Fast-uri Vulnerable To URI Scheme Spoofing Via Percent-encoded Scheme Decoding

Impact "fast-uri" percent-decodes the scheme component with the legacy global "unescape" before validating it, so an input whose decoded scheme is a valid but dangerous token is emitted as a live scheme. RFC 3986 section 3.1 does not allow percent-encoding in a scheme, so no RFC or WHATWG parser...

Multer Vulnerable To Denial Of Service Via A Pending Asynchronous FileFilter After Request Teardown

Impact When "multer" is configured with an asynchronous "fileFilter", a single request can crash the Node.js process. If a request is aborted for example when one file is rejected while another file's async "fileFilter" is still pending, the pending callback later resumes a parsing stream that...

Obsidian-tc HTTP Transport Lacks Origin/DNS-rebinding Protection, Enabling Drive-by Vault Access On Loopback

Impact The Streamable HTTP transport was constructed without "enableDnsRebindingProtection"/"allowedHosts"/"allowedOrigins" and performed no "Origin"-header validation. With the documented "auth.mode: "none"" loopback default, a drive-by web page could "POST http://127.0.0.1/mcp" and receive call...

SvelteKit: URL Redirection To Untrusted Site Via Enhanced Form Submission

Impact Applications using enhanced form actions "use:enhance" on routes that accept paths beginning with "//", such as catch-all routes, may be vulnerable to an open redirect. Patches A fix has been prepared for "@sveltejs/kit" 3.0.0. Users should upgrade to 3.0.0 or later. The fix preserves...

Zod Can Exhaust Memory While Validating Oversized Constrained Collections

Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic ...

Electron: Mitigation For Compromised EMudhra Intermediate Certificates

Impact A set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS clients. This Electron update adds the same block to both Chromium networking and Node.js "tls", "https" and "fetch". On earlier versions, an attacker holding a certificate issued...

@hapi/content: Regular Expression Denial Of Service (ReDoS) In HTTP Header Parsing

All versions of "@hapi/content" through 6.0.0 are vulnerable to Regular Expression Denial of Service ReDoS via crafted HTTP header values. Three regular expressions used to parse "Content-Type" and "Content-Disposition" headers contain patterns susceptible to catastrophic backtracking. This has...

Undici Vulnerable To Subresource Integrity Bypass Via Non-lowercase Algorithm Tokens

Impact undici's "fetch" verifies Subresource Integrity SRI metadata by looking up the algorithm token in a lowercase-only set, but the SRI specification defines a valid token by its ASCII-lowercase form. A correct but non-lowercase token such as "SHA256-..." or "Sha256-..." is therefore treated a...

Obsidian-tc: Default Folder ACL Is Fail-open; .obsidian Plugin Secrets Are Readable By Default

Impact With a default configuration, an undefined "readPaths"/"writePaths" meant allow-all, the "strictReadDefault" flag was inert, and the ".obsidian"/".git"/".trash" control directories were denied only during enumeration — not on the direct request path. A caller could read...

Obsidian-tc : Symlink Read-ACL Scope Bypass Via Lexical Path Checks

Impact ACL checks ran on the lexical vault-relative path while containment used the realpath. An in-vault symlink placed under an allowed glob, whose realpath resolved into a denied folder, passed the read ACL — an intra-vault read-ACL-scope bypass. It requires an out-of-band-planted symlink no M...

Obsidian-tc Tokens Can Access Arbitrary Configured Vaults

Impact Tool dispatch did not check the caller-supplied "input.vault" against the caller's bound vault "ctx.vaultId"; the folder ACL was a single global instance and the JWT carried no vault claim. As a result, any valid token could read, write, or delete any configured vault by passing...

Happy DOM: Incomplete Fix For CVE-2026-33943: Unsanitized Import Alias Leads To Host Code Execution

Summary The ESM compiler in "[email protected]" does not validate imported local binding aliases before interpolating them into generated JavaScript. As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed. This appears to...

Strands Agents SDK: Exposure Of Data Element To Wrong Session In The A2A Server

Summary Strands Agents SDK is an open-source SDK, available for Python strands-agents and TypeScript @strands-agents/sdk, for building and running AI agents. An issue exists where, under certain circumstances, the Agent2Agent A2A server shares conversation history across callers with different...

Undici Vulnerable To Denial Of Service Via Unbounded Memory In The EventSource Parser

Impact undici's "EventSource" client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed "data:" fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growin...

Obsidian-tc Bridge Tools Leak Denied-note Data Via Unfiltered Sibling Fields

Impact Bridge tool results filtered only the "items" array against the read ACL and passed sibling fields through unfiltered: "tasksfilter" emitted "groups" whose counts reflected denied notes, "makemdquery" returned "...result" siblings, and "listtemplates" enumerated Templater template paths an...

Fast-uri Vulnerable To Scheme Injection Via An Unescaped First-segment Colon In Suffix References

Impact "fast-uri"'s "serialize", "normalize", and "resolve", when called with the non-default option "reference: 'suffix'" on a reference that has no authority, emit a relative reference whose first path segment contains a bare colon without escaping it. RFC 3986 section 3.3 requires the first...

Body-parser Vulnerable To Denial Of Service Via Trailing Bytes After A Compressed Request Body

Impact A single request can crash any application using "body-parser" with default options. When a request carries a "Content-Encoding" for example "gzip", "body-parser" pipes it into a decompression stream and, after reading the body, leaves that stream piped with no error listener. A payload of...

Exposure Of Sensitive Information

ApostropheCMS is vulnerable to Exposure of Sensitive Information. The vulnerability is due to predictable export archive filenames and publicly readable export storage, which allows an unauthenticated attacker to download another user's exported data before the archive expires or is removed...

Path Traversal

Vitest is vulnerable to Path Traversal. The vulnerability is due to inconsistent handling of backslashes between path validation and filesystem access on Windows, which allows an attacker who can access the Vite development server to craft a redirect mock that bypasses server.fs.allow restriction...

Django REST Framework: TokenProxy.delete() Reports Success And Revokes Nothing

Summary Deleting an authentication token through "TokenProxy" silently deletes nothing. The call raises no exception and reports success, the database row survives, and the token keeps authenticating. Any application, admin integration or operational script that revokes credentials by calling...

OpenTelemetry Python: Unbounded Tracestate Parsing In Opentelemetry-api

Summary "TraceState.fromheader" splits the inbound W3C "tracestate" header with a regular expression that starts with an unbounded optional-whitespace run, and no length limit is applied first. A run of spaces or tabs that is not followed by a comma costs ON² CPU. A single unauthenticated request...

GraphQL-core: Denial Of Service Via Quadratic Complexity In The OverlappingFieldsCanBeMerged Validation Rule

Summary The "OverlappingFieldsCanBeMerged" validation rule can be driven into quadratic — and in the worst case "On²·m²" — running time by a small, highly compressible query. A single 364 KB document can occupy one CPU core for over five minutes during validation, before any resolver runs. Becaus...

Pillow Multi-frame Loaders Can Reuse Stale Native Image Storage After Mode Transitions

Summary Pillow multi-frame image loaders can retain native "ImagingCore" storage allocated for one frame while changing the Python-side image "mode" and decoder tiles for a later frame. If frame 0 allocates storage for a narrow mode such as "L", and a later frame of the same dimensions switches t...

GraphQL-core: Denial Of Service Via Comment Tokens Bypassing The Parser's Max_tokens Limit

Summary The parser's "maxtokens" limit — the documented defence against oversized GraphQL documents — did not count comment tokens. A document padded with comments could therefore pass a "maxtokens" check of any size while still allocating one "Token" object per comment, all of which stay reachab...

Pillow: Decompression-bomb Protection Bypass Via Multi-frame Seek() In MPO And DCX (MpoImageFile.seek / DcxImageFile.see

Summary Pillow's decompression-bomb protection "Image.decompressionbombcheck", gated by "Image.MAXIMAGEPIXELS" is enforced only on the first frame, inside "Image.open". For multi-frame formats, "seek" re-parses the target frame's header and resets "self.size". "GifImagePlugin" and "TiffImagePlugi...

GitPython Validates A Submodule's ".git" Path Only After Cloning Into It (RCE)

Summary "createsubmodulename, path, url" clones a submodule into the repo's own ".git" directory before it rejects the path. A "path" of ".git/hooks" is accepted by the pre-clone check, so the submodule is cloned straight into the live hooks directory, and a file named "post-checkout" in the...

Virtualenv: Generated Files Can Follow Existing Destination Links

Summary Generated activation files and pyvenv.cfg can follow existing links and write outside the requested environment. The template writer tests exists before unlinking, which misses dangling symlinks; the configuration writer opens the existing path directly. Anthropic's OSS Scanner reported...

Pillow: Reachable Undefined Behavior In Native Integer Operations, Potentially Leading To Denial Of Service Or Logic Int

Summary Affected Object and Source Package: Pillow 12.3.0 Source: PyPI sdist pillow-12.3.0.tar.gz SHA-256: 3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce Sink: src/imaging.c:2809:15, xsize += dx Details The code in Pillow 12.3.0 is: for xsize = 0; text; text++ int dx =...

Jupyter Server: Gateway WebSocket Handler Bypasses Kernel Execute Authorization

Summary Jupyter Server's gateway WebSocket handler checks that a user is authenticated, but it does not ask the configured Authorizer whether that user may execute kernels. In Jupyter Server 2.0.0 through 2.5.0, enabling GatewayClient.url automatically replaced the normal kernel channel handler...

Django REST Framework: JSONParser Applies An Attacker-named Codec To The Request Stream

Summary An unauthenticated attacker can defeat Django's "DATAUPLOADMAXMEMORYSIZE" limit and force a worker process to allocate arbitrary memory, by naming a compression codec in the Content-Type charset parameter. A 108-byte request body produces a 50,331,648-character value inside the view, an...

Django REST Framework: Accept Header With Many Large Quoted Parameters Burns ~19s Of CPU Per Request In Content Negotiat

Summary DRF's content negotiation parses each Accept token several times per request and never limits the number of tokens or their total size. Each parse ends up in Django's parseheaderparameters, which takes quadratic time when a quoted parameter value is packed with semicolons. On my machine a...

Pillow: BMP RLE Decoder Memory-amplification DoS Via Unbounded Delta Escape / Absolute Mode

Summary BmpRleDecoder can be forced to allocate gigabytes of memory from a kilobyte-sized crafted BMP file via unbounded growth in the delta escape and absolute mode branches. Affected versions All versions up to and including current HEAD v13.0.0.dev0, commit e7a7ea84 Root cause...

Goploy: Arbitrary File Read Via Path Traversal In /deploy/fileDiff Allows Remote Server Compromise

Goploy System Arbitrary File Read Vulnerability Basic Information - Vulnerability Name: Goploy Endpoints Arbitrary File Read via Path Traversal - Affected Product: Goploy - Known Affected Versions: =1.17.5 Vulnerability Description Goploy is an open-source automation deployment system. A severe...

Electron: Pointer Lock Permission Requests Can Be Attributed To The Wrong Frame

Impact For "pointerLock" permission requests made from some cross-origin iframes, "session.setPermissionRequestHandler" was given the top-level frame's "requestingUrl" and "isMainFrame" instead of the requesting frame's. Apps that grant pointer lock based on the requesting origin could grant it t...

Nuxt Server Islands Render `useHeadSafe` Input Without Sanitisation

Impact "useHeadSafe" restricts head input to an allowlist of safe tags and attributes. For example, "bodyAttrs" is limited to "class" and "style", event handler attributes are removed, and " Mitigating factors - Server components are experimental. They are only active when the application defines...

Middleware Authorization Bypass

@sentry/nextjs is vulnerable to middleware authorization bypass. The vulnerability is due to middleware being skipped for requests under a configured tunnelRoute, which allows an unauthenticated attacker to access protected application routes without authorization when specific route-collision an...

Stream-json: FlexAssembler String/RegExp Path Filters Join The Full Key Stack Per Container Start, Giving O(depth^2) CPU

Summary "FlexAssembler", the custom-container assembler shipped in the "stream-json" package "src/core/utils/flex-assembler.js", re-exported at "stream-json/utils/flex-assembler.js" and "stream-json/web/utils/flex-assembler.js", compiles a string or RegExp path "filter" into a matcher that runs...

Electron: Off-screen Rendering On MacOS Trusts GPU-supplied Frame Geometry

Impact In offscreen rendering mode on macOS, frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing "paint" event images, disclosing memory or crashing the app...

Toml-node: Uncontrolled Resource Consumption (CPU DoS) Via Unbounded-length Integer Literals In Toml.parse()

Summary "toml.parse" converts integer literals hex, octal, binary, and decimal to "BigInt" without first bounding the length of the digit sequence. Since "BigIntstring" construction from a very long numeric string runs in super-linear time, a single small, well-formed TOML document containing one...

Electron: OpenExternal Permission Requests Can Be Attributed To The Wrong Origin

Impact Requests to open external protocol URLs could be attributed to a document other than the one that asked for them, so the "requestingUrl" passed to "session.setPermissionRequestHandler" was a trusted origin for a launch untrusted content had requested. An origin-based handler could therefor...

Electron: Extension Tabs.query Returns Tab URLs And Titles Without The Tabs Permission

Impact "chrome.tabs.query" returned each tab's "url" and "title" to extensions that held neither the "tabs" permission nor matching host permissions, so any loaded extension could read the URL and title of every webContents in its session. Apps are only affected if they load extensions...

Astro: Reflected/Stored XSS Via Unescaped <script>/<style> Tag Content In JSX/MDX Rendering

Summary Astro's JSX and MDX rendering pipeline treated string children of "", an attacker-controlled value containing "...

Nuxt: Route Rules Are Matched Against The Raw Request Path, So A Percent-encoded Segment Can Bypass `appMiddleware` On D

Summary Nuxt compared "routeRules" keys against the raw request path, without decoding percent-encoding, while the router decodes parameters when it resolves a route. A request whose path is percent-encoded can therefore resolve to a page while failing to match the route rule meant to protect it,...

Electron: Frame Subscription Trusts GPU-supplied Frame Geometry

Impact Frame data received from the GPU process for "webContents.beginFrameSubscription" was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing the captured frame images, disclosing memory or crashing the ap...

Nodemailer: Quadratic (O(n^2)) DKIM Header Unfolding Lets A Large Folded Header Cause Remote Denial Of Service During Si

Summary When nodemailer DKIM-signs an outbound message, its DKIM message parser unfolds RFC 5322 header continuation lines with a loop that concatenates each continuation line onto the preceding line and then re-tests the anchored regex "/^ \t/" against the growing merged line on every iteration...

Electron: SameSite Cookie Restrictions Are Not Applied To Windows Opened From Links

Impact Pages opened into a new window from a link were loaded as if the app itself had navigated there rather than the page that contained the link, so the request was treated as same-site: "SameSite=Strict" cookies were sent and "Sec-Fetch-Site" did not identify the initiating page. Content show...

Fastify Is Vulnerable To Header Validation Bypass Via Case-sensitive PropertyNames

Impact Fastify lowercases header names in a "headers" schema before compilation, because Node.js stores request header names in lowercase. This normalization does not reach the header names held in a "propertyNames" subschema's "enum" and "const". A header-name deny-list written in the canonical...

Cross-site Scripting (XSS)

Vitest is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper sanitization of attacker-controlled URLs inserted into generated module source by createManualModuleSource, which allows an unauthenticated attacker to register a malicious mock through a WebSocket connection a...

Sensitive File Disclosure

Vitest is vulnerable to Sensitive File Disclosure. The vulnerability is due to misapplication of server.fs.deny on Vitest dev servers, where the server serves files such as .env, private keys, .git repositories, and the .vitest-secret-token over plain HTTP, and an attacker who can reach the UI,...

Server-Side Request Forgery (SSRF)

A2A Java SDK is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of push notification destination URLs and unrestricted redirect handling, which allows an unauthenticated attacker to make the server send HTTP requests to internal or restricted...