GHSA-5XFX-XJ4H-5P7R SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()

Summary The attribute-view database cell renderer genAVValueHTML interpolates cell content raw in four of its branches: text, url, phone, and mAsset. A cell value like or " breaks out of its surrounding tag and runs arbitrary JavaScript in the renderer when the victim opens the block-attribute...

GHSA-G5R6-GV6M-F5JV mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment

Summary confluenceuploadattachment passes filepath directly to openfilepath, "rb" with no path validation. Any authenticated MCP client — or an AI agent manipulated via prompt injection — can read any file the server process can access and exfiltrate it to Confluence as an attachment. Details Roo...

GHSA-WM45-QH3G-V83F mcp-atlassian: Arbitrary server-side file read via attachment upload

Summary A client that can invoke MCP tools can read arbitrary files from the server host and exfiltrate them as Atlassian attachments. The attachment-upload tools take a client-supplied filepath and open it on the server's filesystem. The upload tools are meant to attach a file from the caller's...

GHSA-XRMC-C5CG-RV7X SafeInstall agent guard shell parsing can miss raw package execution

Summary SafeInstall CLI through 0.10.1 can fail to recognize some package-manager and registry-runner commands in its agent guard. Case-variant launcher names, leading file-descriptor redirections, and supported shell wrappers with options can cause a raw install command to receive no guard...

GHSA-QV4M-M73M-8HJ7 NotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM employee "Documents" (doc_file)

Summary An authenticated user with the HR "Manage Employees" permission SAEMPLOYEE can upload a file with an arbitrary extension through the employee Documents tab. The handler writes the raw client-supplied filename — extension intact — into a web served directory with no extension, MIME, or...

GHSA-M8GF-V64P-GFMG BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py

Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py Summary BabelDOC's vendored PDF parser babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when loading CMap files. The loaddata method strips only NUL bytes from a PDF-controlled CMap name, then...

GHSA-M93H-4HW7-5QCM File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)

Overview The Hook Authentication feature in File Browser allows administrators to delegate login verification to an external shell command. User-supplied credentials username and password are interpolated into this command string using os.Expand without sanitization. An unauthenticated remote...

GHSA-99J7-FHR2-XFJ4 `exploration` was removed from crates.io for malicious code

A method within the exploration crate attempted to download and execute a payload from a remote site. The malicious crate had 1 version published on 2026-06-02, approximately 1 hour before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Rustsec to Kirill...

GHSA-2PPX-66JV-WPW5 Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search

Summary A resource-scoped API token can read script contents outside its allowed path scope via GET /api/w/workspace/scripts/listsearch. This appears to be a remaining variant of the scoped-token authorization class previously addressed for other endpoints. The route-level scope middleware...

GHSA-W7CG-WHH7-XP28 SiYuan: Stored XSS in Bazaar marketplace via package README event handlers

Summary renderPackageREADME in kernel/bazaar/readme.go renders a Bazaar package README from Markdown to HTML with the lute engine and SetSanitizetrue. The lute sanitizer is an event-handler blocklist: allowAttr rejects only attribute names present in a fixed eventAttrs map copied from the w3schoo...

GHSA-XQP3-JQ6G-X3QM File Browser: Authentication Bypass via Proxy Auth Header Forgery

Summary When FileBrowser is configured with proxy authentication auth.method=proxy, any unauthenticated attacker who can reach the server directly can impersonate any user - including admin - by sending a single forged HTTP header. No credentials are required. Additionally, specifying a...

GHSA-HVR9-72V2-FFF3 SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist

Summary SiYuan Note's kernel HTTP server unconditionally trusts all chrome-extension:// origins, granting RoleAdministrator access to every installed browser extension without any authentication. Combined with the default empty AccessAuthCode on desktop installs, any Chrome/Chromium extension --...

GHSA-GCM7-57GF-953C SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon

Summary The /api/icon/getDynamicIcon endpoint is explicitly excluded from authentication in SiYuan's kernel router router.go, "不需要鉴权" -- no auth needed. When called with type=8 and a valid block id parameter, this endpoint invokes RenderDynamicIconContentTemplate, which executes a Go template tha...

GHSA-9MQM-QCWF-5QHG CredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources

Summary CredSweeper's deep scanner does not enforce recursivelimitsize as a hard limit. Several recursive scanners fully decompress or fully read attacker-controlled content before the remaining budget is validated, and AbstractScanner.recursivescan continues processing even when the residual...

GHSA-H69G-9HX6-F3V4 Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)

Unbounded Row Index Allocation in Worksheet Parser checkSheet OOM/Panic DoS Summary The checkSheet function in github.com/xuri/excelize/v2 uses an attacker-controlled XML attribute value directly as the length argument to makexlsxRow, row without validating it against the Excel row limit TotalRow...

GHSA-H29V-HJ44-Q8CV Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL

Summary The /authorize endpoint accepts any redirecturi without validating it against AllowedOrigins. When responsetype=token or responsetype=idtoken, the server appends accesstoken, idtoken, and refreshtoken as query parameters and issues a 302 redirect to the attacker-supplied URL. An...

GHSA-MVJR-VV3C-W4QV SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()

Summary A CSS snippet body containing breaks out of its surrounding tag when renderSnippet interpolates it via insertAdjacentHTML. A payload like runs arbitrary JavaScript in the renderer. On Electron desktop builds the renderer runs with nodeIntegration:true, so require'childprocess' is reachabl...

GHSA-P4M3-MGMM-C664 SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894

Summary The patch for CVE-2026-41894 "Path Traversal via Double URL Encoding" sanitized the /export/ route but the identical root cause remains in the /assets/path route. In publish mode anonymous read-only HTTP endpoint, default port 6808, an unauthenticated remote attacker can read arbitrary...

GHSA-XCPC-8H2W-3J85 adm-zip: Crafted ZIP file triggers 4GB memory allocation

adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js line 103, Buffer.alloccentralHeader.size allocates memory based on the declared uncompressed size from the ZIP central directory header without...

GHSA-489G-7RXV-6C8Q MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826)

Summary GHSA-7r34-79r5-rcc9's fix added validateurlforssrf, which resolves the attacker-controlled X-Atlassian-Jira,Confluence-Url header host once at middleware time and trusts the result. But the outbound request is later built with the raw hostname and re-resolves at connect time with no IP...

GHSA-JXJ7-G6GM-49J7 tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies

Summary tarteaucitron provides a list of cookies and buttons to delete them. If an attacker can write HTML with data attributes, they could create an element that silently deletes a cookie when clicked and trick a user to delete this cookie. Details tarteaucitron.cookie.purge is called on any...

GHSA-CWC9-CP4J-MCVV libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays

Summary gossipsub processes IHAVE and IWANT control messages by iterating every received message ID synchronously before doing anything with the results. There is no cap on how many IDs a single frame may contain. The default LP frame limit is 4MB, which fits roughly 180,000 message IDs. Iteratin...

GHSA-PJ8J-P4G4-4VW8 Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs

Summary Kimai 2.56.0 contains a server-side request forgery vulnerability in its invoice PDF preview and generation workflow. If an attacker can control Markdown content that is later rendered into an invoice PDF, such as Customer.invoiceText, the server-side PDF renderer will fetch remote image...

GHSA-C6PQ-CPRJ-62FW Duplicate Advisory: PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4gfv-wg42-7jw5. This link is maintained to preserve external references. Original Description PraisonAI pip package praisonaiagents before 1.6.78 contains an unsafe dynamic module loading vulnerability in...

GHSA-WRW8-384C-CG76 Duplicate Advisory: PraisonAI: Shell command allowlist bypass via find -exec built-in action

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cv3g-hj65-pcfh. This link is maintained to preserve external references. Original Description PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command execution that allows...

GHSA-RRQJ-82CC-G6H4 Duplicate Advisory: PraisonAI: Project config can auto-save agent output outside the project root

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qjw5-xwrp-xwpq. This link is maintained to preserve external references. Original Description PraisonAI pip package praisonaiagents before 1.6.78 automatically loads defaults from a project-local...

GHSA-2VWW-6P9H-5G8J Duplicate Advisory: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w867-jm58-p9pv. This link is maintained to preserve external references. Original Description n8n before 2.28.0 and before 1.123.58 on the 1.x branch contains a disk space exhaustion vulnerability in the...

GHSA-W37C-CQ55-FRJP Duplicate Advisory: PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q7m5-3jmv-vm48. This link is maintained to preserve external references. Original Description PraisonAI before 4.6.78 contains a path traversal vulnerability in ContextGatherer that fails to validate include pat...

GHSA-3F4V-MP44-X4X2 Duplicate Advisory: PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4xxv-6wmf-xf45. This link is maintained to preserve external references. Original Description PraisonAI praisonaiagents before 1.6.78 contains a path traversal vulnerability in the FastContext feature...

GHSA-5C3V-H6HW-4GX7 Duplicate Advisory: PraisonAI: Prompt-injection defense blocks only when 3+ detector families fire simultaneously; realistic single-vector injections pass through unblocked

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4r3p-w3mc-5v34. This link is maintained to preserve external references. Original Description PraisonAI before 4.6.78 contains a prompt injection defense bypass vulnerability where the injection defense only...

GHSA-3WRM-PM5V-8VQ8 Duplicate Advisory: PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4w49-gwv8-fpjg. This link is maintained to preserve external references. Original Description PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API...

GHSA-4VJ7-5MJ6-JM8M morgan vulnerable to Log Forging via unneutralized control characters in :remote-user

Impact Morgan's :remote-user token extracts the Basic auth username from the Authorization header and writes it to the log stream without neutralizing control characters. An attacker can send a crafted Authorization: Basic header containing CR/LF characters to inject forged log lines, corrupting...

GHSA-PJHX-3C3W-9V23 API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate

Impact ApiPropertysecurity: ... is evaluated per request to decide whether a property is exposed. The componentsCache arrays in ApiPlatform\JsonApi\Serializer\ItemNormalizer and ApiPlatform\Hal\Serializer\ItemNormalizer are keyed on $context'cachekey', which is set unconditionally before delegati...

GHSA-JWP9-9V96-94MX decompress allows arbitrary hardlink creation during archive extraction

decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries type === 'link', the x.linkname field from the archive is passed directly to fs.link without validation index.js line 113. An...

GHSA-28JH-G32X-V9V4 Tesla vulnerable to multipart part smuggling via unescaped `content-disposition` values

Summary Tesla.Multipart.partheadersfordisposition/1 interpolates Content-Disposition parameter values field name, filename, and other opts verbatim into the part header line without encoding or escaping any special characters. An attacker who controls a filename, field name, or other disposition...

GHSA-H74C-Q9J7-MPCM Tesla vulnerable to atom exhaustion via untrusted URL scheme

Summary In the Mint adapter for the Tesla HTTP client library, Tesla.Adapter.Mint.openconn/2 passes the URL scheme of every outgoing request through String.toatom/1 with no allow-list validation. Because BEAM atoms are permanent never garbage-collected and the atom table is bounded at roughly...

GHSA-9M9W-GXF7-RH8M Tesla: Authorization header leaks on cross-origin redirect via case-sensitive filtering

Summary Tesla.Middleware.FollowRedirects is meant to strip the Authorization header when following a cross-origin redirect, but performs the check with a case-sensitive comparison against the lowercase string "authorization". Because Tesla preserves header keys exactly as supplied by the caller,...

GHSA-MC85-72GR-VM9F Tesla has decompression bomb on response body

Summary Any Tesla client pipeline that includes Tesla.Middleware.DecompressResponse or Tesla.Middleware.Compression eagerly decompresses HTTP response bodies with no size limit. A server under attacker control or reached via a redirect can return a tiny gzip-encoded payload that expands into...

GHSA-Q7JX-V53G-848W Tesla has CRLF injection in request `Content-Type` header via `add_content_type_param`

Summary Tesla.Multipart.addcontenttypeparam/2 appends caller-supplied strings to the multipart Content-Type header with no validation. A param value containing \r\n splits the header line, allowing an attacker who controls any content-type parameter charset, boundary parameter, etc. to inject...

GHSA-QCQ2-496W-V96P Mistune: Potential DoS via quadratic-time parsing in parse_link_text

Summary Mistune is vulnerable to a CPU exhaustion DoS due to superlinear approximately On² behavior in parselinktext. A relatively small input consisting of repeated characters causes significant parsing slowdown. Affected component mistune/inlineparser.py → parselinktext Description When parsing...

GHSA-FRRJ-87JH-2772 GoBGP confederation validation panics on empty AS_PATH attribute

Found through variant analysis based on CVE-2026-41643 Summary GoBGP accepts a zero-length ASPATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP UPDATE validator: a malformed UPDATE that should be rejected a...

GHSA-GJRG-JJR3-56CM GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries

Summary GoBGP contains a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded by the declared capability length, CapLen. A malformed BGP OPEN message can cause bytes from a following...

GHSA-2RMG-VRX8-9J2F psd-tools vulnerable to arbitrary file write via smart-object filename

psd-tools: arbitrary file write/read via smart-object path traversal Summary In psd-tools all releases exposing the SmartObject API through v1.17.0, SmartObject.save writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitise...

GHSA-9VCR-P3RJ-Q5Q6 sigstore-go has a multi-log threshold bypass via single compromised log

Impact What kind of vulnerability is it? Who is impacted? A verifier configured with WithTransparencyLogN1 or WithSignedCertificateTimestampsN1 expected defense-in-depth against the compromise of a single log instance. However, threshold counting counted verified witnesses per-entry or...

GHSA-H672-P7H7-97V9 Rattler vulnerable to package cache path traversal via conda package build string

rattlercache and py-rattler were vulnerable to package-cache path traversal when handling package metadata from conda channels. During cache materialization, the rattercache code used the package record build string as part of a cache key that was joined into a filesystem path. A malicious or...

GHSA-H5G6-XMH4-HC37 OpenRun: Redirect URL validation bypass using  //host  paths leads to Open Redirect

Summary The restrictions on redirect URLs in openrun can be bypassed by attackers, leading to open redirect attacks. Details In the current project, the referrer header value is used for subsequent redirects, so there is currently a validation for this redirect value. The current validation logic...

GHSA-G586-CCQF-7X4R mint: Unbounded streams map growth via PUSH_PROMISE without follow-up HEADERS

Summary Mint's HTTP/2 client accepts PUSHPROMISE frames from any server it connects to and inserts every promised stream into a per-connection map without consulting maxconcurrentstreams. A malicious or compromised HTTP/2 server can flood the client with PUSHPROMISE frames and withhold the matchi...

GHSA-2P26-P43X-FHP8 mint: Unbounded CONTINUATION/HEADERS frame accumulation (CONTINUATION flood)

Summary Mint's HTTP/2 client accumulates CONTINUATION header-block fragments into a per-connection buffer with no cap on size or frame count. A malicious or compromised HTTP/2 server can drive the client's memory to arbitrary size by streaming an endless chain of CONTINUATION frames after a HEADE...

GHSA-MJQX-C6F6-7RC2 mint: Content-Length header accepts non-RFC "+" sign prefix

Summary Mint's HTTP/1 client accepts Content-Length header values with a leading + sign e.g. +0, +123, which RFC 7230 forbids Content-Length = 1DIGIT. On a connection shared with a strict fronting proxy or load balancer, this parser disagreement is a response-smuggling primitive: the proxy frames...

GHSA-2PG6-44CX-C49V mint has potential CRLF injection in its HTTP request line via unvalidated `method`/`target`

Summary Mint's HTTP/1 request encoder splices the caller-supplied method and target directly into the request line without character validation. An application that forwards attacker-controlled input as the HTTP method or the target to Mint.HTTP.request/5 is exposed to request-line CRLF injection...