Malware in @jasperquinn/postcss-motion-helpers

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in tailwind-animationlab

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in tailwind-keyframes

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in tailwindcss-animate-catalog

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in tailwindcss-keyframe-kit

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in bcxhdh1kjlopsde

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in cjlowuxbnexkhgpzq

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in mui-wrapper-x-date-pickers (npm)

mui-wrapper-x-date-pickers was published to npm on 2026-10-27 from 06:55:20 UTC by the account amahrou1w, about one minute after npm's staged-publish placeholder 0.0.0-stage, in versions 1.0.0, 10.0.0. The three packages mw-test-utils, mw-communication-client and mui-wrapper-x-date-pickers were...

Malicious code in spectral-net-probe (npm)

spectral-net-probe has no functional code. Versions 1.0.1 and 1.0.4 have a postinstall script that runs node index.js on npm install, which sends an HTTPS GET to a Cloudflare quick tunnel https://nobody-johnston-with-enabling.trycloudflare.com/aa?x=1 and...

Malicious code in @zmtcdn/components (npm)

@zmtcdn/[email protected] is a dependency-confusion package with an empty index.js and a description of "Security research PoC". Its postinstall script runs node postinstall.js on npm install, which POSTs the hostname, username, platform, working directory and the names of all environment...

Malicious code in @zmtcdn/ui (npm)

@zmtcdn/ui 9999.0.0 and 9999.0.7 are dependency-confusion packages with an empty index.js and a description of "Security research PoC". Their postinstall script runs node postinstall.js on npm install, which POSTs the hostname, username, platform, working directory and the names of all environmen...

Malicious code in identity-two-factor (npm)

[email protected] is a dependency-confusion package aimed at Coinbase its README and postinstall.js say so, and the beacon path is cbhq-canary with no functional code. Its postinstall script runs node postinstall.js on npm install, which writes a marker file to the temp directory and...

Malicious code in mw-communication-client (npm)

mw-communication-client was published to npm on 2026-10-27 from 06:55:13 UTC by the account amahrou1w, about one minute after npm's staged-publish placeholder 0.0.0-stage, in versions 10.0.0, 1.0.1. The three packages mw-test-utils, mw-communication-client and mui-wrapper-x-date-pickers were...

Malicious code in mw-test-utils (npm)

mw-test-utils was published to npm on 2026-10-27 from 06:56:36 UTC by the account amahrou1w, about one minute after npm's staged-publish placeholder 0.0.0-stage, in versions 1.0.0, 10.0.0, 10.0.1. The three packages mw-test-utils, mw-communication-client and mui-wrapper-x-date-pickers were...

Malware in dsh-volcengine-provider

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in dsh-redteam-mode

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in b20miner

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

Summary When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have already arrived without yielding to the event loop. A client can send a body made of millions of 1-byte chunks, which blocks the event loop and therefore every other connection serve...

Tornado: Open redirect in RedirectHandler via protocol-relative URLs

Summary tornado.web.RedirectHandler builds its target URL by substituting parts of the request path into a template. Depending on where those substitutions appear in the template, an attacker can craft a request that redirects to a host of their choosing. This creates an open redirect on the...

Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

Summary Tornado's HTTP header parser takes quadratic time On² when a header value is continued across many "obsolete line folding" obs-fold lines. An unauthenticated attacker can send a request whose header block is mostly short continuation lines. Parsing it uses a large amount of CPU on the...

Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass

Summary Crass's tokenizer didn't terminate a bad URL token at a that followed an escaped backslash \. As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked into passing...

systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks

Summary On Windows, [email protected] builds a PowerShell command using the value passed to services. The default sanitizer removes ASCII quotes but keeps Unicode curly quotes, spaces, and parentheses. A crafted service name can use those characters to break out of the generated filter...

Backstage catalog rules can be bypassed for URL locations using encoded path segments

Summary @backstage/plugin-catalog-backend matches URL-type locations against catalog.rules location patterns using the raw URL string submitted by the user, while URL readers resolve that same string in canonical form when fetching the location's content. A URL can therefore be crafted so that it...

Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it

Summary The main Electrum server the client connects to is trusted with mempool "unconfirmed" transactions. This is documented design. 0 However now someone figured out a way to practically exploit it: - when the client broadcasts a new tx1, a malicious server can swallow it, - and update the...

knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion

⚠️ Update verification, 2026-05-19: C-2 confirmed end-to-end — 4.5× amplification observed worse than the advisory's conservative 2× claim Built a Go PoC cmd/poc-c2/main.go that runs the exact 8-line vulnerable snippet from webhook/admission.go:109-117 verbatim under the same http.HandlerFunc shap...

Waline login accepts a non-string email as a match-all MongoDB query

Summary The login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string for example a JSON object such as "$ne": null, the MongoDB storage adapter's parseWhere silently DROPS...

Seroval: Code injection through a typed array's own constructor property

Summary seroval writes a typed array as a call to its constructor. In affected versions, the constructor name in the output is read from a property that data on the value can replace, and it is written without checks. A typed array that received properties from untrusted data can then put arbitra...

Seroval: Script injection through RegExp sources in serialized output

Summary seroval writes a RegExp as a regular expression literal. In affected versions, the element that the serialized output is placed in, and run script in the page. Details seroval escapes element. RegExp sources did not get the same escaping: - Versions before 1.0.0 wrote the source as is. -...

Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)

Summary fromJSON and fromCrossJSON used two node fields without checking them. - An array node's element list was not checked to be an array. A small payload could set the length the decoder looped over. This part is also tracked in GHSA-wp97-x4hv-qvhp. - A sequence node's done index was not...

Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

Summary fromJSON and fromCrossJSON did not check that an array node's element list is an array. A small crafted payload could set the length the decoder used. That length controlled how much memory was allocated and how many times the decoder looped, and it did not depend on the size of the...

Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check

Summary When fromJSON rebuilt an async iterator, it called on on the iterator's source without checking that the source was a seroval stream. A crafted payload could pick another value as the source, such as a function returned by an application plugin. The deserializer then called that value's o...

Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)

Summary buildsessionscope in mem0/memory/main.py builds the conversation-history scope key used to fetch/store the last N raw messages by naively joining caller-supplied userid/agentid/runid values with unescaped & and = delimiters: def buildsessionscopefilters: parts = for key in sorted"userid",...

Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim

Summary The generic OpenID Connect backend OpenIdConnectAuth and every backend built on it stores the nonce in the shared Association table, not in the user's session. When the ID token comes back, validateclaims only checks that the nonce exists in that table and is not expired. It does not chec...

ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank

Summary ONNX ConvTranspose shape inference performed an out-of-bounds read when the weight tensor had fewer than three dimensions and the model did not provide a kernelshape attribute. The inference function derived an empty effectivekernelshape vector from the undersized weight tensor, then...

ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs

Summary ONNX's Python tensor-materialization helpers could allocate memory according to attacker-controlled tensor dimensions without verifying that a packed sub-byte payload contained the declared number of elements. A very small model could therefore cause a disproportionately large allocation...

ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute

Summary ONNX shape inference did not safely validate the required Scan numscaninputs attribute. Two malformed values could terminate or disrupt the process: 1. If the attribute was missing, ctx.getAttribute"numscaninputs" returned null and was dereferenced. 2. If the attribute was negative,...

ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)

Summary ONNX shape inference performed an out-of-bounds read when processing a malformed RNN, GRU, or LSTM node from opsets 1–6 whose first input had a rank other than three. RNNShapeInferenceopset1to6 checked whether the input shape was present but accessed dim0 and dim1 without first checking i...

vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

Summary The OpenAI-compatible server registers Starlette CORSMiddleware with allowedorigins defaulting to "", and performs no authentication unless --api-key or VLLMAPIKEY is configured. A web page on any origin can send requests to a vLLM server that the victim's browser can reach for example...

vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine

Summary The Phi-4 multimodal audio encoder phi4mmaudio.py / phi4mmutils.py runs its conformer attention in eager mode by default: the official HF config of microsoft/Phi-4-multimodal-instruct does not set useptscaleddotproductattention, so the default False applies phi4mmaudio.py:166, :876;...

vLLM DeepSeek-OCR image processing vulnerable to denial of service

Summary Any vLLM deployment serving a model of the DeepSeek-OCR family — deepseek-ai/DeepSeek-OCR, deepseek-ai/DeepSeek-OCR-2, or baidu/Unlimited-OCR whose UnlimitedOCRForCausalLM subclasses DeepseekOCRForCausalLM — can be killed by a single unauthenticated chat request carrying an ordinary,...

vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE

Summary In vLLM 0.30.0, ImageMediaIO passes attacker-controlled image bytes to Pillow's format autodetection without restricting the accepted formats; the request's MIME label does not constrain decoder selection. An EPS payload labeled image/png reached the host's Ghostscript executable. On a ho...

vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM 0.32.0. Summary When --mm-processor-cache-type shm is enabled, vLLM's multimodal SHM cache represents a cached item with an address and monotonicid pair and treats that pair as authority to dereference shared memory in the worke...

vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)

For a model whose vocabulary size is an exact multiple of the embedding padding size 64 — e.g. any Llama-2-family model, vocab 32000 — a single request carrying a pre-tokenized prompt with token id equal to the vocab size 32000 passes vLLM's input-id validation but is one past the last embedding...

vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs

Summary vLLM's /v1/responses endpoint accepts request-level chattemplatekwargs, but does not apply the --trust-request-chat-template gate that protects Chat Completions, render, tokenize, and pooling paths. When the server is run with the documented default trustrequestchattemplate=False and no...

vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool

Summary vLLM renders chat templates by passing the resolved Jinja2 source to tokenizer.applychattemplate, which compiles and .renders it in an ImmutableSandboxedEnvironment. The sandbox prevents code-execution escapes but imposes no wall-clock timeout, no output-size cap, and no nested-loop or...

Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction

Summary When running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than 256k targets on one brtable instruction in a way that results in an incorrect conditional branch target. This conditional branch could then jump to arbitrary other code...

Go JOSE: Panics in JSON parsing

Summary Parsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash. Note: this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4. Impact Denial of service vulnerability. Any application that parses untrusted JS...

Go JOSE: Panic during CBC-HMAC processing

Summary Decrypting a ciphertext with "A128CBC-HS256", "A192CBC-HS384", or "A256CBC-HS512" can result in a panic on untrusted input. Note this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4. Details Insufficient validation of parameters can lead ...

systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net

Summary On Linux, [email protected] builds /sys/class/net/ paths from the caller-supplied networkStatsiface value without checking that the resolved path stays inside /sys/class/net. A caller who can create a symlink fixture and control the value passed to this API can make the function...

systeminformation has prototype pollution in `networkStats()` via the interface name

Summary networkStats keeps a per interface cache for computing rxsec / txsec between calls. The cache is a plain JavaScript object and is indexed with the interface name the caller supplied. Passing the name proto makes every cache write land on Object.prototype instead of the cache, polluting...