GHSA-558C-9HV2-4PRJ virtualenv: Generated files can follow existing destination links

Summary Generated activation files and pyvenv.cfg can follow existing links and write outside the requested environment. The template writer tests exists before unlinking, which misses dangling symlinks; the configuration writer opens the existing path directly. Anthropic's OSS Scanner reported...

GHSA-78G4-XQWV-Q3G8 Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()

Summary Every Pillow wheel from 11.1.0 onward bundles a libopenjp2 containing a heap-buffer-overflow write that is fixed upstream on master but has never appeared in an OpenJPEG release. See https://osv.dev/vulnerability/OSV-2025-219 Because the wheel bundles its own copy, a patched host OS does...

GHSA-VJH5-4X84-XRQP Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

Impact With the default router.options.sensitive: false, Nuxt's page router resolves routes case-insensitively, so /Admin renders the same page as /admin. On the server, however, route rules were resolved with Nitro's route-rule matcher, which matches keys case-sensitively. A request whose path...

GHSA-XFQ5-W38Q-PC2X Nuxt server islands render `useHeadSafe` input without sanitisation

Impact useHeadSafe restricts head input to an allowlist of safe tags and attributes. For example, bodyAttrs is limited to class and style, event handler attributes are removed, and tags are only kept for JSON types. When useHeadSafe is called inside a server island a .server.vue component or page...

GHSA-JJM6-P2M9-9W4X Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled

Impact An application that renders with a value it does not control can be made to render an anchor whose href executes script in the application's origin when clicked. This is an incomplete fix for GHSA-934w-87qh-qr26 CVE-2026-53722. It only affects applications running without a pages/ director...

GHSA-6GQ8-JGMH-3FFP Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes

Summary Nuxt compared routeRules keys against the raw request path, without decoding percent-encoding, while the router decodes parameters when it resolves a route. A request whose path is percent-encoded can therefore resolve to a page while failing to match the route rule meant to protect it, s...

GHSA-6VVC-X485-93V7 pypdf: Possible long runtimes/large memory usage when retrieving form fields

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage and/or long runtimes. This requires retrieving the form fields of a document. Patches This has been fixed in pypdf==6.21.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR...

GHSA-F54X-CMQ8-QG57 pypdf: Possible large memory usage when parsing arrays and dictionaries

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing arrays and/or dictionaries with lots of elements. Patches This has been fixed in pypdf==6.21.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4218...

GHSA-CGF9-327M-V77C pypdf: Possible large memory usage when parsing content streams

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing content streams with many small operations. Patches This has been fixed in pypdf==6.21.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4218...

GHSA-2P8C-GR87-2676 Electron: SameSite cookie restrictions are not applied to windows opened from links

Impact Pages opened into a new window from a link were loaded as if the app itself had navigated there rather than the page that contained the link, so the request was treated as same-site: SameSite=Strict cookies were sent and Sec-Fetch-Site did not identify the initiating page. Content shown in...

GHSA-X562-297C-G43G Electron: Pointer lock permission requests can be attributed to the wrong frame

Impact For pointerLock permission requests made from some cross-origin iframes, session.setPermissionRequestHandler was given the top-level frame's requestingUrl and isMainFrame instead of the requesting frame's. Apps that grant pointer lock based on the requesting origin could grant it to embedd...

GHSA-98MX-CJP9-GCHM Electron: Extension tabs.query returns tab URLs and titles without the tabs permission

Impact chrome.tabs.query returned each tab's url and title to extensions that held neither the tabs permission nor matching host permissions, so any loaded extension could read the URL and title of every webContents in its session. Apps are only affected if they load extensions...

GHSA-3QXV-5XGR-Q7W9 Electron: Frame subscription trusts GPU-supplied frame geometry

Impact Frame data received from the GPU process for webContents.beginFrameSubscription was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing the captured frame images, disclosing memory or crashing the app...

GHSA-H3V5-H239-PG29 Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry

Impact In offscreen rendering mode on macOS, frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the app...

GHSA-997Q-GVVC-JWMX Electron: openExternal permission requests can be attributed to the wrong origin

Impact Requests to open external protocol URLs could be attributed to a document other than the one that asked for them, so the requestingUrl passed to session.setPermissionRequestHandler was a trusted origin for a launch untrusted content had requested. An origin-based handler could therefore le...

GHSA-673Q-MJM6-R5XR Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

Impact A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays. Workaround There is no known workaround for affected applications with such use cache functions. Y...

GHSA-83VG-56QC-22M7 GitPython validates a submodule's ".git" path only after cloning into it (RCE)

Summary createsubmodulename, path, url clones a submodule into the repo's own .git directory before it rejects the path. A path of ".git/hooks" is accepted by the pre-clone check, so the submodule is cloned straight into the live hooks directory, and a file named post-checkout in the submodule...

GHSA-389G-GV7Q-R4X8 fastify is vulnerable to header validation bypass via case-sensitive propertyNames

Impact Fastify lowercases header names in a headers schema before compilation, because Node.js stores request header names in lowercase. This normalization does not reach the header names held in a propertyNames subschema's enum and const. A header-name deny-list written in the canonical header...

GHSA-H895-CGQG-JF52 toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

Summary CVE-2026-63376 described prototype pollution through proto key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the...

GHSA-4QX8-W7C3-PJ3P toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

Summary toml.parse is vulnerable to a quadratic-complexity On² denial-of-service via many array-of-tables name headers. addTableArray in lib/compiler.js rescans two entire bookkeeping Sets on every name header without pruning unrelated or distinct entries, so a document containing n such headers...

GHSA-9J65-HCG3-GC64 toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()

Summary toml.parse is vulnerable to a quadratic-complexity On² denial-of-service via a single long dotted key, table header, or inline-table key. A 100KB crafted document causes a multi-second synchronous hang; a 200KB document crashes the Node.js process outright with an uncatchable out-of-memor...

GHSA-9QMH-M7C6-F92P toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()

Summary toml.parse converts integer literals hex, octal, binary, and decimal to BigInt without first bounding the length of the digit sequence. Since BigIntstring construction from a very long numeric string runs in super-linear time, a single small, well-formed TOML document containing one long...

GHSA-PX85-F4Q5-JH77 Storybook dev server vulnerable to code injection from the local network

Summary: The Storybook dev server exposes its WebSocket authentication token to any client that can load its HTML pages. Any host on a LAN can open a Storybook app by IP address, and therefore obtain the token. The WebSocket can be used to inject code into story files or to create new files. Unde...

GHSA-98HJ-9722-W3J8 Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering

Summary Astro's JSX and MDX rendering pipeline treated string children of and elements as trusted HTML. When a dynamic value was passed through a JSX expression, such as value, an attacker-controlled value containing or could terminate the element and inject arbitrary HTML and JavaScript. Other J...

GHSA-MPR7-6M5W-76RW Astro: Arbitrary CSS injection in Astro View Transitions

Summary Astro's server-side View Transition CSS generator did not keep string animation properties within their generated CSS declarations. In an application that passes attacker-controlled data into an animation property such as duration, a value containing CSS delimiters could terminate the...

GHSA-C4QX-W738-7HR3 GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

Report metadata | Field | Value | | --- | --- | | Package | @graphql-tools/utils npm, pkg:github/ardatan/graphql-tools | | Repository | https://github.com/ardatan/graphql-tools | | Component | mergeIncrementalResult / setObjectKeyPath packages/utils/src/mergeIncrementalResult.ts | | Vulnerability...

GHSA-R77W-QPH3-7VF8 GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit

Summary The parser's maxtokens limit — the documented defence against oversized GraphQL documents — did not count comment tokens. A document padded with comments could therefore pass a maxtokens check of any size while still allocating one Token object per comment, all of which stay reachable for...

GHSA-VJ8H-FX38-H3VC GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule

Summary The OverlappingFieldsCanBeMerged validation rule can be driven into quadratic — and in the worst case On²·m² — running time by a small, highly compressible query. A single 364 KB document can occupy one CPU core for over five minutes during validation, before any resolver runs. Because th...

GHSA-CG2G-XH64-V4Q7 DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes

Summary When DOMPurify is configured with SAFEFORTEMPLATES: true together with a DOM-returning mode RETURNDOM: true, RETURNDOMFRAGMENT: true, or INPLACE: true, template expressions such as ..., $..., and survive sanitization inside the text content of an attached shadow root. The post-walk safety...

GHSA-MRV2-3PQR-J5JR DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)

Summary The 3.4.16 fix for GHSA-p98j-92pf-mc4p only covers a hook that removes the node it was called for. If an INPLACE hook removes a different node, like the current node's parent or a sibling that has not been visited yet, that subtree is never walked or neutralized. Event handlers in it stay...

GHSA-C6GR-QVV4-5V3F DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml

Summary DOMPurify drops attributeName attributes whose value contains href, so an allowed or can't rewrite a link's href after sanitizing. The check compares the attribute name after transformCaseFunc, and that function doesn't lowercase in XHTML mode. In XHTML the attribute is spelled...

GHSA-PJVX-PRJX-H659 nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc

Summary nbconvert = v7.17.1 has an arbitrary file write vulnerability due to a path traversal in ipynb cell output metadata, more specifically on the filename attribute. Vulnerable converters : --to markdown, --to latex, --to rst, --to asciidoc. In ExtractOutputPreprocessor,...

GHSA-XCQ7-P3PF-P88H OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

Summary TraceState.fromheader splits the inbound W3C tracestate header with a regular expression that starts with an unbounded optional-whitespace run, and no length limit is applied first. A run of spaces or tabs that is not followed by a comma costs ON² CPU. A single unauthenticated request wit...

GHSA-RXP7-6HXX-X8Q5 ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

Summary new Address6 and Address6.isValid strip a zone identifier with the pattern /%.$/ before they apply the 45-character length limit. When the string holds many % characters followed by a line terminator, the pattern is retried from every % and each attempt scans to the line terminator before...

GHSA-CG8M-R9F2-5WM2 Black: GitHub Action installs unvalidated required-version from pyproject.toml

Summary The GitHub Action bundled with Black can read the version from tool.black.required-version if usepyproject is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository. Details This is similar to the previous...

GHSA-XW6W-GCFP-CF8M Django REST framework: TokenProxy.delete() reports success and revokes nothing

Summary Deleting an authentication token through TokenProxy silently deletes nothing. The call raises no exception and reports success, the database row survives, and the token keeps authenticating. Any application, admin integration or operational script that revokes credentials by calling .dele...

GHSA-H694-7CP9-M8P3 next.js cache leak across root param values in nested 'use cache' functions

Impact With Cache Components enabled cacheComponents: true, a 'use cache' function that calls another 'use cache' function that reads a root param can be keyed incorrectly when the inner call is served from an existing entry: the enclosing function's cache key then omits that root param. The...

GHSA-G7CR-3P24-7WF7 Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer

============================================================================ Heap buffer overflow writing JPEG comment after ICC profile fills buffer Location: src/libImaging/JpegEncode.c:330 in ImagingJpegEncode Commit: a707c6b21c313880d0771e54965d142dd42358b6...

GHSA-G4QV-2JXX-769H Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time

Summary A PNG file with a large eXIf chunk full of repeated 6-byte markers makes Pillow's EXIF parser take seconds of CPU instead of milliseconds. The cost grows with the square of the chunk size, so a normal small-photo-sized file is enough to cause real delay. Details Exif.load in...

GHSA-MRFP-P49P-3HF2 Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

Summary Pillow's documented PDF append path can spend disproportionate CPU time on a compact malformed PDF page tree. An attacker who can supply an existing PDF to an application that appends an image with Image.save..., format="PDF", append=True can provide a malformed /Pages tree where each lev...

GHSA-V9PV-5GC8-W2M6 Pillow multi-frame loaders can reuse stale native image storage after mode transitions

Summary Pillow multi-frame image loaders can retain native ImagingCore storage allocated for one frame while changing the Python-side image mode and decoder tiles for a later frame. If frame 0 allocates storage for a narrow mode such as L, and a later frame of the same dimensions switches to a...

GHSA-G842-9RC4-69PW Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS

Summary SpiderImagePlugin's seek bypasses the decompression bomb check, allowing a tiny 1KB crafted SPIDER stack file to trigger a multi-gigabyte allocation on im.load. Affected versions All versions up to and including current HEAD v13.0.0.dev0, commit e7a7ea84 Root cause Image.open runs...

GHSA-P8HX-V2P6-RP84 Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)

Summary Pillow's decompression-bomb protection Image.decompressionbombcheck, gated by Image.MAXIMAGEPIXELS is enforced only on the first frame, inside Image.open. For multi-frame formats, seek re-parses the target frame's header and resets self.size. GifImagePlugin and TiffImagePlugin re-run the...

GHSA-MCHM-GJX6-7H55 Sentry-Javascript: Middleware Bypass when using Tunnel route

Impact The tunnelRoute option makes the SDK send browser events to a path on your own Next.js server for example /monitoring, where a rewrite forwards them to Sentry to prevent ad blockers from blocking them. To keep those envelope requests from being rejected by your middleware, the SDK skips...

GHSA-CPVR-W4J5-2MPG Librsvg: Use-after-free when XML includes have duplicated entities

Librsvg uses libxml2, a C library, to parse XML. When librsvg parses an SVG document which has a nested Xinclude, an XML entity declaration with a duplicate name as an existing one can cause a use-after-free error. While libxml2 is expanding an internal entity, a recursive XInclude can parse...

GHSA-P3M5-59MP-JV5R Next.js: Denial of Service in App Router using Server Actions

Impact Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. Workarounds No workaround exists besides upgrading. Applications using Pages Router or not using...

GHSA-JJ87-HC4R-JWFW stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

Summary FlexAssembler, the custom-container assembler shipped in the stream-json package src/core/utils/flex-assembler.js, re-exported at stream-json/utils/flex-assembler.js and stream-json/web/utils/flex-assembler.js, compiles a string or RegExp path filter into a matcher that runs...

GHSA-PXH4-856F-4H89 PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery

Summary HMACAlgorithm.fromjwk accepts a symmetric kty=oct JWK whose k value is the empty string and returns a zero-length key without raising. When a token is then verified with that key object a PyJWK, or a PyJWK resolved by PyJWKSet / PyJWKClient, the HMAC verifier computes HMACkey=b"",...

GHSA-354V-3Q48-CV69 Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization

Summary Jupyter Server's gateway WebSocket handler checks that a user is authenticated, but it does not ask the configured Authorizer whether that user may execute kernels. In Jupyter Server 2.0.0 through 2.5.0, enabling GatewayClient.url automatically replaced the normal kernel channel handler...

GHSA-9JH8-V38H-CVHR ammonia: mXSS via MathML `annotation-xml` encoding strip

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser. The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the...