GitHub Advisory Databaseの情報
10月24日(土)昨日
virtualenv: Xonsh activation literals depend on the script decoding codec
影響: pip:virtualenv < 21.14.9 → 21.14.9 Caller-supplied prompt text can become executable syntax in the xonsh activation script. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment. Affected area Xonsh reads a UTF-8 activation script using a legacy multibyte encoding such as GBK. Printable non-ASCII bytes can change how the reader recognizes an adjacent quote. The report concerns POSIX activation. It does not establish exposure through unrelated activators. Attacker-control…
virtualenv: Bash prompt values can change meaning under older compatibility modes
影響: pip:virtualenv < 21.14.9 → 21.14.9 Caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. Affected area Bash runs with compatibility level 4.2 and draws the environment prompt. Its replacement-string behavior differs from newer compatibility modes, leaving prompt text subject to a second interpretation. The report concerns POSIX activation. It does not establish ex…
MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint
影響: npm:@azure/msal-node >= 5.0.0-beta.0, < 7.1.0 → 7.1.0 Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow. Patches Version 7.1.0 and higher are patched. Workarounds Ensure you pass in only the auth_code to to acquireTokenByCode
undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
影響: npm:undici >= 6.23.0, < 6.29.1 → 6.29.1, npm:undici >= 7.18.0, < 7.30.1 → 7.30.1, npm:undici >= 8.0.0, < 8.12.2 → 8.12.2 undici's fetch() crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses (a content-encoding limit), but it created the internal response stream before that check and returned without attaching an error listener or aborting the request. The early close then surfaces a content-length mismatch on that orphaned internal stream, which Node.js treats as an unhandled err…
multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
影響: npm:multer >= 2.0.0, < 2.5.0 → 2.5.0 When multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If a request is aborted (for example when one file is rejected) while another file's async fileFilter is still pending, the pending callback later resumes a parsing stream that multer has already torn down. busboy then emits an error on a stream that no longer has an error listener, which Node raises as an unhandled 'error' event, and the process exits. A single unauthenticated request is…
Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
影響: npm:happy-dom >= 17.0.0, <= 21.0.3 → 21.0.4 The ESM compiler in happy-dom@20.14.5 does not validate imported local binding aliases before interpolating them into generated JavaScript. As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed. This appears to be an alternate injection path and incomplete remediation of GHSA-6q6h-j7hj-3r64 / CVE-2026-33943. The previous fix validates importName in the local export { ... } handler, but the named import handler still pl…
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
影響: rust:wasmtime < 36.0.19 → 36.0.19, rust:wasmtime >= 37.0.0, < 43.0.0 → 43.0.0 In Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox. Cranelift was changed in Wasmtime v43 to use a full u32 index, with checks…
filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files
影響: pip:filelock >= 3.20.4, <= 4.2.0 → 4.2.1 ReadWriteLock and AsyncReadWriteLock (the SQLite-backed reader/writer lock) hand SQLite a name they do not control. On Linux the lock validates its database through a descriptor (the number the kernel gives a process for an open file). It then connects SQLite to /proc/self/fd/ , a Linux path that names the process's own open file n. SQLite turns that path back into a plain path and reopens it by name, following symlinks (a symlink is a file that points at another path). On every POSIX route SQL…
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
影響: pip:pillow <= 12.3.0 → 13.0.0 Credits Researcher: Alex Bouffard (mixbo@pebwalker.com) Summary A heap buffer overflow in Pillow's FlashPix (FPX) JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with Image.open(). The file is recognized by content (the OLE2 magic), not by extension, so any service that opens or thumbnails untrusted uploads with the optional olefile dependency installed is reachable with no user interaction. In the PoC below, opening on…
postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words
影響: npm:postal-mime >= 3.0.0, < 4.0.8 → 4.0.8 Decoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as =?utf-8?B?QUJD?= repeated tens of thousands of times in a Subject, From, To, a filename or a description, took time quadratic in the number of words. The join check ran a regex over the text joined so far for every word, which flattens the accumulated string each time. A single well formed message of about 1.6 MB blocked the event loop for one to twenty seconds depending on the host, and inline message/rf…
Laravel TokenGuard authentication bypass through non-string API credentials
影響: composer:laravel/framework >= 13.0.0, < 13.29.0 → 13.29.0, composer:laravel/framework < 12.68.0 → 12.68.0 Laravel's built-in TokenGuard, when configured with a standard token-based API guard, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. Under certain database configurations (MySQL/MariaDB) an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected. Impact An unauth…
vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)
影響: pip:vllm >= 0.7.3, < 0.31.0 → 0.31.0 API clients can supply arbitrary mm_processor_kwargs per request. vLLM forwards these values through the multimodal rendering and processing pipeline to Hugging Face and custom image/video processor constructors and calls. Resource-sensitive values such as image size, patch size, patch count, crop count, or frame count can therefore be controlled by a remote client. For processors that upscale inputs, a single request can force an allocation large enough to terminate the API server or worker wi…
pypdf: Possible long runtimes for repeated references to the same missing object
影響: pip:pypdf < 6.21.2 → 6.21.2 An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading relevant parts of a file (like their pages) where the same, but non-existent indirect object is referenced multiple times. Patches This has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2). Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4240](https://github.com/py-pdf/pypdf/pull/4240).
pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)
影響: pip:pypdf < 6.21.2 → 6.21.2 An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams. Patches This has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2). Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4240](https://github.com/py-pdf/pypdf/pull/4240). Notes This is a follow-up to https://github.com/py-pdf/pypdf/security/advisories/GHSA-55h5-xmcq-…
pypdf: Possible long runtimes for large xref table header limits
影響: pip:pypdf < 6.21.2 → 6.21.2 An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires opening a file with large/wrong upper limits in the xref table. Patches This has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2). Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4239](https://github.com/py-pdf/pypdf/pull/4239).
Electron: Mitigation for compromised eMudhra intermediate certificates
影響: npm:electron >= 45.0.0-alpha.1, < 45.0.0-beta.6 → 45.0.0-beta.6, npm:electron >= 44.0.0-alpha.1, < 44.9.1 → 44.9.1, npm:electron >= 43.0.0-alpha.1, < 43.8.1 → 43.8.1, npm:electron < 42.11.16 → 42.11.16 A set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS clients. This Electron update adds the same block to both Chromium networking and Node.js tls, https and fetch. On earlier versions, an attacker holding a certificate issued through these intermediates and able to intercept network traffic could impersonate a TLS server to an app. Apps are only affected if they make TLS connections over a network an attacker can intercept. Apps that make…
body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
影響: npm:body-parser >= 2.0.0, < 2.4.0 → 2.4.0, npm:body-parser < 1.20.9 → 1.20.9 A single request can crash any application using body-parser with default options. When a request carries a Content-Encoding (for example gzip), body-parser pipes it into a decompression stream and, after reading the body, leaves that stream piped with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an unca…
gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()
影響: rust:gix >= 0.88.0, <= 0.89.0 → 0.90.0 In the gix crate, Cache::protect_options() in gix/src/config/cache/access.rs reads the three filesystem path-protection settings (core.protectHFS, core.protectNTFS, and gitoxide.core.protectWindows) with the unfiltered gix_config::File::boolean() accessor instead of the trust-aware boolean_filter() accessor used by every other security-critical config read in the same file. When a repository is opened with reduced trust (an ownership mismatch, which maps .git/config sections to Trust::Reduced),…
Echo: WebSocket proxy can retain connections and handlers after client disconnect
影響: go:github.com/labstack/echo/v4 >= 4.15.0, < 4.16.1 → 4.16.1, go:github.com/labstack/echo/v5 >= 5.0.0, < 5.4.1 → 5.4.1 Echo's Proxy middleware could retain a handler, copy goroutines and network connections after a WebSocket client disconnected if the upstream kept its connection open. The raw proxy waited for both copy directions to finish without reliably closing the other connection when one direction ended. Rejected upgrade responses with HTTP keep-alive were one way to trigger this behavior. Repeated connections can accumulate resources and cause denial of service. The impact depends on the proxy route's a…
Echo: Decompress permits unbounded gzip expansion in v4
影響: go:github.com/labstack/echo/v4 >= 4.0.0, < 4.16.1 → 4.16.1 Echo v4's opt-in Decompress middleware exposed a gzip-decoded request stream without limiting its expanded size. A small compressed request could therefore produce a very large decoded body. Handlers that read or bind that body could consume excessive memory or CPU, and repeated or concurrent requests could cause denial of service. The middleware is not enabled by default. A limit on the compressed request size alone does not bound the decompressed size. Applications that already apply an effec…
Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
影響: go:github.com/labstack/echo/v4 >= 4.0.0, < 4.16.1 → 4.16.1, go:github.com/labstack/echo/v5 >= 5.0.0, < 5.4.1 → 5.4.1 Echo's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validating whether the configured upstream accepted it. If the upstream returned an ordinary HTTP response and kept the connection alive, subsequent HTTP requests on that connection were forwarded directly to the same upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only at Echo's routes. Exploitation requires an…
Echo: BodyDump captures request and response bodies without size limits in v4
影響: go:github.com/labstack/echo/v4 >= 4.0.0, < 4.16.1 → 4.16.1 Echo v4's opt-in BodyDump middleware read complete request bodies into memory and retained complete response bodies without a capture limit. A client able to submit large requests to a route using BodyDump could cause large allocations before the application handler ran. Large responses, including responses whose size can be influenced by a client, also caused an additional unbounded capture allocation. Repeated or concurrent requests can exhaust process memory and cause denial of service. Body…
Strands Agents SDK: Exposure of data element to wrong session in the A2A Server
影響: pip:strands-agents < 1.43.0 → 1.43.0, npm:@strands-agents/sdk < 1.5.0 → 1.5.0 Strands Agents SDK is an open-source SDK, available for Python (strands-agents) and TypeScript (@strands-agents/sdk), for building and running AI agents. An issue exists where, under certain circumstances, the Agent2Agent (A2A) server shares conversation history across callers with different context\_id values, allowing one caller to read and influence another caller's session. Impact The A2A server did not properly isolate conversation state between callers. In multi-tenant deployments, an aut…
virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)
影響: pip:virtualenv >= 21.14.9, < 21.14.13 → 21.14.13 The bash activator puts the caller-supplied prompt value into PS1 unescaped whenever promptvars is off at activation time, and assumes prompt expansion can never run afterwards. promptvars and posix mode are runtime shell state, not a property of the activation moment: re-enabling prompt expansion in the same shell (shopt -s promptvars, set -o posix) or starting an interactive child bash that inherits the exported PS1 makes bash expand the stored value and run the command substitution in it. An…
Mistune: Path Traversal and XSS in Include directive
影響: pip:mistune <= 3.2.0 → 3.3.0 The Include directive in src/mistune/directives/include.py does not validate that the resolved file path stays within the source directory, allowing path traversal via ../ sequences to read arbitrary files. Additionally, error messages and included file contents are rendered without HTML escaping, leading to XSS even when escape=True. Affected functions: - Path resolution (lines 27-31) - block_error() in html.py (line 140) - render_html_include() (line 72) The Include plugin must be explicitly…
Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer
影響: pip:Twisted <= 26.4.0 → 26.10.0rc1 An unbounded-buffer vulnerability (CWE-770) in the Twisted words IRC server lets any unauthenticated remote client exhaust server memory. twisted.words.protocols.irc.IRC.dataReceived appends every received byte to a per-connection buffer and only removes data at a line feed, with no maximum length. Because IRC is a plain Protocol and not a LineReceiver, one connection that streams bytes without a line feed grows the buffer without bound and drives the whole single-threaded process to out-of-mem…
Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer
影響: pip:Twisted <= 26.4.0 → 26.10.0rc1 An allocation-without-limits vulnerability (CWE-770) in the Twisted conch telnet transport lets any unauthenticated remote peer exhaust server memory over a single connection. When the peer opens a telnet subnegotiation with IAC SB and then streams bytes without ever sending the IAC SE terminator, every byte is appended to a per-connection buffer that has no maximum length. The buffer persists across reads and is released only on the terminator the attacker withholds, so it grows without bound…
Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree
影響: pip:Twisted <= 26.4.0 → 26.10.0rc1 An allocation-without-limits vulnerability in the Twisted XML element stream lets any unauthenticated remote peer exhaust server memory over a single stream. When the peer opens a container element and streams child elements without ever closing the container, every element is materialised into an in-memory tree with no limit on depth or child count. An element is released only when its end tag arrives, so a container the attacker never closes retains everything beneath it until the process is…
obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes
影響: npm:obsidian-tc >= 1.0.1, <= 1.31.3 → 1.31.4 create_entity, link_entities, rename_entity, unlink_entities and delete_entity regenerate a memory note's body from SQLite at the computed memory/ / .md path. When a note already existed at that path and was not owned by the entity being written (a hand-authored note, or an orphan left by a different entity whose name sanitized to the same path), its entire body was overwritten on the next write naming that (type, name), keeping only its frontmatter. Separately, several of these tools inserted…
SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream
影響: go:github.com/siyuan-note/siyuan/kernel < 0.0.0-20260731131820-67bc300b6ea6 → 0.0.0-20260731131820-67bc300b6ea6 Two checks on the same WebSocket request URI parse it differently. The authentication exemption for keepalive sessions matches raw substrings, while the quarantine introduced to contain those sessions reads a parsed query parameter. Because Go's url.Values.Get returns only the first value for a repeated key, a single URI can satisfy the exemption and still resolve to a non-auth session identity. The result is that an unauthenticated remote caller connects to the kernel WebSocket with a valid ac…
obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback
影響: npm:obsidian-tc < 1.3.1 → 1.3.1 The Streamable HTTP transport was constructed without enableDnsRebindingProtection/allowedHosts/allowedOrigins and performed no Origin-header validation. With the documented auth.mode: "none" loopback default, a drive-by web page could POST http://127.0.0.1/mcp and receive caller http-local with scopes [""] — full vault read/write — via DNS rebinding / a forged Origin. Patches Fixed in 1.3.1. Upgrade to >= 1.3.1. The transport now enables DNS-rebinding protection and allowed hosts/origins and r…
obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP
影響: npm:obsidian-tc >= 1.13.0, <= 1.31.3 → 1.31.4 On a Streamable HTTP deployment with auth.jwtSecret configured, serving a 2026-07-28-era client that declared elicitation.form support, a call to a dispatch-gated tool (destructive: true, or a scope with an HITL floor) that was offered an inputRequired confirmation could still complete after the human declined, cancelled, or the elicitation response was omitted or malformed, provided the client echoed the validly bound requestState on resubmission. The server trusted an authentic, call-bound st…
obsidian-tc tokens can access arbitrary configured vaults
影響: npm:obsidian-tc < 1.3.1 → 1.3.1 Tool dispatch did not check the caller-supplied input.vault against the caller's bound vault (ctx.vaultId); the folder ACL was a single global instance and the JWT carried no vault claim. As a result, any valid token could read, write, or delete any configured vault by passing input.vault, defeating multi-tenant isolation across ~90 tool sites. (resources/read was the only surface that already guarded this.) Patches Fixed in 1.3.1 (the fix was developed on the v1.3.0 tag, which never published…
10月23日(金)
Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()
影響: pip:pillow >= 11.1.0, < 13.0.0 → 13.0.0 Every Pillow wheel from 11.1.0 onward bundles a libopenjp2 containing a heap-buffer-overflow write that is fixed upstream on master but has never appeared in an OpenJPEG release. See https://osv.dev/vulnerability/OSV-2025-219 Because the wheel bundles its own copy, a patched host OS does not help. It is reachable from Image.open(fp); im.load() with default settings. I am reporting it here rather than only upstream because Pillow is where the vulnerable binary actually reaches users. Note the in…
Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
影響: npm:next >= 16.0.0, <= 16.4.0 → 16.4.1 A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays. Workaround There is no known workaround for affected applications with such use cache functions. You should upgrade immediately even if your application does not have similar functions.
GitPython validates a submodule's ".git" path only after cloning into it (RCE)
影響: pip:Gitpython <= 3.2.0 → 3.2.1 create_submodule(name, path, url) clones a submodule into the repo's own .git directory before it rejects the path. A path of ".git/hooks" is accepted by the pre-clone check, so the submodule is cloned straight into the live hooks directory, and a file named post-checkout in the submodule becomes an executable .git/hooks/post-checkout. On 3.2.0+ the later index check does raise ValueError, but only after the clone already wrote to disk, and it does not remove the planted hook; on 3.1.x there is…
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
影響: npm:tome <= 5.0.0 → 5.0.1 CVE-2026-63376 described prototype pollution through __proto__ key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the owned-container check is not applied on the path that matters. A four-line TOML document parsed with toml.parse() writes a property onto Object.prototype, where it is visible to every object in the process — includ…
toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()
影響: npm:toml <= 5.0.0 → 5.0.1 toml.parse() is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via many array-of-tables ([[name]]) headers. addTableArray() in lib/compiler.js rescans two entire bookkeeping Sets on every [[name]] header without pruning unrelated or distinct entries, so a document containing n such headers costs O(n²) compiler work. A ~321KB document of 20,000 distinct-named [[name]] blocks takes ~10.3 seconds to parse — a completely ordinary-looking TOML shape (a flat settings block plus one or…
toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()
影響: npm:toml <= 5.0.0 → 5.0.1 toml.parse() is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via a single long dotted key, table header, or inline-table key. A ~100KB crafted document causes a multi-second synchronous hang; a ~200KB document crashes the Node.js process outright with an uncatchable out-of-memory error. This is a separate, unpatched code path from the previously fixed stack-overflow DoS (GHSA-82x6-q7mm-w9cf) — it requires no array/inline-table nesting at all, and is confirmed unaffected by the…
toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()
影響: npm:toml <= 5.0.0 → 5.0.1 toml.parse() converts integer literals (hex, octal, binary, and decimal) to BigInt without first bounding the length of the digit sequence. Since BigInt(string) construction from a very long numeric string runs in super-linear time, a single small, well-formed TOML document containing one long integer literal can pin a Node.js process's event loop at 100% CPU for several seconds — a denial of service for any application that parses attacker-supplied or third-party TOML. No authentication or com…
Storybook dev server vulnerable to code injection from the local network
影響: npm:storybook >= 8.0.0, < 8.6.19 → 8.6.19, npm:storybook >= 9.0.0, < 9.1.21 → 9.1.21, npm:storybook >= 10.0.0, < 10.6.2 → 10.6.2, npm:storybook >= 11.0.0-alpha.0, < 11.0.0-alpha.6 → 11.0.0-alpha.6, npm:@storybook/core >= 8.0.0, < 8.6.19 → 8.6.19, npm:@storybook/core-server >= 8.0.0, < 8.6.19 → 8.6.19, npm:@storybook/experimental-addon-test >= 8.0.0, < 8.6.19 → 8.6.19, npm:@storybook/addon-vitest >= 9.0.0, < 9.1.21 → 9.1.21, npm:@storybook/addon-vitest >= 10.0.0, < 10.6.2 → 10.6.2, npm:@storybook/addon-vitest >= 11.0.0-alpha.0, < 11.0.0-alpha.6 → 11.0.0-alpha.6, npm:@storybook/addon-mcp >= 10.6.0, < 10.6.2 → 10.6.2, npm:@storybook/addon-mcp >= 11.0.0-alpha.0, < 11.0.0-alpha.6 → 11.0.0-alpha.6 Summary: The Storybook dev server exposes its WebSocket authentication token to any client that can load its HTML pages. Any host on a LAN can open a Storybook app by IP address, and therefore obtain the token. The WebSocket can be used to inject code into story files or to create new files. Under the right circumstances, an attacker can execute code on the machine of a developer connected on the same LAN. Who is impacted? You are impacted if you run a Storybook dev server whilst connected on a…
GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments
影響: npm:@graphql-tools/utils >= 10.10.1, <= 12.0.1 → 12.0.2 Report metadata | Field | Value | | --- | --- | | Package | @graphql-tools/utils (npm, pkg:github/ardatan/graphql-tools) | | Repository | https://github.com/ardatan/graphql-tools | | Component | mergeIncrementalResult / setObjectKeyPath (packages/utils/src/mergeIncrementalResult.ts) | | Vulnerability class | Prototype pollution (via unvalidated object path traversal) | | Verified against | Source read at 134d67ae36a559651f43ec7fe4a9da76f4a00c2b; master HEAD ccca0ff0dc8ea20726fd116b2f19a38709c30…
GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit
影響: pip:graphql-core >= 3.2.3, < 3.2.12 → 3.2.12, pip:graphql-core >= 3.3.0a3, < 3.3.0rc1 → 3.3.0rc1 The parser's max_tokens limit — the documented defence against oversized GraphQL documents — did not count comment tokens. A document padded with comments could therefore pass a max_tokens check of any size while still allocating one Token object per comment, all of which stay reachable for the lifetime of the parsed document. A 38 MB comment-padded payload allocated roughly 92 MB of additional resident memory with max_tokens=5 in force. Details Lexer.lookahead() reads tokens one at a time and…
GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule
影響: pip:graphql-core >= 3.0.0, < 3.2.12 → 3.2.12, pip:graphql-core >= 3.3.0a1, < 3.3.0rc1 → 3.3.0rc1 The OverlappingFieldsCanBeMerged validation rule can be driven into quadratic — and in the worst case O(n²·m²) — running time by a small, highly compressible query. A single 364 KB document can occupy one CPU core for over five minutes during validation, before any resolver runs. Because the rule is part of specified_rules and therefore enabled by default, every GraphQL-core based server is affected at default settings. Details OverlappingFieldsCanBeMerged compares every pair of fields that sha…
DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
影響: npm:dompurify >= 3.4.4, <= 3.4.16 → 3.4.17 When DOMPurify is configured with SAFE_FOR_TEMPLATES: true together with a DOM-returning mode (RETURN_DOM: true, RETURN_DOM_FRAGMENT: true, or IN_PLACE: true), template expressions such as {{...}}, ${...}, and survive sanitization inside the text content of an attached shadow root. The post-walk safety net _scrubTemplateExpressions (src/purify.ts:1717) was extended to recurse into .content, but it never recurses into attached shadow roots. An attacker who can supply a DOM node carrying a shadow…
DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)
影響: npm:dompurify <= 3.4.16 → 3.4.17 The 3.4.16 fix for GHSA-p98j-92pf-mc4p only covers a hook that removes the node it was called for. If an IN_PLACE hook removes a different node, like the current node's parent or a sibling that has not been visited yet, that subtree is never walked or neutralized. Event handlers in it stay on the elements, and an that was already loading fires after sanitize() returns. The README says: "Nodes that a hook detaches from the tree ... are treated as removed. In IN_PLACE mode their subtree is neutra…
nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc
影響: pip:nbconvert >= 5.4.0, <= 7.17.1 → 7.17.2 nbconvert <= v7.17.1 has an arbitrary file write vulnerability due to a path traversal in ipynb cell output metadata, more specifically on the filename attribute. Vulnerable converters : --to markdown, --to latex, --to rst, --to asciidoc. In ExtractOutputPreprocessor, extractoutput.py:116-119 joins attacker-controlled path to output_files_dir with no canonicalization check, enabling arbitrary file write. This is a sibling vulnerability of https://github.com/advisories/GHSA-4c99-qj7h-p3vg. Impac…
Black: GitHub Action installs unvalidated required-version from pyproject.toml
影響: pip:black < 26.10.1 → 26.10.1 The GitHub Action bundled with Black can read the version from tool.black.required-version if use_pyproject is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository. Details This is similar to the previous CVE-2026-31900. The value in tool.black.required-version is accepted as the version to be installed by the action without validation. Proof of concept Reproduction requires a victim to use Black's GitHub Action w…
Django REST framework: TokenProxy.delete() reports success and revokes nothing
影響: pip:djangorestframework >= 3.12.0, < 3.18.2 → 3.18.2 Deleting an authentication token through TokenProxy silently deletes nothing. The call raises no exception and reports success, the database row survives, and the token keeps authenticating. Any application, admin integration or operational script that revokes credentials by calling .delete() on a TokenProxy instance believes it has revoked a token that is still live. Details TokenProxy overrides pk to return the user id (rest_framework/authtoken/models.py:49-63): python @property def pk(self):…
Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation
影響: pip:djangorestframework < 3.18.2 → 3.18.2 DRF's content negotiation parses each Accept token several times per request and never limits the number of tokens or their total size. Each parse ends up in Django's parse_header_parameters, which takes quadratic time when a quoted parameter value is packed with semicolons. On my machine a single GET with a 780KB Accept header made of 96 such tokens kept one gunicorn worker busy for 18.87 seconds (Django 6.1, djangorestframework 3.18.0, gunicorn 26.0.0, Python 3.13, Docker on macOS). The heade…