CVE-2026-85687

surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw filepath parameters. Attackers can read any image or PDF file on the host by supplying arbitrary file paths to Image.open or pypdfium2.PdfDocument,...

CVE-2026-85687 surya 0.22.1 Unauthenticated Arbitrary File Read via screenshot server

surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw filepath parameters. Attackers can read any image or PDF file on the host by supplying arbitrary file paths to Image.open or pypdfium2.PdfDocument,...

CVE-2026-85687

CVE-2026-85687 affects the surya 0.22.1 screenshot server, where the /info, /page, and /process routes accept raw file_path parameters without validation. The unsanitized paths are passed directly to Image.open or pypdfium2.PdfDocument , allowing an unauthenticated attacker to read any image or P...

EUVD-2026-71136

surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw filepath parameters. Attackers can read any image or PDF file on the host by supplying arbitrary file paths to Image.open or pypdfium2.PdfDocument,...

Malicious code in surya-rendang61-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc1f544f92b819743395e0336b8cc22f6750d1f2ca7fe6b652b9159ba270a011 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in surya-wajit45-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ea9fb81da8c2d89600399da9dfcb721d2637a09f2329ce85e477f3049cac567 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in surya-enting57-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 712fe9b5d9e426611ea29626a79e123f3f329fcc5d1c884c6438242fca7a8aa4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in surya-rawon26-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f2a6ab866b89a8f2c281b993c1b9a8d5f95d6fbd819e6b69abf503c9eb21ce0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-137128 Malicious code in surya-gandul42-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7b23526d62eaf6a3e098e425d442e617a1cc1145fe02d7d662bcbfa0416af89 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-137161 Malicious code in surya-rendang77-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e338c62e65f4209affef9c40235e57d8758e7363049c2ff2180860a551572e1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-137172 Malicious code in surya-tempe11-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d58200ca292d4680287bb390ded4f73cfdc1c4b6c4ec42d8ca9cd5f78b3b40d2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in surya-kupang86-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa8f755477764c78485d141c69c21adcf8a4e729e1505916d4c53948976bcf08 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in surya-rangi68-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37e25f6a73b512cb38c7799f88ff140e6e4273f3cb2301651ce3d9f6d88cb547 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in surya-ubi57-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d9f4d0b222a64f2deb26d3a6423e7d136ffa6d2c6414c0e51a8d4fe18966151 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in surya-toge39-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 570824d6dba0565376c74d4c1f60ecf5f29249b6db6066bf0cac31e1853e8338 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in surya-mendoan2-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1092b6220aa9f7b638b4f4f2c7016af849585cb1874290a71df43e1ba2072be This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in surya-klipo83-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db568da5d44e751ad00508c86f1f7ca531ce930be4b559d8efb653d6fa5a59e9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in surya-kue26-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a3a12920c299c1594c4b5eacd8494e3f8baee23a44f3d0af87ac936ec1ec05d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in surya-bubursumsum5-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a3c2ac2da93b636fcc97e37abce1fe9b443d5b7a79e0072ce0d27ba62414d89 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in surya-gandul42-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7b23526d62eaf6a3e098e425d442e617a1cc1145fe02d7d662bcbfa0416af89 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...