CVE-2026-102242

The Google MCP Toolbox for Databases (versions 1.2.0 through 1.9.0 ) is vulnerable to a path traversal flaw due to improper link resolution (CWE-59 / CWE-22 ) in the allowedLocalRoots path validation. Because the system performs lexical path validation without first resolving symbolic links , a r...

CVE-2026-102242 Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databases

Improper link resolution CWE-59 / CWE-22 in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path...

CVE-2026-102242 Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databases

Improper link resolution CWE-59 / CWE-22 in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path...

CVE-2026-102242 Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databases

Improper link resolution CWE-59 / CWE-22 in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path...

CVE-2026-102242: Improper Link Resolution Before File Access

Improper link resolution CWE-59 / CWE-22 in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path...

PT-2026-102751

Improper link resolution CWE-59 / CWE-22 in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path...

CVE-2025-14814

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and including, 12.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

EUVD-2025-211000

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and including, 12.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-14814 CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via cjtoolbox Shortcode

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and including, 12.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-14814 CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via cjtoolbox Shortcode

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and including, 12.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-14814

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 12.0.6 . The root cause is insufficient input sanitization and output escaping on user-supplied attributes within the cjtoolbox shortcode . This allows authenti...

PT-2026-98348

Name of the Vulnerable Software and Affected Versions CSS & JavaScript Toolbox versions prior to 12.0.7 Description Stored Cross-Site Scripting occurs via the cjtoolbox shortcode due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with...

CVE-2025-14814: Improper Neutralization of Input During Web Page Generation

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and including, 12.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

@bsv/amountinator (0.2.12), @bsv/cars-cli (>=1.2.0, <=1.2.9) +8 more potentially affected by CVE-2026-56744 via @bsv/wallet-toolbox-client (1.8.3)

@bsv/wallet-toolbox-client NPM version 1.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on @bsv/wallet-toolbox-client and may be impacted: - @bsv/amountinator 0.2.12 - @bsv/cars-cli =1.2.0, =1.2.0, =1.0.0, =0.0.1, =0.2.1, =0.1.0, =0.0.3, =1.1.5,...

@1sat/actions (>=0.0.173, <=0.0.190), @1sat/cli (>=0.0.75, <=0.0.90) +21 more potentially affected by CVE-2026-56744 via @bsv/wallet-toolbox (>=1.8.3, <=2.1.24)

@bsv/wallet-toolbox NPM version =1.8.3, =0.0.173, =0.0.75, =0.0.42, =0.0.74, =0.0.34, =0.0.30, =0.0.71, =0.0.70, =0.0.3, =0.0.75, =0.0.56, =0.0.47, =0.0.25, =0.0.1, =0.0.6 and more Source cves: CVE-2026-56744 Source advisory: OSV:GHSA-36F9-7RG5-CPF8...

`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction

Reported by @echennells Eric Chennells. Migrated from public issue 191 to a private advisory. Affected: @bsv/wallet-toolbox / -client / -mobile. Verified in 2.1.21 and 2.1.21-parity-fix.2; the relevant code is the same at current HEAD Summary: When createAction runs against a remote StorageClient...

GHSA-36F9-7RG5-CPF8 `@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction

Reported by @echennells Eric Chennells. Migrated from public issue 191 to a private advisory. Affected: @bsv/wallet-toolbox / -client / -mobile. Verified in 2.1.21 and 2.1.21-parity-fix.2; the relevant code is the same at current HEAD Summary: When createAction runs against a remote StorageClient...

CVE-2026-56744

@bsv/wallet-toolbox provides BRC-100 wallet signing and storage components, while @bsv/wallet-toolbox-client and @bsv/wallet-toolbox-mobile provide client-focused distributions for standard and mobile applications using wallet storage services. A vulnerability in these packages causes transaction...

CVE-2026-56744 `@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction (can redirect payments when using remote storage)

@bsv/wallet-toolbox provides BRC-100 wallet signing and storage components, while @bsv/wallet-toolbox-client and @bsv/wallet-toolbox-mobile provide client-focused distributions for standard and mobile applications using wallet storage services. A vulnerability in these packages causes transaction...

CVE-2026-56744 `@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction (can redirect payments when using remote storage)

@bsv/wallet-toolbox provides BRC-100 wallet signing and storage components, while @bsv/wallet-toolbox-client and @bsv/wallet-toolbox-mobile provide client-focused distributions for standard and mobile applications using wallet storage services. A vulnerability in these packages causes transaction...