percent encoded dot segments %2e and separators %2f to reach...

CVE-2026-54650

CVE-2026-54650 describes a path traversal vulnerability in openhole-server prior to 0.1.2. In 0.1.1 and earlier, internal/server/public_proxy.go forwarded the request using r.URL.Path instead of preserving the original target via r.URL.EscapedPath(). This allowed percent-encoded dot segments (%2e...

EUVD-2026-50087

openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/publicproxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath, allowing percent encoded dot segments %2e and separators %2f to reach...

CVE-2026-54650

openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/publicproxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath, allowing percent encoded dot segments %2e and separators %2f to reach...