GHSA-R57G-MC79-8HJ2 djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool

Affected version / file / line Version: djust v1.1.4 latest release, published 2026-09-23. File: python/djust/mcp/server.py:354-433 MCP tool findhandlersfortemplate. Confirmed identical on the commit used for triage, a7e4fafd1667b4db0b1465652d4a63cb17117a07. Description @mcp.tool def...

GHSA-F66C-MPJ2-3R8H ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user

Summary The slugTaken endpoint returns a boolean indicating whether a slug is in use across all document types and visibility levels, with no permission or type filter. Any logged-in user including editors can enumerate the slug space of private pages, drafts, and archived content. Details POST...

GHSA-VH56-5M88-39RQ ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users

Summary The getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document id can read the full content of admin-only pages and their privileged fields, while the getAll endpoint correctly enforces...

GHSA-7JG5-FRGC-C67W ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

Summary ApostropheCMS widget styles support project-defined schema fields. If a project defines a free-form string style field with a CSS property and no selector, an editor-controlled value is rendered as an inline CSS declaration. The resulting declaration is then inserted into the widget...

GHSA-RW26-WWFC-9WVM ApostropheCMS: Missing Authentication in `cleanExport` Route

Summary The API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly...

GHSA-RQGM-CFRP-4HX8 ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API

Summary ApostropheCMS lets a module expose an anonymous read API by setting publicApiProjection, which whitelists the document fields unauthenticated callers may see. The public REST GET handler applies every launderable query builder from the query string before forcing that projection. Two of...

GHSA-VMGJ-9CWM-CF3H ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix

Summary The color field accepts any string that begins with a valid rgb / hsl color, because TinyColor.isValid does not anchor its match at the end of the string. An authenticated user with edit rights can store arbitrary HTML after a valid color prefix. When the stored value is rendered , the...

GHSA-C9RX-X947-FP3H ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

Summary Since 2.18.0, when an is not allowed and disallowedTagsMode is 'discard' the defaults, its raw-text content is re-sanitized by a recursive call to sanitizeHtmltext, options the change from 5564, fixing 5550. The recursion has no bound and starts each nested call with a fresh state. Two...

GHSA-5M22-7PFQ-VP65 ApostropheCMS: Import API bypasses publication roles for protected content

Review scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/[email protected], commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce September 30, 2026. Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip...

GHSA-JF5H-36MG-RP6X ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content

Review scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/[email protected], commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce September 30, 2026. Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip...

GHSA-9G7P-M758-RP72 ApostropheCMS: Import archives can exhaust server storage and deny service

Review scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/[email protected], commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce September 30, 2026. Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip...

GHSA-QFV9-64JG-MH7P pypdf: Possible infinite loop in PdfWriter.find_outline_item

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires calling findoutlineitem on a PdfWriter. Patches This has been fixed in pypdf==6.20.1. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4188...

GHSA-9MX8-4J7G-633P pypdf: Possible infinite loop when removing tree items

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires removing an object from a tree, for example an outline item. Patches This has been fixed in pypdf==6.20.1. Workarounds If you cannot upgrade yet, consider applying the changes from PR 418...

GHSA-VXJ4-Q4G9-CRJ7 virtualenv bash activate runs commands from an environment name with a backslash before $

Summary The bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing $... runs as commands in the user's shell each time bash draws the prompt. Affected area...

GHSA-7MH2-4GG2-979F pypdf: Possible large memory usage for streams with multiple filters

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing any stream with a large amount of filters or multiple filters which pass around large amounts of data. Patches This has been fixed in pypdf==6.20.0. Workarounds If you...

GHSA-9JRQ-W75R-8GCW Vite: Cross origin script execution through Vite custom middleware

Summary When accessing a malicious site while a dev server using Vite is running, that site was able to load scripts in a page served by the dev server. Impact Only apps that match the following conditions are affected: - the dev server passes an unchanged browser request URL to...

GHSA-RQ7H-C2JC-7F22 Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

Summary The content of files outside server.fs setting can be returned to the browser if the project imports a file path concatenated with the root. For example, if the project references /etc/hosts, the content of /etc/hosts was possible to be returned. The content of files outside the...

GHSA-VFPM-58RQ-9QCG Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

Summary The first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Impact Only apps that match one of the following conditions are affected: - explicitly expose the Vite dev server to the network using --host or the...

GHSA-5VJQ-RRRF-7H2Q virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

Impact zsh users activate an environment with the bash activate script, which puts the environment name into PS1. Since 21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when BASHVERSION is set, so zsh gets the raw value. With the PROMPTSUBST option set, zs...

GHSA-C947-3PG5-GM8Q virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote

Impact FishActivator defines no quote, so it inherits ViaTemplateActivator.quote, which returns shlex.quotestring. That function follows POSIX sh rules, where a backslash inside single quotes stays a literal character. fish reads ' inside single quotes as an escaped quote and \ as an escaped...

GHSA-8RJX-V5WW-45PP virtualenv activation scripts run code from a path that contains a placeholder name

Impact ViaTemplateActivator.instantiatetemplate replaces the placeholders in an activation template one key at a time, each across the whole text. When a value that it already substituted and quoted contains the name of a later placeholder, the later pass rewrites that name inside the quoted...

GHSA-CRWC-VW2R-QR6M OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies

Summary OGNL's optional stricter invocation mode maintains a block list that prevents expressions from directly calling methods on dangerous classes such as Runtime, ProcessBuilder, and ClassLoader. The block list filters on the declaring class of the method OGNL invokes. Because...

GHSA-46R4-Q7WV-32FC OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs

Summary The OpenChoreo API server authorized PUT .../workflowruns/runName against ownership metadata taken from the request body, while the object it actually mutated was selected by the URL path. Nothing forced the two to agree. A WorkflowRun's membership in a project and component is carried...

GHSA-5588-RP99-5FJH Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization

Exclusive XML canonicalization http://www.w3.org/2001/10/xml-exc-c14n in github.com/moov-io/signedxml copied the entire accumulated namespace map at every node during ValidateReferences, before any reference digest or signature check. For a chain of nested elements that each declare many unused...

GHSA-7CGW-QMXX-7FC2 Duplicate Advisory: chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-j6qf-3m9c-vwj3. This link is maintained to preserve external references. Original Description In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trust...

GHSA-86WM-68PQ-5JWQ ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export

Summary A potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by @apostrophecms/import-export. The affected import API routes invoke: self.apos.http.bigUploadMiddleware before the actual import handler performs its authentication check. Because ...

GHSA-M3WX-QQMX-QXVF Duplicate Advisory: uv vulnerable to arbitrary file deletion through RECORD entries

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pjjw-68hj-v9mw. This link is maintained to preserve external references. Original Description Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by...

GHSA-85PR-XR59-R75H Duplicate Advisory: SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-27mw-82g8-phjj. This link is maintained to preserve external references. Original Description SvelteKit @sveltejs/kit before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a...

GHSA-PVHG-7V4P-F5Q9 Duplicate Advisory: SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pfhg-q3qv-9q6r. This link is maintained to preserve external references. Original Description SvelteKit @sveltejs/kit before 3.0.0 contains an open redirect vulnerability in enhanced form actions use:enhance on...

GHSA-3CGQ-C484-RX5J Duplicate Advisory: vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gx7p-2j49-hfq4. This link is maintained to preserve external references. Original Description vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients ...

GHSA-F623-HJM8-5WG5 Duplicate Advisory: vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-h3rc-6mm3-gc2m. This link is maintained to preserve external references. Original Description vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mmprocessorkwargs.coderevision to Transformers...

GHSA-HFWF-HGVP-4RR8 Duplicate Advisory: vLLM vulnerable to remote denial of service through forged multimodal UUID cache desynchronization

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-p92p-rxj5-7p2x. This link is maintained to preserve external references. Original Description vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cac...

GHSA-X397-5HRV-J9M9 Cachet has Stored XSS in Incident Component

Summary A stored Cross-Site Scripting XSS vulnerability exists in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover...

GHSA-X32G-JVVM-4725 A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure

Impact. Push notification bearer tokens and authentication credentials submitted by clients are written to server log files in cleartext. Any operator, log aggregation system, or attacker with log access can read these secrets and use them to authenticate to the client's push notification...

GHSA-4FPJ-G9JF-9RGG A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix

The GHSA-9rhm fix added this safe setting in AndroidA2AHttpClient.createConnection: connection.setInstanceFollowRedirectsfalse; The synchronous POST builder later overwrites it: private boolean followRedirects = true; public A2AHttpResponse post throws IOException HttpURLConnection connection =...

GHSA-Q78C-5JJQ-57G8 A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

--- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common push-notification delivery - Affected versions: = 1.2.0.Final and 1.2.1.Final-SNAPSHOT on main prior to the fix - Patched version: the release that carries the fix - CWE: CWE-918 Server-Side Request Forgery -...

GHSA-QW47-MCM5-934W A2A Java SDK has a fail-open default task authorization

Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships. --- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common...

GHSA-9RHM-2H4X-JWMX A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect

Impact. A malicious or compromised A2A agent can cause the client's API key credential to be forwarded to an arbitrary third-party server. The agent serves an AgentCard with an APIKeySecurityScheme specifying a custom header name, then responds with an HTTP redirect. The JDK HttpClient follows th...

GHSA-58R4-6RV3-GFH8 Pillow: Out-of-bounds access in _imagingmorph on a zero-width image

Summary A PPM or PGM file can declare a width of 0, which Pillow accepts, producing an image of size 0, N. Passing that image to ImageMorph.MorphOp.apply makes the native morphology code index a row buffer at outrowwidth - 1, which is outrow-1 when the width is 0. The process crashes. Details The...

GHSA-65QM-JVMH-6PQG Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS

============================================================================ GIF seek keeps rejected size after DecompressionBombError, allowing DoS Location: src/PIL/GifImagePlugin.py:293 in GifImageFile.seek Commit: a707c6b21c313880d0771e54965d142dd42358b6...

GHSA-VX6W-VV9F-6GVG Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit

============================================================================ EPS loadscale lets Ghostscript render past the decompression bomb limit Location: src/PIL/EpsImagePlugin.py:92 in Ghostscript Commit: a707c6b21c313880d0771e54965d142dd42358b6...

GHSA-Q45J-58J2-45RG Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips

============================================================================ TiffDecode returns uninitialized memory as pixels for short JPEG strips Location: src/libImaging/TiffDecode.c:554 in decodeStrip Commit: a707c6b21c313880d0771e54965d142dd42358b6...

GHSA-PCHR-8J38-3X4P Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read

Summary A small attacker-supplied TIFF can be opened and loaded normally, then reach an out-of-bounds read when an application saves it back to TIFF with retained metadata. The fixed reproducer is a 1×1, 16-bit grayscale, PackBits-compressed TIFF containing tag 320 ColorMap with 768 SHORT values:...

GHSA-P4WG-P73J-C528 Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)

Summary When an application appends to an existing PDF with Image.save..., format="PDF", append=True, Pillow parses that file with PdfParser. Two recursive parsers have no effective bound. linearizepagetree follows /Kids with no visited set or depth limit, so a cyclic or duplicated page tree...

GHSA-462X-PGG6-55FP Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)

Summary Pillow's libImaging decodeTile decoder, used to decode tiled TIFF images, allocates a per-tile buffer using reallocstate-buffer, TIFFTileSizetiff. After each TIFFReadTile it then iterates tiley from 0 up to currenttilelength and calls the configured row unpacker here copy4 with the source...

GHSA-C6HW-5GRF-FF96 Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels

============================================================================ OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels Location: src/libImaging/TiffDecode.c:483 in decodeTile Commit: a707c6b21c313880d0771e54965d142dd42358b6...

GHSA-8G5G-8VMR-9782 Pillow: Heap buffer overflow in ImagingJpegDecode

Summary JpegImageFile.draft — which Image.thumbnail calls automatically — requests 1/2, 1/4 or 1/8 scaled JPEG output and shrinks self.size and the tile extents to match, so setimage allocates a single-row decode buffer of ceilW/s samples. ImagingJpegDecode sets cinfo.scalenum/scaledenom, calls...

GHSA-JFGX-762W-99VR @angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)

An incomplete fix for GHSA-58c5-g7wp-6w37 CVE-2025-66035 in @angular/common's HTTP Client HttpClient allows Cross-Site Request Forgery XSRF tokens to be leaked to attacker-controlled cross-origin domains when requests use URLs that exploit parsing discrepancies between regular expressions and the...

GHSA-GFR2-RV44-R23C markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

Summary A link reference definition whose label or title is never closed is On² in markdown-it 15.0.2 with default options. Continuation lines are pulled lazily with str += lineContent in src/rulesblock/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copyin...

GHSA-VFGH-JCMW-G37Q markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

Summary With html: true, markdown-it takes quadratic time to parse repeated unterminated HTML constructs inside a paragraph. This affects HTML comments , ?, , and . When the terminator is absent, matching fails. Parsing eventually reaches the next opener and scans an overlapping suffix again...