Malicious code in wix-reg-poc-bypass (npm)

Source: amazon-inspector 4b0b4a2bb63a48ca7c9f712068de893526ec0e3515ffd367f37b5c251034965a The package shadows internal Wix registry module names thunderboltRegistry, corvidRegistry, editorRegistry, siteAssetsRegistry, and others and ships a registry-manifest.min.json pointing at a parastorage CDN...

Malicious code in wie888r (npm)

Source: amazon-inspector b3f438329492b2e0f2917a0eebe97ad8149149b66cd5eb9201bed0b8f5750e7b [email protected] ships a stub main index.js that exports a Proxy returning no-op functions for any property access, so bundlers that resolve this name do not crash. The package's postinstall script runs...

Malicious code in @wxwxtest/testrrrdd (npm)

Source: amazon-inspector 2c288e48135ebe9f305d450f5b19324ae944865fb7057ced986d0eb30cb1fe34 The package ships a postinstall script scripts.postinstall runs node beacon.cjs and a top-level require'./beacon.cjs'.fire in index.js that POST installer host metadata — hostname, install path, cwd, Node...

Malicious code in css-overscroll-contain (npm)

Source: amazon-inspector 5d978121f021eb6136e6a34db790556ba757de3bb8fa81981903445baf025d16 The package advertises itself as a CSS overscroll-behavior utility but its shipped modules thunderboltRegistry.js and sibling files named after Wix-internal registries such as siteAssetsRegistry,...

Malicious code in pxnpm (npm)

pxnpm 7.0.0-beta.6, 7.0.0-beta.8 and 7.0.0 published 2026-10-06 by user nfjbill are a 10-file, 16 KB launcher for a native executable that is not contained in the package. The postinstall script bin/install.cjs calls ensureNative in dist/download.cjs, which downloads a 17-21 MB Brotli archive for...

Malicious code in xblaxw (npm)

Source: amazon-inspector 2d2e0b35582727d314517ea66b234f665258076783678cdf645075a7294a0aed [email protected] is a stub package whose only behavior is a beacon. The package.json postinstall script runs node beacon.cjs, which collects host identifiers hostname, install path, process.cwd, process.version...

Malicious code in testrrrd (npm)

Source: amazon-inspector 91a77cc9dbdff4799414082dc85fc6581b9f2d7297136dea8c50540f7d5244ad On npm install, package.json scripts.postinstall runs node beacon.cjs, which POSTs a JSON payload containing the installer's hostname os.hostname, install path dirname, current working directory process.cwd,...

fast-jwt: Verifier cache accepts expired JWTs without iat.

Summary cacheSet only derives its exp cache deadline inside hasIat src/verifier.js:127-140. JWT iat is optional. For a valid token with exp but no iat, cacheSet substitutes clockTimestamp + clockTolerance + cacheTTL src/verifier.js:142-146. Later, the cache path returns the saved payload before...

Hazelcast allows arbitrary member memory access by low-privileged client

Impact A flaw has been found in Hazelcast Enterprise Edition and Community Edition, which would allow a low-privileged malicious client to read arbitrary data in memory from any cluster member including Java heap memory, off-heap data, and JVM process address space. Additionally, such a client ma...

Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry

Summary In banks.registries.DirectoryPromptRegistry, prompt file paths and the index file index.json do not refuse symbolic links. When a prompt directory contains or accepts untrusted files e.g. unpacked archives, shared repositories, or multi-tenant folders, symbolic links pointing outside the...

Banks: User-controlled prompt input can be parsed as privileged chat messages

Summary Banks' Prompt.chatmessages method parses every rendered output line as a potential ChatMessage JSON object. If attacker-controlled template data renders to JSON such as "role":"system","content":"...", Banks returns it as a privileged system message instead of treating it as plain...

Indico: Incomplete Server-Side Request Forgery (SSRF) check

Impact Indico makes outgoing requests to user-provides URLs in various places. This is mostly intentional and part of Indico's functionality, but of course it is never intended to let you access "special" targets such as localhost or cloud metadata endpoints. The previous fix CVE-2026-25738 did n...

Indico: Missing access check in legacy session export API

Impact A legacy API to retrieve session details could be misused to retrieve metadata such as title, description and conveners of a restricted session within without having access to that session, as long as the event itself was accessible. Patches You should to update to Indico 3.3.13 as soon as...

Indico: Cross-Site-Scripting in minutes editor

Impact There is a Cross-Site-Scripting vulnerability in the minute editor conflict UI tha's shown when concurrent edits are made to the same minutes in an event. Patches You should to update to Indico 3.3.13 as soon as possible. See the docs for instructions on how to update. Workarounds - Set...

Indico: Cross-Site-Scripting in link fields

Impact There is a Cross-Site-Scripting vulnerability in fields that allow entering custom URLs. Patches You should to update to Indico 3.3.13 as soon as possible. See the docs for instructions on how to update. Workarounds - Set CSPENABLED = True in indico.conf - this is recommended regardless of...

Hazelcast has an authorization bypass in IMap Predicates API

Impact Missing authorization checks in the Predicates API may allow a malicious client to execute arbitrary code on a Hazelcast member. Patches Enterprise customers should upgrade to a fixed version of Hazelcast Enterprise Edition: 5.7.0 5.6.1 5.5.10 5.4.5 Customers with extended support contract...

AdonisJS: Unencoded route parameters can produce open redirects

Route parameters are inserted into generated URLs without URI encoding. When an application passes untrusted input to a route whose first path segment is dynamic, a value beginning with / can produce a scheme-relative URL. For example: ts router.get'/:page', handler.as'pages.show'...

Mechanize sends credential headers to another origin after a meta refresh

Summary mechanize applied no trust boundary to a meta refresh, so credentials set through Mechanizerequestheaders= followed a refresh that pointed at another origin. Details Mechanize::HTTP::Agentresponsefollowmetarefresh fetched the refresh target with no notion of a crossed origin, so...

Mechanize sends credential headers to another host after an HTTP redirect

Summary mechanize leaked credentials to the redirect target when an HTTP redirect crossed to another host. Credentials set through Mechanizerequestheaders= leaked even when they were Authorization. Details Two defects, both in lib/mechanize/http/agent.rb. 1. Mechanizerequestheaders= bypassed the...

Malware in revine

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

Summary createVerifier in fast-jwt ≤ 6.3.0 skips signature verification entirely when the key option is a falsy synchronous value '' or null and the algorithms option is set to a non-empty allowlist. An attacker who can present a JWT to the application — regardless of algorithm — can forge...

fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

Summary The fix for CVE-2026-34950 CVSS 9.1, released in v6.2.0 is incomplete. It adds key.trim to the PEM-detection path in src/crypto.js, but String.prototype.trim only strips characters classified as whitespace by the ECMAScript specification. The subsequent ^-anchored regex /^-----BEGIN?: RSA...

fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)

Summary createVerifier clockTolerance: Infinity silently bypasses both exp expiry AND nbf not-before validation. Any expired or not-yet-active token is accepted as valid. The same primitive also corrupts the verifier's internal cache so cached entries inherit infinite validity — they remain valid...

fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

Summary fast-jwt's createVerifier silently skips all configured claim validators exp, nbf, iss, aud, sub, jti, nonce when a validly-signed JWT carries a JSON array as its payload instead of an object. The verifier reports success while having enforced only the signature. This breaks the library's...

fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

Summary fast-jwt 6.2.4 silently classifies raw serialized public JWK JSON as an HMAC secret. If an application supplies public JWK JSON text as the verifier key and HS256 is explicitly allowed or automatically inferred, an attacker who knows the same public JSON text can use it as an HMAC key and...

PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure

Summary The AgentOS server in the praisonai TypeScript/npm package ships an insecure default: it binds 0.0.0.0, sets no API key, and uses CORS with credentials. The API-key middleware is only registered when an API key is configured, so the documented quickstart new AgentOSagents:....serveport...

PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass

Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass Summary praisonai-platform lets an ordinary workspace member patch owner-created project, issue, and agent records even though the paired delete routes enforce owner/admin authorization. For...

PraisonAI: Shell command allowlist bypass via find -exec built-in action

Summary The shell command execution hardening introduced in PraisonAI npm 1.7.2 / Python 4.6.58 to fix GHSA-5jv7-2mjm-h6qj utility-tools shell chaining and GHSA-vjv9-7m7j-h833 SandboxExecutor chaining can be bypassed via find's built-in -exec action. The fix blocks shell metacharacters ;|& + The ...

PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls

Summary The AICoder UI component exposes writetofile and executecommand tools to the LLM with no path validation and no command sanitization. An attacker can achieve arbitrary file write to any location on the filesystem including /root/.ssh/authorizedkeys, /etc/crontab and arbitrary command...

PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface

Summary PraisonAI's MCP HTTP-stream server authenticates requests only when an API key is configured; the CLI defaults --api-key to None, so praisonai mcp serve --transport http-stream exposes the full MCP surface unauthenticated. A request with no Authorization and no Origin can initialize and...

PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization

Platform members can rewrite shared labels and owner issue labels without owner/admin authorization Summary praisonai-platform lets an ordinary workspace member rename and recolor shared labels and add/remove labels on an owner-created issue even though direct label deletion is restricted to...

PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend

Summary SecurityPolicy in praisonaiagents/sandbox/config.py is a documented configuration data class with fields for allowsubprocess, allowedpaths, blockedpaths, allowedcommands, blockedcommands, allowedimports, and blockedimports. Its strict classmethod is explicitly described as creating "a...

PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF

Summary PraisonAI's Async Jobs API enables its API-key middleware only when PRAISONAIJOBSAPIKEY is set, so by default every endpoint is unauthenticated. An unauthenticated POST /api/v1/runs accepts an attacker-controlled webhookurl; on job completion the server POSTs the job payload to it via...

Malicious code in kafka-roller (PyPI)

Source: ossf-package-analysis 4b68fa52500e16cab90e8038ae96e2ba1be6c448a8caa40ab3e46dc6d3c26436 The OpenSSF Package Analysis project identified 'kafka-roller' @ 99.0.0 pypi as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity...

Malicious code in kafka-helmsman (PyPI)

Source: ossf-package-analysis a2d266a2b4e9df8f2466cfb34e58fe98c636cb75d4ad1ec08cee919bd9a86588 The OpenSSF Package Analysis project identified 'kafka-helmsman' @ 99.0.1 pypi as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master

Summary StsdAtom.get in lib/mp4/AtomToken.ts parses an MP4 stsd sample description box's entry table by advancing a cursor with off += size - 4, where size is a 32-bit, attacker-controlled per-entry length read straight from the file. When size == 0, that advance is 0, so a file declaring a huge...

music-metadata: Uncontrolled memory allocation in APEv2 parser

Summary music-metadata 11.15.0 is vulnerable to uncontrolled memory allocation in the APEv2 parser. The parser reads the size of an APEv2 tag item from the input file and uses that value to allocate memory before checking whether the file actually contains that many bytes. A small crafted .ape fi...

music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS

Summary The ID3v2 parser in music-metadata trusts the tag size field without validation and allocates the full requested buffer before reading. A specially crafted MP3 file with a truncated ID3v2 tag can force allocation of up to 268 MB from a 10-byte file, causing server memory exhaustion. This...

music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort

Summary The Matroska/WebM EBML parser decodes attacker-controlled variable-length integer VINT element lengths without first validating that the declared element fits within its enclosing container or the available input. Leaf lengths are then used directly for string-token and Uint8Array...

Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early

This issue was posted by Codex Desktop using gpt-6.1-sol on behalf of David. Summary Applications that wrap a model with ConcurrencyLimitedModel or limitmodelconcurrency can permanently lose shared concurrency capacity when a streamed request releases its slot from a different task than the one...

MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES

Description When escaping string and binary parameters for the text protocol, the connector always escaped the quote character with a backslash, without ever consulting the session's NOBACKSLASHESCAPES SQL mode. The server status flag was declared STATUSNOBACKSLASHESCAPES but never read. Under a...

MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)

Description With the non-default permitSetMultiParamEntries option enabled, an object passed as a query parameter is expanded into a SET clause, each key becoming a column name. The three code paths implementing that expansion built the backtick-quoted identifier by hand and wrote the key out...

MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters

Description When encoding a GeoJSON Polygon or MultiPolygon parameter for the binary protocol, the connector sized its output buffer from the length property of each ring, then wrote each ring only if it was a real array. The two loops disagreed: any non-array ring carrying a numeric length a...

MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS

Description On the zero-configuration TLS path, the connector accepts a self-signed server certificate at the TLS level and then validates the server's identity from the fingerprint hash the server appends to the final OKPacket Authentication.validateFingerPrint. That validation calls hash on the...

CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>

Summary Rendering an untrusted SVG whose contains many segments is On² CPU. A single under 1 MiB burns tens of seconds. Two independent On² sites in cairosvg/path.py: 1. Tokenizer — the path-data parser consumes the d string with a while string: loop that repeatedly slices/re-scans the remaining...

enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision

Summary A crafted SVG bypasses enshrined/svg-sanitize's href validation and delivers a javascript: URL through the sanitizer unchanged. The bypass exploits a semantic mismatch between XML entity resolution used during sanitization and HTML5 Named Character Reference resolution used by the browser...

svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences

Summary Resolver::processReferences collects elements with the XPath predicate use@href or @xlink:href, which is case sensitive. A element written as xlink:HrEf is therefore never added to the reference graph, so the nesting-DoS nullification never marks it for removal...

enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash

Summary A crafted SVG file 1009 bytes crashes the PHP process when sanitized by enshrined/svg-sanitize any version through 0.22.x. The sanitizer's cleanAttributesOnWhitelist method calls DOMElement::removeAttribute twice on the same attribute name — first removing the explicit attribute, then...

music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7)

Summary DsfParser.parseChunks skips an unrecognised chunk's payload with an un-awaited call: js this.tokenizer.ignoreNumberchunkHeader.size - ChunkHeader.len; // lib/dsf/DsfParser.js:51 — no await ChunkHeader.len is 12. A crafted .dsf chunk with id != 'fmt ' and size in 0..11 makes the argument...

amqp091-go: Pre-negotiation frame limit is not enforced to 4KB

Summary The frame-size mitigation released in amqp091-go v1.13.0 can be bypassed before connection.tune completes. A malicious or compromised AMQP peer can send only a seven-byte body-frame header containing a large attacker-controlled uint32 payload length. The client allocates a slice of that...