CVE-2026-85687

surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw filepath parameters. Attackers can read any image or PDF file on the host by supplying arbitrary file paths to Image.open or pypdfium2.PdfDocument,...

CVE-2026-85687 surya 0.22.1 Unauthenticated Arbitrary File Read via screenshot server

surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw filepath parameters. Attackers can read any image or PDF file on the host by supplying arbitrary file paths to Image.open or pypdfium2.PdfDocument,...

CVE-2026-85687 surya 0.22.1 Unauthenticated Arbitrary File Read via screenshot server

surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw filepath parameters. Attackers can read any image or PDF file on the host by supplying arbitrary file paths to Image.open or pypdfium2.PdfDocument,...

EUVD-2026-71136

surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw filepath parameters. Attackers can read any image or PDF file on the host by supplying arbitrary file paths to Image.open or pypdfium2.PdfDocument,...

CVE-2026-85687

CVE-2026-85687 affects the surya 0.22.1 screenshot server, where the /info, /page, and /process routes accept raw file_path parameters without validation. The unsanitized paths are passed directly to Image.open or pypdfium2.PdfDocument , allowing an unauthenticated attacker to read any image or P...

CVE-2026-85687 surya 0.22.1 Unauthenticated Arbitrary File Read via screenshot server

surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw filepath parameters. Attackers can read any image or PDF file on the host by supplying arbitrary file paths to Image.open or pypdfium2.PdfDocument,...

PT-2026-85573

surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw file path parameters. Attackers can read any image or PDF file on the host by supplying arbitrary file paths to Image.open or pypdfium2.PdfDocument...

CVE-2026-85687: External Control of File Name or Path

surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw filepath parameters. Attackers can read any image or PDF file on the host by supplying arbitrary file paths to Image.open or pypdfium2.PdfDocument,...

Malicious code in surya-bubursumsum5-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a3c2ac2da93b636fcc97e37abce1fe9b443d5b7a79e0072ce0d27ba62414d89 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in surya-wajit45-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ea9fb81da8c2d89600399da9dfcb721d2637a09f2329ce85e477f3049cac567 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in surya-rawon26-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f2a6ab866b89a8f2c281b993c1b9a8d5f95d6fbd819e6b69abf503c9eb21ce0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in surya-toge39-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 570824d6dba0565376c74d4c1f60ecf5f29249b6db6066bf0cac31e1853e8338 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in surya-ubi57-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d9f4d0b222a64f2deb26d3a6423e7d136ffa6d2c6414c0e51a8d4fe18966151 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in surya-mendoan2-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1092b6220aa9f7b638b4f4f2c7016af849585cb1874290a71df43e1ba2072be This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in surya-gandul42-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7b23526d62eaf6a3e098e425d442e617a1cc1145fe02d7d662bcbfa0416af89 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-137128 Malicious code in surya-gandul42-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7b23526d62eaf6a3e098e425d442e617a1cc1145fe02d7d662bcbfa0416af89 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-137143 Malicious code in surya-kue57-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01de45c37a50c002e963ec4e1f58af7a378ba0e1699b5ed6cfe747f2037d271f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-137172 Malicious code in surya-tempe11-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d58200ca292d4680287bb390ded4f73cfdc1c4b6c4ec42d8ca9cd5f78b3b40d2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-137132 Malicious code in surya-jus22-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c6735da0bb63f702728090ff88be2bdd7dac6763a947993b9b6d00411dd629c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-137176 Malicious code in surya-toge39-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 570824d6dba0565376c74d4c1f60ecf5f29249b6db6066bf0cac31e1853e8338 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...