Malicious code in formatting-subtitles (npm)

Source: amazon-inspector 25577370189f57a5678b2f2c45e212abfc79a3675dc7d51581f633e78aba47a6 package.json declares preinstall: sh./prepare.js && exit 0. prepare.js is shaped like JavaScript ending with console.log'hello world' but is executed by /bin/sh, which does not treat /... / as a comment...

Malicious Package

Overview formatting-subtitles is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-18184 Malicious code in formatting-subtitles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25577370189f57a5678b2f2c45e212abfc79a3675dc7d51581f633e78aba47a6 package.json declares preinstall: sh./prepare.js && exit 0. prepare.js is shaped like JavaScript ending with console.log'hello world' but is executed...

Malicious code in formatting-subtitles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25577370189f57a5678b2f2c45e212abfc79a3675dc7d51581f633e78aba47a6 package.json declares preinstall: sh./prepare.js && exit 0. prepare.js is shaped like JavaScript ending with console.log'hello world' but is executed...

Malware in formatting-subtitles-for-claude

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-18099 Malicious code in formatting-subtitles-for-claude (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f683c00ef9c42d55e37cdb367179f21e58ce2441dba55485d6d19670bcefa700 The package declares a postinstall hook sh./nodemodules/unicode-title-normalizer/x.js && exit 0, which runs arbitrary shell content shipped by the...

Malicious code in formatting-subtitles-for-claude (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f683c00ef9c42d55e37cdb367179f21e58ce2441dba55485d6d19670bcefa700 The package declares a postinstall hook sh./nodemodules/unicode-title-normalizer/x.js && exit 0, which runs arbitrary shell content shipped by the...

Malicious Package

Overview formatting-subtitles-for-claude is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

xqq libaribcaption buffer error vulnerability

The xqq libaribcaption version 1.1.0 to 1.1.2 contains a buffer error vulnerability. This vulnerability stems from the global out-of-bounds read in DecoderImpl::HandleGLGR. No upper-bound checks were performed on the kLatinSpecialTable, resulting in reading beyond the boundaries of 78 tables...

Rocky Linux 9.6 [TuxCare] Security Update: gstreamer1-plugins-bad-free / gstreamer1-plugins-bad-free-devel / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1777970873)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777970873 advisory. - GStreamer DVB Subtitles Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to...

AlmaLinux 9.6 [TuxCare] Security Update: gstreamer1-plugins-bad-free / gstreamer1-plugins-bad-free-devel / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1777970873)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777970873 advisory. - GStreamer DVB Subtitles Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to...

Rocky Linux 10.1 [CIQ] Security Update: gstreamer1-plugins-bad-free / gstreamer1-plugins-bad-free-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_6259)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20266259 advisory. GStreamer: GStreamer: Arbitrary code execution via ASF file processing CVE-2026-2920 GStreamer: GStreamer: Remote Code Execution via heap-based buffer...

Rocky Linux 8 [CIQ] Security Update: gstreamer1-plugins-bad-free / gstreamer1-plugins-bad-free-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_6750)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20266750 advisory. GStreamer: GStreamer: Arbitrary code execution via ASF file processing CVE-2026-2920 GStreamer: GStreamer: Remote Code Execution via heap-based buffer...

Astra Linux – Vulnerability in gst-plugins-base1.0

GStreamer PGS File Parsing: Heap-Based Buffer Overflow and Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability, but the attack...

NewStart CGSL MAIN 7.02 : gstreamer1-plugins-base Vulnerability (NS-SA-2026-0099)

The remote NewStart CGSL host, running version MAIN 7.02, has gstreamer1-plugins-base packages installed that are affected by a vulnerability: - GStreamer DVB Subtitles Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on...

[SECURITY] [DLA 4769-1] libass security update

Debian LTS Advisory DLA-4769-1 [email protected] https://www.debian.org/lts/security/ Daniel Leidert September 02, 2026 https://wiki.debian.org/LTS Package : libass Version : 1:0.17.1-1+deb12u1 CVE ID : CVE-2026-61627 A vulnerability has been found in libass, a library for SSA/ASS...

SUSE CVE-2026-70628

FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsubparser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard...

JLSEC-2026-1187 FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write...

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vfquirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose seco...

FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files

Summary The subtitlesHandler endpoint GET /api/media/subtitles accepts two user-controlled query parameters: path and name, both of which are used in filesystem operations without sanitization, creating two independent path traversal vectors. The primary vector is the path parameter: it is passed...

GHSA-VVP7-H4FJ-M28W FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files

Summary The subtitlesHandler endpoint GET /api/media/subtitles accepts two user-controlled query parameters: path and name, both of which are used in filesystem operations without sanitization, creating two independent path traversal vectors. The primary vector is the path parameter: it is passed...