VulnPulse

脆弱性・アップデート

2 ページ目

10月22日(木)今日

  • 注意01:48脆弱性アドバイザリJavaScript / Node.jsGitHub Advisory Database

    Vite: Cross origin script execution through Vite custom middleware

    影響: npm:vite >= 8.3.0, <= 8.3.2 → 8.3.3, npm:vite >= 8.2.0, <= 8.2.3 → 8.2.4, npm:vite >= 8.0.0, <= 8.1.5 → 8.1.6, npm:vite >= 7.0.0, <= 7.3.6 → 7.3.7, npm:vite <= 6.4.3 → 6.4.4, npm:vite-plus <= 1.0.0 → 1.1.0 When accessing a malicious site while a dev server using Vite is running, that site was able to load scripts in a page served by the dev server. Impact Only apps that match the following conditions are affected: - the dev server passes an unchanged browser request URL to server.transformIndexHtml: this is normally used for server.middlewareMode: true or appType: 'custom'. The internal call for appType: 'spa' and appType: 'mpa' does not match this. - the transformed HTML contains an inli…

    CVE-2026-112945
  • 警告01:47脆弱性アドバイザリJavaScript / Node.jsGitHub Advisory Database

    Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

    影響: npm:vite >= 8.3.0, <= 8.3.2 → 8.3.3, npm:vite >= 8.2.0, <= 8.2.3 → 8.2.4, npm:vite >= 8.0.0, <= 8.1.5 → 8.1.6, npm:vite >= 7.0.0, <= 7.3.6 → 7.3.7, npm:vite <= 6.4.3 → 6.4.4, npm:vite-plus <= 1.0.0 → 1.1.0 The content of files outside server.fs setting can be returned to the browser if the project imports a file path concatenated with the root. For example, if the project references /etc/hosts, the content of /etc/hosts was possible to be returned. The content of files outside the server.fs.allow option can be returned to the browser when a project imports a file whose root-relative path matches an absolute path on the host. For example, referencing /etc/hosts could make Vite return the h…

    CVE-2026-112946
  • 警告01:47脆弱性アドバイザリJavaScript / Node.jsGitHub Advisory Database

    Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

    影響: npm:vite >= 8.3.0, <= 8.3.2 → 8.3.3, npm:vite >= 8.2.0, <= 8.2.3 → 8.2.4, npm:vite-plus >= 0.2.8, <= 1.0.0 → 1.1.0 The first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Impact Only apps that match one of the following conditions are affected: - explicitly expose the Vite dev server to the network using --host or the [server.host](https://vite.dev/config/server-options#server-host) option - there's a file that has a sensitive information in the first 4 bytes - uses Node.js or Deno to run Vite (if Bun is used, it is not affe…

    CVE-2026-112947
  • 重要01:46脆弱性アドバイザリPythonGitHub Advisory Database

    virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

    影響: pip:virtualenv <= 21.14.3 → 21.14.4 zsh users activate an environment with the bash activate script, which puts the environment name into PS1. Since 21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when BASH_VERSION is set, so zsh gets the raw value. With the PROMPT_SUBST option set, zsh runs parameter expansion, command substitution and arithmetic expansion on PS1 each time it draws the prompt. A name that contains $(...), backticks or ${...} then runs as commands in the user's she…

    CVE-2026-113726
  • 重要01:39脆弱性アドバイザリPythonGitHub Advisory Database

    virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote

    影響: pip:virtualenv <= 21.14.1 → 21.14.2 FishActivator defines no quote(), so it inherits ViaTemplateActivator.quote, which returns shlex.quote(string). That function follows POSIX sh rules, where a backslash inside single quotes stays a literal character. fish reads \' inside single quotes as an escaped quote and \\ as an escaped backslash. A value with a backslash before a quote therefore ends the literal somewhere other than where shlex.quote put the end, and fish expands the command substitution that follows. The environmen…

    CVE-2026-113732
  • 重要01:39脆弱性アドバイザリPythonGitHub Advisory Database

    virtualenv activation scripts run code from a path that contains a placeholder name

    影響: pip:virtualenv >= 20.26.6, <= 21.14.1 → 21.14.2 ViaTemplateActivator.instantiate_template replaces the placeholders in an activation template one key at a time, each across the whole text. When a value that it already substituted and quoted contains the name of a later placeholder, the later pass rewrites that name inside the quoted literal. The inserted value brings its own quotes, which close the outer literal, and the rest of the path runs as code when a user activates the environment. __VIRTUAL_NAME__ holds the environment's direc…

    CVE-2026-113776
  • 警告01:38脆弱性アドバイザリRustGitHub Advisory Database

    Slack Morphism verifier errors disclose valid HMACs in the logs

    影響: rust:slack-morphism >= 1.0.0, <= 2.27.0 → 2.28.0 Slack Morphism exposes the correct Slack request HMAC when signature verification fails. For an invalid request, slack-morphism computes the correct signature for the attacker-controlled timestamp and request body and stores it in SlackEventWrongSignatureError.generated_hash. The error's Debug and Display representations expose that value, and the default Axum listener error handler logs it at error level. An attacker who can both reach the application's Slack callback endpoint and read…

    CVE-2026-113799
  • 警告01:31脆弱性アドバイザリJavaGitHub Advisory Database

    OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies

    影響: maven:ognl:ognl <= 3.4.12 → 3.4.13 OGNL's optional stricter invocation mode maintains a block list that prevents expressions from directly calling methods on dangerous classes such as Runtime, ProcessBuilder, and ClassLoader. The block list filters on the declaring class of the method OGNL invokes. Because java.lang.reflect.Method (and Constructor/Field) are not on the list, an expression can use reflection as a proxy — someMethod.invoke(target, args) — to reach a blocked method. The real call (e.g. ProcessBuilder.start(…

    CVE-2026-113730
  • 重要01:29脆弱性アドバイザリGitHubGoGitHub Advisory Database

    OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs

    影響: go:github.com/openchoreo/openchoreo >= 1.0.0, < 1.0.6 → 1.0.6, go:github.com/openchoreo/openchoreo >= 1.1.0, < 1.1.7 → 1.1.7, go:github.com/openchoreo/openchoreo >= 1.2.0, < 1.2.5 → 1.2.5 The OpenChoreo API server authorized PUT .../workflowruns/{runName} against ownership metadata taken from the request body, while the object it actually mutated was selected by the URL path. Nothing forced the two to agree. A WorkflowRun's membership in a project and component is carried entirely by its openchoreo.dev/project and openchoreo.dev/component labels. Because the workflowrun:update check read those labels from the submitted object rather than the stored one, a caller holding…

    CVE-2026-113727
  • 重要01:27脆弱性アドバイザリGitHubGoGitHub Advisory Database

    Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization

    影響: go:github.com/moov-io/signedxml <= 1.4.0 → 1.4.1 Exclusive XML canonicalization (http://www.w3.org/2001/10/xml-exc-c14n#) in github.com/moov-io/signedxml copied the entire accumulated namespace map at every node during ValidateReferences(), before any reference digest or signature check. For a chain of nested elements that each declare many unused namespace prefixes, that produced O(m × depth²) time and peak memory (m = prefixes per level). beevik/etree caps tree depth (~1024), but m is unbounded, so a small attacker-controlled document (on t…

    CVE-2026-113729
  • 01:17リリース・告知JavaScript / Node.jsNode.js Vulnerability Blog

    Wednesday, October 21, 2026 Security Releases

10月21日(水)昨日