vuln-osv update 2026-11-11T00:44:13Z
This commit is contained in:
Vulnerability Bot
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-xcf7-88g6-7xr8","published":"2026-11-10T21:50:54Z","modified":"2026-11-10T22:00:04.231598969Z","aliases":["CVE-2026-125125"],"summary":" compose-lint: Workflow command injection through SARIF-directory errors triggered by pull request symlinks ","details":"### Impact\n\nIn Action tags v0.30.0 and v0.31.0, when `sarif-file:` names a file in a subdirectory that can't be created, the Action prints the directory's resolved path in an error message. In v0.31.0 that message is outside the window in which the Action turns command processing off, and v0.30.0 has no such window. A pull request can commit a symlink on that path to a directory whose name contains a newline followed by a command.\n\nA pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed.\n\nOnly the Action is affected, and only when `sarif-file:` points into a subdirectory. The documented setup, `sarif-file: results.sarif` at the repository root, is not affected. The `compose-lint` package, the pre-commit hook and the Docker image do not print this message.\n\nFound during an internal pre-1.0 security review. It was first published as part of GHSA-r7j4-crjv-h467, together with four other gaps in the same fix. Each gap now has its own advisory.\n\n### Patches\n\nFixed in 0.32.0. The SARIF-directory error names the `sarif-file:` input as written.\n\n### Workarounds\n\n- Upgrade to 0.32.0 or later.\n- Keep `sarif-file` at the workspace root, for example `sarif-file: results.sarif`.\n\n### Reproduction\n\nOn a GitHub-hosted runner (runner 2.337.0), the Action at v0.31.0 with `sarif-file: out/reports/results.sarif`, where `out` is a committed symlink to a directory named `d\\n::warning::X` that contains a regular file `reports`, creates an annotation. With `sarif-file` at the repository root it creates none.","affected":[{"package":{"name":"tmatens/compose-lint","ecosystem":"GitHub Actions"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.30.0"},{"fixed":"0.32.0"}]},{"type":"GIT","repo":"https://github.com/tmatens/compose-lint","events":[{"introduced":"adf00708734b772686337b69831c8e3912fa0ed4"},{"fixed":"2d42617e4c6416f797bbfc6a057950131fa02df3"}]}],"versions":["v0.31.0","v0.30.0"],"database_specific":{"last_known_affected_version_range":"<= 0.31.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xcf7-88g6-7xr8/GHSA-xcf7-88g6-7xr8.json"}}],"references":[{"type":"WEB","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-xcf7-88g6-7xr8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125125"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/pull/945"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"},{"type":"PACKAGE","url":"https://github.com/tmatens/compose-lint"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"}],"database_specific":{"cwe_ids":["CWE-117","CWE-150"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:50:54Z","nvd_published_at":"2026-11-10T17:17:27Z","severity":"LOW"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N"}]}
|
||||
File diff suppressed because one or more lines are too long
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-49q5-vjx7-5gwr","published":"2026-11-10T21:32:51Z","modified":"2026-11-10T22:15:03.501127686Z","withdrawn":"2026-11-10T22:07:38Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-114154 - ASP.NET Core Denial of Service Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-3893-7fxc-qvff. This link is maintained to preserve external references.\n\n## Original Description\nUncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.","affected":[{"package":{"name":"Microsoft.AspNetCore.Server.HttpSys","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Server.HttpSys"},"versions":["2.3.10"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-49q5-vjx7-5gwr/GHSA-49q5-vjx7-5gwr.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114154"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114154"}],"database_specific":{"cwe_ids":["CWE-401"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T22:07:38Z","nvd_published_at":"2026-11-10T19:19:08Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-95x6-7hq8-2c37","published":"2026-11-10T21:32:52Z","modified":"2026-11-10T22:30:03.785251805Z","withdrawn":"2026-11-10T22:16:47Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-114157 - ASP.NET Core Security Feature Bypass Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-7phj-vgxq-r67h. This link is maintained to preserve external references.\n\n## Original Description\nConcurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.","affected":[{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"last_affected":"8.0.33"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-95x6-7hq8-2c37/GHSA-95x6-7hq8-2c37.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114157"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114157"}],"database_specific":{"cwe_ids":["CWE-362"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T22:16:47Z","nvd_published_at":"2026-11-10T19:19:09Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-c827-j3xf-67v6","published":"2026-11-10T21:32:51Z","modified":"2026-11-10T22:30:03.730169787Z","withdrawn":"2026-11-10T22:14:43Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-114156 - ASP.NET Core Security Feature Bypass Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-8w29-6cjc-h6w4. This link is maintained to preserve external references.\n\n## Original Description\nImproper input validation in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.","affected":[{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.7.26381.103"},{"last_affected":"11.0.0-rc.3.26522.148"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-c827-j3xf-67v6/GHSA-c827-j3xf-67v6.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114156"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114156"}],"database_specific":{"cwe_ids":["CWE-41"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T22:14:43Z","nvd_published_at":"2026-11-10T19:19:08Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N"}]}
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-fgfw-85w4-gx99","published":"2026-11-10T21:33:44Z","modified":"2026-11-10T22:45:03.444752861Z","withdrawn":"2026-11-10T22:30:50Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-120792 - Aspire Information Disclosure Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-q6jf-24jf-m3cg. This link is maintained to preserve external references.\n\n## Original Description\nInsertion of sensitive information into log file in .NET Aspire allows an authorized attacker to disclose information locally.","affected":[{"package":{"name":"Aspire.Cli","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.2.0"}]}],"versions":["13.2.0","13.2.1","13.2.2","13.2.3","13.2.4","13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4","13.6.5"],"database_specific":{"last_known_affected_version_range":"< 13.6.5","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-fgfw-85w4-gx99/GHSA-fgfw-85w4-gx99.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120792"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-120792"}],"database_specific":{"cwe_ids":["CWE-532"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T22:30:50Z","nvd_published_at":"2026-11-10T19:20:28Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-gxg8-5rwf-cg43","published":"2026-11-10T21:32:51Z","modified":"2026-11-10T22:15:04.366637508Z","withdrawn":"2026-11-10T22:06:12Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-114147 - ASP.NET Core Denial of Service Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-wr8v-9x5q-ggcm. This link is maintained to preserve external references.\n\n## Original Description\nMissing release of memory after effective lifetime in ASP.NET Core allows an unauthorized attacker to deny service over a network.","affected":[{"package":{"name":"Microsoft.AspNetCore.SignalR.StackExchangeRedis","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.SignalR.StackExchangeRedis"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"last_affected":"8.0.33"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-gxg8-5rwf-cg43/GHSA-gxg8-5rwf-cg43.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114147"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114147"}],"database_specific":{"cwe_ids":["CWE-401"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T22:06:12Z","nvd_published_at":"2026-11-10T19:19:07Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-hfpm-4fc4-g2wc","published":"2026-11-10T21:33:43Z","modified":"2026-11-10T22:30:03.447265936Z","withdrawn":"2026-11-10T22:17:41Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-120778 - Aspire Elevation of Privilege Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-m63f-xhvm-6mv5. This link is maintained to preserve external references.\n\n## Original Description\nCreation of temporary file in directory with insecure permissions in .NET Aspire allows an authorized attacker to elevate privileges locally.","affected":[{"package":{"name":"Aspire.Cli","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.2.0"}]}],"versions":["13.2.0","13.2.1","13.2.2","13.2.3","13.2.4","13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4","13.6.5"],"database_specific":{"last_known_affected_version_range":"< 13.6.5","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-hfpm-4fc4-g2wc/GHSA-hfpm-4fc4-g2wc.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120778"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-120778"}],"database_specific":{"cwe_ids":["CWE-379"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T22:17:41Z","nvd_published_at":"2026-11-10T19:20:26Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}]}
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-r33q-3g5w-gqx6","published":"2026-11-10T21:32:22Z","modified":"2026-11-11T00:30:04.459937050Z","withdrawn":"2026-11-11T00:11:54Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-105544 - .NET Elevation of Privilege Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-6856-87hx-p5x7. This link is maintained to preserve external references.\n\n## Original Description\nImproper access control in .NET allows an authorized attacker to elevate privileges locally.","affected":[{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.2.0-preview-20220301-01"}]}],"versions":["17.10.0","17.10.0-preview-24080-01","17.10.0-release-24177-07","17.11.0","17.11.0-release-24352-06","17.11.0-release-24373-02","17.11.1","17.11.2","17.12.0","17.12.1","17.13.0","17.14.0","17.14.0-preview-25107-01","17.14.1","17.14.2","17.2.0","17.2.0-preview-20220301-01","17.2.0-preview-20220401-07","17.2.0-preview-20220401-08","17.2.1","17.3.0","17.3.0-preview-20220426-02","17.3.0-preview-20220530-08","17.3.0-preview-20220612-01","17.3.1","17.3.2","17.3.3","17.3.4","17.4.0","17.4.0-preview-20220707-01","17.4.0-preview-20220726-02","17.4.0-preview-20221003-03","17.4.0-release-20220926-01","17.4.1","17.5.0","17.5.0-preview-20221003-04","17.5.0-preview-20221221-03","17.6.0","17.6.0-preview-20230223-05","17.6.1","17.6.2","17.6.3","17.7.0","17.7.0-preview-23364-03","17.7.1","17.7.2","17.8.0","17.8.0-preview-23371-04","17.8.0-preview-23424-02","17.8.0-release-23468-02","17.8.1","17.9.0","17.9.0-preview-23503-02","17.9.0-preview-23531-01","17.9.0-preview-23577-04","17.9.0-release-23619-01","18.0.0","18.0.1","18.0.2","18.10.0","18.10.1","18.10.2","18.11.0","18.11.1","18.3.0","18.4.0","18.5.0","18.5.1","18.6.0","18.7.0","18.7.1","18.8.0","18.8.1","18.9.0"],"database_specific":{"last_known_affected_version_range":"< 17.3.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r33q-3g5w-gqx6/GHSA-r33q-3g5w-gqx6.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105544"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105544"}],"database_specific":{"cwe_ids":[],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:11:54Z","nvd_published_at":"2026-11-10T19:17:56Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"}]}
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-wrm2-c2h2-4w82","published":"2026-11-10T21:32:29Z","modified":"2026-11-11T00:30:04.347303079Z","withdrawn":"2026-11-11T00:21:09Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-109478 - ASP.NET Core Denial of Service Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-r3qf-p3jm-8h4p. This link is maintained to preserve external references.\n\n## Original Description\nInefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.","affected":[{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"last_affected":"8.0.33"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wrm2-c2h2-4w82/GHSA-wrm2-c2h2-4w82.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109478"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109478"}],"database_specific":{"cwe_ids":["CWE-407"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:21:09Z","nvd_published_at":"2026-11-10T19:18:17Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-8v59-qmwv-4p6q","published":"2026-11-10T21:58:53Z","modified":"2026-11-10T22:15:03.405244565Z","aliases":["CVE-2026-125123"],"summary":"compose-lint: File paths embedded in pull requests can inject CI workflow commands through command-line error messages ","details":"### Impact\n\n0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. The fix escapes the command openers in compose-lint's own output, but not in the argument parser's error messages. When a repository path reaches compose-lint's arguments without a `--` before it, the argument parser prints it raw in its error message. That includes a carriage return, which the runner treats as a line break, so a command can also start a new line there.\n\nA pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed.\n\nAffected setups pass repository paths to compose-lint without a `--` before them: the pre-commit hook when `args:` is set without the documented trailing `--`, or the `compose-lint` package or Docker image called that way in a workflow. The pre-commit hook's default configuration passes `--` and is not affected. The GitHub Action turns command processing off around each compose-lint run, so it is not affected.\n\nFound during an internal pre-1.0 security review. It was first published as part of GHSA-r7j4-crjv-h467, together with four other gaps in the same fix. Each gap now has its own advisory.\n\n**Docker image.** `composelint/compose-lint` tag 0.31.0 and the matching minor tag are affected, as was `latest` while it pointed to 0.31.0.\n\nReleases before 0.31.0 are covered by GHSA-6f4g-xm8v-pgv6.\n\n### Patches\n\nFixed in 0.32.0. The argument parser's messages go through the same sanitizer as the rest of compose-lint's output.\n\n### Workarounds\n\n- Upgrade to 0.32.0 or later.\n- End the pre-commit hook's `args:` with `--`, and put `--` before file paths when calling compose-lint directly.\n- On GitHub Actions, use the `tmatens/compose-lint` Action, or bracket the compose-lint step with `::stop-commands::<random token>` and `::<token>::`, as the Action does.\n\n### Reproduction\n\nOn compose-lint 0.31.0 on a GitHub-hosted runner (runner 2.337.0), `compose-lint '--##[warning]X/compose.yml'` with no `--` creates an annotation. The same path after `--` creates none. The `composelint/compose-lint:0.31.0` image produces byte-identical output to the package.","affected":[{"package":{"name":"compose-lint","ecosystem":"PyPI","purl":"pkg:pypi/compose-lint"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.31.0"},{"fixed":"0.32.0"}]}],"versions":["0.31.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-8v59-qmwv-4p6q/GHSA-8v59-qmwv-4p6q.json"}}],"references":[{"type":"WEB","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-8v59-qmwv-4p6q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125123"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/pull/945"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"},{"type":"PACKAGE","url":"https://github.com/tmatens/compose-lint"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"}],"database_specific":{"cwe_ids":["CWE-117","CWE-150"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:58:53Z","nvd_published_at":"2026-11-10T17:17:26Z","severity":"LOW"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-hr4h-4c45-v4q4","published":"2026-11-10T21:40:50Z","modified":"2026-11-10T22:00:03.806318604Z","aliases":["CVE-2026-125122"],"summary":"compose-lint: Text in a pull request can issue CI workflow commands through JSON and SARIF output on stdout","details":"### Impact\n\n0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. `--format json` and `--format sarif` output never passed through that fix, so `##[` inside a service name or other value reaches the log intact when the output is printed to stdout rather than written to a file. The runner acts on `##[` in the middle of a line, so the JSON layout does not prevent it.\n\nA pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed.\n\nAffected setups print JSON or SARIF output to a CI log from the `compose-lint` package, the pre-commit hook or the Docker image. Writing that output to a file, which SARIF upload requires, is not affected. The GitHub Action turns command processing off around each compose-lint run, so it is not affected.\n\nFound during an internal pre-1.0 security review. It was first published as part of GHSA-r7j4-crjv-h467, together with four other gaps in the same fix. Each gap now has its own advisory.\n\n**Docker image.** `composelint/compose-lint` tag 0.31.0 and the matching minor tag are affected, as was `latest` while it pointed to 0.31.0.\n\nReleases before 0.31.0 are covered by GHSA-6f4g-xm8v-pgv6.\n\n### Patches\n\nFixed in 0.32.0. JSON and SARIF on stdout escape `##[` inside strings as `\\u005b`, which decodes to the same data.\n\n### Workarounds\n\n- Upgrade to 0.32.0 or later.\n- Write `--format json` and `--format sarif` output to a file rather than the log.\n- On GitHub Actions, use the `tmatens/compose-lint` Action, or bracket the compose-lint step with `::stop-commands::<random token>` and `::<token>::`, as the Action does.\n\n### Reproduction\n\nOn compose-lint 0.31.0 on a GitHub-hosted runner (runner 2.337.0), a service named `a##[warning]X`, linted with `--format json` or `--format sarif` to stdout, creates annotations. The same file linted with the text report creates none. The `composelint/compose-lint:0.31.0` image produces byte-identical output to the package.","affected":[{"package":{"name":"compose-lint","ecosystem":"PyPI","purl":"pkg:pypi/compose-lint"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.31.0"},{"fixed":"0.32.0"}]}],"versions":["0.31.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-hr4h-4c45-v4q4/GHSA-hr4h-4c45-v4q4.json"}}],"references":[{"type":"WEB","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-hr4h-4c45-v4q4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125122"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/pull/945"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"},{"type":"PACKAGE","url":"https://github.com/tmatens/compose-lint"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"}],"database_specific":{"cwe_ids":["CWE-117","CWE-150"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:40:50Z","nvd_published_at":"2026-11-10T17:17:26Z","severity":"LOW"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N"}]}
|
||||
File diff suppressed because one or more lines are too long
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-2gff-2mmg-m73p","published":"2026-11-10T21:20:06Z","modified":"2026-11-10T21:30:04.269070700Z","aliases":["CVE-2026-126083"],"summary":"Action Pack: Possible IP spoofing in Action Dispatch RemoteIp","details":"### Impact\nSince Rails 8.1.0, `ActionDispatch::RemoteIp` derives `request.remote_ip` from `Rack::Request#forwarded_for`, which under Rack 3 reads the RFC 7239 `Forwarded` header in preference to `X-Forwarded-For`. When a reverse proxy appends the client address to `X-Forwarded-For` but passes a client-supplied `Forwarded` header through unchanged, `request.remote_ip` returns an address chosen by the client, and the IP spoofing check does not raise, because it compares only `Client-Ip` with the forwarded addresses. An unauthenticated attacker could therefore spoof `request.remote_ip`, possibly bypassing IP-based access controls and rate limits keyed on the client address (including the default `by:` of `rate_limit`), and falsifying the client address in logs.\n\n### Details\nThe 8.1.0 change ([2d084af8](https://github.com/rails/rails/commit/2d084af8444a7b6b868c7cbb256172007871e78d)) switched `ActionDispatch::RemoteIp` from reading `X-Forwarded-For` directly to Rack's `forwarded_for`, in order to reuse Rack's port handling. Rails continues to honor `Forwarded`, the standard header.\n\nIn the fixed releases, when `config.action_dispatch.ip_spoofing_check` is enabled (the default), `ActionDispatch::RemoteIp` also compares the first untrusted client address in `Forwarded` with the first untrusted client address in `X-Forwarded-For`, as exact strings, and raises `ActionDispatch::RemoteIp::IpSpoofAttackError` when both headers are present and the addresses differ. Deployments whose proxies report the client address inconsistently between the two headers will receive this error after upgrading. See the `actionpack` CHANGELOG.\n\n### Affected applications\nAn application is affected if it meets all of these requirements:\n- Runs Rails 8.1.0 through 8.1.4 with Rack 3. Under Rack 2.2, `forwarded_for` reads only `X-Forwarded-For`.\n- Is served behind a proxy that does not remove or overwrite a client-supplied `Forwarded` header.\n- Relies on `request.remote_ip` for access control, rate limiting, or auditing.\n\nThe fix detects a spoofed `Forwarded` header only when the proxy also sets `X-Forwarded-For`. An application whose proxy passes a client-supplied `Forwarded` header through and sets no `X-Forwarded-For` remains exposed after upgrading, and should configure the proxy to remove or overwrite `Forwarded`, or apply the workaround below.\n\n### Mitigation\n- Upgrade to a fixed version of `actionpack`.\n- Configure reverse proxies to remove or overwrite any client-supplied `Forwarded` header.\n\n### Workarounds\nApplications whose proxies set `X-Forwarded-For` can make Rack ignore the `Forwarded` header, restoring the client address resolution of Rails 8.0, by setting `Rack::Request.forwarded_priority = [:x_forwarded]` in an initializer. This setting is available in Rack 3.0.0 and later, and it also causes Rack to ignore `Forwarded` when determining the request scheme, host, and port.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/2a01a5ac521184419d9a92fa2c25e102e68cd227.patch\n\n### Versions affected\n- actionpack >= 8.1, < 8.1.4.1\n\n### Credit\nThis issue was responsibly reported by HackerOne researcher [luryus](https://hackerone.com/luryus).","affected":[{"package":{"name":"actionpack","ecosystem":"RubyGems","purl":"pkg:gem/actionpack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-2gff-2mmg-m73p/GHSA-2gff-2mmg-m73p.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-2gff-2mmg-m73p"},{"type":"WEB","url":"https://github.com/rails/rails/commit/2a01a5ac521184419d9a92fa2c25e102e68cd227"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/GHSA-2gff-2mmg-m73p.yml"}],"database_specific":{"cwe_ids":["CWE-348"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:20:06Z","nvd_published_at":null,"severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-2w9f-fxwj-w2qf","published":"2026-11-10T21:27:12Z","modified":"2026-11-10T21:45:04.318644879Z","aliases":["CVE-2026-126075"],"summary":"Active Support: Possible XSS vulnerability in Active Support MessagePack serializer","details":"### Impact\n`ActiveSupport::MessagePack` serializes an `ActiveSupport::SafeBuffer` as its bytes alone and deserializes it as a new `SafeBuffer`, so a buffer that is no longer `html_safe?` (for example, one mutated in place with `gsub!`) is restored as `html_safe`. If such a buffer holds untrusted input and is stored through a MessagePack serializer, rendering it after it is loaded bypasses ERB auto-escaping, possibly leading to XSS.\n\nApplications on Rails 8.1 are affected if they use a MessagePack serializer, such as `config.action_dispatch.cookies_serializer = :message_pack` or `:message_pack_allow_marshal`, or `serializer: :message_pack` for `Rails.cache`, `ActiveSupport::MessageVerifier` or `ActiveSupport::MessageEncryptor`, and store a `SafeBuffer` that was mutated in place with untrusted input. Rails 8.0 and earlier do not serialize `SafeBuffer` with MessagePack and are not affected.\n\n### Details\nThe fixed releases serialize a `SafeBuffer` that is not `html_safe?` with a marker and deserialize it as a `String`; a `SafeBuffer` that is `html_safe?` keeps the existing format. Versions without the fix cannot read an unsafe buffer serialized by the fixed releases, so during a rolling deploy a cookie or cache entry holding one could fail to load on a process that has not been upgraded.\n\n### Workarounds\nApplications that cannot upgrade can convert a `SafeBuffer` to a `String` with `to_str` before storing it in a value that a MessagePack serializer writes.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/4ca090665976e6fbc471c38689b399f84b43cdc7.patch\n\n### Credit\nThis issue was responsibly reported by HackerOne researcher [jcwilk](https://hackerone.com/jcwilk).","affected":[{"package":{"name":"activesupport","ecosystem":"RubyGems","purl":"pkg:gem/activesupport"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-2w9f-fxwj-w2qf/GHSA-2w9f-fxwj-w2qf.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-2w9f-fxwj-w2qf"},{"type":"WEB","url":"https://github.com/rails/rails/commit/4ca090665976e6fbc471c38689b399f84b43cdc7"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/GHSA-2w9f-fxwj-w2qf.yml"}],"database_specific":{"cwe_ids":["CWE-79"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:27:12Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-3w22-6jfg-527w","published":"2026-11-10T20:51:19Z","modified":"2026-11-10T21:00:04.036274050Z","aliases":["CVE-2026-126064"],"summary":"Nokogiri: Use-After-Free in Nokogiri when replacing an attribute value","details":"### Summary\n\nNokogiri's CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an existing XML attribute via `Nokogiri::XML::Node#[]=` or `Nokogiri::XML::Node#lang=`. If Ruby code had already accessed the attribute's child nodes, replacing the value could free those native child nodes while their wrappers remained reachable. Using one of those child nodes afterwards could cause an invalid read and a possible segfault.\n\nThis is the same class of issue as [GHSA-phwj-rprq-35pp](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-phwj-rprq-35pp), which was fixed for `Attr#value=` in Nokogiri 1.19.4.\n\nNokogiri 1.19.5 preserves all already-wrapped attribute child nodes before replacing the attribute value.\n\nJRuby is not affected.\n\n### Severity\n\nThe Nokogiri maintainers have evaluated this as low severity. Reaching it requires an unusual API-usage pattern that does not arise during normal use. The application must directly access an attribute's child nodes and then replace that same attribute's value via `Node#[]=` or `Node#lang=`. Nokogiri 1.19.5 makes this pattern safe with no change to the public API.\n\n### Mitigation\n\nUpgrade to Nokogiri 1.19.5 or later.\n\nAs a workaround, avoid accessing attribute child nodes directly via `Attr#children` or similar before replacing the same attribute's value.\n\n### Credit\n\nThis issue was responsibly reported by zx (@manus-pi).","affected":[{"package":{"name":"nokogiri","ecosystem":"RubyGems","purl":"pkg:gem/nokogiri"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.1","1.10.0","1.10.0.rc1","1.10.1","1.10.10","1.10.2","1.10.3","1.10.4","1.10.5","1.10.6","1.10.7","1.10.8","1.10.9","1.11.0","1.11.0.rc1","1.11.0.rc2","1.11.0.rc3","1.11.0.rc4","1.11.1","1.11.2","1.11.3","1.11.4","1.11.5","1.11.6","1.11.7","1.12.0","1.12.0.rc1","1.12.1","1.12.2","1.12.3","1.12.4","1.12.5","1.13.0","1.13.1","1.13.10","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.13.7","1.13.8","1.13.9","1.14.0","1.14.0.rc1","1.14.1","1.14.2","1.14.3","1.14.4","1.14.5","1.15.0","1.15.1","1.15.2","1.15.3","1.15.4","1.15.5","1.15.6","1.15.7","1.16.0","1.16.0.rc1","1.16.1","1.16.2","1.16.3","1.16.4","1.16.5","1.16.6","1.16.7","1.16.8","1.17.0","1.17.1","1.17.2","1.18.0","1.18.0.rc1","1.18.1","1.18.10","1.18.2","1.18.3","1.18.4","1.18.5","1.18.6","1.18.7","1.18.8","1.18.9","1.19.0","1.19.1","1.19.2","1.19.3","1.19.4","1.2.0","1.2.1","1.2.2","1.2.3","1.3.0","1.3.1","1.3.2","1.3.3","1.4.0","1.4.1","1.4.2","1.4.2.1","1.4.3","1.4.3.1","1.4.4","1.4.4.1","1.4.4.2","1.4.5","1.4.6","1.4.7","1.5.0","1.5.0.beta.1","1.5.0.beta.2","1.5.0.beta.3","1.5.0.beta.4","1.5.1","1.5.1.rc1","1.5.10","1.5.11","1.5.2","1.5.3","1.5.3.rc2","1.5.3.rc3","1.5.3.rc4","1.5.3.rc5","1.5.3.rc6","1.5.4","1.5.4.rc1","1.5.4.rc2","1.5.4.rc3","1.5.5","1.5.5.rc1","1.5.5.rc2","1.5.5.rc3","1.5.6","1.5.6.rc1","1.5.6.rc2","1.5.6.rc3","1.5.7","1.5.7.rc1","1.5.7.rc2","1.5.7.rc3","1.5.8","1.5.9","1.6.0","1.6.0.rc1","1.6.1","1.6.2","1.6.2.1","1.6.2.rc1","1.6.2.rc2","1.6.2.rc3","1.6.3","1.6.3.1","1.6.3.rc1","1.6.3.rc2","1.6.3.rc3","1.6.4","1.6.4.1","1.6.5","1.6.6.1","1.6.6.2","1.6.6.3","1.6.6.4","1.6.7","1.6.7.1","1.6.7.2","1.6.7.rc2","1.6.7.rc3","1.6.7.rc4","1.6.8","1.6.8.1","1.6.8.rc1","1.6.8.rc2","1.6.8.rc3","1.7.0","1.7.0.1","1.7.1","1.7.2","1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.9.0","1.9.0.rc1","1.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3w22-6jfg-527w/GHSA-3w22-6jfg-527w.json"}}],"references":[{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-3w22-6jfg-527w"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/pull/3752"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/commit/b15b518db9fd15fd6b046f73d1439c282e5cc425"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/commit/feaed3c8c9bd9d81d064d4ca09b16044cd705d6f"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-3w22-6jfg-527w.yml"},{"type":"PACKAGE","url":"https://github.com/sparklemotion/nokogiri"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5"}],"database_specific":{"cwe_ids":["CWE-416"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T20:51:19Z","nvd_published_at":null,"severity":"LOW"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-4p39-36wj-23h4","published":"2026-11-10T20:47:36Z","modified":"2026-11-10T21:00:04.024722735Z","aliases":["CVE-2026-126063"],"summary":"Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer","details":"### Summary\n\nNokogiri's HTML5 serializer did not escape text inside `noscript` elements, or `<` and `>` inside attribute values. When a document parsed with the default options is serialized, a browser with scripting enabled can parse the output into markup that Nokogiri's parser never produced. This is a mutation XSS for applications that sanitize untrusted HTML with `Nokogiri::HTML5`, allow `noscript` elements, and send the serialized output to browsers.\n\nNokogiri 1.19.5 escapes both, as the HTML standard's serialization algorithm requires. Text inside `noscript` is still emitted unescaped for documents parsed with `parse_noscript_content_as_text: true`.\n\nOnly the C extension (CRuby and TruffleRuby) is affected. JRuby does not implement `Nokogiri::HTML5`.\n\n### Severity\n\nThe Nokogiri maintainers have evaluated this as low severity (CVSS 2.3, `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N`). Exploitation requires an application that allows `noscript` in sanitized HTML. Loofah and rails-html-sanitizer do not allow it by default, and Sanitize always removes it.\n\n### Mitigation\n\nUpgrade to Nokogiri 1.19.5 or later.\n\nApplications that sanitize HTML and allow `noscript` should parse with `parse_noscript_content_as_text: true` (available since Nokogiri 1.17.0), or remove `noscript` elements. This is the workaround for earlier versions, and it is recommended on every version: some content inside `noscript` is serialized unchanged, as the standard requires.\n\n### Credit\n\nThis issue was responsibly reported by @a-zara-n.","affected":[{"package":{"name":"nokogiri","ecosystem":"RubyGems","purl":"pkg:gem/nokogiri"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.19.5"}]}],"versions":["1.12.0","1.12.1","1.12.2","1.12.3","1.12.4","1.12.5","1.13.0","1.13.1","1.13.10","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.13.7","1.13.8","1.13.9","1.14.0","1.14.0.rc1","1.14.1","1.14.2","1.14.3","1.14.4","1.14.5","1.15.0","1.15.1","1.15.2","1.15.3","1.15.4","1.15.5","1.15.6","1.15.7","1.16.0","1.16.0.rc1","1.16.1","1.16.2","1.16.3","1.16.4","1.16.5","1.16.6","1.16.7","1.16.8","1.17.0","1.17.1","1.17.2","1.18.0","1.18.0.rc1","1.18.1","1.18.10","1.18.2","1.18.3","1.18.4","1.18.5","1.18.6","1.18.7","1.18.8","1.18.9","1.19.0","1.19.1","1.19.2","1.19.3","1.19.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-4p39-36wj-23h4/GHSA-4p39-36wj-23h4.json"}}],"references":[{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-4p39-36wj-23h4"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/pull/3752"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/commit/3e84df6ff7ab4d78f446e3a415430bd69a055d32"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/commit/c6c0bffbdcd194694995acafeeed27326b0805f8"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-4p39-36wj-23h4.yml"},{"type":"PACKAGE","url":"https://github.com/sparklemotion/nokogiri"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5"}],"database_specific":{"cwe_ids":["CWE-116","CWE-79"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T20:47:36Z","nvd_published_at":null,"severity":"LOW"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-4v2w-w6g6-f8f8","published":"2026-11-10T21:24:31Z","modified":"2026-11-10T21:45:04.235740111Z","aliases":["CVE-2026-126071"],"summary":"Active Storage: Possible DoS vulnerability in Active Storage proxy mode via storage errors during streaming","details":"### Impact\nWhen Active Storage serves a file through its proxy controllers, `ActiveStorage::Streaming#send_blob_stream` handles an error from the storage service by calling `head` to send a 404 or 500 response. If the error occurs after the first chunk has been written, the response is already committed, and `head` replaces the response body while the server is still reading the original `ActionController::Live` buffer. That buffer is never closed, so the server thread handling the request blocks until the process restarts. Repeated failed downloads could exhaust the server's threads, possibly resulting in a DoS vulnerability.\n\nApplications are affected when they store files on a service that streams a download in several requests, such as Amazon S3, an S3-compatible service or Google Cloud Storage, and draw Active Storage's default routes. The proxy routes are drawn whether or not proxy mode is the default for the application. A file deleted while it is being served, or any other storage error partway through a download, triggers the condition.\n\n### Details\nA storage error raised before the response is committed still produces a 404 or 500 response. After the fix, a storage error raised after the response is committed is re-raised instead, so the server closes the streamed response and releases the thread; the client receives a truncated body, and the exception reaches the application's error reporting.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/3c67a693fb21870ecb1222e3da59d5c491a62009.patch\n- 8.0: https://github.com/rails/rails/commit/655b4442de136a3701334607f634d698bf9d5b82.patch\n\n### Credit\nThis issue was found by the Anthropic OSS Scanner (ANT-2026-FMPUMYTB).","affected":[{"package":{"name":"activestorage","ecosystem":"RubyGems","purl":"pkg:gem/activestorage"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-4v2w-w6g6-f8f8/GHSA-4v2w-w6g6-f8f8.json"}},{"package":{"name":"activestorage","ecosystem":"RubyGems","purl":"pkg:gem/activestorage"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0.beta1"},{"fixed":"8.0.5.2"}]}],"versions":["8.0.0","8.0.0.1","8.0.0.beta1","8.0.0.rc1","8.0.0.rc2","8.0.1","8.0.2","8.0.2.1","8.0.3","8.0.4","8.0.4.1","8.0.5","8.0.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-4v2w-w6g6-f8f8/GHSA-4v2w-w6g6-f8f8.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-4v2w-w6g6-f8f8"},{"type":"WEB","url":"https://github.com/rails/rails/commit/3c67a693fb21870ecb1222e3da59d5c491a62009"},{"type":"WEB","url":"https://github.com/rails/rails/commit/655b4442de136a3701334607f634d698bf9d5b82"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/GHSA-4v2w-w6g6-f8f8.yml"}],"database_specific":{"cwe_ids":["CWE-772"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:24:31Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-v995-44v6-5fqm","published":"2026-11-10T20:52:38Z","modified":"2026-11-10T21:00:04.025096383Z","aliases":["CVE-2026-126062"],"summary":"JRuby: NONET is bypassed for external DTDs and entities when the systemId uses a short-form IPv4 host","details":"### Summary\n\nOn JRuby, the `NONET` parse option did not block an external DTD or entity whose system identifier used a short-form IPv4 host, such as `http://127.1/` or `http://169.254.43518/`, or was an absolute path such as `/x.dtd` in a document parsed from a network URL. An application that parses untrusted XML with `DTDLOAD`, `DTDVALID` or `NOENT` could be made to send network requests, potentially enabling SSRF.\n\nNokogiri 1.19.5 applies the `XML::Schema` check from [GHSA-8678-w3jw-xfc2](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-8678-w3jw-xfc2): with `NONET` set, only local resources are loaded.\n\nOnly JRuby is affected. Default parse options are not affected.\n\n### Severity\n\nThe Nokogiri maintainers have evaluated this as low severity.\n\n### Mitigation\n\nUpgrade to Nokogiri 1.19.5 or later, or do not enable `DTDLOAD`, `DTDVALID` or `NOENT` for untrusted input.\n\n### Credit\n\nThis issue was responsibly reported by @arpitjain099.","affected":[{"package":{"name":"nokogiri","ecosystem":"RubyGems","purl":"pkg:gem/nokogiri"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.1","1.10.0","1.10.0.rc1","1.10.1","1.10.10","1.10.2","1.10.3","1.10.4","1.10.5","1.10.6","1.10.7","1.10.8","1.10.9","1.11.0","1.11.0.rc1","1.11.0.rc2","1.11.0.rc3","1.11.0.rc4","1.11.1","1.11.2","1.11.3","1.11.4","1.11.5","1.11.6","1.11.7","1.12.0","1.12.0.rc1","1.12.1","1.12.2","1.12.3","1.12.4","1.12.5","1.13.0","1.13.1","1.13.10","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.13.7","1.13.8","1.13.9","1.14.0","1.14.0.rc1","1.14.1","1.14.2","1.14.3","1.14.4","1.14.5","1.15.0","1.15.1","1.15.2","1.15.3","1.15.4","1.15.5","1.15.6","1.15.7","1.16.0","1.16.0.rc1","1.16.1","1.16.2","1.16.3","1.16.4","1.16.5","1.16.6","1.16.7","1.16.8","1.17.0","1.17.1","1.17.2","1.18.0","1.18.0.rc1","1.18.1","1.18.10","1.18.2","1.18.3","1.18.4","1.18.5","1.18.6","1.18.7","1.18.8","1.18.9","1.19.0","1.19.1","1.19.2","1.19.3","1.19.4","1.2.0","1.2.1","1.2.2","1.2.3","1.3.0","1.3.1","1.3.2","1.3.3","1.4.0","1.4.1","1.4.2","1.4.2.1","1.4.3","1.4.3.1","1.4.4","1.4.4.1","1.4.4.2","1.4.5","1.4.6","1.4.7","1.5.0","1.5.0.beta.1","1.5.0.beta.2","1.5.0.beta.3","1.5.0.beta.4","1.5.1","1.5.1.rc1","1.5.10","1.5.11","1.5.2","1.5.3","1.5.3.rc2","1.5.3.rc3","1.5.3.rc4","1.5.3.rc5","1.5.3.rc6","1.5.4","1.5.4.rc1","1.5.4.rc2","1.5.4.rc3","1.5.5","1.5.5.rc1","1.5.5.rc2","1.5.5.rc3","1.5.6","1.5.6.rc1","1.5.6.rc2","1.5.6.rc3","1.5.7","1.5.7.rc1","1.5.7.rc2","1.5.7.rc3","1.5.8","1.5.9","1.6.0","1.6.0.rc1","1.6.1","1.6.2","1.6.2.1","1.6.2.rc1","1.6.2.rc2","1.6.2.rc3","1.6.3","1.6.3.1","1.6.3.rc1","1.6.3.rc2","1.6.3.rc3","1.6.4","1.6.4.1","1.6.5","1.6.6.1","1.6.6.2","1.6.6.3","1.6.6.4","1.6.7","1.6.7.1","1.6.7.2","1.6.7.rc2","1.6.7.rc3","1.6.7.rc4","1.6.8","1.6.8.1","1.6.8.rc1","1.6.8.rc2","1.6.8.rc3","1.7.0","1.7.0.1","1.7.1","1.7.2","1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.9.0","1.9.0.rc1","1.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-v995-44v6-5fqm/GHSA-v995-44v6-5fqm.json"}}],"references":[{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v995-44v6-5fqm"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/pull/3752"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/commit/97f41b65f4ee0cac859b87f0b26d2648c4806cb8"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/commit/e448ca2827a9198644610fb730259e12baacdeac"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-v995-44v6-5fqm.yml"},{"type":"PACKAGE","url":"https://github.com/sparklemotion/nokogiri"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5"}],"database_specific":{"cwe_ids":["CWE-611","CWE-918"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T20:52:38Z","nvd_published_at":null,"severity":"LOW"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-474x-hrwr-fgx4","published":"2026-11-10T21:09:44Z","modified":"2026-11-10T21:15:03.074649810Z","aliases":["CVE-2026-126066"],"summary":"fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags","details":"### Summary\n\nWith the non-default stopNodes option, a stop node's body with many \"<a \" fragments and no closing \">\" anywhere after makes readStopNodeData() rescan the entire remaining input from every \"<\". The failed lookahead is neither cached nor bounded, so n fragments cost O(n²) before the parser throws. Availability-only (CPU exhaustion), needs the non-default stopNodes option — not benchmarked yet, see Proof of Concept.\n\n### Details\n\n**CWE-407** — Inefficient Algorithmic Complexity\n\n**Code**\n- `OrderedObjParser.js:520` — `parseXml()` calls `readStopNodeData()` after a matching stop node opens\n- `OrderedObjParser.js:810` — calls `readTagExp()` for every non-special `<`\n- `OrderedObjParser.js:688-722` — `tagExpWithClosingIndex()` scans to end-of-input and returns `undefined` when no `>` exists\n- `OrderedObjParser.js:812-818` — on failure, `i` isn't advanced, so the next `<` repeats the same full scan\n- `OrderedObjParser.js:423` — the main parse loop throws immediately on the same failure; only the stop-node path retries\n\n**Root cause:** a failed closing-`>` lookahead is neither cached nor bounded — `n` copies of `<a ` with no later `>` means `n` scans over the remaining input, O(n²) work, before it finally throws.\n\n**Fix**\n1. Throw immediately in `readStopNodeData()` when `readTagExp()` returns `undefined`\n2. Or break the loop on the first failed scan\n3. Or find the next `>` once and reuse/bound that result\n4. Add a test asserting near-linear scaling when payload size doubles\n\n### Proof of concept\n\nNot benchmarked — static-analysis finding, confidence 0.5.\n\nTo confirm: configure `stopNodes` matching a root element. Build input as `'<stop>' + '<a '.repeat(n)`. Time `parse()` until it throws `Unexpected end of <tag>`. Start around n=10,000 and double it — quadratic should show ~4x time per doubling, linear ~2x. Control: same input with a `>` present, or `stopNodes` unset.\n\n### Impact\n\nCPU-exhaustion DoS in Node.js services parsing untrusted XML with `stopNodes` enabled. A ~100KB payload is estimated at ~10⁹ character operations (roughly a second or more of blocked event loop) — analytical estimate, not a benchmark. No confidentiality/integrity impact. CVSS 3.1: `AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L` (3.7, Low).","affected":[{"package":{"name":"fast-xml-parser","ecosystem":"npm","purl":"pkg:npm/fast-xml-parser"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.12.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 5.11.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-474x-hrwr-fgx4/GHSA-474x-hrwr-fgx4.json"}}],"references":[{"type":"WEB","url":"https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-474x-hrwr-fgx4"},{"type":"WEB","url":"https://github.com/NaturalIntelligence/fast-xml-parser/commit/0c3659348364959da62954b73728fb3bd05ebcb4"},{"type":"PACKAGE","url":"https://github.com/NaturalIntelligence/fast-xml-parser"},{"type":"WEB","url":"https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.12.0"}],"database_specific":{"cwe_ids":["CWE-407"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:09:44Z","nvd_published_at":null,"severity":"LOW"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}
|
||||
File diff suppressed because one or more lines are too long
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-6972-9mcm-vhwj","published":"2026-11-10T20:46:33Z","modified":"2026-11-10T21:00:03.527469283Z","aliases":["CVE-2026-125118"],"summary":"Mongoose: Prototype pollution via Schema.prototype.virtual()","details":"### Summary\n\nPrototype pollution via Schema.prototype.virtual() — the 2022 fix for CVE-2022-2564 / CVE-2022-24304 protected Schema.path()/add() but never virtual(), so the same class of bug is still exploitable in all maintained release lines.\n\n### Details\n\nIn lib/schema.js, Schema.prototype.virtual() (defined at line 2643) builds the virtual path via:\n\n```javascript\nvirtuals[name] = parts.reduce(function(mem, part, i) {\nmem[part] || (mem[part] = (i === parts.length - 1)\n? new VirtualType(options, name)\n: {});\nreturn mem[part];\n}, this.tree); // lines 2755-2759\n```\n\nUnlike `path()`/`add()`, `virtual()` never received the `specialProperties` check added for CVE-2022-2564/CVE-2022-24304 (`lib/schema.js` lines 806, 1308, 1331).\n\nA path containing `__proto__`/`constructor`/`prototype` segments resolves through the prototype chain and writes onto `Object.prototype` / `Function.prototype`.\n\n### Proof of concept\n\n```javascript\nconst mongoose = require('mongoose');\nconst schema = new mongoose.Schema({});\n\nschema.virtual('__proto__.polluted');\nconsole.log(({}).polluted); // VirtualType instance\nconsole.log(Object.prototype.hasOwnProperty('polluted')); // true\nconsole.log(Object.getOwnPropertyDescriptor(\nObject.prototype, 'polluted').enumerable); // true\n\nschema.virtual('constructor.prototype.opol');\nconsole.log(({}).opol); // true\n\nschema.virtual('hasOwnProperty.__proto__.fpol');\nconsole.log((function(){}).fpol); // Function.prototype polluted\n```\n\n### Impact\n\nAttacker-influenced schema field names (dynamic schemas, CMS form builders, schema-as-code) allow pollution of Object.prototype (own, enumerable keys visible on every object — e.g. `({}).isAdmin` checks can be spoofed) and Function.prototype (a known gadget primitive in server-side JS).","affected":[{"package":{"name":"mongoose","ecosystem":"npm","purl":"pkg:npm/mongoose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.13.12"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6972-9mcm-vhwj/GHSA-6972-9mcm-vhwj.json"}},{"package":{"name":"mongoose","ecosystem":"npm","purl":"pkg:npm/mongoose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.8.13"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6972-9mcm-vhwj/GHSA-6972-9mcm-vhwj.json"}},{"package":{"name":"mongoose","ecosystem":"npm","purl":"pkg:npm/mongoose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.24.7"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6972-9mcm-vhwj/GHSA-6972-9mcm-vhwj.json"}},{"package":{"name":"mongoose","ecosystem":"npm","purl":"pkg:npm/mongoose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"9.0.0"},{"fixed":"9.11.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6972-9mcm-vhwj/GHSA-6972-9mcm-vhwj.json"}}],"references":[{"type":"WEB","url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-6972-9mcm-vhwj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125118"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/318f7e09dd363a1dfddb8180878488dccd2796d1"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/74df7769b5a8d89c4413b764029911ee915ea467"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/7a2a6567abbb72c0430c8cc5b7942141844fecff"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/fb467e6d33174293dc0360649f20ce68d99117a9"},{"type":"PACKAGE","url":"https://github.com/Automattic/mongoose"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/6.13.12"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/7.8.13"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/8.24.7"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/9.11.4"}],"database_specific":{"cwe_ids":["CWE-1321"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T20:46:33Z","nvd_published_at":"2026-11-09T23:17:22Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-6cv4-p8m7-4r25","published":"2026-11-10T21:16:22Z","modified":"2026-11-10T21:30:03.999795607Z","aliases":["CVE-2026-125333"],"summary":"Forge: ReDoS in forge.http response header and cookie trimming","details":"`forge.http` trims response header and `Set-Cookie` values with the regular expression `/\\s*$/`, which takes quadratic time on a long run of whitespace followed by another character. A server or on-path attacker can block a `forge.http` client for minutes with one large response header. Fixed in node-forge 1.4.3.\n\n### Details\n`_trimString()` in `lib/http.js` removes trailing whitespace with `str.replace(/\\s*$/, '')`. On a string of n whitespace characters followed by a non-whitespace character, the regular expression engine tries a match at each of the n positions and scans the rest of the run each time, so the work is O(n^2). `forge.http` calls `_trimString()` on every response header value read by `response.readHeader()`, and again on cookie names and values in `response.getCookies()`. There is no limit on header size.\n\nWith Node.js 24, an 80 KB header value takes about 4 seconds to parse, and 1 MB about 10 minutes, during which the event loop (or browser tab) is blocked.\n\n`forge.http` is not loaded by `require('node-forge')`. It is part of the `forge.all` bundle and needs a socket pool provided by the application (historically Flash sockets via `forge.xhr`), so few applications use it.\n\nThe fix trims trailing whitespace with a loop, as `lib/pem.js` has done since 1.4.1. The trimmed result is unchanged.\n\n#### Patches\nFixed in node-forge 1.4.3.\n\n#### Workarounds\nLimit the size of HTTP response headers before passing them to `forge.http`, for example in the socket pool's data handler.\n\n#### Resources\n- Related: GHSA-7wch-p9px-956x (ReDoS in PEM decoding, fixed in 1.4.1): https://github.com/digitalbazaar/forge/security/advisories/GHSA-7wch-p9px-956x\n\n#### Severity\nCVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (5.9, Moderate)\nCVSS 4.0 (informational): CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N (8.2)\nCVSS 4.0 has no counterpart to 3.1's AC:H beyond AT:P and scores this higher; the severity rating follows CVSS 3.1.\n\n#### Credits\nReported by @manus-pi.\n\n### Proof of concept\n var response = forge.http.createResponse();\n var ws = new Array(40001).join('\\t ');\n response.readHeader(forge.util.createBuffer(\n 'HTTP/1.1 200 OK\\r\\nX-A: a' + ws + 'X\\r\\n\\r\\n'));\n // <= 1.4.2: about 4 seconds (quadratic in the whitespace length)\n // 1.4.3: about 1 ms\n\nRegression tests are in tests/security/ghsa-6cv4-p8m7-4r25.js.\n\n### Impact\nApplications that use `forge.http` to talk to servers they don't control are affected. The server, or an on-path attacker, can send a response header that blocks the client's event loop for minutes, denying service to everything else in the process. There is no confidentiality or integrity impact.","affected":[{"package":{"name":"node-forge","ecosystem":"npm","purl":"pkg:npm/node-forge"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.2"},{"fixed":"1.4.3"}]}],"database_specific":{"last_known_affected_version_range":"<= 1.4.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6cv4-p8m7-4r25/GHSA-6cv4-p8m7-4r25.json"}}],"references":[{"type":"WEB","url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-6cv4-p8m7-4r25"},{"type":"WEB","url":"https://github.com/digitalbazaar/forge/pull/1169"},{"type":"WEB","url":"https://github.com/digitalbazaar/forge/commit/326a4d0903ee46358bc849a5c3fd96d9c21489bd"},{"type":"PACKAGE","url":"https://github.com/digitalbazaar/forge"},{"type":"WEB","url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.3"}],"database_specific":{"cwe_ids":["CWE-1333"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:16:22Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}
|
||||
File diff suppressed because one or more lines are too long
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-j8rw-jp99-435v","published":"2026-11-10T21:14:26Z","modified":"2026-11-10T21:30:04.008068866Z","aliases":["CVE-2026-125334"],"summary":"Forge: TLS client crash on a handshake record received without a session","details":"### Summary\nA `forge.tls` client throws an uncaught `TypeError` from `connection.process()` when it receives a ServerHello while it has no session: after a `close_notify` alert or a call to `close()`, or before `handshake()` is called. A malicious server or an on-path attacker can use this to terminate a Node.js process. Fixed in node-forge 1.4.3.\n\n### Details\n`tls.handleHandshake()` in `lib/tls.js` updates the handshake digests with `c.session.md5.update(bytes)` before it calls the message handler. A client creates its session in `handshake()`, and `c.reset()` sets it to `null` when the connection is closed. Closing doesn't set the fail flag, and the client goes back to expecting a ServerHello, so a Handshake record received afterwards still reaches `handleHandshake()`, which throws `TypeError: Cannot read properties of null (reading 'md5')`.\n\nThis happens:\n- after the server sends a `close_notify` alert (at any alert level);\n- after the application calls `close()`;\n- before the application calls `handshake()`.\n\nThe exception propagates out of `connection.process()`. Applications that pass socket data to `process()` from a `data` event handler without catching exceptions, as in the README example, terminate. After a reset the connection uses no encryption, so an on-path attacker can inject the records even when the real server is honest.\n\nServers are not affected: a server creates its session when it receives a ClientHello.\n\nThe fix handles these records like other unexpected records on a closed client: they are ignored.\n\n#### Patches\nFixed in node-forge 1.4.3.\n\n#### Workarounds\nCatch exceptions thrown by `connection.process()` and close the socket, or stop passing socket data to `process()` once the `closed` callback has been called and until `handshake()` is called again.\n\n#### Resources\n- RFC 5246, section 7.2.1 (Closure Alerts): https://www.rfc-editor.org/rfc/rfc5246#section-7.2.1\n- Related: GHSA-525v-9gp9-w22h (another TLS client `TypeError`, fixed in 1.4.1): https://github.com/digitalbazaar/forge/security/advisories/GHSA-525v-9gp9-w22h\n\n#### Severity\nCVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (5.9, Moderate)\nCVSS 4.0 (informational): CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N (8.2)\nCVSS 4.0 has no counterpart to 3.1's AC:H beyond AT:P and scores this higher; the severity rating follows CVSS 3.1.\n\n#### Credits\nReported by @manus-use.\n\n### Proof of concept\n var c = forge.tls.createConnection({server: false, ...});\n c.handshake();\n // warning close_notify alert, then an empty ServerHello, in separate\n // process() calls\n c.process(forge.util.hexToBytes('15030100020100'));\n c.process(forge.util.hexToBytes('160301000402000000'));\n // <= 1.4.2: TypeError: Cannot read properties of null (reading 'md5')\n // 1.4.3: the record is ignored\n\nThe reporter's PoC is in tests/pocs/ghsa-j8rw-jp99-435v.js, and regression tests are in tests/unit/tls.js.\n\n### Impact\nApplications that use `forge.tls` as a client and pass data from a network socket to `connection.process()` are affected. The server they connect to, or an on-path attacker, can make `process()` throw; if the application doesn't catch it, the Node.js process terminates, dropping all its connections. Servers built on `forge.tls` are not affected. There is no confidentiality or integrity impact.","affected":[{"package":{"name":"node-forge","ecosystem":"npm","purl":"pkg:npm/node-forge"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.3"}]}],"database_specific":{"last_known_affected_version_range":"<= 1.4.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-j8rw-jp99-435v/GHSA-j8rw-jp99-435v.json"}}],"references":[{"type":"WEB","url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-j8rw-jp99-435v"},{"type":"WEB","url":"https://github.com/digitalbazaar/forge/pull/1169"},{"type":"WEB","url":"https://github.com/digitalbazaar/forge/commit/2cfaeb516cb3d4aff1c0569d39394df41c5cb17c"},{"type":"PACKAGE","url":"https://github.com/digitalbazaar/forge"},{"type":"WEB","url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.3"}],"database_specific":{"cwe_ids":["CWE-476"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:14:26Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-w4xr-hqv8-ch44","published":"2026-11-10T21:17:14Z","modified":"2026-11-10T21:30:04.002424182Z","aliases":["CVE-2026-125332"],"summary":"Forge: TLS client crash on an unsupported ServerHello compression method","details":"### Summary\nA `forge.tls` client accepts any compression method in the ServerHello, although it only offers no compression. An unknown method makes `connection.process()` throw an uncaught `Error` when the client handles ServerHelloDone, before the server is authenticated. A malicious server or an on-path attacker can use this to terminate a Node.js process. Fixed in node-forge 1.4.3.\n\n### Details\nThe client's ClientHello offers only the `null` compression method. `tls.parseHelloMessage()` in `lib/tls.js` stores the ServerHello's `compression_method` for the client without checking it (the code has a `TODO: handle compression methods`). When the client handles ServerHelloDone it calls `tls.createConnectionState()`, which throws `Error('Unsupported compression algorithm.')` for any method other than `null` (0) and `deflate` (1). The exception propagates out of `connection.process()`.\n\nThe ServerHello isn't authenticated until the server's Finished message, so an on-path attacker can change the compression byte of a genuine ServerHello; the certificate chain still verifies. Applications that pass socket data to `process()` without catching exceptions terminate. This includes `forge.tls.wrapSocket`, which calls `process()` from its socket data handler, and `forge.http`, which uses it. A `deflate` (1) method, also never offered, makes the handshake fail later with an error instead of a crash.\n\nServers are not affected: a server always selects no compression.\n\nThe fix fails the handshake with an `illegal_parameter` alert, through the connection's `error` callback, when the ServerHello selects any compression method other than `null`.\n\n#### Patches\nFixed in node-forge 1.4.3.\n\n#### Workarounds\nCatch exceptions thrown by `connection.process()` and close the socket.\n\n#### Resources\n- RFC 5246, section 7.4.1.3 (Server Hello): https://www.rfc-editor.org/rfc/rfc5246#section-7.4.1.3\n- Related: GHSA-525v-9gp9-w22h (another TLS client crash during the handshake, fixed in 1.4.1): https://github.com/digitalbazaar/forge/security/advisories/GHSA-525v-9gp9-w22h\n\n#### Severity\nCVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (5.9, Moderate)\nCVSS 4.0 (informational): CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N (8.2)\nCVSS 4.0 has no counterpart to 3.1's AC:H beyond AT:P and scores this higher; the severity rating follows CVSS 3.1.\n\n#### Credits\nReported by @alienkeric.\n\n### Proof of concept\nA server (or on-path attacker) sends a ServerHello with `compression_method` 0xff, followed by a valid Certificate and ServerHelloDone:\n\n client.handshake();\n client.process(serverHello + certificate + serverHelloDone);\n // <= 1.4.2: throws Error: Unsupported compression algorithm.\n // 1.4.3: error callback with \"Unsupported compression method.\"\n\nThe reporter's PoC (a CA-issued server certificate and the default verify callback) is in tests/pocs/ghsa-w4xr-hqv8-ch44.js, and regression tests are in tests/unit/tls.js.\n\n### Impact\nApplications that use `forge.tls` as a client (directly, through `forge.tls.wrapSocket`, or through `forge.http`) and pass data from a network socket to `connection.process()` are affected. The server they connect to, or an on-path attacker, can make `process()` throw before the server is authenticated; if the application doesn't catch it, the Node.js process terminates, dropping all its connections. Servers built on `forge.tls` are not affected. There is no confidentiality or integrity impact.","affected":[{"package":{"name":"node-forge","ecosystem":"npm","purl":"pkg:npm/node-forge"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.3"}]}],"database_specific":{"last_known_affected_version_range":"<= 1.4.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-w4xr-hqv8-ch44/GHSA-w4xr-hqv8-ch44.json"}}],"references":[{"type":"WEB","url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-w4xr-hqv8-ch44"},{"type":"WEB","url":"https://github.com/digitalbazaar/forge/pull/1169"},{"type":"WEB","url":"https://github.com/digitalbazaar/forge/commit/1d9816d333c23c523ef2bd8b24282c87db2654ef"},{"type":"PACKAGE","url":"https://github.com/digitalbazaar/forge"},{"type":"WEB","url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.3"}],"database_specific":{"cwe_ids":["CWE-20","CWE-248"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:17:14Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.0","id":"MAL-2026-14473","published":"2026-08-25T06:41:07Z","modified":"2026-08-25T23:49:14.976899962Z","summary":"Malicious code in css-import-order (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a190c01197be10bae5104dd08b8cb119ff1460eaa0c816bc0eb74da8a4b88ae4)\npackage.json declares the package's own name `css-import-order` as both a dependency and devDependency pointing at `http://pack.nppacks.com/npm/css-import-order` — a non-registry, plain-HTTP, unpinned URL under a domain unrelated to the npm publisher. On `npm install`, npm resolves and unpacks whatever tarball that host returns, executing any lifecycle scripts it contains. Because the source is not the npm registry, there is no integrity or version pinning, and the plain-HTTP transport additionally allows on-path substitution of the served bytes. The shipped index.js is a small benign transformer and carries a header comment reading `This package use for Security Research Testing Purpose.`, but the harmful vector is the install-time resolution to attacker-mutable content at pack.nppacks.com, not the local module code.\n","affected":[{"package":{"name":"css-import-order","ecosystem":"npm","purl":"pkg:npm/css-import-order"},"versions":["1.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"790d66d817786f03157052455eb2da9603154bb56e425540c3374cba0168d70e","tlsh":"95f04c65df20ea2344c875531d574813b23059870728fd0832d71b6c0b4c17728f829d"},{"path":"index.js","sha256":"f2fcebdb4f0e41365a39ca87a52fcc4e6abd5633fe6272e60d1386d26b90ef41","tlsh":"71a1935ab5e0159745aa22e5b3ce48b577bd80b3330df5a0b54cbf563f40c348a1aed1"}],"package_integrity":[{"filename":"css-import-order-1.1.0.tgz","hashes":{"sha1":"3a09d3b4a582170bcde7538d3e980c4a8de4d1a5","sha512_sri":"sha512-NCcYjT+1y3hNg6Anq6IkTPvnfnyCcnXLYycKju8Bs0ocnSGj7YhG8oqgEnSWT92+88PCo8KE9pPlPGMrmjxqHg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/css-import-order/MAL-2026-14473.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/css-import-order/v/1.1.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018687","import_time":"2026-08-25T06:50:12.618751863Z","modified_time":"2026-08-25T06:41:07Z","sha256":"a190c01197be10bae5104dd08b8cb119ff1460eaa0c816bc0eb74da8a4b88ae4","source":"amazon-inspector","versions":["1.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-14473","published":"2026-08-25T06:41:07Z","modified":"2026-11-10T23:30:03.300237598Z","aliases":["GHSA-wc5q-g53w-pg32"],"summary":"Malicious code in css-import-order (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a190c01197be10bae5104dd08b8cb119ff1460eaa0c816bc0eb74da8a4b88ae4)\npackage.json declares the package's own name `css-import-order` as both a dependency and devDependency pointing at `http://pack.nppacks.com/npm/css-import-order` — a non-registry, plain-HTTP, unpinned URL under a domain unrelated to the npm publisher. On `npm install`, npm resolves and unpacks whatever tarball that host returns, executing any lifecycle scripts it contains. Because the source is not the npm registry, there is no integrity or version pinning, and the plain-HTTP transport additionally allows on-path substitution of the served bytes. The shipped index.js is a small benign transformer and carries a header comment reading `This package use for Security Research Testing Purpose.`, but the harmful vector is the install-time resolution to attacker-mutable content at pack.nppacks.com, not the local module code.\n\n## Source: ghsa-malware (6c2915b485aa515505c532c5c5f456f1129ddf07ef25e014b7dae81bb15357f6)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"css-import-order","ecosystem":"npm","purl":"pkg:npm/css-import-order"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"790d66d817786f03157052455eb2da9603154bb56e425540c3374cba0168d70e","tlsh":"95f04c65df20ea2344c875531d574813b23059870728fd0832d71b6c0b4c17728f829d"},{"path":"index.js","sha256":"f2fcebdb4f0e41365a39ca87a52fcc4e6abd5633fe6272e60d1386d26b90ef41","tlsh":"71a1935ab5e0159745aa22e5b3ce48b577bd80b3330df5a0b54cbf563f40c348a1aed1"}],"package_integrity":[{"filename":"css-import-order-1.1.0.tgz","hashes":{"sha1":"3a09d3b4a582170bcde7538d3e980c4a8de4d1a5","sha512_sri":"sha512-NCcYjT+1y3hNg6Anq6IkTPvnfnyCcnXLYycKju8Bs0ocnSGj7YhG8oqgEnSWT92+88PCo8KE9pPlPGMrmjxqHg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/css-import-order/MAL-2026-14473.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/css-import-order/v/1.1.0"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wc5q-g53w-pg32"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018687","import_time":"2026-08-25T06:50:12.618751863Z","modified_time":"2026-08-25T06:41:07Z","sha256":"a190c01197be10bae5104dd08b8cb119ff1460eaa0c816bc0eb74da8a4b88ae4","source":"amazon-inspector","versions":["1.1.0"]},{"id":"GHSA-wc5q-g53w-pg32","import_time":"2026-11-10T23:17:30.219700604Z","modified_time":"2026-11-10T22:21:24Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"6c2915b485aa515505c532c5c5f456f1129ddf07ef25e014b7dae81bb15357f6","source":"ghsa-malware"}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.0","id":"MAL-2026-14483","published":"2026-08-25T08:40:02Z","modified":"2026-08-25T23:49:44.367550212Z","summary":"Malicious code in modules-newline (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4c5565e7fd7984da26242b79340fb41f4f4595fdd5fbeb929ff5dfca5b13cc1a)\npackage.json declares the package's own name, modules-newline, as both a dependency and devDependency pointing to http://pack.nppacks.com/npm/modules-newline instead of the npm registry. On npm install, npm fetches and installs whatever tarball is currently served from that URL, bypassing registry auditing. The URL is plain HTTP (subject to MITM substitution), unpinned (no tag, commit, or integrity hash), and hosted on a non-publisher domain unrelated to npm. Any project that installs this package, directly or transitively, executes code delivered from that external endpoint at install time, including any lifecycle scripts inside the fetched tarball. The shipped index.js is a near-verbatim copy of babel-plugin-transform-define preceded by a comment stating 'This package use for Security Research Testing Purpose.', and the package name does not correspond to the copied plugin's function.\n","affected":[{"package":{"name":"modules-newline","ecosystem":"npm","purl":"pkg:npm/modules-newline"},"versions":["0.0.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"6d5fa1e1adbecdc905b1782f464206a459372264cf5257eed8aa7acbbe6a2def","tlsh":"6ef02808ca72b9a346d83554b96602836e5159874818bd1872cf1e2c0bcd8bb30f415e"},{"path":"index.js","sha256":"f2fcebdb4f0e41365a39ca87a52fcc4e6abd5633fe6272e60d1386d26b90ef41","tlsh":"71a1935ab5e0159745aa22e5b3ce48b577bd80b3330df5a0b54cbf563f40c348a1aed1"}],"package_integrity":[{"filename":"modules-newline-0.0.6.tgz","hashes":{"sha1":"c3ec8c0ba2156289e3ff37dbb0f3b84d0409361a","sha512_sri":"sha512-srdlkwQ6Tk3mAUjcftujyA29qRZNLTeYwQOtgfH+8OQleIQYtAnyfpSY6dgPyCjUDsPzMK26UPsqxlsQpcEbVg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/modules-newline/MAL-2026-14483.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/modules-newline/v/0.0.6"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018735","import_time":"2026-08-25T08:49:18.267158287Z","modified_time":"2026-08-25T08:40:02Z","sha256":"4c5565e7fd7984da26242b79340fb41f4f4595fdd5fbeb929ff5dfca5b13cc1a","source":"amazon-inspector","versions":["0.0.6"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-14483","published":"2026-08-25T08:40:02Z","modified":"2026-11-10T23:30:04.125278885Z","aliases":["GHSA-5hjr-7qfq-x5m5"],"summary":"Malicious code in modules-newline (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4c5565e7fd7984da26242b79340fb41f4f4595fdd5fbeb929ff5dfca5b13cc1a)\npackage.json declares the package's own name, modules-newline, as both a dependency and devDependency pointing to http://pack.nppacks.com/npm/modules-newline instead of the npm registry. On npm install, npm fetches and installs whatever tarball is currently served from that URL, bypassing registry auditing. The URL is plain HTTP (subject to MITM substitution), unpinned (no tag, commit, or integrity hash), and hosted on a non-publisher domain unrelated to npm. Any project that installs this package, directly or transitively, executes code delivered from that external endpoint at install time, including any lifecycle scripts inside the fetched tarball. The shipped index.js is a near-verbatim copy of babel-plugin-transform-define preceded by a comment stating 'This package use for Security Research Testing Purpose.', and the package name does not correspond to the copied plugin's function.\n\n## Source: ghsa-malware (24f31121cb1502118185811b8789ced462350675da336fc0407ec380f6d4209c)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"modules-newline","ecosystem":"npm","purl":"pkg:npm/modules-newline"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["0.0.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"6d5fa1e1adbecdc905b1782f464206a459372264cf5257eed8aa7acbbe6a2def","tlsh":"6ef02808ca72b9a346d83554b96602836e5159874818bd1872cf1e2c0bcd8bb30f415e"},{"path":"index.js","sha256":"f2fcebdb4f0e41365a39ca87a52fcc4e6abd5633fe6272e60d1386d26b90ef41","tlsh":"71a1935ab5e0159745aa22e5b3ce48b577bd80b3330df5a0b54cbf563f40c348a1aed1"}],"package_integrity":[{"filename":"modules-newline-0.0.6.tgz","hashes":{"sha1":"c3ec8c0ba2156289e3ff37dbb0f3b84d0409361a","sha512_sri":"sha512-srdlkwQ6Tk3mAUjcftujyA29qRZNLTeYwQOtgfH+8OQleIQYtAnyfpSY6dgPyCjUDsPzMK26UPsqxlsQpcEbVg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/modules-newline/MAL-2026-14483.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/modules-newline/v/0.0.6"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-5hjr-7qfq-x5m5"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018735","import_time":"2026-08-25T08:49:18.267158287Z","modified_time":"2026-08-25T08:40:02Z","sha256":"4c5565e7fd7984da26242b79340fb41f4f4595fdd5fbeb929ff5dfca5b13cc1a","source":"amazon-inspector","versions":["0.0.6"]},{"id":"GHSA-5hjr-7qfq-x5m5","import_time":"2026-11-10T23:17:30.176531453Z","modified_time":"2026-11-10T22:21:24Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"24f31121cb1502118185811b8789ced462350675da336fc0407ec380f6d4209c","source":"ghsa-malware"}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
|
||||
File diff suppressed because one or more lines are too long
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-18448","published":"2026-10-29T15:19:02Z","modified":"2026-11-02T05:30:05.699365843Z","summary":"Malicious code in @mobile-platform/magnetic-components (npm)","details":"@mobile-platform/magnetic-components is a dependency-confusion package: its description says the scoped name is referenced in the Meraki Dashboard Android app's bundled JavaScript and was unclaimed on the public registry, so a build that resolves `@mobile-platform` from npm runs its code instead of the intended private package. Its preinstall script runs `node preinstall.js` on npm install; in 0.0.1 and 0.0.2 it writes `DEPENDENCY_CONFUSION_POC_MARKER.txt` into the working directory, and in 0.0.3 it makes a DNS lookup of a fixed subdomain of `dbhmeq71af5395un3p70tujr84cuwuyg7.oast.me`, an interactsh callback host, signalling that the package was installed. It sends no host data beyond the lookup itself, but unreviewed code from an outside publisher has run with the installing user's privileges. The npm account io-8 published the three versions on 2026-10-29.","affected":[{"package":{"name":"@mobile-platform/magnetic-components","ecosystem":"npm","purl":"pkg:npm/%40mobile-platform/magnetic-components"},"versions":["0.0.1","0.0.2","0.0.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@mobile-platform/magnetic-components/MAL-2026-18448.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@mobile-platform/magnetic-components"}],"database_specific":{"iocs":{"domains":["dbhmeq71af5395un3p70tujr84cuwuyg7.oast.me"],"files":[{"digests":{"sha256":"b05b2de35c5389f706fe6eee9828ac202d7b35515ef9a0a23dbee6f5403e92fb"},"note":"preinstall runs `node preinstall.js` (@mobile-platform/magnetic-components@0.0.1).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"322393c3bedbac6de7e38a571c143fe6a5784d0b882ceb79397d762bdd8a2626"},"note":"Executed by the preinstall script of @mobile-platform/magnetic-components@0.0.1.","paths":["preinstall.js"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"ea24f367887b542a1bdd9e3e016e0a5facf4b85be726a028e4b7763c7bee6b03"},"note":"preinstall runs `node preinstall.js` (@mobile-platform/magnetic-components@0.0.2).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"322393c3bedbac6de7e38a571c143fe6a5784d0b882ceb79397d762bdd8a2626"},"note":"Executed by the preinstall script of @mobile-platform/magnetic-components@0.0.2.","paths":["preinstall.js"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"2aa36d500c4a7b8551e5e7e6bbbf6b9cfe524712433b637eec4deda8483ebe39"},"note":"preinstall runs `node preinstall.js` (@mobile-platform/magnetic-components@0.0.3).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"a3579427acd74986af891231ebf87f4dd2649b831c11203df0d887dcbb79513c"},"note":"Executed by the preinstall script of @mobile-platform/magnetic-components@0.0.3.","paths":["preinstall.js"],"source":"PACKAGE_ARCHIVE"}]}},"credits":[{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-18448","published":"2026-10-29T15:19:02Z","modified":"2026-11-10T23:30:03.327475155Z","aliases":["GHSA-fmr2-gc7p-wpc7"],"summary":"Malicious code in @mobile-platform/magnetic-components (npm)","details":"@mobile-platform/magnetic-components is a dependency-confusion package: its description says the scoped name is referenced in the Meraki Dashboard Android app's bundled JavaScript and was unclaimed on the public registry, so a build that resolves `@mobile-platform` from npm runs its code instead of the intended private package. Its preinstall script runs `node preinstall.js` on npm install; in 0.0.1 and 0.0.2 it writes `DEPENDENCY_CONFUSION_POC_MARKER.txt` into the working directory, and in 0.0.3 it makes a DNS lookup of a fixed subdomain of `dbhmeq71af5395un3p70tujr84cuwuyg7.oast.me`, an interactsh callback host, signalling that the package was installed. It sends no host data beyond the lookup itself, but unreviewed code from an outside publisher has run with the installing user's privileges. The npm account io-8 published the three versions on 2026-10-29.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (9594fe5dcfe6dbe11568cb09f324f04b3050c8e19ef0a0523d63e0ba88d16ff9)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"@mobile-platform/magnetic-components","ecosystem":"npm","purl":"pkg:npm/%40mobile-platform/magnetic-components"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["0.0.1","0.0.2","0.0.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@mobile-platform/magnetic-components/MAL-2026-18448.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@mobile-platform/magnetic-components"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-fmr2-gc7p-wpc7"}],"database_specific":{"iocs":{"domains":["dbhmeq71af5395un3p70tujr84cuwuyg7.oast.me"],"files":[{"digests":{"sha256":"b05b2de35c5389f706fe6eee9828ac202d7b35515ef9a0a23dbee6f5403e92fb"},"note":"preinstall runs `node preinstall.js` (@mobile-platform/magnetic-components@0.0.1).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"322393c3bedbac6de7e38a571c143fe6a5784d0b882ceb79397d762bdd8a2626"},"note":"Executed by the preinstall script of @mobile-platform/magnetic-components@0.0.1.","paths":["preinstall.js"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"ea24f367887b542a1bdd9e3e016e0a5facf4b85be726a028e4b7763c7bee6b03"},"note":"preinstall runs `node preinstall.js` (@mobile-platform/magnetic-components@0.0.2).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"322393c3bedbac6de7e38a571c143fe6a5784d0b882ceb79397d762bdd8a2626"},"note":"Executed by the preinstall script of @mobile-platform/magnetic-components@0.0.2.","paths":["preinstall.js"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"2aa36d500c4a7b8551e5e7e6bbbf6b9cfe524712433b637eec4deda8483ebe39"},"note":"preinstall runs `node preinstall.js` (@mobile-platform/magnetic-components@0.0.3).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"a3579427acd74986af891231ebf87f4dd2649b831c11203df0d887dcbb79513c"},"note":"Executed by the preinstall script of @mobile-platform/magnetic-components@0.0.3.","paths":["preinstall.js"],"source":"PACKAGE_ARCHIVE"}]},"malicious-packages-origins":[{"id":"GHSA-fmr2-gc7p-wpc7","import_time":"2026-11-10T23:17:30.193901378Z","modified_time":"2026-11-10T22:24:01Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"9594fe5dcfe6dbe11568cb09f324f04b3050c8e19ef0a0523d63e0ba88d16ff9","source":"ghsa-malware"}]},"credits":[{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19094","published":"2026-11-10T20:48:09Z","modified":"2026-11-10T21:30:05.432952652Z","aliases":["GHSA-wfqq-mfhj-vpr2"],"summary":"Malicious code in health-relay-client (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (c6e8bbff6fa5aae1c7c050c63db277bfc1ac21694f9c4fcb188299b048da9640)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"health-relay-client","ecosystem":"npm","purl":"pkg:npm/health-relay-client"},"versions":["1.0.4","1.0.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/health-relay-client/MAL-2026-19094.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wfqq-mfhj-vpr2"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-wfqq-mfhj-vpr2","import_time":"2026-11-10T21:16:53.478865266Z","modified_time":"2026-11-10T20:48:10Z","sha256":"c6e8bbff6fa5aae1c7c050c63db277bfc1ac21694f9c4fcb188299b048da9640","source":"ghsa-malware","versions":["1.0.4","1.0.3"]}]}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19095","published":"2026-11-10T22:06:21Z","modified":"2026-11-10T22:30:04.224813458Z","aliases":["GHSA-w584-99h6-6g9r"],"summary":"Malicious code in @rclaude/win32-x64 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (cd858623f60706d20738ee99009d20d9a2922472a9218d93df227dac1db66b5b)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"@rclaude/win32-x64","ecosystem":"npm","purl":"pkg:npm/%40rclaude/win32-x64"},"versions":["0.2.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@rclaude/win32-x64/MAL-2026-19095.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-w584-99h6-6g9r"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-w584-99h6-6g9r","import_time":"2026-11-10T22:17:23.507905808Z","modified_time":"2026-11-10T22:06:22Z","sha256":"cd858623f60706d20738ee99009d20d9a2922472a9218d93df227dac1db66b5b","source":"ghsa-malware","versions":["0.2.1"]}]}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19096","published":"2026-11-10T21:19:15Z","modified":"2026-11-10T22:30:04.223056714Z","aliases":["GHSA-5mg5-p59w-76r5"],"summary":"Malicious code in react-svg-chunk (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (187ada1449be0fbb2c6b4faa68a5cb801c33a035ceb8a952c7ea127fa0faa993)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"react-svg-chunk","ecosystem":"npm","purl":"pkg:npm/react-svg-chunk"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/react-svg-chunk/MAL-2026-19096.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-5mg5-p59w-76r5"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-5mg5-p59w-76r5","import_time":"2026-11-10T22:17:23.460172095Z","modified_time":"2026-11-10T21:19:16Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"187ada1449be0fbb2c6b4faa68a5cb801c33a035ceb8a952c7ea127fa0faa993","source":"ghsa-malware"}]}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19097","published":"2026-11-10T22:14:10Z","modified":"2026-11-10T22:30:04.275943835Z","aliases":["GHSA-p4j3-63x4-qr3v"],"summary":"Malicious code in solvit-cli (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (3b270954337a28d1b72f04e9bacc53c50aee3b15907ed8a3b4969dc486b40725)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"solvit-cli","ecosystem":"npm","purl":"pkg:npm/solvit-cli"},"versions":["0.5.0","0.4.4","0.4.3","0.4.2","0.2.1","0.1.2","0.1.1","0.1.0","0.0.0-stage"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/solvit-cli/MAL-2026-19097.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-p4j3-63x4-qr3v"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-p4j3-63x4-qr3v","import_time":"2026-11-10T22:17:23.497283903Z","modified_time":"2026-11-10T22:14:11Z","sha256":"3b270954337a28d1b72f04e9bacc53c50aee3b15907ed8a3b4969dc486b40725","source":"ghsa-malware","versions":["0.5.0","0.4.4","0.4.3","0.4.2","0.2.1","0.1.2","0.1.1","0.1.0","0.0.0-stage"]}]}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19098","published":"2026-11-10T22:54:07Z","modified":"2026-11-10T23:30:03.211838613Z","aliases":["GHSA-hwgp-r9x8-49cx"],"summary":"Malicious code in baidu-ti (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (3b7e5e1d660ae08477b2cc28649e9f689a3e5a9a0edd3967d520468b1f70117c)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"baidu-ti","ecosystem":"npm","purl":"pkg:npm/baidu-ti"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/baidu-ti/MAL-2026-19098.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hwgp-r9x8-49cx"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-hwgp-r9x8-49cx","import_time":"2026-11-10T23:17:30.201063843Z","modified_time":"2026-11-10T22:54:07Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"3b7e5e1d660ae08477b2cc28649e9f689a3e5a9a0edd3967d520468b1f70117c","source":"ghsa-malware"}]}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19099","published":"2026-11-10T22:22:19Z","modified":"2026-11-10T23:30:03.210757096Z","aliases":["GHSA-pmjf-g9mp-9hrr"],"summary":"Malicious code in hissakdx-wix-ssr-callback-canary (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (478c6e8fb729d3310647b40d0dffe6530437f79106afbdaddbca8b924608f4d5)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"hissakdx-wix-ssr-callback-canary","ecosystem":"npm","purl":"pkg:npm/hissakdx-wix-ssr-callback-canary"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hissakdx-wix-ssr-callback-canary/MAL-2026-19099.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-pmjf-g9mp-9hrr"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-pmjf-g9mp-9hrr","import_time":"2026-11-10T23:17:30.20965974Z","modified_time":"2026-11-10T22:22:24Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"478c6e8fb729d3310647b40d0dffe6530437f79106afbdaddbca8b924608f4d5","source":"ghsa-malware"}]}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19100","published":"2026-11-10T22:21:24Z","modified":"2026-11-10T23:30:03.220202681Z","aliases":["GHSA-hc34-qc67-9qp4"],"summary":"Malicious code in read-react-app-in (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (26e0edc20779ff037012127f0eeaf51de67c8f7b30ebe52d63866c6b4d476d83)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"read-react-app-in","ecosystem":"npm","purl":"pkg:npm/read-react-app-in"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/read-react-app-in/MAL-2026-19100.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hc34-qc67-9qp4"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-hc34-qc67-9qp4","import_time":"2026-11-10T23:17:30.19959409Z","modified_time":"2026-11-10T22:21:25Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"26e0edc20779ff037012127f0eeaf51de67c8f7b30ebe52d63866c6b4d476d83","source":"ghsa-malware"}]}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19101","published":"2026-11-10T22:21:24Z","modified":"2026-11-10T23:30:03.286771153Z","aliases":["GHSA-wfm4-3cjm-9545"],"summary":"Malicious code in read-react-app-out (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (24b1bf27fec55a13b65c23b917d5ef520f226d260222d74d4efe79f2911e7f40)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"read-react-app-out","ecosystem":"npm","purl":"pkg:npm/read-react-app-out"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/read-react-app-out/MAL-2026-19101.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wfm4-3cjm-9545"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-wfm4-3cjm-9545","import_time":"2026-11-10T23:17:30.220568266Z","modified_time":"2026-11-10T22:21:24Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"24b1bf27fec55a13b65c23b917d5ef520f226d260222d74d4efe79f2911e7f40","source":"ghsa-malware"}]}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19102","published":"2026-11-10T22:21:24Z","modified":"2026-11-10T23:30:03.293195875Z","aliases":["GHSA-rf9p-c6g8-r84w"],"summary":"Malicious code in read-react-app-test (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (8949f2c689dac9e0a1dd63f41cfb03971981c139e04b4bd22ecd3b74cc6fc745)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"read-react-app-test","ecosystem":"npm","purl":"pkg:npm/read-react-app-test"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/read-react-app-test/MAL-2026-19102.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-rf9p-c6g8-r84w"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-rf9p-c6g8-r84w","import_time":"2026-11-10T23:17:30.215355528Z","modified_time":"2026-11-10T22:21:24Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"8949f2c689dac9e0a1dd63f41cfb03971981c139e04b4bd22ecd3b74cc6fc745","source":"ghsa-malware"}]}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19103","published":"2026-11-10T22:22:19Z","modified":"2026-11-10T23:30:03.215719636Z","aliases":["GHSA-2wg4-r52x-r477"],"summary":"Malicious code in selectlist-polyfill-lite (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (218352b39c5ccdb5b603c057d80cc73b3541309ca18aadb008f2ef2ed438ef30)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"selectlist-polyfill-lite","ecosystem":"npm","purl":"pkg:npm/selectlist-polyfill-lite"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/selectlist-polyfill-lite/MAL-2026-19103.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2wg4-r52x-r477"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-2wg4-r52x-r477","import_time":"2026-11-10T23:17:30.167334086Z","modified_time":"2026-11-10T22:22:20Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"218352b39c5ccdb5b603c057d80cc73b3541309ca18aadb008f2ef2ed438ef30","source":"ghsa-malware"}]}}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.7.5","id":"MAL-2026-2497","published":"2026-04-06T09:11:24Z","modified":"2026-04-07T14:51:08.773993Z","summary":"Malicious code in commerce-utils (npm)","details":"Malicious package due to data exfiltration to a suspicious host, combined with arbitrary code execution during preinstall.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3bb3d6d3a8a8898abe7e371e54753d5902a5062151888ccff6c656f5edac6ba6)\nThe package commerce-utils was found to contain malicious code.\n","affected":[{"package":{"name":"commerce-utils","ecosystem":"npm","purl":"pkg:npm/commerce-utils"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/commerce-utils/MAL-2026-2497.json"}}],"references":[{"type":"REPORT","url":"https://app.safedep.io/community/malysis/01KNFFV2J9TJFEVM7P4RHQZQBY"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-04-07T14:39:12.848201267Z","modified_time":"2026-04-07T14:24:50Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"3bb3d6d3a8a8898abe7e371e54753d5902a5062151888ccff6c656f5edac6ba6","source":"amazon-inspector"}]},"credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"SafeDep","contact":["https://safedep.io"],"type":"FINDER"}]}
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-2497","published":"2026-04-06T09:11:24Z","modified":"2026-11-10T21:30:04.885610226Z","aliases":["GHSA-4m72-8w6v-x24q"],"summary":"Malicious code in commerce-utils (npm)","details":"Malicious package due to data exfiltration to a suspicious host, combined with arbitrary code execution during preinstall.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3bb3d6d3a8a8898abe7e371e54753d5902a5062151888ccff6c656f5edac6ba6)\nThe package commerce-utils was found to contain malicious code.\n\n## Source: ghsa-malware (96bc23613e41a01d93bddc7a544fcfdf7cf308051171c1c290527b0a7c9ed747)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"commerce-utils","ecosystem":"npm","purl":"pkg:npm/commerce-utils"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["0.0.2","0.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/commerce-utils/MAL-2026-2497.json"}}],"references":[{"type":"REPORT","url":"https://app.safedep.io/community/malysis/01KNFFV2J9TJFEVM7P4RHQZQBY"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-4m72-8w6v-x24q"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-04-07T14:39:12.848201267Z","modified_time":"2026-04-07T14:24:50Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"3bb3d6d3a8a8898abe7e371e54753d5902a5062151888ccff6c656f5edac6ba6","source":"amazon-inspector"},{"id":"GHSA-4m72-8w6v-x24q","import_time":"2026-11-10T21:16:53.429744006Z","modified_time":"2026-11-10T20:42:58Z","sha256":"96bc23613e41a01d93bddc7a544fcfdf7cf308051171c1c290527b0a7c9ed747","source":"ghsa-malware","versions":["0.0.2","0.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"SafeDep","contact":["https://safedep.io"],"type":"FINDER"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.7.5","id":"MAL-2026-3679","published":"2026-05-12T07:42:47Z","modified":"2026-05-13T20:21:28.616802Z","summary":"Malicious code in @2oolkit/hyperliquid-cli (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1c3af30011dcf54950f270463028270d732fce20b5cd5da44342a0748922e6df)\nThe package is advertised as a neutral CLI/MCP wrapper for Hyperliquid, but its distributed code silently routes value from the installer to an author-controlled address. In dist/index.js and dist/mcp.js, the constants BUILDER_ADDRESS = 0xa6f967d47c6f85a5ba4fc43543e5e1c171cccf98, BUILDER_FEE = 1 (0.01%), and REFERRAL_CODE = '2OOLKIT' are hardcoded. On `config init` / `config set --private-key...`, a fire-and-forget `silentAutoSetup(env, privateKey, walletAddress)` signs and submits (a) a `setReferrer('2OOLKIT')` transaction and (b) an `approveBuilderFee(0xa6f9...cf98, '0.1%')` transaction on the user's Hyperliquid account, with errors swallowed so the user sees no indication. Additionally, `HyperliquidClient.placeOrder` unconditionally injects `action.builder = { b: BUILDER_ADDRESS, f: BUILDER_FEE }` into every order, so every trade routed through the CLI pays a builder fee to the hardcoded address in perpetuity. None of this is disclosed in the README or command output, there is no opt-out, and the behavior is triggered by the documented setup flow. This is a silent-relay pattern causing direct, ongoing financial harm to anyone who installs and uses the package with a funded wallet. The repeated POSTs flagged in dist/index.js:610 and dist/mcp.js:466 correspond to the Hyperliquid exchange submissions carrying these hardcoded builder/referrer fields.\n","affected":[{"package":{"name":"@2oolkit/hyperliquid-cli","ecosystem":"npm","purl":"pkg:npm/%402oolkit/hyperliquid-cli"},"versions":["0.2.1","0.2.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.js","sha256":"73cd6941832c612aca22f77edd9c5da8e3bea943be2ba77d3a11538523080292","tlsh":"6653a52075fa212114a3b6ae6b6b81042035f653350cec957becfbd11f9e42689b7f78"}],"package_integrity":[{"filename":"hyperliquid-cli-0.2.1.tgz","hashes":{"sha1":"1a139c96cec462bcf72c21e399097100fb7d6369","sha512_sri":"sha512-4NbhUFbpf6OoGv8cYFr3hOsNgMkwp1QFnHp3hChfiLBAKCRFU9zLN+coacxfyiW7PJN9xjkpm+9MD0z8DQkrHw=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@2oolkit/hyperliquid-cli/MAL-2026-3679.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@2oolkit/hyperliquid-cli/v/0.2.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@2oolkit/hyperliquid-cli/v/0.2.2"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-002224","import_time":"2026-05-13T20:10:54.006616674Z","modified_time":"2026-05-12T19:03:07Z","sha256":"1c3af30011dcf54950f270463028270d732fce20b5cd5da44342a0748922e6df","source":"amazon-inspector","versions":["0.2.1"]},{"id":"IN-MAL-2026-002225","import_time":"2026-05-13T20:10:54.072521104Z","modified_time":"2026-05-12T19:03:07Z","sha256":"66215e5cdec4c1ec4dfa5fb21237998c57bfbfd96a0bcb9792b92e4c88be3f17","source":"amazon-inspector","versions":["0.2.2"]}]},"credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-3679","published":"2026-05-12T07:42:47Z","modified":"2026-11-10T21:30:04.895641392Z","aliases":["GHSA-qg83-c6x5-qw8f"],"summary":"Malicious code in @2oolkit/hyperliquid-cli (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1c3af30011dcf54950f270463028270d732fce20b5cd5da44342a0748922e6df)\nThe package is advertised as a neutral CLI/MCP wrapper for Hyperliquid, but its distributed code silently routes value from the installer to an author-controlled address. In dist/index.js and dist/mcp.js, the constants BUILDER_ADDRESS = 0xa6f967d47c6f85a5ba4fc43543e5e1c171cccf98, BUILDER_FEE = 1 (0.01%), and REFERRAL_CODE = '2OOLKIT' are hardcoded. On `config init` / `config set --private-key...`, a fire-and-forget `silentAutoSetup(env, privateKey, walletAddress)` signs and submits (a) a `setReferrer('2OOLKIT')` transaction and (b) an `approveBuilderFee(0xa6f9...cf98, '0.1%')` transaction on the user's Hyperliquid account, with errors swallowed so the user sees no indication. Additionally, `HyperliquidClient.placeOrder` unconditionally injects `action.builder = { b: BUILDER_ADDRESS, f: BUILDER_FEE }` into every order, so every trade routed through the CLI pays a builder fee to the hardcoded address in perpetuity. None of this is disclosed in the README or command output, there is no opt-out, and the behavior is triggered by the documented setup flow. This is a silent-relay pattern causing direct, ongoing financial harm to anyone who installs and uses the package with a funded wallet. The repeated POSTs flagged in dist/index.js:610 and dist/mcp.js:466 correspond to the Hyperliquid exchange submissions carrying these hardcoded builder/referrer fields.\n\n## Source: ghsa-malware (3284a25ae4e115f06eb2c8b261be6b71b6a756407aa0d306395bbae0f5f43d10)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"@2oolkit/hyperliquid-cli","ecosystem":"npm","purl":"pkg:npm/%402oolkit/hyperliquid-cli"},"versions":["0.2.1","0.2.2","0.2.7","0.2.6","0.2.5","0.2.4","0.2.3","0.2.0","0.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.js","sha256":"73cd6941832c612aca22f77edd9c5da8e3bea943be2ba77d3a11538523080292","tlsh":"6653a52075fa212114a3b6ae6b6b81042035f653350cec957becfbd11f9e42689b7f78"}],"package_integrity":[{"filename":"hyperliquid-cli-0.2.1.tgz","hashes":{"sha1":"1a139c96cec462bcf72c21e399097100fb7d6369","sha512_sri":"sha512-4NbhUFbpf6OoGv8cYFr3hOsNgMkwp1QFnHp3hChfiLBAKCRFU9zLN+coacxfyiW7PJN9xjkpm+9MD0z8DQkrHw=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@2oolkit/hyperliquid-cli/MAL-2026-3679.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@2oolkit/hyperliquid-cli/v/0.2.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@2oolkit/hyperliquid-cli/v/0.2.2"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-qg83-c6x5-qw8f"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-002224","import_time":"2026-05-13T20:10:54.006616674Z","modified_time":"2026-05-12T19:03:07Z","sha256":"1c3af30011dcf54950f270463028270d732fce20b5cd5da44342a0748922e6df","source":"amazon-inspector","versions":["0.2.1"]},{"id":"IN-MAL-2026-002225","import_time":"2026-05-13T20:10:54.072521104Z","modified_time":"2026-05-12T19:03:07Z","sha256":"66215e5cdec4c1ec4dfa5fb21237998c57bfbfd96a0bcb9792b92e4c88be3f17","source":"amazon-inspector","versions":["0.2.2"]},{"id":"GHSA-qg83-c6x5-qw8f","import_time":"2026-11-10T21:16:53.471635091Z","modified_time":"2026-11-10T20:18:38Z","sha256":"3284a25ae4e115f06eb2c8b261be6b71b6a756407aa0d306395bbae0f5f43d10","source":"ghsa-malware","versions":["0.2.7","0.2.6","0.2.5","0.2.4","0.2.3","0.2.2","0.2.1","0.2.0","0.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}
|
||||
Reference in New Issue
Block a user