GHSA-3325-V43H-43RV JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs

JupyterLab's PyPI extension manager runs python -m pip uninstall with the extension name taken from the request body. ExtensionHandler.post validates the name for cmd=install but not for cmd=uninstall, so a name that begins with - reaches the command line and pip reads it as an option rather than...

GHSA-6966-VJJ6-99XV JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

Description JupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses clipboard text as cell JSON and inserts the cells without clearing metadata.trusted, so a payload can declare its own output as trusted. JupyterLab does not sanitize a trusted output...

GHSA-7HHH-6RMP-J9QF jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)

Status FULLY REPRODUCED. A malformed token fed through createParserDataInput produced a 20,000,109-character exception message from a 20-million-character attacker payload, while the identical payload fed through createParserInputStream produced a correctly bounded 367-character message. Affected...

GHSA-P6PP-M3F8-5C89 jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()

Status FULLY REPRODUCED with a clean, textbook empirical signature: measured runtime grew almost exactly 4x for every doubling of input size across five consecutive doublings 5,000 → 160,000 characters, confirming On² behavior. A single 160,000-character string smaller than a typical HTTP request...

GHSA-J22F-VQ7H-C4QM devalue: `stringify`/`uneval` serialize shared memory

Impact stringify and uneval serialize a typed array by emitting its backing ArrayBuffer, not just the view. In the case of a Node Buffer object, the backing buffer is a process-wide shared pool, meaning unrelated memory can be serialized into a response that is then sent to the client. For a Node...

GHSA-HX4R-W6WJ-J8FG devalue: Residual sparse-array CPU amplification in uneval

uneval performs synchronous work proportional to a sparse array's declared length. An application that passes attacker-influenced sparse values to uneval can suffer event-loop blocking. Since attacker-controlled creation of sparse arrays is so difficult, this vulnerability is very difficult to...

GHSA-MCM9-63F2-9J32 devalue: Repeated primitive strings cause quadratic expansion in uneval

Under very constrained circumstances, data that was parsed and then passed to uneval could turn a small payload into a very large serialized string...

GHSA-WF3X-273G-MVXV devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated

Evaluating legitimate uneval output for a sparse array can allocate memory proportional to its declared length. A tiny serialized value can therefore cause large memory allocation in a consuming browser/runtime. This occurs during evaluation of generated code, not in default parse sparse-array...

GHSA-R9W8-H9R3-54W4 devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation

Under very specific circumstances, parse could create massive ArrayBuffers with very small input. This required a malformed ArrayBuffer custom reviver...

GHSA-X5RW-Q4PP-HG5G devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise

When serializing multiple promises, a later promise can reject before an earlier one settles. An internal rejected promise remains unhandled even if the caller catches the returned stringifyAsync promise. Under Node's default unhandled-rejection behavior this can terminate the process. Applicatio...

GHSA-4Q55-J62X-FR9H devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion

This is another instance of https://github.com/sveltejs/devalue/security/advisories/GHSA-mwv9-gp5h-frr4, where some payloads could cause parse to create objects with a proto own property. This on its own is not enough to cause prototype pollution, and indeed this is actually how JSON.parse works,...

GHSA-P58F-9548-MPM2 virtualenv bash and fish activation scripts execute commands embedded in paths

Impact The generated activate bash/zsh and activate.fish scripts interpolate a shlex.quote-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs comman...

GHSA-X78J-V8H9-3J2Q virtualenv: Command injection via --prompt in activate.bat (batch activator)

BatchActivator.quote returned its input unchanged, the only activator with no escaping at all. --prompt, the VIRTUALENVPROMPT environment variable, and the config file all set the prompt, and activate.bat writes it straight into @set "VAR=value". A prompt containing a double quote closes that...

GHSA-V247-6F48-MGCJ pypdf: Possible long runtimes with large amount of embedded files

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing the embedded files through the dictionary-based API. Patches This has been fixed in pypdf==6.19.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4081...

GHSA-PHP9-FJ8V-98FJ pypdf: Possible long runtimes when generating appearance streams

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires updating form field values with flattening enabled, which triggers appearance stream generation. Patches This has been fixed in pypdf==6.19.0. Workarounds If you cannot upgrade yet, consider...

GHSA-W23X-9JRW-R45C pypdf: Possible large memory usage when retrieving alphabetical page labels

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing the page labels of a document with large alphabetical labels. Patches This has been fixed in pypdf==6.19.0. Workarounds If you cannot upgrade yet, consider applying the...

GHSA-JW7Q-GVRG-4VJ3 pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a partially malformed /FlateDecode stream, where the byte-by-byte decompression is used. Patches This has been fixed in pypdf==6.18.1. Workarounds If you cannot upgrade yet, consider applyin...

GHSA-G9CG-PRRW-2R8Q pypdf: Possible large memory usage when parsing font data

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the /Widths entry of a TrueType or Type1 fonts with unusually large values, for example during text extraction. Patches This has been fixed in pypdf==6.18.1. Workarounds I...

GHSA-FP3H-C4FM-7VVF pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction. Patches This has been fixed in pypdf==6.18.1. Workarounds If you cannot...

GHSA-5JQ2-8X83-X246 pypdf: Possible long runtimes/large memory usage when parsing indirect objects

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires reading a PDF document with long indirect object headers, not terminated by whitespace. Patches This has been fixed in pypdf==6.18.0. Workarounds If you cannot upgrade yet, consider applying...

GHSA-QV6H-RV94-W285 pypdf: Possible large memory usage when retrieving Roman page labels

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing the page labels of a document with large Roman numerals. Patches This has been fixed in pypdf==6.17.0. Workarounds If you cannot upgrade yet, consider applying the chang...

GHSA-67C8-PQHQ-4RMX piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env

Summary A prototype-pollution gadget in ThreadPool.options allows an attacker who can pollute Object.prototype to execute arbitrary code in Piscina worker threads, invoke arbitrary functions during task scheduling, or inject environment variables into workers. The root cause is that...

GHSA-C475-QRG2-PJ4R basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)

Summary Client.list parses the server's directory listing with the Unix-style parser in parseListUnix.js. Its RELINE regex has two adjacent \S+?:\s\S+ groups owner name, then group name followed by a required numeric size group. When a line starts with a valid listing prefix but the tokens after ...

GHSA-HGFG-J9PG-43XW SiYuan discloses an administrator's open documents and search terms to anonymous readers

Summary /api/system/getConf serves Conf.UILayout to publish readers after passing it through FilterConfByPublishIgnore, whose only function is to filter that layout. The layout is written exclusively by setUILayout, which is administrator-gated, so what readers receive is the administrator's own...

GHSA-33JQ-P8C2-Q3Q4 SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking

Summary The /api/filetree/searchDocs endpoint concatenates the caller-supplied search keyword directly into a SQL statement with no escaping and no parameter binding. The endpoint is gated by CheckAuth only reachable by the publish RoleReader token, and by the anonymous account when...

GHSA-94P9-XGH2-XP45 virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

downloadwheel runs pip download and hands the result straight to the seeder, with nothing checking the bytes it gets back. The embedded pip and setuptools wheels carry a BUNDLESHA256 that virtualenv checks on every load, but a wheel fetched over the network for the periodic-update feature or the...

GHSA-9H9J-4VRJ-GF7G virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

Summary pyvenv.cfg is a line-based format with no escape syntax. PyEnvCfg.write wrote values verbatim, while PyEnvCfg.readvalues parses the file with str.splitlines. A value containing a line boundary therefore became additional configuration lines, and because reading is last-wins, the injected...

GHSA-4MH8-R7RC-XPVC fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

Impact fastify crashes with an uncaught ERRHTTP2INVALIDCONNECTIONHEADERS exception when a route that registers a response trailer via reply.trailer is served over HTTP/2. Fastify unconditionally adds the Transfer-Encoding: chunked header when a trailer is set, which is forbidden on HTTP/2, so...

GHSA-GVP8-978C-RX2Q PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

Summary PyJWT.decode/decodecomplete mutates a caller-supplied options dict in place whenever verifysignature is falsy, adding verifyexp/verifynbf/verifyiat/verifyaud/verifyiss/verifysub/verifyjti keys directly onto that object. If application code reuses the same options dict across calls a confi...

GHSA-3HV7-MJH2-FV65 Tornado: Unbounded query-string argument count allows event-loop-stalling DoS

Summary HTTPServerRequest.init in tornado/httputil.py parses the URL query string via parseqsbytes with no field-count limit — while the sibling POST-body parsing path parsebodyarguments received a maxnumfields=1000 cap added earlier in this exact same release v6.5.8, commit 8d6363ed, explicitly ...

GHSA-CHX6-46F5-W4VP tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM

An unbounded memory accumulation decompression bomb in tornado.curlhttpclient.CurlAsyncHTTPClient — the client-side sibling gap of CVE-2026-49855 — verified end-to-end on the 2026-08-15 master snapshot 6.6.dev1 and present unchanged in the latest release tag v6.5.8 and on master checked 2026-08-1...

GHSA-C2M8-H5V5-343R Tornado: StaticFileHandler follows symlinks outside static root (path traversal)

Summary StaticFileHandler allows an unauthenticated attacker to read arbitrary files from the server's filesystem by requesting a path that resolves to a symbolic link placed inside the static root directory. Any application that serves user-uploadable content, or whose static directory is...

GHSA-59CR-6R3X-644W GitPython submodule update path traversal can write outside the repository

Affected: GitPython 3.1.61 latest release and main — git/objects/submodule/base.py. git diff 3.1.61 origin/main -- git/objects/submodule/ is empty, so both are identical here. --- The gap The fix for GHSA-hmq2-w58f-27jc added Submodule.validatedname and wired it into update and five siblings,...

GHSA-HXH3-VQPV-XPQV hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Summary hono/jsx does not HTML-escape a plain string placed directly as a child or fallback of Suspense or ErrorBoundary, as the only child of a Context.Provider, or as the root value of renderToString / renderToReadableStream from hono/jsx/dom/server. Such a string is emitted as markup instead o...

GHSA-667R-XXJV-C9MM fastify vulnerable to request body replacement via an async validation result collision

Impact Fastify runs a route's validator and, for a result shaped like value, error , unwraps it: an error becomes a validation failure and value replaces the request part. This convention is intended for synchronous custom compilers for example Joi. A JSON Schema $async validator, however, resolv...

GHSA-P68Q-WCHP-6FH7 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

Impact Fastify routes a malformed URL under one plugin prefix to the custom not-found handler of a different sibling plugin, invoking the handler registered last and skipping the preHandler declared in its setNotFoundHandler. When the request method has no route in the main router, a malformed...

GHSA-HWR6-493R-VM6H fastify vulnerable to request validation bypass via skipped boolean false schemas

Impact Fastify decided whether to validate a request part by checking its schema for JavaScript truthiness. JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance, but because false is falsy, a route that set body, querystring, params, or headers to false had...

GHSA-9Q9J-Q6P8-XQ58 fastify vulnerable to header validation bypass via incomplete schema case normalization

Impact Fastify lowercases header-schema property names before compiling the schema, because Node.js stores request header names in lowercase. That normalization was incomplete: it lowercased only top-level properties keys and the root required array, and did not lowercase the JSON Schema Draft 7...

GHSA-G4MP-VGX3-XRVM pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)

Summary MemoryMap::read in the pageant crate part of the russh workspace, used by russh's SSH-agent client on Windows via AgentClient::connectpageant copies a peer-controlled number of bytes out of an 8192-byte shared-memory view with no bounds check — unlike the sibling MemoryMap::write, which...

GHSA-35G8-35P8-C8FW Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey

Summary A russh server can be driven to unbounded heap growth process OOM / kill by a peer that speaks only standard SSH messages, in the default configuration. The peer starts a key re-exchange sends SSHMSGKEXINIT but never sends the follow-up SSHMSGKEXECDHINIT, leaving the server's kex state...

GHSA-4233-JC72-56C5 Astro: Netlify Image CDN allowlist bypass enables SSRF

Summary The @astrojs/netlify adapter generated regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Netlify evaluates these expressions with RegExp.test, so an allowed image origin appearing anywhere in a URL, including its path or...

GHSA-QH8J-HQJV-7M4X Astro: Malformed port in the Host header can crash the Node adapter

Summary In the Astro Node adapter, a request whose Host header contains a malformed port for example example.com:65536 or example.com:8080:8080 produced an invalid request URL. The fallback intended to recover from an unparseable URL reused the same malformed host, so it failed again and raised a...

GHSA-G5VV-9GXW-82HX GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing

Summary GitPython's Actor.nameemailregex regular expression git/util.py, line 863 is vulnerable to catastrophic backtracking ReDoS — Regular Expression Denial of Service. When GitPython parses the author or committer header of a git commit object that contains a long string with an unterminated ,...

GHSA-WHH4-5Q6C-9V3X GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle

Summary GitPython 3.1.59 blocks a previously available local-file read path through unsafe git diff options such as -O/--orderfile. However, the high-level diff API still permits --no-index with the default allowunsafeoptions=False. --no-index changes the semantics of the paths arguments: instead...

GHSA-239G-WHFQ-7XJ9 GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution

Summary Repo.init decides which directory is the git directory by testing candidate paths in an order that considers the real .git last. Two earlier tests can be satisfied by ordinary tracked files. Git reserves only the literal name .git, so HEAD, objects/, refs/, config, gitdir, commondir and...

GHSA-P8QX-H547-FJW9 russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic

Summary SshBlockCipher implementations AES-CBC, AES-CTR, 3DES-CBC, etc. report needsmac == true, meaning they are documented/intended to always be paired with a separate integrity MAC. However, key-exchange negotiation only checks needsmac inside the fallback branch of MAC algorithm selection use...

GHSA-47HW-GVQ5-R2GM russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened

Summary CVE-2026-68930 was fixed by adding Session::isestablishedchannel in russh/src/server/encrypted.rs, which gates every channel-scoped SERVER-side message CHANNELREQUEST, CHANNELDATA, CHANNELEOF, CHANNELCLOSE, CHANNELWINDOWADJUST, CHANNELEXTENDEDDATA on enc.channels.get&channel.issomeand|c|...

GHSA-W3JG-PJXF-73P4 Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange

Vulnerability The hybrid ML-KEM 768 + X25519 key exchange implementation in russh/src/kex/hybridmlkem.rs does not validate that the remote peer's X25519 public key is not the zero point all-zero 32-byte value. This allows a remote peer to force the X25519 contribution to the combined shared secre...

GHSA-G6XM-F9XP-QQ35 Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path

Details Affected versions and vulnerable location - Confirmed present on default branch main at HEAD 0089c89c94753bebbec12b956c07a1cd38740379. - Crate version at HEAD: 0.62.4. - Vulnerable locations on current default branch: - russh/src/server/mod.rs:91 pub maxauthattempts: usize -...

GHSA-3CV6-JPF6-8222 LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

Impact Any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination they control and cause the proxy to send its own configured provider credentials to that destination. The proxy's request-body validation was a denylist that did not cover every sensitive paramet...