GitHub Advisory Databaseの情報
10月24日(土)今日
obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes
影響: npm:obsidian-tc >= 1.0.1, <= 1.31.3 → 1.31.4 create_entity, link_entities, rename_entity, unlink_entities and delete_entity regenerate a memory note's body from SQLite at the computed memory/ / .md path. When a note already existed at that path and was not owned by the entity being written (a hand-authored note, or an orphan left by a different entity whose name sanitized to the same path), its entire body was overwritten on the next write naming that (type, name), keeping only its frontmatter. Separately, several of these tools inserted…
SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin
影響: go:github.com/siyuan-note/siyuan/kernel < 0.0.0-20260808010544-26ccb40d390e → 0.0.0-20260808010544-26ccb40d390e installBazaarPlugin (and the equivalent endpoints for widgets/icons/templates/themes) accept packageName, repoURL, and repoHash as independent request fields with no validation that they refer to the same package. packageName alone determines the install destination; repoURL/repoHash alone determine what content gets downloaded and written there. A request can name an already-installed, already-enabled plugin as packageName while pointing repoURL/ repoHash at different, attacker-influenced cont…
SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream
影響: go:github.com/siyuan-note/siyuan/kernel < 0.0.0-20260731131820-67bc300b6ea6 → 0.0.0-20260731131820-67bc300b6ea6 Two checks on the same WebSocket request URI parse it differently. The authentication exemption for keepalive sessions matches raw substrings, while the quarantine introduced to contain those sessions reads a parsed query parameter. Because Go's url.Values.Get returns only the first value for a repeated key, a single URI can satisfy the exemption and still resolve to a non-auth session identity. The result is that an unauthenticated remote caller connects to the kernel WebSocket with a valid ac…
SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden
影響: go:github.com/siyuan-note/siyuan/kernel < 0.0.0-20260731093152-c7522b8db586 → 0.0.0-20260731093152-c7522b8db586 /api/filetree/authFilePublishAccess is registered with CheckAuth only and is reachable anonymously. It never sets a failure code, so its outcome is signalled entirely by the response message and by whether a Set-Cookie header is present. Those two signals differ across access tiers, which lets an anonymous caller determine, for any candidate document identifier, whether that document is public or nonexistent, password-protected, or exists at the hidden or forbidden tier. Separately, hidden and…
SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers
影響: go:github.com/siyuan-note/siyuan/kernel < 0.0.0-20260730150429-5b42614311b0 → 0.0.0-20260730150429-5b42614311b0 /api/av/getAttributeViewBacklinks filters its results for reader roles through FilterAttributeViewBacklinksByPublishAccess. That function resolves its ignore list with GetDisablePublishAccess, which covers only the forbidden tier. Documents at the hidden tier are absent from that list, so they pass the check. The result is that an anonymous reader supplying a publicly visible database row receives the database name, row title and document path of rows in hidden documents that reference it. The…
SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized
影響: go:github.com/siyuan-note/siyuan/kernel < 0.0.0-20260729005258-4daee87d4152 → 0.0.0-20260729005258-4daee87d4152 Relationship to GHSA-hgfg-j9pg-43xw That advisory concerned the administrator's live UI layout, and commit 63c7d5474 resolved it by removing FilterUILayoutByPublishIgnore and nulling Conf.UILayout for readers. That fix is correct and complete for the live layout. This report concerns a different endpoint, a different filter function and a different storage backing. /api/storage/getLocalStorage reads data/storage/local.json rather than Conf.UILayout, and its filter FilterLocalStorageByPublishAcc…
obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback
影響: npm:obsidian-tc < 1.3.1 → 1.3.1 The Streamable HTTP transport was constructed without enableDnsRebindingProtection/allowedHosts/allowedOrigins and performed no Origin-header validation. With the documented auth.mode: "none" loopback default, a drive-by web page could POST http://127.0.0.1/mcp and receive caller http-local with scopes [""] — full vault read/write — via DNS rebinding / a forged Origin. Patches Fixed in 1.3.1. Upgrade to >= 1.3.1. The transport now enables DNS-rebinding protection and allowed hosts/origins and r…
obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields
影響: npm:obsidian-tc < 1.3.1 → 1.3.1 Bridge tool results filtered only the items array against the read ACL and passed sibling fields through unfiltered: tasks_filter emitted groups whose counts reflected denied notes, makemd_query returned ...result siblings, and list_templates enumerated Templater template paths and parsed user-function bodies with no read-whitelist gate. A caller could infer or read data from notes outside its read ACL. Patches Fixed in 1.3.1. Upgrade to >= 1.3.1. All path-attributable fields are now scrubbed o…
obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP
影響: npm:obsidian-tc >= 1.13.0, <= 1.31.3 → 1.31.4 On a Streamable HTTP deployment with auth.jwtSecret configured, serving a 2026-07-28-era client that declared elicitation.form support, a call to a dispatch-gated tool (destructive: true, or a scope with an HITL floor) that was offered an inputRequired confirmation could still complete after the human declined, cancelled, or the elicitation response was omitted or malformed, provided the client echoed the validly bound requestState on resubmission. The server trusted an authentic, call-bound st…
obsidian-tc tokens can access arbitrary configured vaults
影響: npm:obsidian-tc < 1.3.1 → 1.3.1 Tool dispatch did not check the caller-supplied input.vault against the caller's bound vault (ctx.vaultId); the folder ACL was a single global instance and the JWT carried no vault claim. As a result, any valid token could read, write, or delete any configured vault by passing input.vault, defeating multi-tenant isolation across ~90 tool sites. (resources/read was the only surface that already guarded this.) Patches Fixed in 1.3.1 (the fix was developed on the v1.3.0 tag, which never published…
obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default
影響: npm:obsidian-tc < 1.3.1 → 1.3.1 With a default configuration, an undefined readPaths/writePaths meant allow-all, the strictReadDefault flag was inert, and the .obsidian/.git/.trash control directories were denied only during enumeration — not on the direct request path. A caller could read .obsidian/plugins//data.json, exfiltrating plugin API keys and Obsidian Sync passwords (live-reproduced), as well as any other in-vault file by path. Patches Fixed in 1.3.1. Upgrade to >= 1.3.1. The default now denies .obsidian/.git/.trash…
obsidian-tc : Symlink read-ACL scope bypass via lexical path checks
影響: npm:obsidian-tc < 1.3.1 → 1.3.1 ACL checks ran on the lexical vault-relative path while containment used the realpath. An in-vault symlink placed under an allowed glob, whose realpath resolved into a denied folder, passed the read ACL — an intra-vault read-ACL-scope bypass. It requires an out-of-band-planted symlink (no MCP tool creates one) and is not a vault-root escape. Patches Fixed in 1.3.1. Upgrade to >= 1.3.1. ACL enforcement now derives the realpath vault-relative path and feeds a single unified predicate at every sit…
10月23日(金)昨日
virtualenv: Generated files can follow existing destination links
影響: pip:virtualenv < 21.14.9 → 21.14.9 Generated activation files and pyvenv.cfg can follow existing links and write outside the requested environment. The template writer tests exists() before unlinking, which misses dangling symlinks; the configuration writer opens the existing path directly. Anthropic's OSS Scanner reported this as ANT-2026-XBEOCBS1 in virtualenv-20261015-005, received on 15 October 2026. Affected area Final file entries written during environment creation and seeding. Attacker-controlled input Another account mu…
Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()
影響: pip:pillow >= 11.1.0, < 13.0.0 → 13.0.0 Every Pillow wheel from 11.1.0 onward bundles a libopenjp2 containing a heap-buffer-overflow write that is fixed upstream on master but has never appeared in an OpenJPEG release. See https://osv.dev/vulnerability/OSV-2025-219 Because the wheel bundles its own copy, a patched host OS does not help. It is reachable from Image.open(fp); im.load() with default settings. I am reporting it here rather than only upstream because Pillow is where the vulnerable binary actually reaches users. Note the in…
Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive
影響: npm:nuxt >= 4.0.0, < 4.6.2 → 4.6.2, npm:nuxt >= 3.0.0, < 4.0.0, npm:@nuxt/nitro-server >= 4.2.0, < 4.6.2 → 4.6.2, npm:@nuxt/nitro-server >= 3.20.0, < 4.0.0 With the default router.options.sensitive: false, Nuxt's page router resolves routes case-insensitively, so /Admin renders the same page as /admin. On the server, however, route rules were resolved with Nitro's route-rule matcher, which matches keys case-sensitively. A request whose path differs from a rule key only in letter case therefore rendered the page with none of that rule applied. Earlier fixes ([GHSA-mm7m-92g8-7m47](https://github.com/nuxt/nuxt/security/advisories/GHSA-mm7m-92g8-7m47)…
Nuxt server islands render `useHeadSafe` input without sanitisation
影響: npm:nuxt >= 3.13.0, < 4.6.2 → 4.6.2 useHeadSafe restricts head input to an allowlist of safe tags and attributes. For example, bodyAttrs is limited to class and style, event handler attributes are removed, and Mitigating factors - Server components are experimental. They are only active when the application defines a .server.vue component or page, or enables experimental.componentIslands and renders . - Exploitation requires the application to pass attacker-controlled data to useHeadSafe inside a server island. useHeadSafe called…
Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled
影響: npm:nuxt < 4.6.0 → 4.6.0 An application that renders with a value it does not control can be made to render an anchor whose href executes script in the application's origin when clicked. This is an incomplete fix for [GHSA-934w-87qh-qr26](https://github.com/nuxt/nuxt/security/advisories/GHSA-934w-87qh-qr26) (CVE-2026-53722). It only affects applications running without a pages/ directory, where pages resolves to false and Nuxt registers its own router in place of vue-router. Applications using vue-router are not affect…
Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes
影響: npm:nuxt >= 4.0.0, < 4.4.4 → 4.4.4, npm:nuxt >= 3.11.0, < 3.21.4 → 3.21.4 Nuxt compared routeRules keys against the raw request path, without decoding percent-encoding, while the router decodes parameters when it resolves a route. A request whose path is percent-encoded can therefore resolve to a page while failing to match the route rule meant to protect it, so the rule's appMiddleware never runs, including during server rendering. Impact For a page served through a dynamic or catch-all route, an attacker can percent-encode a character in the path to skip the rule:…
pypdf: Possible long runtimes/large memory usage when retrieving form fields
影響: pip:pypdf < 6.21.0 → 6.21.0 An attacker who uses this vulnerability can craft a PDF which leads to large memory usage and/or long runtimes. This requires retrieving the form fields of a document. Patches This has been fixed in [pypdf==6.21.0](https://github.com/py-pdf/pypdf/releases/tag/6.21.0). Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4219](https://github.com/py-pdf/pypdf/pull/4219).
pypdf: Possible large memory usage when parsing arrays and dictionaries
影響: pip:pypdf < 6.21.0 → 6.21.0 An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing arrays and/or dictionaries with lots of elements. Patches This has been fixed in [pypdf==6.21.0](https://github.com/py-pdf/pypdf/releases/tag/6.21.0). Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4218](https://github.com/py-pdf/pypdf/pull/4218).
pypdf: Possible large memory usage when parsing content streams
影響: pip:pypdf < 6.21.0 → 6.21.0 An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing content streams with many small operations. Patches This has been fixed in [pypdf==6.21.0](https://github.com/py-pdf/pypdf/releases/tag/6.21.0). Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4218](https://github.com/py-pdf/pypdf/pull/4218).
Electron: SameSite cookie restrictions are not applied to windows opened from links
影響: npm:electron >= 45.0.0-alpha.1, < 45.0.0-alpha.6 → 45.0.0-alpha.6, npm:electron >= 44.0.0-alpha.1, < 44.3.0 → 44.3.0, npm:electron >= 43.0.0-alpha.1, < 43.7.0 → 43.7.0, npm:electron < 42.11.3 → 42.11.3 Pages opened into a new window from a link were loaded as if the app itself had navigated there rather than the page that contained the link, so the request was treated as same-site: SameSite=Strict cookies were sent and Sec-Fetch-Site did not identify the initiating page. Content shown in the app could use this to make a credentialed top-level request to another site that relies on SameSite cookies as a CSRF defence. Apps are only affected if they load untrusted content and allow it to open ne…
Electron: Pointer lock permission requests can be attributed to the wrong frame
影響: npm:electron >= 45.0.0-alpha.1, < 45.0.0-alpha.13 → 45.0.0-alpha.13, npm:electron >= 44.0.0-alpha.1, < 44.5.0 → 44.5.0, npm:electron >= 43.0.0-alpha.1, < 43.7.6 → 43.7.6, npm:electron < 42.11.9 → 42.11.9 For pointerLock permission requests made from some cross-origin iframes, session.setPermissionRequestHandler() was given the top-level frame's requestingUrl and isMainFrame instead of the requesting frame's. Apps that grant pointer lock based on the requesting origin could grant it to embedded content under the top-level page's identity. Apps are only affected if they embed untrusted content in iframes and decide pointerLock requests by origin in setPermissionRequestHandler. Apps that do not em…
Electron: Extension tabs.query returns tab URLs and titles without the tabs permission
影響: npm:electron >= 45.0.0-alpha.1, < 45.0.0-alpha.4 → 45.0.0-alpha.4, npm:electron >= 44.0.0-alpha.1, < 44.1.1 → 44.1.1, npm:electron >= 43.0.0-alpha.1, < 43.5.1 → 43.5.1, npm:electron < 42.11.1 → 42.11.1 chrome.tabs.query() returned each tab's url and title to extensions that held neither the tabs permission nor matching host permissions, so any loaded extension could read the URL and title of every webContents in its session. Apps are only affected if they load extensions (session.extensions.loadExtension) that they do not fully trust. Apps that load no extensions, or only trusted ones, are not affected. Workarounds Do not load untrusted or unvalidated extensions. In general you should only lo…
Electron: Frame subscription trusts GPU-supplied frame geometry
影響: npm:electron < 42.11.6 → 42.11.6, npm:electron >= 43.0.0-alpha.1, < 43.7.3 → 43.7.3, npm:electron >= 44.0.0-alpha.1, < 44.4.3 → 44.4.3, npm:electron >= 45.0.0-alpha.1, < 45.0.0-alpha.9 → 45.0.0-alpha.9 Frame data received from the GPU process for webContents.beginFrameSubscription was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing the captured frame images, disclosing memory or crashing the app. Apps are only affected if they use webContents.beginFrameSubscription and an attacker has separately gained code execution in the GPU process. Apps that do not subscribe to captured frames are not affected. W…
Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
影響: npm:electron < 42.11.6 → 42.11.6, npm:electron >= 43.0.0-alpha.1, < 43.7.3 → 43.7.3, npm:electron >= 44.0.0-alpha.1, < 44.4.3 → 44.4.3, npm:electron >= 45.0.0-alpha.1, < 45.0.0-alpha.9 → 45.0.0-alpha.9 In offscreen rendering mode on macOS, frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the app. GHSA-pfmc-3mgc-p6fp covers the same issue on the other capture paths. Apps are only affected if they use offscreen rendering (webPreferences.offscreen) on macOS and an attacker has separately gained code execution in…
Electron: openExternal permission requests can be attributed to the wrong origin
影響: npm:electron < 42.11.3 → 42.11.3, npm:electron >= 43.0.0-alpha.1, < 43.7.0 → 43.7.0, npm:electron >= 44.0.0-alpha.1, < 44.3.0 → 44.3.0, npm:electron >= 45.0.0-alpha.1, < 45.0.0-alpha.5 → 45.0.0-alpha.5 Requests to open external protocol URLs could be attributed to a document other than the one that asked for them, so the requestingUrl passed to session.setPermissionRequestHandler was a trusted origin for a launch untrusted content had requested. An origin-based handler could therefore let untrusted content launch an OS-registered external application. Apps are only affected if they grant openExternal based on the requesting origin and let untrusted content open or navigate windows. Apps whose…
Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
影響: npm:next >= 16.0.0, <= 16.4.0 → 16.4.1 A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays. Workaround There is no known workaround for affected applications with such use cache functions. You should upgrade immediately even if your application does not have similar functions.
GitPython validates a submodule's ".git" path only after cloning into it (RCE)
影響: pip:Gitpython <= 3.2.0 → 3.2.1 create_submodule(name, path, url) clones a submodule into the repo's own .git directory before it rejects the path. A path of ".git/hooks" is accepted by the pre-clone check, so the submodule is cloned straight into the live hooks directory, and a file named post-checkout in the submodule becomes an executable .git/hooks/post-checkout. On 3.2.0+ the later index check does raise ValueError, but only after the clone already wrote to disk, and it does not remove the planted hook; on 3.1.x there is…
fastify is vulnerable to header validation bypass via case-sensitive propertyNames
影響: npm:fastify >= 5.12.2, < 5.12.6 → 5.12.6 Fastify lowercases header names in a headers schema before compilation, because Node.js stores request header names in lowercase. This normalization does not reach the header names held in a propertyNames subschema's enum and const. A header-name deny-list written in the canonical header case, such as propertyNames: { not: { enum: ['X-Debug-Override'] } }, therefore never matches the lowercased request headers, and the forbidden header reaches the handler. Any application that uses a propertyNa…
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
影響: npm:tome <= 5.0.0 → 5.0.1 CVE-2026-63376 described prototype pollution through __proto__ key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the owned-container check is not applied on the path that matters. A four-line TOML document parsed with toml.parse() writes a property onto Object.prototype, where it is visible to every object in the process — includ…
toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()
影響: npm:toml <= 5.0.0 → 5.0.1 toml.parse() is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via many array-of-tables ([[name]]) headers. addTableArray() in lib/compiler.js rescans two entire bookkeeping Sets on every [[name]] header without pruning unrelated or distinct entries, so a document containing n such headers costs O(n²) compiler work. A ~321KB document of 20,000 distinct-named [[name]] blocks takes ~10.3 seconds to parse — a completely ordinary-looking TOML shape (a flat settings block plus one or…
toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()
影響: npm:toml <= 5.0.0 → 5.0.1 toml.parse() is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via a single long dotted key, table header, or inline-table key. A ~100KB crafted document causes a multi-second synchronous hang; a ~200KB document crashes the Node.js process outright with an uncatchable out-of-memory error. This is a separate, unpatched code path from the previously fixed stack-overflow DoS (GHSA-82x6-q7mm-w9cf) — it requires no array/inline-table nesting at all, and is confirmed unaffected by the…
toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()
影響: npm:toml <= 5.0.0 → 5.0.1 toml.parse() converts integer literals (hex, octal, binary, and decimal) to BigInt without first bounding the length of the digit sequence. Since BigInt(string) construction from a very long numeric string runs in super-linear time, a single small, well-formed TOML document containing one long integer literal can pin a Node.js process's event loop at 100% CPU for several seconds — a denial of service for any application that parses attacker-supplied or third-party TOML. No authentication or com…
Storybook dev server vulnerable to code injection from the local network
影響: npm:storybook >= 8.0.0, < 8.6.19 → 8.6.19, npm:storybook >= 9.0.0, < 9.1.21 → 9.1.21, npm:storybook >= 10.0.0, < 10.6.2 → 10.6.2, npm:storybook >= 11.0.0-alpha.0, < 11.0.0-alpha.6 → 11.0.0-alpha.6, npm:@storybook/core >= 8.0.0, < 8.6.19 → 8.6.19, npm:@storybook/core-server >= 8.0.0, < 8.6.19 → 8.6.19, npm:@storybook/experimental-addon-test >= 8.0.0, < 8.6.19 → 8.6.19, npm:@storybook/addon-vitest >= 9.0.0, < 9.1.21 → 9.1.21, npm:@storybook/addon-vitest >= 10.0.0, < 10.6.2 → 10.6.2, npm:@storybook/addon-vitest >= 11.0.0-alpha.0, < 11.0.0-alpha.6 → 11.0.0-alpha.6, npm:@storybook/addon-mcp >= 10.6.0, < 10.6.2 → 10.6.2, npm:@storybook/addon-mcp >= 11.0.0-alpha.0, < 11.0.0-alpha.6 → 11.0.0-alpha.6 Summary: The Storybook dev server exposes its WebSocket authentication token to any client that can load its HTML pages. Any host on a LAN can open a Storybook app by IP address, and therefore obtain the token. The WebSocket can be used to inject code into story files or to create new files. Under the right circumstances, an attacker can execute code on the machine of a developer connected on the same LAN. Who is impacted? You are impacted if you run a Storybook dev server whilst connected on a…
Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering
影響: npm:astro < 7.3.2 → 7.3.2 Astro's JSX and MDX rendering pipeline treated string children of , an attacker-controlled value containing or could terminate the element and inject arbitrary HTML and JavaScript. Other JSX expression contexts escaped dynamic strings automatically. This behavior was limited to passed to was emitted without escaping. The browser interpreted the first closing tag as markup and executed the injected script. The fix preserves raw rendering for literal script and style content while escaping dynami…
Astro: Arbitrary CSS injection in Astro View Transitions
影響: npm:astro >= 7.1.0, <= 7.3.2 → 7.3.3 Astro's server-side View Transition CSS generator did not keep string animation properties within their generated CSS declarations. In an application that passes attacker-controlled data into an animation property such as duration, a value containing CSS delimiters could terminate the declaration and rule, then add attacker-selected CSS to the server-rendered page. The injected content remains inside the generated
GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments
影響: npm:@graphql-tools/utils >= 10.10.1, <= 12.0.1 → 12.0.2 Report metadata | Field | Value | | --- | --- | | Package | @graphql-tools/utils (npm, pkg:github/ardatan/graphql-tools) | | Repository | https://github.com/ardatan/graphql-tools | | Component | mergeIncrementalResult / setObjectKeyPath (packages/utils/src/mergeIncrementalResult.ts) | | Vulnerability class | Prototype pollution (via unvalidated object path traversal) | | Verified against | Source read at 134d67ae36a559651f43ec7fe4a9da76f4a00c2b; master HEAD ccca0ff0dc8ea20726fd116b2f19a38709c30…
GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit
影響: pip:graphql-core >= 3.2.3, < 3.2.12 → 3.2.12, pip:graphql-core >= 3.3.0a3, < 3.3.0rc1 → 3.3.0rc1 The parser's max_tokens limit — the documented defence against oversized GraphQL documents — did not count comment tokens. A document padded with comments could therefore pass a max_tokens check of any size while still allocating one Token object per comment, all of which stay reachable for the lifetime of the parsed document. A 38 MB comment-padded payload allocated roughly 92 MB of additional resident memory with max_tokens=5 in force. Details Lexer.lookahead() reads tokens one at a time and…
GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule
影響: pip:graphql-core >= 3.0.0, < 3.2.12 → 3.2.12, pip:graphql-core >= 3.3.0a1, < 3.3.0rc1 → 3.3.0rc1 The OverlappingFieldsCanBeMerged validation rule can be driven into quadratic — and in the worst case O(n²·m²) — running time by a small, highly compressible query. A single 364 KB document can occupy one CPU core for over five minutes during validation, before any resolver runs. Because the rule is part of specified_rules and therefore enabled by default, every GraphQL-core based server is affected at default settings. Details OverlappingFieldsCanBeMerged compares every pair of fields that sha…
DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
影響: npm:dompurify >= 3.4.4, <= 3.4.16 → 3.4.17 When DOMPurify is configured with SAFE_FOR_TEMPLATES: true together with a DOM-returning mode (RETURN_DOM: true, RETURN_DOM_FRAGMENT: true, or IN_PLACE: true), template expressions such as {{...}}, ${...}, and survive sanitization inside the text content of an attached shadow root. The post-walk safety net _scrubTemplateExpressions (src/purify.ts:1717) was extended to recurse into .content, but it never recurses into attached shadow roots. An attacker who can supply a DOM node carrying a shadow…
DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)
影響: npm:dompurify <= 3.4.16 → 3.4.17 The 3.4.16 fix for GHSA-p98j-92pf-mc4p only covers a hook that removes the node it was called for. If an IN_PLACE hook removes a different node, like the current node's parent or a sibling that has not been visited yet, that subtree is never walked or neutralized. Event handlers in it stay on the elements, and an that was already loading fires after sanitize() returns. The README says: "Nodes that a hook detaches from the tree ... are treated as removed. In IN_PLACE mode their subtree is neutra…
DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml
影響: npm:dompurify <= 3.4.16 → 3.4.17 DOMPurify drops attributeName attributes whose value contains href, so an allowed or can't rewrite a link's href after sanitizing. The check compares the attribute name after transformCaseFunc, and that function doesn't lowercase in XHTML mode. In XHTML the attribute is spelled attributeName, so the comparison with "attributename" never matches and the guard does nothing. An app that uses PARSER_MEDIA_TYPE: 'application/xhtml+xml' and allows animate and attributeName will keep . Clicking the pa…
nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc
影響: pip:nbconvert >= 5.4.0, <= 7.17.1 → 7.17.2 nbconvert <= v7.17.1 has an arbitrary file write vulnerability due to a path traversal in ipynb cell output metadata, more specifically on the filename attribute. Vulnerable converters : --to markdown, --to latex, --to rst, --to asciidoc. In ExtractOutputPreprocessor, extractoutput.py:116-119 joins attacker-controlled path to output_files_dir with no canonicalization check, enabling arbitrary file write. This is a sibling vulnerability of https://github.com/advisories/GHSA-4c99-qj7h-p3vg. Impac…
OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api
影響: pip:opentelemetry-api <= 1.45.0 → 1.45.1 TraceState.from_header splits the inbound W3C tracestate header with a regular expression that starts with an unbounded optional-whitespace run, and no length limit is applied first. A run of spaces or tabs that is not followed by a comma costs O(N²) CPU. A single unauthenticated request with a ~100 KB tracestate keeps the handling worker busy for ~6 s (spaces) to ~12 s (tabs); under an asyncio server it blocks every other connection for that time. Affected component / version - Package: opente…
ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process
影響: npm:ip-address <= 10.7.3 → 10.7.4 new Address6() and Address6.isValid() strip a zone identifier with the pattern /%.$/ before they apply the 45-character length limit. When the string holds many % characters followed by a line terminator, the pattern is retried from every % and each attempt scans to the line terminator before failing, so rejecting the string takes time proportional to the square of its length. 10,000 % characters and a newline take 41 ms, 40,000 take 632 ms and 100,000 take 3.9 s of synchronous work. The same s…
Black: GitHub Action installs unvalidated required-version from pyproject.toml
影響: pip:black < 26.10.1 → 26.10.1 The GitHub Action bundled with Black can read the version from tool.black.required-version if use_pyproject is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository. Details This is similar to the previous CVE-2026-31900. The value in tool.black.required-version is accepted as the version to be installed by the action without validation. Proof of concept Reproduction requires a victim to use Black's GitHub Action w…
Django REST framework: TokenProxy.delete() reports success and revokes nothing
影響: pip:djangorestframework >= 3.12.0, < 3.18.2 → 3.18.2 Deleting an authentication token through TokenProxy silently deletes nothing. The call raises no exception and reports success, the database row survives, and the token keeps authenticating. Any application, admin integration or operational script that revokes credentials by calling .delete() on a TokenProxy instance believes it has revoked a token that is still live. Details TokenProxy overrides pk to return the user id (rest_framework/authtoken/models.py:49-63): python @property def pk(self):…
Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation
影響: pip:djangorestframework < 3.18.2 → 3.18.2 DRF's content negotiation parses each Accept token several times per request and never limits the number of tokens or their total size. Each parse ends up in Django's parse_header_parameters, which takes quadratic time when a quoted parameter value is packed with semicolons. On my machine a single GET with a 780KB Accept header made of 96 such tokens kept one gunicorn worker busy for 18.87 seconds (Django 6.1, djangorestframework 3.18.0, gunicorn 26.0.0, Python 3.13, Docker on macOS). The heade…
Django REST framework: JSONParser applies an attacker-named codec to the request stream
影響: pip:djangorestframework >= 3.6.4, < 3.18.2 → 3.18.2 An unauthenticated attacker can defeat Django's DATA_UPLOAD_MAX_MEMORY_SIZE limit and force a worker process to allocate arbitrary memory, by naming a compression codec in the Content-Type charset parameter. A 108-byte request body produces a 50,331,648-character value inside the view, an amplification factor of 466,033, and grows process peak RSS by about 97 MiB. No application configuration is required beyond DRF's default parser set; the endpoint only has to accept a JSON body. Details JSONP…