morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

Impact Morgan writes attacker-controlled request data to the access log. Its escaping added in 1.11.0 and 1.12.0 neutralizes control characters, the Unicode line separators, and backslash, but not the double quote 0x22, which is the field delimiter of the Apache combined log format morgan emits. ...

Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE

A Denial of Service DoS vulnerability exists in @angular/platform-server's DOM emulation parser domino. When processing untrusted user input containing an incomplete DOCTYPE declaration ending with whitespace before EOF such as , and keyword matching advance nextchar, the EOF branch case -1: // E...

fast-uri vulnerable to authority injection via an unvalidated port in serialize

Impact fast-uri serializes the port component of a URI without validating it. When recomposing the authority, fast-uri escapes the userinfo and host components but concatenates the port verbatim, so a port value that is not a sequence of digits can inject authority delimiters. For example,...

fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

Impact fast-uri accepts a host that contains an unbalanced or misplaced authority bracket or without reporting an error. A host that starts with but does not end with , such as @127.0.0.1, is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the host wi...

jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)

Summary DefaultBaseTypeLimitingValidator — the PolymorphicTypeValidator used automatically whenever @JsonTypeInfo is applied without an explicitly configured custom validator — denies polymorphic resolution only for nine specific "unsafe base types" Object, Serializable, Closeable, AutoCloseable,...

ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts

Summary Address6.isLinkLocal recognizes fe80::/64 rather than fe80::/10. Link-local unicast is the whole /10 under RFC 4291 §2.4 and the IANA IPv6 Special-Purpose Address Registry, so the method returns false for every link-local address outside the one /64 that stateless address autoconfiguratio...

ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass

Summary No classifier on Address6 recognizes the NAT64 local-use range 64:ff9b:1::/48 RFC 8215. isPrivate, isLoopback, isLinkLocal and their siblings all return false for every address in it, so an internal IPv4 destination written through a local-use NAT64 prefix 64:ff9b:1:7f00:0:100:: for...

Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements

Summary An XSS vulnerability exists in @angular/platform-server during server-side rendering SSR HTML serialization of ProcessingInstruction DOM nodes , nodeType === 7 when nested inside fallback raw-content elements , , , . While processing instruction data escaped to , it did not check for or...

jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS

Summary jackson-databind 3.2.1 deserializes a JSON string bound to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDurationvalue / newXMLGregorianCalendarvalue. Per the XML-Schema lexical grammar these factory...

jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution

Summary A java.nio.file.Path field bound from untrusted JSON reaches JDKFromStringDeserializer.NioPathHelper.deserialize. The attacker string flows through new URIvalue → Path.ofuri, then on FileSystemNotFoundException into a ServiceLoader enumeration that calls provider.getPathuri on the first...

jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization

Summary CVE-2026-54514 GHSA-hgj6-7826-r7m5 fixed an eager-DNS-resolution / SSRF issue in jackson-databind's deserialization of java.net.InetSocketAddress by switching to InetSocketAddress.createUnresolved... PR 5951, commit 1f5a1037, released in 2.18.8 / 2.21.4 / 3.1.4. That fix did not cover the...

@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches

Impact When using RBAC to apply authentication rules, the exact path method name matcher applies a prefix match instead of an exact match for case-insensitive matches. As a result, if a service has a method with a name that is a prefix of the name of a different method, and they have different...

How we found 24 Android vulnerabilities using our open source AI security agent

With the rise of AI in the security space, our team created the GitHub Security Lab Taskflow Agent as a way for security researchers to easily automate, package, and share the AI prompts and workflows that they find effective for their work. In this blog post, I'll share how I created auditing...

scim-patch: Mutation of Inherited Built-in Method Objects

Summary Incomplete Prototype Pollution Fix Allows Mutation of Inherited Built-in Method Objects scim-patch blocks direct dangerous path segments such as proto, constructor, and prototype, but still traverses inherited properties when applying SCIM patch paths. An attacker who controls a SCIM PATC...

code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)

grepsearch Command Injection via Unescaped $ Shell Substitution CWE-78 Summary The grepsearch tool in code-ollama constructs a shell command string by interpolating attacker-controlled pattern and path arguments, then executes it via childprocess.exec. The sanitization only escapes backslashes an...

SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests

Summary The AetherBrowser API server scripts/aetherbrowser/apiserver.py exposes the POST /api/ops/check-email endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the emailreader.py subprocess, which connects to configured ProtonMail or Gmail...

mpp vulnerable to Gas Draining with low gas limit

Vulnerability When the server acts as the fee payer, mpp Elixir 0.4.0 ZenHive/mpp does not validate whether the gaslimit set by the client is enough before broadcasting. A malicious client can drain the server's gas without paying. A transferWithMemo call on Tempo Moderato testnet requires 51,299...

mpp vulnerable to Gas Draining with access list

Details When the server acts as the feepayer, mpp Elixir 0.4.0 copies the client-supplied EIP-2930 access list verbatim into the cosigned fee-payer transaction. In cosignfeepayer, the server re-signs the raw basefields index 5 of the 0x76 AASigned envelope without inspecting the access list field...

mpp vulnerable to Gas Draining with no limit

Details When the server acts as the feepayer, the mpp Elixir 0.4.0 does not validate gaslimit, maxfeepergas and maxpriorityfeepergas before cosigning the client's fee-payer transaction. A malicious client embeds arbitrarily large maxfeepergas and maxpriorityfeepergas values in the signed envelope...

CliInvoke.Specializations has command injection in PowerShell and Cmd shell wrappers

Impact An OS command injection vulnerability exists in the PowerShell and Cmd shell wrappers provided by the CliInvoke.Specializations package the PowershellProcessInvoker/CmdProcessInvoker invokers, and the UsePowerShell/UseCmd middleware in v3 pre-release versions. The wrappers re-run a...

CliInvoke: Argument Injection in Extensibility Runner Factory

Impact An argument-injection vulnerability exists in the CliInvoke package's runner factory: RunnerProcessFactory on the 2.x line and RunnerConfigurationFactory on the 3.x line. The factory joins the runner arguments, the caller's target, and the caller's arguments into a single...

khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem

Summary The /home/filepath:path endpoint in webclient.py serves static files by directly concatenating the user-supplied filepath with the homedirectory constant. There is no path traversal filtering, no path normalization check, and no authentication required. An attacker can use ../ sequences t...

Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools

Overview Verified. Multiple Unrestricted Path Traversal vulnerabilities exist in the Knowns MCP docs and memory tools, allowing arbitrary file read, write, and deletion operations outside the project sandbox. The storage layer functions Get, Create, Update, Rename, Delete in both docstore.go and...

OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet

Impact Two locations consume an encrypted handle returned by an untrusted external party and use it without verifying that the party is ACL-authorized on it. VestingWalletConfidential Malicious users can call release with a malicious token. This token could return an alternative handle on...

Containerd has image-pull DoS via crafted OCI index graph amplification

Impact A vulnerability exists in containerd's image pull handlers where a crafted OCI image index containing deeply nested or heavily fanned-out descriptor graphs can cause unbounded CPU and memory consumption. During the PullImage operation, the recursive traversal and processing of child...

FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

Impact An unauthenticated account takeover vulnerability exists in fof/oauth when the Discord OAuth provider is enabled. Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with...

Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled

Summary With $wgEmbedVideoRequireConsent disabled not the default, the urls for videos are passed into an iframe src attribute without sanitization. When given a malformed url or id, the src attribute can be escaped via double quotes, allowing for html/javascript injection. Details The iframe...

code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

Impact A Stored Cross-Site Scripting XSS vulnerability exists in the rich text editor due to improper sanitization of the srcdoc attribute on elements. While the underlying Symfony HtmlSanitizer correctly HTML-encodes special characters inside the attribute value e.g., converting to script, the...

code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

Impact The vulnerability allows an attacker to bypass the HTML sanitizer by using the data-html-content attribute in the content of a SharpEditorFormField. Patches The field must now explicitly configure SharpFormEditorField::RAWHTML in the toolbar to keep this behavior. When using the RAWHTML...

Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

Summary The Feed Reader front-end module passes RSS feed URLs from its configuration directly to $this-feedIo-read$url without any scheme validation or private-IP blocklist. A backend user with module-edit permissions can configure an arbitrary URL pointing to internal network services,...

social-auth-core has a Session Fixation issue

Impact The partial-pipeline resume mechanism accepted partialtoken as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could allow an attacker to start an authentication flow, obtain a valid partial token and...

social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

Impact The vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such a...

social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend

Impact The LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token, making the victi...

social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend

Impact The Vend OAuth2 backend used only the numeric Vend userid as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop coul...

social-auth-core has an Improper Authentication issue

Impact The SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML...

Ash: Private action arguments can be set by user input via string-keyed params and atomic changesets

Summary Ash fails to consistently strip private action arguments those declared with public?: false when a changeset is built from an untrusted parameter map. Private arguments are meant to be set only by trusted server-side code, but a caller who controls the parameters supplied to an action can...

Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)

At a glance - Actor: attacker who controls the -o/--output argument to trestle author catalog,profile,ssp-generate e.g. via a CI pipeline that derives the output directory from repository-controlled data - Primitive: attacker-controlled --output value reaches trestleroot / args.output write sink...

Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)

Reporter: Cavan Loughran, Celvex Group Inc. Summary ------- The fix for CVE-2026-46439 3.12.2 / 4.0.3 removed the recursive re-render loop in trestle/core/commands/author/jinja.py rendertemplate, but the custom include tags in trestle/core/jinja/tags.py MDSectionInclude, MDCleanInclude still...

Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)

Summary The Cline Hub dashboard server @cline/cline-hub, launched via the cline dashboard CLI command, accepts WebSocket connections on the /browser endpoint without validating the HTTP Origin header. When ROOMSECRET is not set—the default for local 127.0.0.1 binds—isAuthorizedBrowserRequest...

zbateson/mail-mime-parser has CRLF header injection via attachment filename

Impact A CRLF carriage-return / line-feed header injection affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename. Attachment filenames are interpolated into the Content-Type and Content-Disposition header values without...

zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME

Impact An uncontrolled resource consumption / algorithmic complexity vulnerability affecting any application that parses untrusted email with this library. Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does not bound the work done. A crafted messa...

hpack: Unbounded variable integer decoding can cause run-away computation on malformed input

Impact Users of the python-hyper/hpack library, most commonly used as downstream dependency of the python-hyper/h2 library an HTTP/2 client and server implementation. Unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively blockin...

@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

Summary The default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS Access-Control-Allow-Origin: . Any network-adjacent or remote attacker can send a single...

Podman: Malformed Image can trick podman run into leaking host environment variables into the container

Summary An container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk will cause podman to pass all host variables into the container. So...

Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces

Impact In Cilium clusters using Gateway API, users with permissions to create or update namespaced HTTPRoutes can mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default. Patches This issue affects...

@bytebase/dbhub's read-only mode does not prevent database writes

Summary Setting readonly = true on the executesql tool does not make the connection read-only. The connectors are written to set PostgreSQL defaulttransactionreadonly=on and open SQLite in readOnly mode, but that code is gated on a config value that is never populated, so it never runs. The only...

DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

Summary DBHub 0.21.2 exposes an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example --transport http --port 8080. The HTTP server attempts to protect browser-origin access by checking whether the Origin hostname equals the Host hostname, then...

http4s-scala-xml has an XML External Entity (XXE) processing issue

http4s-scala-xml provides EntityDecoderF, scala.xml.Elem instances that parse XML message bodies. These decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default settings, the parser resolves DOCTYPE...

xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS

xhtml-purifier does not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString XHTMLPurifier.js, around line 148 the attribute value is concatenated directly into a double-quoted attribute without encoding. As a result, an attacker-controlled value in any...

`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction

Reported by @echennells Eric Chennells. Migrated from public issue 191 to a private advisory. Affected: @bsv/wallet-toolbox / -client / -mobile. Verified in 2.1.21 and 2.1.21-parity-fix.2; the relevant code is the same at current HEAD Summary: When createAction runs against a remote StorageClient...