Malware in local-commander-agent

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory

Summary The Kubeflow Pipelines API server decompresses uploaded pipeline archives without adequately bounding expanded data in affected versions. A small ZIP or gzip-compressed tar archive can consume disproportionately large amounts of memory while the server locates or reads the pipeline file,...

Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs

Summary The Kubeflow Pipelines API server's GET /apis/v1alpha1/runs/runid/nodes/nodeid/log handler retrieves logs without authorizing the caller against the selected run. A caller who can reach the backend and knows a victim run ID and a suitable pod or node identifier can read live or archived...

pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires opening an incomplete file without a trailer. Patches This has been fixed in pypdf==6.21.4. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4289...

pypdf has possible large memory usage when parsing page tree

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the page tree with many shared resources. Patches This has been fixed in pypdf==6.21.4. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4290...

pypdf has possible infinite loop when cloning dictionaries

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires cloning/duplicating a DictionaryObject. Patches This has been fixed in pypdf==6.21.4. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4288...

joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service

Summary Joi.string.email multiple: true takes quadratic time to split a value that contains a long run of whitespace. One request with 100 KB of spaces blocks the Node.js event loop for several seconds, which causes a denial of service. Details When the multiple option is set, the email rule spli...

@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

Summary Content.disposition takes quadratic time when a Content-Disposition parameter contains a long token without =. One unauthenticated multipart request can block the Node.js event loop for several minutes. Details Content.disposition reads the parameters with a global regular expression in...

minimatch has potential denial of service via globparts amplification

minimatch 10.2.6 contains an attacker-controlled pattern amplification in firstPhasePreProcess when optimizationLevel = 2. researcher: Reid Downing b1nv0id files: - src/index.ts: 690-770 - src/index.ts: 780-796 issue: input-controlled growth of globParts during first-phase preprocessing, followed...

Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal

Summary In glob 13.0.6, an aborted async walk rejects or emits an error but continues recursively reading directories in the background. The root cause is that abort branches in src/walker.ts call cb without returning. As a result, callers that rely on signal or AbortSignal.timeout to bound glob...

Authlib RFC 7592 examples omit registration-access-token client binding

Description Summary RFC 7592 OAuth 2.0 Dynamic Client Registration Management Protocol lets a previously registered client read, update, or delete its own registration, authenticated by a registrationaccesstoken issued specifically to that client at registration time. The entire security model of...

pypdf has possible long runtimes when retrieving page labels

Impact An attacker who uses this vulnerability can craft a PDF which leads to large runtimes. This requires retrieving the page labels of a file. Patches This has been fixed in pypdf==6.21.3. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4251...

pypdf has possible large memory usage for exceptions in strict mode

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading an invalid dictionary. Patches This has been fixed in pypdf==6.21.3. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4265...

pypdf has possible long runtimes/large memory usage for encrypted PDF files

Impact An attacker who uses this vulnerability can craft a PDF which leads to large runtimes/memory usage. This requires accessing the page count of an encrypted PDF file, which itself declares a wrong /Count value. Patches This has been fixed in pypdf==6.21.3. Workarounds If you cannot upgrade...

pypdf has possible large memory usage when parsing cross-reference streams

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires opening a file with cross-reference streams. Patches This has been fixed in pypdf==6.21.3. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4269...

pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding

Summary In pyasn1 through 0.6.4, decoding a constructed BIT STRING with many fragments repeatedly shifts and copies the entire value accumulated so far. For fixed-size fragments, CPU time grows quadratically with the encoded input size. An application that passes sufficiently large,...

pyasn1 has quadratic-complexity denial of service in binary REAL decoding

Summary In pyasn1 0.6.4 and earlier, decoding a binary-encoded ASN.1 REAL with a large mantissa can consume CPU time quadratic in the mantissa length. The BER, CER, and DER decoders all use the affected RealPayloadDecoder. An application is exposed when it passes attacker-controlled ASN.1...

pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding

Summary In pyasn1 0.6.4 and earlier, decoding a constructed OCTET STRING or character string made of many fragments can spend disproportionate CPU time repeatedly copying the accumulated value. A separate indefinite-length ANY path has the same problem while collecting the encoded components. The...

pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding

Summary When an application decodes attacker-controlled BER, CER, or DER data without an ASN.1 schema, a container with many distinct long tag IDs can cause quadratic CPU use. Repeated inputs can exhaust CPU and reduce service availability. Details...

Forge: ASN.1 OID first arc truncation in asn1.oidToDer

Summary asn1.oidToDer did not range-check the first two arcs of an OID string, so an OID such as 0.42.840.113549.1.1.1 or 4294977127.18.840.113549.1.1.1 was encoded as the DER of a different OID here rsaEncryption, 1.2.840.113549.1.1.1. This is an incomplete fix of CVE-2025-66030. Fixed in...

Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie

Summary The forge.http client stored cookies from Set-Cookie response headers in a plain object keyed by cookie name and path. A malicious server could use the cookie name proto to add properties to Object.prototype, use inherited names such as constructor to add properties to Object, and send an...

Forge: TLS client crash when the server sends no certificate

Summary The forge TLS client's check for a missing server certificate read the wrong property and never ran. A malicious TLS server, or an on-path attacker who removes the server's Certificate message, can make connection.process throw a TypeError, which crashes applications that use the forge TL...

Forge: Regular expression denial of service in PEM decoding (pem.decode)

Summary pem.decode, which every node-forge API that parses PEM input uses, split messages with a regular expression that takes polynomial time on input without a matching END line, and parsed encapsulated headers with regular expressions that take quadratic time on long header lines. A remote...

Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)

Summary BigInteger.prototype.modInverse in node-forge's bundled jsbn library enters an infinite loop when the value or the modulus is negative, for example when a negative public exponent is passed to forge.pki.rsa.generateKeyPair. This is an incomplete fix of CVE-2026-33891 GHSA-5m6q-g25r-mvwx,...

Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store

Summary When a CA store created by pki.createCaStore holds two or more certificates with the same subject name, pki.verifyCertificateChain permanently removes those certificates from the store while trying each one as the issuer. A peer can send any certificate that names that subject as its issu...

Forge: AES-GCM authentication bypass via unvalidated tagLength option

Summary The AES-GCM mode in forge.cipher does not validate the tagLength option passed to start. With a tagLength of 0 or a value that converts to 0 such as null, false, '' or '0', the authentication tag is empty, and decipher.finish returns true for any ciphertext and additional data when the...

Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count

Summary forge.pkcs12.pkcs12FromAsn1 accepts a PKCS12 MAC iteration count of zero or less from the input, and the PKCS12 key derivation function then returns a constant key that does not depend on the password or salt. An attacker who does not know the password can modify a PKCS12/PFX file and...

Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message

Summary A connection created with forge.tls.createConnection throws an uncaught TypeError from process when it receives a record of another content type while waiting for the rest of a handshake message that was split across records. A peer can trigger this with 18 bytes before the handshake,...

Forge: Denial of service in TLS record processing via call stack exhaustion

Summary Connections created with forge.tls.createConnection processed received TLS records recursively, one stack level per record. A peer can send one chunk of thousands of small records, such as heartbeat records, which are accepted before the handshake, and process throws RangeError: Maximum...

Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13

Summary node-forge parses certificate extensions with the deprecated OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and forge.pki.verifyCertificateChain used the first extension with that name. A certificate with a forged deprecated-OID extension cA TRUE before its genuine basicConstraints...

PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling

Summary When PHPT tests are run with code coverage, PHPUnit 13.4.0 to 13.4.3 writes the code of each PHPT test to a directory with a fixed name below the operating system's path used for temporary files, for instance /tmp/phpunit-phpt on Linux, and executes it from there. PHPUnit uses this...

Nuxt dev server exposes generated appSecret through Vite file serving

Impact When no appSecret is configured via NUXTAPPSECRET, NITROAPPSECRET or runtimeConfig.appSecret, nuxt dev generates a development secret and stores it in /app-secret by default .nuxt/app-secret. The build directory is inside the directories that Nuxt passes to Vite's server.fs.allow, so the...

Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes

Summary Since 4.6.0, Nuxt resolves . and .. segments in the request path, including percent-encoded forms such as %2e, before rendering a page. Nitro's routing, Nitro's route rules and server/middleware see the path with those segments still in place. A request for /%2e/admin therefore renders th...

Nuxt dev server arbitrary file read through client error reports

Summary A client that can connect to the dev server's HMR socket can send a nuxt:dev:client-error event whose message ends in an absolute file path. The dev server reads that file while building the error report, and its contents are returned in the error overlay, on the dev error channel, and in...

Nuxt dev server exposes private runtime config through the Nitro dev bundle

Summary With Nitro 2 the default server engine in Nuxt 3 and Nuxt 4, the Nitro development server bundle written by nuxt dev can be fetched through the Vite dev server. Nitro inlines the resolved runtimeConfig into that bundle, so private runtime config values that were resolved at build time can...

@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location

Summary @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location Affected versions and vulnerable location - Confirmed on sigstore-js at 3a83271 current HEAD. - File: packages/oci/src/registry.ts. - signIn installs the credential as a DEFAULT header on the shared...

MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets

Summary MariaDB Connector/J sized heap allocations from lengths declared by the server in OK packets before checking that those lengths fit in the packet. A rogue or MitM server can make the client allocate megabytes from a packet of a few bytes. Details When CLIENTSESSIONTRACK is negotiated the...

MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths

Summary MariaDB Connector/J narrowed 8-byte length-encoded integers received from the server to int without validation. A rogue or MitM server can send a value above Integer.MAXVALUE whose truncation becomes a negative or arbitrary length. Details The protocol encodes lengths as length-encoded...

MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths

Summary XAResource.recover in MariaDB Connector/J trusted the gtridlength and bquallength columns returned by XA RECOVER to allocate and split each Xid. Details MariaDbPoolConnection and MariaDbPoolPinnedConnection built each Xid of the recovery list by allocating new bytegtridlength and new...

MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files

Summary MariaDB Connector/J checked a server's LOAD DATA LOCAL INFILE file request by searching the text of the command it had sent for LOAD DATA LOCAL INFILE ''. The search also matched inside quoted identifiers, string literals and comments, so text returned by the server and re-used in a later...

MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing

Summary MariaDB Connector/J decodes every result as UTF-8 and guards charactersetclient against a change to another charset, but did not guard charactersetresults, and relied on the server's global sessiontracksystemvariables list to be told about charset changes at all. Details The connector...

follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects

Summary follow-redirects 1.16.0 and 1.16.1 validate the documented sensitiveHeaders option with instanceof Array. An array created in another JavaScript realm is silently replaced with an empty list, so a caller-declared custom credential header can be forwarded to an attacker-controlled...

russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation

Summary The agent server in russh::keys::agent::server never calls Agent::confirm before signing with a key that was added with the confirm constraint. That constraint is SSHAGENTCONSTRAINCONFIRM RFC 9987 §5.2.7.2, which is what ssh-add -c sends. The call was replaced by a hard-coded true in...

pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)

Summary pageant::PageantStream reads a 4-byte big-endian length prefix from its input stream and buffers until len + 4 bytes are available, without ever validating len. The underlying WMCOPYDATA transport physically cannot carry frames larger than 8 KiB AGENTMAXMSGLEN, the fixed-size shared memor...

russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)

Summary A peer can advertise maximum packet size = 0 in its channel-open message CHANNELOPEN when attacking a server, CHANNELOPENCONFIRMATION when attacking a client. russh accepts the value without validation and copies it into the channel write state, where it caps the size of every outgoing da...

russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages

Summary All evidence, reproduction steps, and scripts in the report were verified against a real running instance. Nothing is fabricated or synthetic; every verdict is backed by captured output from an actual deployment. The SSH agent server that ships with russh russh::keys::agent::server::serve...

russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets

Summary All evidence, reproduction steps, and scripts in the report were verified against a real running instance. Nothing is fabricated or synthetic; every verdict is backed by captured output from an actual deployment. Concretely, the evidence comes from executing the real russh v0.64.1 client...

GraphQL-core has denial of service via memory leak in aborted validations

Summary When a validation was aborted because the document contained more errors than allowed by maxerrors 100 by default, validate raised a single module-level ValidationAbortedError instance. Python appends the frames of every raise to the existing traceback of an exception that is raised again...

OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client

Summary OAuthlib's token grant handlers can authenticate one client while authorizing the grant type and requested scopes using a different, attacker-supplied clientid from the request body. In affected token grant flows, authenticateclientrequest sets request.client to the authenticated client...

OpenWISP Controller CA CRL REST API does not scope requests to managed organizations

Summary The authenticated REST API endpoint for downloading a CA Certificate Revocation List resolves the requested CA without applying the organization-scoped queryset used by the rest of the PKI API. An organization manager with CA view permission can request another organization's sequential C...