r2web — Updated!

r2web: Access radare2 from anywhere, anytime. Overview r2web lets you run radare2 without local installs or platform hassles. Analyze files directly in your browser. It runs entirely client-side using radare2 WASI and Wasmer, with an xterm.js frontend for interactive command execution. 👉 Try it...

SUSE SLES12 Security Update : net-tools (SUSE-SU-2026:3222-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:3222-1 advisory. - CVE-2024-58251: denial of service via terminal escape sequences bsc1254323. Tenable has extracted the preceding description block directly from the...

GHSA-FWJX-9P69-H25H Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data

Summary Oh My Posh renders dynamic, potentially attacker-controlled strings the current directory name, Git commit metadata, environment variable values, command output into the prompt without neutralizing raw terminal control characters. An attacker who controls one of these values can inject...

Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes

Summary pheditor's terminal feature restricts callers to an allowlist of commands TERMINALCOMMANDS and rejects shell metacharacters. The allowlist is enforced as a PREFIX match with no argument validation, and the allowlist includes binaries that grant arbitrary command execution through their ow...

GHSA-G3HQ-HPHG-8FHH Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes

Summary pheditor's terminal feature restricts callers to an allowlist of commands TERMINALCOMMANDS and rejects shell metacharacters. The allowlist is enforced as a PREFIX match with no argument validation, and the allowlist includes binaries that grant arbitrary command execution through their ow...

Arbitrary Argument Injection

Overview Affected versions of this package are vulnerable to Arbitrary Argument Injection via the terminal process. An attacker can execute arbitrary commands on the host system by supplying crafted arguments to allowlisted binaries, bypassing command restrictions through argument injection. This...

open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

AI assistance was used to help inspect the code and prepare this report. Summary The fix for GHSA-r2wg-2mcr-66rv is incomplete in v0.9.6 and current main. backend/openwebui/routers/terminals.py documents sanitizeproxypath as decoding until stable, but the implementation stops after 8 unquote...

GHSA-FRVJ-C5QP-XJ4W open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

AI assistance was used to help inspect the code and prepare this report. Summary The fix for GHSA-r2wg-2mcr-66rv is incomplete in v0.9.6 and current main. backend/openwebui/routers/terminals.py documents sanitizeproxypath as decoding until stable, but the implementation stops after 8 unquote...

Server-side Request Forgery (SSRF)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the sanitizeproxypath process. An attacker can access unauthorized files or directories by submitting a specially crafted, deeply percent-encoded path parameter that bypass...

Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)

Summary The terminal proxy in backend/openwebui/routers/terminals.py forwards the Open WebUI user's identity to the upstream terminal server / backend coordinator as an authorization claim, with no cryptographic binding to the session that produced it. The forwarded identity is...

GHSA-J657-M4C4-24JQ Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)

Summary The terminal proxy in backend/openwebui/routers/terminals.py forwards the Open WebUI user's identity to the upstream terminal server / backend coordinator as an authorization claim, with no cryptographic binding to the session that produced it. The forwarded identity is...

User Impersonation

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to User Impersonation via the wsterminal process. An attacker can gain unauthorized access to another user's terminal session by injecting crafted values into the sessionid parameter, causing the backend to...

GHSA-855V-HQ7W-JMJW Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

Summary With Redis configured, Open WebUI supports JWT revocation: POST /api/v1/auths/signout per-token jti and OIDC back-channel logout per-user revokedat record revocations in Redis, and HTTP auth getcurrentuser rejects revoked tokens with 401. The realtime authentication surfaces do not perfor...

Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records

Summary A post-authentication denial-of-service panic in russh 0.62.2 commit c4be19f1915c8682f4615c3fd50008512b474491, current default branch main as of 2026-07-22. An authenticated client sends a pty-req channel request carrying more than 130 terminal-mode records. The parser uses a fixed...

GHSA-CQJC-RMPQ-XPRQ Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records

Summary A post-authentication denial-of-service panic in russh 0.62.2 commit c4be19f1915c8682f4615c3fd50008512b474491, current default branch main as of 2026-07-22. An authenticated client sends a pty-req channel request carrying more than 130 terminal-mode records. The parser uses a fixed...

PT-2026-71922

Name of the Vulnerable Software and Affected Versions Russh versions prior to 0.62.4 Description An authenticated SSH client can trigger a denial of service by sending a pty-req channel request containing more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs utilizes a...

PT-2026-67601

Summary Oh My Posh renders dynamic, potentially attacker-controlled strings the current directory name, Git commit metadata, environment variable values, command output into the prompt without neutralizing raw terminal control characters. An attacker who controls one of these values can inject...

PT-2026-67602

Summary pheditor's terminal feature restricts callers to an allowlist of commands TERMINAL COMMANDS and rejects shell metacharacters. The allowlist is enforced as a PREFIX match with no argument validation, and the allowlist includes binaries that grant arbitrary command execution through their o...

Security update for net-tools (low)

openSUSE security update: security update for net-tools ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21429-1 Rating: low References: bsc1254323 Cross-References: CVE-2024-58251 CVSS scores: CVE-2024-58251 SUSE : 2.8...

Security update for net-tools

This update for net-tools fixes the following issues: CVE-2024-58251: denial of service via terminal escape sequences bsc1254323. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the...