GHSA-VQRG-773H-4WXC Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content

Description def escapev: str - str: return strv.replace"'", "\'".replace"\", "\\" The escaping order is backwards, exactly like the classic HTML double-escape bug: step 1 inserts a literal backslash in front of every ', then step 2 re-matches that just-inserted backslash and doubles it. For an...

GHSA-G5FF-637F-6Q2M LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`

Summary An authenticated LiteLLM proxy user could read arbitrary local files from the proxy runtime by sending a crafted vertexaicredentials value to /utils/transformrequest. The request-body safety blocklist rejected vertexcredentials but missed its alias vertexaicredentials, which let the value...

GHSA-44JH-23M7-HPCF @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL

Am I affected? You are affected if you use @better-auth/drizzle-adapter from 1.6.17 through versions before 1.7.7 including the 1.7.0 prereleases from beta.6 through rc.6 or @better-auth/kysely-adapter 1.6.17 through 1.6.31, and keep rate-limit records in a PostgreSQL database. All of these must ...

GHSA-R4XP-PRCW-77QF better-auth: OAuth Proxy lets an attacker sign in as another user

Am I affected? You may be affected if you use better-auth from 1.5.0-beta.12 through versions before 1.7.7 with the OAuth Proxy plugin. You are affected only if all of these are also true: - On a participating environment, the OAuth Proxy plugin has no dedicated secret, or its secret equals that...

GHSA-965C-763C-88JM better-auth: OAuth state can be used as a Magic Link to sign in as another user

Am I affected? You may be affected if you use better-auth from 1.4.0-beta.18 through versions before 1.7.7 with the Magic Link plugin and social or Generic OAuth sign-in. You are affected if all of these are true: - Magic Link is enabled with default storeToken: "plain", or with storeToken:...

GHSA-HHWW-MRG2-969H LiteLLM vulnerable to reflected XSS in /sso/debug/callback

Summary The /sso/debug/callback endpoint reflected identity-provider-controlled fields into an inline block via json.dumps, which escapes JSON string syntax but not HTML context characters such as . An IdP-returned string field containing for example a user-editable display name closed the script...

GHSA-23MF-XHV8-69C2 GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)

A note on the referenced files. This report was submitted through GitHub's private vulnerability reporting API, which carries no attachments. Every transcript this report leans on is reproduced inline above, verbatim. The file names it mentions poc.sh, poc.log, per-case transcripts, evidence.md,...

GHSA-GQ48-PQFC-9P58 GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree

Summary GitPython's public Submodule.move API verifies that its destination is lexically inside the parent repository, but it does not reject symbolic links in the destination's intermediate components before filesystem operations. On systems that check out Git symlinks, an untrusted repository c...

GHSA-F9J4-QGGQ-H239 GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution

Summary Remote.pull in GitPython forwards its positional refspec argument directly to the git pull child process while its unsafe-option guard inspects only keyword arguments. An application that passes attacker-influenced data as the refspec for example a user-supplied branch or refspec paramete...

GHSA-W8JC-G24H-CRHW GitPython command wrappers omit unsafe protocol and option checks

Summary GitPython has spent 2022-2026 rolling out two reusable guards method-by-method: Git.checkunsafeprotocolsurl raises UnsafeProtocolError for :: remote-helper URLs - CVE-2022-24439 and Git.checkunsafeoptions... raises UnsafeOptionError for denylisted option spellings - CVE-2023-40267,...

GHSA-FX3J-RWGX-FR94 GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name

Summary Repo.clone's handling of separategitdir never disables Git.polishurl's environment-variable expansion, unlike every other caller of that helper that handles attacker-influenced data. Since separategitdir can be derived from an attacker-controlled .gitmodules submodule name, a completely...

GHSA-M64X-33Q8-M5H7 GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines

Summary This is a residual of GHSA-g5vv-9gxw-82hx / CVE-2026-87819. The 3.1.60 fix made Actor.fromstring regex-free, but parseactoranddate still runs reactorepoch on the same author/committer/tagger line one step earlier. That pattern backtracks quadratically when the trailing epoch or timezone i...

GHSA-4FFR-JQ9G-5FFX Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service

Summary Nodemailer's SMTP client applies four regular expressions to a peer's EHLO response to detect the supported SASL mechanisms. Each pattern uses an alternation with two overlapping whitespace-matching sub-patterns, which produces quadratic On^2 backtracking whenever the mechanism name is...

GHSA-G73G-HQQH-JR95 Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped

Summary Nodemailer's address parser has three published, patched fixes for RFC 5322 comment ... handling inside an addr-spec: GHSA-cc9r-2j5m-2m83 comment glued two domain atoms into one, GHSA-g57g-f23g-4646 the same glue for a quoted local part, and the related ReDoS fixes GHSA-prgh-xp8r-p3m5 /...

GHSA-4G23-2XM8-66GC Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service

Summary The SMTP client response parser reassembles multiline server replies by appending each continuation line onto a single response-queue entry and re-testing whether that entry is still a partial continuation reply on every line. The partial-response test runs str.slicestr.lastIndexOf'\n' + ...

GHSA-7HP6-4W63-5G45 LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key

Summary An authenticated user with internaluser privileges can escalate to proxyadmin and achieve remote code execution. The proxy uses one encryption key for two purposes: sealing secrets at rest and minting session tokens. An attacker exploits this by requesting a new API key with a crafted...

GHSA-J586-36CW-2GC2 MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure

Impact The msgpack-python C extension msgpack.cmsgpack leaks a decoded map value when deserialization rejects a key with strictmapkey=True the default. Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled...

GHSA-J456-XH4H-CPF2 NLTK: WekaClassifier passes an unvalidated caller-controlled model path to the weka JVM, bypassing nltk.pathsec containment

Summary WekaClassifier in NLTK passes a caller-controlled model file path to the weka Java VM without any nltk.pathsec validation. WekaClassifier.train puts the caller's modelfilename verbatim into the weka argv "-d", modelfilename, ... weka writes the trained model there, and...

GHSA-6V38-4H7W-RJ9H Authlib: empty signatures validation in JWS JSON deserialization

Authlib prior to 1.9.0 contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key. Root caus...

GHSA-Q84F-53JG-9PPM better-auth: Device login approval does not show the requesting client or permissions

Am I affected? You may be affected if you use better-auth from 1.3.8-beta.3 up to, but not including, 1.7.0-rc.3, and you enable the deviceAuthorization plugin. This range includes all 1.6 releases. You are affected only if all of these are also true: - An attacker can start a device request:...

GHSA-WX4J-MVGX-MQWP Satori-generated SVG has improper escaping

Impact Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Workaround No complete workaround exists besides upgrading. Applications tha...

GHSA-FRVG-QW88-HWW9 vllm p2p never connected zmq_exhaustion

Summary When the OffloadingConnector uses TieringOffloadingSpec with a P2P secondary tier, an API client can submit many unique non-listening peer addresses through kvtransferparams.prefill. vLLM keeps every never-established P2P session and its ZeroMQ sockets after the request finishes. On vLLM...

GHSA-QR6X-7V33-6QMG Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs

The public /api/remove endpoint uses attacker-controlled extras.sammodel in both SAM filenames and GitHub download URLs. Path traversal plus a URL fragment lets an unauthenticated attacker place malicious ONNX models beside a target file. The models read the file as ONNX external data and encode...

GHSA-JJ36-9PVH-VJ5R Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation

Summary twisted.names.dns.DNSDatagramProtocol, the UDP transport used by twisted's DNS client twisted.names.client.Resolver, createResolver, and anything built on it, including MX lookups in twisted.mail, accepts a DNS response for a pending query solely on the basis of the 16-bit transaction ID...

GHSA-QRH6-CWG3-343X Ghost: Authorization Bypass in Comment Like Feature

Impact An input validation issue allowed members to delete comment likes / dislikes that they were not authorized to delete. Vulnerable versions This vulnerability is present in Ghost from v5.9.0 up to v6.44.1. Patches v6.44.1 contains a fix for this issue. How to update For self-hosters using...

GHSA-C8R8-95HG-MP34 SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files

Summary kernel/mcp/tools/file.go's resolvePath includes an explicit comment stating its sensitive-path blocklist is meant to align with the HTTP file API's established blacklist refuseToAccess in kernel/api/file.go, following the remediation for GHSA-cvhv-7xhj-xjp8 "Unauthenticated Administrator...

GHSA-WQW6-WPR3-45RH fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'

Summary fpdf2 expands SVG references by deep-copying the complete referenced graphics tree. A small SVG can use nested references to make the number of in-memory objects grow exponentially, causing excessive CPU and memory consumption during FPDF.image processing. This was reproduced with an...

GHSA-RW7V-4HRQ-X6R9 fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content

Summary fpdf2 implicitly dereferences image resource references supplied to rendering APIs. If an application passes untrusted HTML, SVG, template data, or image paths into those APIs, fpdf2 may issue outbound HTTPS requests or attempt to open local filesystem paths. This behavior is relevant in...

GHSA-XXPH-C9WW-HJ94 Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation

CompactHashMap/CompactHashSet/MapMakerInternalMap native deserialization triggers uncontrolled memory allocation Summary CompactHashMap, CompactHashSet, and MapMakerInternalMap implement readObjectObjectInputStream by reading an attacker-controlled elementCount or initialCapacity from the stream...

GHSA-M4W4-3R8H-JW98 Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`

Impact Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component. The fieldtype parameter on a FunctionCall input field was passed to Python's built-in eval, allowing an attacker who could influence that value to execute arbitrary Python code...

GHSA-3JP2-3MRG-2VXC OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow

Summary A call to the token endpoint with a grant type of "urn:ietf:params:oauth:grant-type:devicecode" and a bogus devicecode is able to get a bearer token as long as they know a valid client ID enabled for the device workflow. Details Section 3.4 of the RFC 8628 spec says that the token endpoin...

GHSA-6HP3-VR39-RQW8 MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)

Summary An unauthenticated remote attacker can crash a running MONAILabel server or silently corrupt its medical AI inference results by uploading a single crafted DICOM file 132 KB via the REST API. The vulnerability stems from pydicom's lack of validation for Decimal String DS and Integer Strin...

GHSA-PX68-XX5G-48Q5 dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS

dcmjs, a JavaScript library for DICOM manipulation used in web-based medical imaging viewers, contains an input validation bypass in its handling of DS Decimal String and IS Integer String value representations. The DecimalString and IntegerString classes in ValueRepresentation.js use a regex...

GHSA-47HV-J4PX-H3C9 Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern | | | |---|---| | Product | wailsapp/wails v2 | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator latest as of 2026-03-26 ...

GHSA-V5FQ-CF5M-VWV7 Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter

Summary A SQL Injection vulnerability exists in the Third Party Company update functionality of Dolibarr ERP/CRM. The localtax1value parameter lt1 is concatenated directly into an SQL UPDATE statement in societe/class/societe.class.php at line 1672 without any escaping, type casting, or...

GHSA-VCW3-R3FX-J444 Ajenti has potential Remote Code Execution

Impact An unauthenticated user could gain access to a server to execute arbitrary code on this server. Patches This is fixed in the version 2.2.13. Users should upgrade to this version as soon as possible...

GHSA-JQC4-5CVW-7W85 filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name

ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock remove their private .filelock- link directories with shutil.rmtree a recursive delete on a remembered path. They do not check that the path still names the directory they created. This happens on the hard-link route a hard...

GHSA-9VHV-JXWW-XFM5 filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database

On Windows, ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: -journal, the rollback journal pages saved to undo an interrupted write; -wal, the write-ahead...

GHSA-567Q-5QVW-PF92 filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break

On Windows the soft locks SoftFileLock, MarkerSoftFileLock, SoftFileLease, their async forms, and a FileLock that fell back to a soft lock read their marker by path. The marker is the lock file whose presence says a process holds the lock. Each acquire attempt that finds a marker opens it with...

GHSA-4F8H-VR72-P32C virtualenv: Temporary app-data can leave dangling seed package links

Summary The app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlinkappdata can enable this state even though the command-line flag is disabled for temporary app-data...

GHSA-CX28-75Q4-X26Q virtualenv: Pip seeding with download omits wheel digest verification

Summary The pip seeder acquires bundled wheels with download=False and lets pip access the index when --download is selected. Index candidates on that path do not pass through virtualenv's wheel digest verification. Anthropic's OSS Scanner reported this as ANT-2026-74ALJBUF in...

GHSA-494P-63J8-28P3 virtualenv: Downloaded wheel selection and caching precede verification

Summary Wheel downloads go directly into the reusable wheelhouse, while the verification target is selected from pip's textual output. A verification failure does not remove the downloaded file from that cache. Anthropic's OSS Scanner reported this as ANT-2026-ST00DRO3 in virtualenv-20261015-005,...

GHSA-394H-QWMC-48PF virtualenv: Xonsh activation literals depend on the script decoding codec

Summary Caller-supplied prompt text can become executable syntax in the xonsh activation script. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment. Affected area Xonsh reads a UTF-8 activation script using a legacy multibyte encoding...

GHSA-FC2G-4W5P-6WHM virtualenv: Seeded files retain permissions from an older cache

Summary The app-data copy seeder uses shutil.copy, which preserves cached file modes independently of the current umask. A cache populated under permissive permissions can therefore produce files with wider access in later environments. Anthropic's OSS Scanner reported this as ANT-2026-487MH6OW i...

GHSA-6W3R-XR62-4XCP virtualenv: Bash prompt values can change meaning under older compatibility modes

Summary Caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. Affected area Bash runs with compatibility level 4.2 and draws the...

GHSA-QMX5-4P3X-WVQF virtualenv: Venv configuration readback can reinterpret path boundaries

Summary The venv creator reads the standard library's generated pyvenv.cfg with splitlines and merges all resulting keys over virtualenv's configuration. Line-boundary characters from destination data can therefore become configuration structure before output sanitization. Anthropic's OSS Scanner...

GHSA-HHXQ-47XX-J5XX virtualenv: Seed replacement does not contain metadata deletion paths

Summary The app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths without checking containment within the environment. Anthropic's OSS Scanner reported this as ANT-2026-SXOEHWP7 in virtualenv-20261015-005, received on 15 October 2026...

GHSA-XCX6-JX8P-X3H5 MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint

Impact Origin validation error in Microsoft Authentication Library MSAL for Node.js allows an unauthorized attacker to disclose information over a network. This affects the authcode flow. Patches Version 7.1.0 and higher are patched. Workarounds Ensure you pass in only the authcode to to...

GHSA-XJJ6-F33Q-929C undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

Impact undici's fetch crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses a content-encoding limit, but it created the internal response stream before that check...

GHSA-4QV8-2P9J-2685 undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

Impact undici's EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data: fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing...