GHSA-F6PJ-QV47-G96W MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters

Summary The Jira and Confluence attachment upload tools accept caller-controlled file path parameters and read those paths from the MCP server's local filesystem before uploading the file as an Atlassian attachment. In local stdio deployments, this can expose files readable by the user's MCP...

GHSA-HGCF-4MQ8-5266 MCP Atlassian: SSRF Protection Bypass

Environment - Project: sooperset/mcp-atlassian - Affected function: validateurlforssrf - Affected path: header-based Jira/Confluence URL authentication flow - Tested endpoint: POST /mcp - Tested version: 2.14.5 Description The SSRF protection in validateurlforssrf can be bypassed with a URL...

GHSA-6CR4-CCF3-X7H4 MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials

Summary Missing path validation in confluenceuploadattachment allows any authenticated MCP client to read arbitrary files from the server filesystem and exfiltrate their contents to Confluence. On Linux deployments, /proc/self/environ yields all runtime secrets in a single call. --- Details...

GHSA-49XV-9743-PW8W MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow

Summary The SSRF protection for header-based authentication uses a validate-then-use pattern vulnerable to DNS rebinding. validateurlforssrf resolves the hostname via DNS and checks that the resolved IP is globally routable. However, the actual HTTP request happens later, during which the DNS...

GHSA-MFV2-4WVM-9PGP MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call

Summary The uploadattachment functions in both the Jira and Confluence modules accept a user-controlled filepath parameter and open the specified file for reading without calling validatesafepath. An authenticated MCP client can supply an arbitrary path such as /etc/passwd or /proc/self/environ,...

GHSA-H7WJ-5V37-59R2 MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)

Summary The confluenceuploadattachment and confluenceuploadattachments MCP tools accept a filepath parameter and do not validate that the path is confined to an allowed directory before opening the file. An attacker who can call these tools can read any file accessible to the MCP server process S...

GHSA-2XJ6-XX86-CWWC MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue

Summary A critical Confused Deputy Arbitrary File Read & Exfiltration vulnerability in the Atlassian MCP server Python allows an AI agent to exfiltrate sensitive host files and environment secrets. By providing absolute system paths to the attachments parameter of the updateissue tool, an agent c...

GHSA-VC25-24VV-FXXM MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files

Summary MCP Atlassian exposes Jira and Confluence attachment upload tools that accept arbitrary local filesystem paths and upload those file contents to Atlassian. In HTTP or multi-user deployments, an MCP caller who can invoke write tools can cause the server to read any file accessible to the M...

GHSA-W66G-J6C4-HCFC MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)

Summary mcp-atlassian is a popular community MCP server wrapper exposing Jira / Confluence to MCP clients. Operators commonly restrict the surface to a small allowlist of projects/spaces via the JIRAPROJECTSFILTER and CONFLUENCESPACESFILTER environment variables, which the README documents as the...

GHSA-7HVX-28GP-MF6J Unleash: CR-approval email renders user-controlled raw HTML

Summary The change-request approval HTML email template renders fields as raw HTML. User who can create a change request can inject HTML into approval notification emails. I was not able to confirm Enterprise platform is using vulnerable code nor that it doesn't sanitize input. Details...

GHSA-8H6X-H86X-75WH SIPGO: DoS via unvalidated WebSocket frame length

Summary The WebSocket transport allocates a buffer from the frame payload length before validating its size, which can lead to an unauthenticated DoS. Details WSConnection.Read allocates a buffer from the declared WebSocket frame length before reading the payload...

GHSA-727H-3VM5-QWQ6 mppx: Gas Draining with padding

Details When the server acts as the feepayer, mppx 0.6.27 validates calldata using viem's decodeFunctionData, which is lenient about trailing bytes. The FeePayerPolicy caps gaslimit ≤ 2 M and maxfeepergas ≤ 100 Gwei but does not check calldata length. Tempo uses legacy calldata gas pricing: 16 ga...

GHSA-G26X-M427-F48F Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check

Summary The GET /api/v1/stable/durable-tasks/durable-task endpoint listDurableEventLog is missing tenant authorization validation, allowing any authenticated user to read durable task event logs from any tenant. Impact This CVE requires the attacker to successfully guess the target UUID. Any...

GHSA-65GG-G7RW-6CPC Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`

Same panic class as GHSA-m5j3-4634-c2vq and GHSA-m6xr-fvfg-5g64, sister site on the same function. Trigger is any selector ending in whitespace: dasel query 'a ' panics at selector/lexer/tokenize.go:60. The whitespace-skip loop right above lines 55-57 advances p.i to p.srcLen when the input is...

GHSA-CH3G-4XVR-674Q OpenCVE: Server-Side Request Forgery (SSRF) in notifications

Impact OpenCVE contains a Server-Side Request Forgery SSRF vulnerability in the notification testing functionality for both Webhook and Slack integrations. An authenticated user with permission to configure notification channels can trigger test requests to arbitrary HTTPS endpoints. Insufficient...

GHSA-8Q6G-VJHF-JP8M psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry

Summary PSDImage.composite and .numpy allocate the output image buffer from the PSD's header geometry width × height × channels × depth, and per-layer rectangles before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte...

GHSA-29HQ-23M2-2J47 Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)

Summary validateUser in backend/src/authentication/providers/mysql/auth-provider-mysql.service.ts returns immediately when the supplied login/email does not match any account, without ever calling comparePassword: async validateUserloginOrEmail: string, password: string, ip?: string, scope?:...

GHSA-JX63-H26R-8CPH Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`

Affected component: Sync-in Server v2.3.0, POST /api/app/sync/operation/diff/:id, vulnerable implementation of pathFilters in backend/src/applications/sync/dtos/sync-operations.dto.ts. Summary In the vulnerable version, the sync diff endpoint accepted a user-controlled regex pattern through...

GHSA-PXCX-FV34-X9P5 nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition

Summary POST /api/users/onboarding/finish is registered as anonymous unauthenticated and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act TOCTOU pattern between the "onboarding already completed?" check and the user-creation write, with no atomic...

GHSA-JR34-H97M-9HPX nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware

Summary The gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists...

GHSA-JHJP-4C2Q-XMX4 k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containers

The k8saudit plugin's per-container fields ka.req.pod.containers. and the shipped k8sauditrules.yaml evaluated only requestObject.spec.containers. Security-relevant settings on a pod's initContainers or ephemeralContainers were not inspected, so the shipped Create Privileged Pod rule did not fire...

GHSA-CH52-4W7C-C8XP http-cache-semantics max-stale handling can disclose cross-user cached responses

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to...

GHSA-JGH3-FGGC-MCPM Obot: Server-Side Request Forgery via remote MCP server URL

Summary In affected versions, the URL of a remote MCP server is attacker-controlled at registration and is fetched server-side with no validation of the destination. There is no guard against loopback, link-local, RFC1918 private ranges, or the cloud metadata endpoint 169.254.169.254, so a use wi...

GHSA-XWMW-PRC4-V3CR Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion

Summary In affected versions, an unauthenticated attacker could register an OAuth client with an arbitrary external redirect URI, and the authorization flow would auto-complete without a consent screen. If a logged-in victim visited a crafted authorization URL, an authorization code was delivered...

GHSA-5GMM-HJFJ-8FF7 Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade)

Summary The service downgrade implementation in app/Livewire/Services/Upgrade.php::doUpgrade executes a proration calculation and a subsequent user credit refund without any transactional safety or database locks. The only concurrency check relies on an unisolated database query checking for...

GHSA-5GM3-9CRP-6G3V Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools

Summary A malicious website can use DNS rebinding to control a developer's local process-compose MCP SSE listener when MCP SSE is enabled. The vulnerable path accepts browser-origin requests before any Host validation, Origin validation, or caller-secret check, then dispatches the requests into...

GHSA-3RM2-H79C-8QW6 md-editor-v3: XSS via fenced-code language rendering bypass

Summary MdPreview interpolates a fenced-code language into HTML attributes without escaping it. A crafted info string therefore executes JavaScript even when the shipped XSSPlugin is enabled. Details useMarkdownIt packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts:206 registers a...

GHSA-W72W-9QMJ-C9QM AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets

Summary The telemetry subsystem embeds a hardcoded auth token "secret" in the public source and transmits raw CLI arguments—including --secret, --jwtsecret, and --httprpcsecret values—to a third-party telemetry endpoint. Details In telemetry/config.go line 12, var authToken = "secret" is committe...

GHSA-3W57-8XMC-8V26 AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups

AnyIO 4.14.0 accepts the POSIX extragroups argument on anyio.runprocess and anyio.openprocess, but openprocess forwards the wrong variable to the backend: when extragroups is not None, it assigns kwargs"extragroups" = group instead of extragroups. As a result, callers cannot reliably clear or set...

GHSA-QG2G-G9W3-M5H8 ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement

Summary A containerized MCP server running with the default network permission profile insecureallowall: true can reach host-local services via host.docker.internal. This includes the ToolHive API itself, other ToolHive-managed MCP server proxies, and any other service listening on the host's...

GHSA-2VH9-42VM-XMV2 LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

Summary LMDeploy's PyTorch DistServe/PD-disaggregation control plane used recvpyobj to deserialize messages received through a ZeroMQ PULL socket. PyZMQ implements recvpyobj using Python pickle deserialization, which can execute arbitrary code while reconstructing an object. The peer address used...

GHSA-JR78-W6W5-M8F8 Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks

Summary The api.php?action=smwtask API module performs no authorization check. The equivalent maintenance interface in the web UI Special:SMWAdmin requires the smw-admin right, but the API module that backs several of the same operations enforces nothing. An unauthenticated visitor can therefore...

GHSA-9RCC-PMJ8-FFHR Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354)

Summary Special:FacetedSearch cstate hidden inputs enable reflected XSS residual of CVE-2025-10354 Details Affected versions and vulnerable location - Confirmed present on latest shipped release tag available in the local clone: SemanticMediaWiki/[email protected]. - Confirmed present on...

GHSA-Q5FM-9MX6-44F4 Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)

Query debug output XSS Failure mode Semantic MediaWiki's query debug output format=debug, or the debug request parameter on Special:Ask is assembled by SMW\Query\DebugFormatter and emitted as raw HTML. Several of its sinks apply no output-context encoding, so attacker-controlled query input is...

GHSA-59XW-QV23-J3RC Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)

Failure mode The value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Remediation - The form value is escaped before it is placed back into the input field. - Derived error messages are also escaped before being rendered into...

GHSA-9HXX-M5G2-2Q3H Duplicate Advisory: vm2 contains a sandbox escape vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pq68-rvw4-xp4r. This link is maintained to preserve external references. Original Description vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUSBUILTINS denylist omits...

GHSA-R94F-HX44-8JQF Grav CMS vulnerable to remote code execution via .zip file upload

Summary A logged-in user can run any command on the server. A settings field can fill itself by calling one of Grav's built-in routines, and a safety check is supposed to allow only harmless ones. The check only recognises a routine when its name is written as one piece of text; named as a pair o...

GHSA-XHFV-7758-R9HX Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin

Summary The core Flex group blueprint system/blueprints/user/group.yaml access field, lines 48-55 omits the security@: admin.super field guard that its sibling account blueprint carries account.yaml:131/138/150, added by the CVE-2026-42613 fix. A delegated non-super operator holding...

GHSA-9GM5-9RFH-M6VX CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP

Summary CoreDNS accepted RFC 2136 UPDATE messages over DoH, DoH3, DoQ, and DNS-over-gRPC, then allowed the proxy/forward plugin to send them unchanged to an upstream DNS server. UDP, TCP, and DoT rejected the same opcode before plugin dispatch. If an update-capable upstream trusts CoreDNS's sourc...

GHSA-GJV8-XP57-G29C Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns

Summary soupsieve compiles CSS selector strings with a set of hand-written regular expressions. The shared IDENTIFIER sub-pattern also embedded in VALUE, and therefore in attribute selectors places two adjacent quantified groups over overlapping character classes: ?:classA|ESC+?:classB|ESC, where...

GHSA-J934-XHV5-FG8F Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)

Summary Before tokenizing, selectoriter trims leading/trailing whitespace and comments by running two regexes over the whole raw selector with .search. The trailing one, REWSEND = re.compiler'WSC$', is anchored only at the end $, not the start. Because .search retries the pattern at every offset,...

GHSA-QRFJ-MGW8-J9C6 @platejs/core HTML deserialization can trigger browser behavior during parsing

Summary HTML strings passed to Plate's core deserialization APIs were parsed in the active document. Certain HTML attributes could therefore trigger browser behavior during parsing, before the content was converted into editor nodes. Applications that deserialize HTML from untrusted or cross-user...

GHSA-X424-64QH-5J54 react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

Summary A malformed HTTP message using Transfer-Encoding: chunked can drive React\Http\Io\ChunkedDecoder into an infinite loop, pegging a CPU core and freezing the event loop. Because ReactPHP is single-threaded, one such message stalls the entire process for every client until it is killed. Both...

GHSA-MRG3-QVQR-JW29 CoreDNS: Unauthenticated memory exhaustion in custom transports

Summary CoreDNS parses attacker-controlled DNS section counts before validating them on DNS-over-HTTPS DoH and DoH3, DNS-over-QUIC DoQ, and DNS-over-gRPC listeners. An unauthenticated client can use DNS name compression to make one 65,533-byte request allocate more than 10 MiB while it is unpacke...

GHSA-W34Q-CM8F-9C5X OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning

Summary The OTLP log gRPC exporter loads TLS settings from environment variables but does not apply them when creating gRPC transport credentials. Operators who rely on OTELEXPORTEROTLPLOGSCERTIFICATE, OTELEXPORTEROTLPCERTIFICATE, or related client certificate variables for CA pinning or mTLS get...

GHSA-8WMF-6V46-5GFG OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs

Summary OpenTelemetry Go versions 1.5.0 through 1.44.0 can include trace exporter endpoint configuration in an internal diagnostic log emitted when an SDK TracerProvider is created. The default OpenTelemetry logger does not emit this event. Exposure requires an application to install a logger tha...

GHSA-C3MW-737P-C7G2 Jupyter Server: 5xx request logging leaks token-bearing Referer header values

Summary When a request returns a 500, jupyterserver/log.py logs a small JSON block of request headers. The Referer header was copied into it as-is, so a token in the Referer URL ended up in the logs in plain text. Impact Anyone who can read the server logs can pick tokens out of these 500 entries...

GHSA-3JHR-MXMX-38CX Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()

Summary system/config/security.yaml's Twig sandbox policy allow-lists offsetget and offsetexists for Grav\Common\User\Interfaces\UserInterface. The concrete Grav\Common\User\DataUser\User class does not filter which fields offsetGet returns, so any sandboxed template with access to a User object...

GHSA-38P6-H87P-R4CG Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection

Summary Grav\Common\Utils::verifyNonce, the core function Grav and its plugins use to validate CSRF nonces, compares the submitted nonce to the expected value with PHP's === operator instead of hashequals. === on strings short circuits at the first differing byte, so the comparison time leaks how...

GHSA-4RF6-QX84-Q9FV Fulgur: Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)

fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.26.0, a childless box that resolves to a pathologically tall height was amplified into thousands of blank PDF pages, even when it produces no visible output. The...