CVE-2026-13723 Develar's electron-builder allows arbitrary file overwrite

A vulnerability in the zipx.Unzip extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalization Collision combined with symlink following behavior. APFS treats certain Unicode equivalent filenames as identical e.g.,...

CVE-2026-13723

A vulnerability in the zipx.Unzip extraction routine of Develar's app-builder (a tool used in the Electron ecosystem) allows an attacker to overwrite arbitrary files on macOS systems using the APFS file system. The root cause is a combination of Unicode Normalization Collisions and unsafe symlink...

CVE-2026-13723: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in the zipx.Unzip extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalization Collision combined with symlink following behavior. APFS treats certain Unicode equivalent filenames as identical e.g.,...

PT-2026-65851

A vulnerability in the zipx.Unzip extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalization Collision combined with symlink following behavior. APFS treats certain Unicode equivalent filenames as identical e.g.,...

Arbitrary File Overwrite in Develar app-builder (zipx.Unzip) via Symlink Following on macOS (APFS)

Overview A vulnerability in the zipx.Unzip extraction routine of Develar’s app-builder allows an attacker to overwrite arbitrary files on macOS using Apple File System APFS. The issue arises from a combination of Unicode normalization collisions and unsafe symlink-following behavior. APFS treats...

SUSE-SU-2026:3300-1 Security update for ignition

This update for ignition fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266606. - CVE-2026-56852: golang.org/x/text/unicode/norm: handling of input containing invali...

openSUSE 16 Security Update : distribution (openSUSE-SU-2026:21441-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21441-1 advisory. This update for distribution fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded...

SUSE-SU-2026:22945-1 Security update for distribution

This update for distribution fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266629. - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on...

Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

Summary The default email-address normalizer used by the email/magic-link sign-in flow validates the address before applying Unicode normalization. An address can contain a Unicode character that is not an ASCII @ U+0040 but canonicalizes to one under NFKC/NFKD normalization the normalization...

GHSA-7RQJ-J65F-68WH Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

Summary The default email-address normalizer used by the email/magic-link sign-in flow validates the address before applying Unicode normalization. An address can contain a Unicode character that is not an ASCII @ U+0040 but canonicalizes to one under NFKC/NFKD normalization the normalization...

PT-2026-71919

Name of the Vulnerable Software and Affected Versions @auth/core versions prior to 0.41.3 next-auth versions prior to 4.24.15 next-auth versions prior to 5.0.0-beta.32 Description The defaultNormalizer used in the email and magic-link sign-in flow validates an email address before applying Unicod...

GHSA-H35F-9H28-MQ5C setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

Summary When building a source distribution python -m build --sdist / setup.py sdist, setuptools' FileList applies MANIFEST.in directives exclude, global-exclude, recursive-exclude, prune by matching a compiled glob against on-disk file names byte-for-byte, with no Unicode normalization. On...

EUVD-2026-42323

setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision NFC/NFD on macOS APFS/HFS+...

setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

Summary When building a source distribution python -m build --sdist / setup.py sdist, setuptools' FileList applies MANIFEST.in directives exclude, global-exclude, recursive-exclude, prune by matching a compiled glob against on-disk file names byte-for-byte, with no Unicode normalization. On...

Amazon Linux 2023 : python3.13, python3.13-devel, python3.13-freethreading (ALAS2023-2026-1910)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1910 advisory. tarfile.extractall with the 'data' or 'tar'filter could be bypassed by a crafted archive where a hardlinkreferences a symlink stored at a deeper name than the hardlink itself.The extraction...

BIT-SETUPTOOLS-2026-59890 setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unico...

PT-2026-58929

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unico...

setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

...

CVE-2026-59890

A flaw was found in setuptools, a Python package management tool. The FileList component, responsible for handling file exclusions, did not properly normalize Unicode file names when applying exclusion rules. This oversight could allow a specially crafted file name, using a different Unicode...

SUSE CVE-2026-59890

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unico...