vuln-osv update 2026-11-11T06:44:02Z
This commit is contained in:
Vulnerability Bot
File diff suppressed because one or more lines are too long
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GO-2026-6848","published":"2026-11-11T02:51:11Z","modified":"2026-11-11T03:15:14.770362892Z","aliases":["CVE-2026-97043"],"summary":"Unexpected code execution via escaped quotes in //go:cgo_ldflag in cmd/go and cmd/compile","details":"Building a malicious package that uses cgo could bypass \"#cgo LDFLAGS\" validation and cause unexpected code execution at build time, or cause the go command to panic, via crafted quoting in \"//go:cgo_ldflag\" directives.\n\nWhen \"cmd/cgo\" generates \"_cgo_gotypes.go\", it quotes each \"#cgo LDFLAGS\" argument with strconv.Quote in a \"//go:cgo_ldflag\" directive, but \"cmd/compile\" and \"cmd/go\" parsed those directives by splitting on raw quote characters without handling backslash escapes or unquoting the string. This mismatch allowed disallowed linker flags or unvalidated linker search paths to be smuggled past the go command's flag checks and passed to the external linker. In addition, deduplicating LDFLAGS in the go command could panic with an out-of-bounds slice index when a prefix of the flag list matched near the end of the slice.\n\n\"cmd/compile\" and \"cmd/go\" now properly handle backslash-escaped quotes and unquote \"//go:cgo_*\" pragma strings with strconv.Unquote, and the slice bounds check in processCgoOutputs has been fixed.","affected":[{"package":{"name":"toolchain","ecosystem":"Go","purl":"pkg:golang/toolchain"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.11"},{"introduced":"1.27.0-0"},{"fixed":"1.27.4"}]}],"ecosystem_specific":{"imports":[{"path":"cmd/go"},{"path":"cmd/compile"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6848.json"}}],"references":[{"type":"FIX","url":"https://go.dev/cl/862156"},{"type":"REPORT","url":"https://go.dev/issue/82567"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6848"}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GO-2026-6849","published":"2026-11-11T02:51:11Z","modified":"2026-11-11T03:15:14.799110962Z","aliases":["CVE-2026-97042"],"summary":"Linker flag injection via cgo_import_dynamic and PE DLL names in cmd/cgo, cmd/compile, and cmd/link","details":"Building a malicious package that uses \"//go:cgo_import_dynamic\" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker.\n\nThe compiler only checked the first character of the library name in \"//go:cgo_import_dynamic\" directives and skipped validation in cgo-generated files. In addition, on Windows, \"cmd/cgo\" and \"cmd/link\" did not validate imported DLL names extracted from PE object files before emitting \"-l<name>\" flags for the external linker, allowing a crafted DLL name containing \"..\" path traversal or special characters to reference arbitrary files on disk.\n\nThe compiler now validates every character of the library name in \"//go:cgo_import_dynamic\" directives (including in cgo-generated files on Windows) and rejects \"..\" path traversal, and \"cmd/cgo\" and \"cmd/link\" reject PE imported DLL names containing path separators, \"..\", \":\", or leading \"-\" or \"@\".","affected":[{"package":{"name":"toolchain","ecosystem":"Go","purl":"pkg:golang/toolchain"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.11"},{"introduced":"1.27.0-0"},{"fixed":"1.27.4"}]}],"ecosystem_specific":{"imports":[{"path":"cmd/cgo"},{"path":"cmd/compile"},{"path":"cmd/link"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6849.json"}}],"references":[{"type":"FIX","url":"https://go.dev/cl/862155"},{"type":"REPORT","url":"https://go.dev/issue/82568"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6849"}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GO-2026-6850","published":"2026-11-11T02:51:11Z","modified":"2026-11-11T03:15:14.803931428Z","aliases":["CVE-2026-97041"],"summary":"Host linker flag injection via //go:cgo_* directives in cmd/compile and cmd/link","details":"Building a malicious package containing \"//go:cgo_*\" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms.\n\nThe compiler and linker did not reject commas in \"//go:cgo_import_dynamic\", \"//go:cgo_export_dynamic\", \"//go:cgo_export_static\", \"//go:cgo_import_static\", and \"//go:cgo_dynamic_linker\" directives, and the linker passed the dynamic linker path using \"-Wl,--dynamic-linker,<path>\". Furthermore, the two-argument form of \"//go:cgo_import_dynamic\" (which is permitted in non-cgo Go source files) could overwrite the external symbol name of a symbol already marked for cgo export. A symbol name or dynamic linker path containing a comma or leading \"@\" could split \"-Wl,--export-dynamic-symbol=\" or \"-Wl,--dynamic-linker,\" into arbitrary host linker flags or response file arguments.\n\nThe compiler and linker now reject commas in \"//go:cgo_*\" symbol and dynamic linker directives, the linker passes \"-Wl,--dynamic-linker=<path>\", and \"cgo_import_dynamic\" no longer overwrites symbols exported via \"cgo_export_dynamic\" or \"cgo_export_static\".","affected":[{"package":{"name":"toolchain","ecosystem":"Go","purl":"pkg:golang/toolchain"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.11"},{"introduced":"1.27.0-0"},{"fixed":"1.27.4"}]}],"ecosystem_specific":{"imports":[{"path":"cmd/compile"},{"path":"cmd/link"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6850.json"}}],"references":[{"type":"FIX","url":"https://go.dev/cl/862154"},{"type":"REPORT","url":"https://go.dev/issue/82569"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6850"},"credits":[{"name":"RyotaK (https://ryotak.net) of GMO Flatt Security Inc."}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GO-2026-6851","published":"2026-11-11T02:51:11Z","modified":"2026-11-11T03:15:14.815322039Z","aliases":["CVE-2026-97040"],"summary":"Cgo directive injection via .syso files disguised as Go object files in cmd/go and cmd/link","details":"Building a package containing a crafted \".syso\" file could bypass cgo flag validation and inject arbitrary linker flags when linking.\n\nWhen loading \".syso\" entries from a package archive, the linker only checked for recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling through to Go object parsing. A \".syso\" file beginning with a \"go object\" header was parsed as a Go compiler object, allowing untrusted cgo metadata directives (such as \"cgo_ldflag\" or \"cgo_dynamic_linker\") embedded in the \".syso\" file to be passed to the external linker without validation. Additionally, \".syso\" filenames longer than 16 bytes lost their \".syso\" extension when truncated in archive headers, and unrecognized \".syso\" formats forced external linking in pure-Go builds.\n\nThe linker now rejects \".syso\" files that are not recognized host object formats, and \"cmd/go\" and \"cmd/pack\" preserve the \".syso\" suffix when truncating long archive member names.","affected":[{"package":{"name":"toolchain","ecosystem":"Go","purl":"pkg:golang/toolchain"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.11"},{"introduced":"1.27.0-0"},{"fixed":"1.27.4"}]}],"ecosystem_specific":{"imports":[{"path":"cmd/go"},{"path":"cmd/link"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6851.json"}}],"references":[{"type":"FIX","url":"https://go.dev/cl/862153"},{"type":"REPORT","url":"https://go.dev/issue/82570"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6851"},"credits":[{"name":"RyotaK (https://ryotak.net) of GMO Flatt Security Inc."}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GO-2026-6852","published":"2026-11-11T02:51:11Z","modified":"2026-11-11T03:15:14.802903591Z","aliases":["CVE-2026-97039"],"summary":"Flag sanitization bypass via \"#cgo pkg-config:\" directives in cmd/go","details":"Building a malicious package that uses \"#cgo pkg-config:\" directives could load untrusted pkg-config \".pc\" files or inject unvalidated compiler and linker flags.\n\nThe pkg-config flag allowlist previously permitted \"--with-path=\" and \"--personality=\", allowed \"--define-variable=\" values beginning with \"=\" or \"$\" (which can rewrite paths in system \".pc\" files into sysroot-prefixed \"-L=\" or \"-L$SYSROOT\" linker search paths), and allowed package arguments ending in \".pc\" or containing path separators or \"..\", which caused pkg-config to load local \".pc\" files directly from the package directory. In addition, flags returned by \"pkg-config --cflags\" in cgoCPPFLAGS were not checked when determining whether internal linking is safe.\n\nThe go command now disallows \"--with-path=\", \"--personality=\", leading \"=\" or \"$\" characters in \"--define-variable=\" values, and local \".pc\" paths in \"#cgo pkg-config:\" directives, and inspects cgoCPPFLAGS when checking internal linking compatibility.","affected":[{"package":{"name":"toolchain","ecosystem":"Go","purl":"pkg:golang/toolchain"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.11"},{"introduced":"1.27.0-0"},{"fixed":"1.27.4"}]}],"ecosystem_specific":{"imports":[{"path":"cmd/go"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6852.json"}}],"references":[{"type":"FIX","url":"https://go.dev/cl/862152"},{"type":"REPORT","url":"https://go.dev/issue/82571"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6852"}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GO-2026-6853","published":"2026-11-11T02:51:11Z","modified":"2026-11-11T03:15:14.801899979Z","aliases":["CVE-2026-97038"],"summary":"Arbitrary code execution via crafted .syso files and cgo linker input files in cmd/go","details":"Building a malicious package containing \".syso\" files or cgo linker inputs could inject arbitrary linker flags or execute arbitrary code at link time.\n\nLinker input files—including \".syso\" files, direct object or library inputs in \"#cgo LDFLAGS\", and libraries in \"-L\" directories—were passed to the external linker without validating their format or checking for embedded linker options. Across platforms, this allowed executing GNU ld implicit linker scripts disguised as libraries or \".syso\" files (or loaded via \"-l:<filename>\" or \"-l\" containing path separators), injecting unallowlisted linker flags via PE/COFF \".drectve\" sections on Windows or Mach-O \"LC_LINKER_OPTION\" load commands on Darwin, or invoking LTO plugins via GCC or LLVM LTO intermediate representation sections in ELF, PE/COFF, or Mach-O objects.\n\nThe go command now verifies that \".syso\" files, direct linker inputs, and libraries in \"-L\" directories are valid binary objects or archives that do not contain unallowlisted \".drectve\" directives, \"LC_LINKER_OPTION\" load commands, or LTO IR sections, and disallows \"-l:<filename>\" and \":\", \"=\", or path separators in \"-l\" flags.","affected":[{"package":{"name":"toolchain","ecosystem":"Go","purl":"pkg:golang/toolchain"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.11"},{"introduced":"1.27.0-0"},{"fixed":"1.27.4"}]}],"ecosystem_specific":{"imports":[{"path":"cmd/go"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6853.json"}}],"references":[{"type":"FIX","url":"https://go.dev/cl/862151"},{"type":"REPORT","url":"https://go.dev/issue/82572"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6853"}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GO-2026-6854","published":"2026-11-11T02:51:11Z","modified":"2026-11-11T03:15:14.799312883Z","aliases":["CVE-2026-97037"],"summary":"Linker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo in cmd/go","details":"Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host linker via \"#cgo LDFLAGS\".\n\nSplit \"-Wl,\" flags that consume a following argument (such as \"-Wl,-rpath\", \"-Wl,--just-symbols\", and \"-Wl,-undefined\") previously accepted a bare second argument without a \"-Wl,\" prefix, which the compiler driver passes directly to the linker as a positional input file. Additionally, when using GNU ld.bfd, flags such as \"-framework\", \"-Wl,-framework\", \"-Wl,-undefined\", \"-Wl,--just-symbols\", \"-Wl,-R\", \"-Wl,-subsystem\", and (on non-Darwin platforms) \"-Wl,-sectcreate\" could cause ld.bfd to interpret their arguments as linker scripts if they named a regular file on disk.\n\nThe go command now requires a \"-Wl,\" prefix on the second token of split \"-Wl,\" flags (except \"-Wl,-R\"), verifies that these flags do not reference linker script files, and disallows bare \"-Wl,--warn-backrefs-exclude\".","affected":[{"package":{"name":"toolchain","ecosystem":"Go","purl":"pkg:golang/toolchain"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.11"},{"introduced":"1.27.0-0"},{"fixed":"1.27.4"}]}],"ecosystem_specific":{"imports":[{"path":"cmd/go"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6854.json"}}],"references":[{"type":"FIX","url":"https://go.dev/cl/862150"},{"type":"REPORT","url":"https://go.dev/issue/82573"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6854"}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GO-2026-6855","published":"2026-11-11T02:51:11Z","modified":"2026-11-11T03:15:15.677114364Z","aliases":["CVE-2026-97036"],"summary":"Arbitrary code execution during build on darwin via \"-l to_library\" in cgo in cmd/go","details":"On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing \"-l to_library <path>\" in a \"#cgo LDFLAGS\" directive.\n\nThe Apple linker recombines the separated arguments \"-l\" and \"to_library\" into \"-lto_library\", which loads an arbitrary LTO plugin dynamic library at link time.\n\nThe go command now disallows \"-l\" followed by \"to_library\" in \"#cgo LDFLAGS\", rejects \"-lazy_library\", \"-lazy_framework\", \"-load_hidden\", \"-library\", and \"-library-path\", and checks recombined \"-l\" arguments against disallowed linker flags and patterns.","affected":[{"package":{"name":"toolchain","ecosystem":"Go","purl":"pkg:golang/toolchain"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.11"},{"introduced":"1.27.0-0"},{"fixed":"1.27.4"}]}],"ecosystem_specific":{"imports":[{"goos":["darwin"],"path":"cmd/go"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6855.json"}}],"references":[{"type":"FIX","url":"https://go.dev/cl/862149"},{"type":"REPORT","url":"https://go.dev/issue/82574"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6855"},"credits":[{"name":"Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276/)"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GO-2026-6856","published":"2026-11-11T02:51:11Z","modified":"2026-11-11T03:15:15.719402274Z","aliases":["CVE-2026-97035"],"summary":"Unexpected code execution and arbitrary file write via Clang -gen-* and GCC -gnat* flags in cgo in cmd/go","details":"When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time or write files to arbitrary directories via \"-gen-*\" or \"-gnat*\" flags in \"#cgo\" directives.\n\nThe \"-g*\" wildcard in the compiler and linker flag allowlists previously matched Clang's two-argument \"-gen-cdb-fragment-path <dir>\" flag and GCC's two-argument \"-gnatO <file>\" flag, permitting compilation database fragments and sidecar output files to be written to arbitrary directories and desynchronizing flag argument parsing between the go command and the compiler driver so that subsequent arguments could be passed as unvalidated positional inputs to the linker.\n\n\"-gen-*\" and \"-gnat*\" flags are now disallowed in \"#cgo\" compiler and linker flags.","affected":[{"package":{"name":"toolchain","ecosystem":"Go","purl":"pkg:golang/toolchain"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.11"},{"introduced":"1.27.0-0"},{"fixed":"1.27.4"}]}],"ecosystem_specific":{"imports":[{"path":"cmd/go"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6856.json"}}],"references":[{"type":"FIX","url":"https://go.dev/cl/862148"},{"type":"REPORT","url":"https://go.dev/issue/82575"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6856"}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GO-2026-6857","published":"2026-11-11T02:51:11Z","modified":"2026-11-11T03:15:14.793749820Z","aliases":["CVE-2026-97034"],"summary":"Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/go","details":"When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files (\"specs\" or \"*.spec\").\n\nWhen linking with \"-fopenmp\", \"-fopenacc\", or \"-fsanitize=\" in \"#cgo LDFLAGS\", GCC's built-in link spec evaluates \"%:include(libgomp.spec)\" or \"%:include(libsanitizer.spec)\" and searches for spec files in \"-L\" and sysroot directories (including subdirectories and multilib sibling directories such as \"../lib64\"), as well as the working directory when \"-fopenmp\" or \"-fopenacc\" is used or when \"-fsanitize=\" is combined with \"-static\" or \"-static-lib*\".\n\nThe go command now rejects \"-L\", \"-isysroot\", and \"-Wl,-syslibroot\" directories (and the working and package directories when applicable) that contain GCC spec files, and disallows \"@\" and \"-\" prefixes in \"-fsanitize=\" compiler flag values.","affected":[{"package":{"name":"toolchain","ecosystem":"Go","purl":"pkg:golang/toolchain"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.11"},{"introduced":"1.27.0-0"},{"fixed":"1.27.4"}]}],"ecosystem_specific":{"imports":[{"path":"cmd/go"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6857.json"}}],"references":[{"type":"FIX","url":"https://go.dev/cl/862147"},{"type":"REPORT","url":"https://go.dev/issue/82576"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6857"}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GO-2026-6858","published":"2026-11-11T02:51:11Z","modified":"2026-11-11T03:15:14.803158957Z","aliases":["CVE-2026-97033"],"summary":"Unexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags in cmd/go","details":"Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags permitted in \"#cgo\" directives.\n\nSpecifically, \"--sysroot\" in GCC and Clang relocates compiler subprograms, spec files, and CRT startup objects to an attacker-controlled directory; \"-target\" in Clang falls back to executing target helper tools from the current working directory when not found in PATH; \"-isysroot\" and \"-Wl,-syslibroot\" can pass a regular file on disk to GNU ld.bfd, which interprets it as a positional linker script; and \"-x\" permitted specifying arbitrary compiler input languages beyond those supported by cgo.\n\n\"--sysroot\" and \"-target\" are now disallowed in \"#cgo\" flags, \"-isysroot\" and \"-Wl,-syslibroot\" are verified not to point to regular files, and \"-x\" is restricted to the C, C++, Objective-C, and assembler languages supported by cgo.","affected":[{"package":{"name":"toolchain","ecosystem":"Go","purl":"pkg:golang/toolchain"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.11"},{"introduced":"1.27.0-0"},{"fixed":"1.27.4"}]}],"ecosystem_specific":{"imports":[{"path":"cmd/go"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6858.json"}}],"references":[{"type":"FIX","url":"https://go.dev/cl/862146"},{"type":"REPORT","url":"https://go.dev/issue/82577"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6858"}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GO-2026-6859","published":"2026-11-11T02:51:11Z","modified":"2026-11-11T03:15:14.805898236Z","aliases":["CVE-2026-97054"],"summary":"HTTP/1 server crash due to MaxBytesReader header race in net/http","details":"For HTTP/1 servers, when MaxBytesReader's limit is exceeded, \"Connection: close\" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.","affected":[{"package":{"name":"stdlib","ecosystem":"Go","purl":"pkg:golang/stdlib"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.11"},{"introduced":"1.27.0-0"},{"fixed":"1.27.4"}]}],"ecosystem_specific":{"imports":[{"path":"net/http","symbols":["CanonicalHeaderKey","Client.CloseIdleConnections","Client.Do","Client.Get","Client.Head","Client.Post","Client.PostForm","ClientConn.Close","ClientConn.RoundTrip","Cookie.String","Cookie.Valid","CrossOriginProtection.AddInsecureBypassPattern","CrossOriginProtection.AddTrustedOrigin","CrossOriginProtection.Check","Dir.Open","Error","Get","Handle","HandleFunc","HandlerFunc.ServeHTTP","Head","Header.Add","Header.Del","Header.Get","Header.Set","Header.Values","Header.Write","Header.WriteSubset","ListenAndServe","ListenAndServeTLS","NewRequest","NewRequestWithContext","NotFound","ParseCookie","ParseSetCookie","ParseTime","Post","PostForm","ProxyFromEnvironment","ReadRequest","ReadResponse","Redirect","Request.AddCookie","Request.BasicAuth","Request.Cookie","Request.Cookies","Request.CookiesNamed","Request.FormFile","Request.FormValue","Request.MultipartReader","Request.ParseForm","Request.ParseMultipartForm","Request.PostFormValue","Request.Referer","Request.SetBasicAuth","Request.UserAgent","Request.Write","Request.WriteProxy","Response.Cookies","Response.Location","Response.Write","ResponseController.EnableFullDuplex","ResponseController.Flush","ResponseController.Hijack","ResponseController.SetReadDeadline","ResponseController.SetWriteDeadline","Serve","ServeContent","ServeFile","ServeFileFS","ServeMux.Handle","ServeMux.HandleFunc","ServeMux.ServeHTTP","ServeTLS","Server.Close","Server.ListenAndServe","Server.ListenAndServeTLS","Server.Serve","Server.ServeTLS","Server.SetKeepAlivesEnabled","Server.Shutdown","SetCookie","Transport.CancelRequest","Transport.Clone","Transport.CloseIdleConnections","Transport.NewClientConn","Transport.RoundTrip","body.Close","body.Read","bodyEOFSignal.Close","bodyEOFSignal.Read","bodyLocked.Read","bufioFlushWriter.Write","cancelTimerBody.Close","cancelTimerBody.Read","checkConnErrorWriter.Write","chunkWriter.Write","connReader.Read","connectMethodKey.String","expectContinueReader.Close","expectContinueReader.Read","extraHeader.Write","fileHandler.ServeHTTP","fileTransport.RoundTrip","globalOptionsHandler.ServeHTTP","gzipReader.Close","gzipReader.Read","http1ClientConn.Close","http1ClientConn.RoundTrip","http2ClientConn.RoundTrip","http2Handler.ServeHTTP","http2ResponseWriter.Flush","http2ResponseWriter.FlushError","http2ResponseWriter.Push","http2RoundTripper.RoundTrip","http3ServerHandler.ServeHTTP","initALPNRequest.ServeHTTP","loggingConn.Close","loggingConn.Read","loggingConn.Write","maxBytesReader.Close","maxBytesReader.Read","onceCloseListener.Close","persistConn.Read","persistConnWriter.ReadFrom","persistConnWriter.Write","populateResponse.Write","populateResponse.WriteHeader","readTrackingBody.Close","readTrackingBody.Read","readWriteCloserBody.CloseWrite","readWriteCloserBody.Read","redirectHandler.ServeHTTP","response.Flush","response.FlushError","response.Hijack","response.ReadFrom","response.Write","response.WriteHeader","response.WriteString","serverHandler.ServeHTTP","socksDialer.DialWithConn","socksUsernamePassword.Authenticate","stringWriter.WriteString","timeoutHandler.ServeHTTP","timeoutWriter.Write","timeoutWriter.WriteHeader","transportReadFromServerError.Error","unencryptedHTTP2Request.ServeHTTP"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6859.json"}}],"references":[{"type":"FIX","url":"https://go.dev/cl/862185"},{"type":"REPORT","url":"https://go.dev/issue/82563"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6859"},"credits":[{"name":"Jakub Ciolek (https://ciolek.dev)"}]}
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-6rff-vv3p-7mrw","published":"2026-11-10T21:32:51Z","modified":"2026-11-11T00:45:04.075864219Z","withdrawn":"2026-11-11T00:32:10Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-114159 - Visual Studio Remote Code Execution Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-3cgx-w6gm-fqrx. This link is maintained to preserve external references.\n\n## Original Description\nHeap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.","affected":[{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9","11.0.0","8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.34","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8","9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.23","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"< 8.0.34","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6rff-vv3p-7mrw/GHSA-6rff-vv3p-7mrw.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114159"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114159"}],"database_specific":{"cwe_ids":["CWE-122"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:32:10Z","nvd_published_at":"2026-11-10T19:19:09Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-cfv6-4v53-fff6","published":"2026-11-10T21:33:10Z","modified":"2026-11-11T01:00:31.824270939Z","withdrawn":"2026-11-11T00:39:56Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-118745 - Visual Studio Remote Code Execution Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-x8x8-p968-x646. This link is maintained to preserve external references.\n\n## Original Description\nHeap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.","affected":[{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9","11.0.0","8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.34","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8","9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.23","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"< 8.0.34","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-cfv6-4v53-fff6/GHSA-cfv6-4v53-fff6.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118745"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118745"}],"database_specific":{"cwe_ids":["CWE-122"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:39:56Z","nvd_published_at":"2026-11-10T19:19:51Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-cjjx-gv54-83qh","published":"2026-11-10T21:32:52Z","modified":"2026-11-11T00:45:03.751293279Z","withdrawn":"2026-11-11T00:34:02Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-114158 - Visual Studio Remote Code Execution Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-r8h3-p8p6-ggp7. This link is maintained to preserve external references.\n\n## Original Description\nHeap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.","affected":[{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9","11.0.0","8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.34","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8","9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.23","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"< 8.0.34","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-cjjx-gv54-83qh/GHSA-cjjx-gv54-83qh.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114158"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114158"}],"database_specific":{"cwe_ids":["CWE-122"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:34:02Z","nvd_published_at":"2026-11-10T19:19:09Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}
|
||||
File diff suppressed because one or more lines are too long
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-hm4p-mv9w-4w8f","published":"2026-11-10T21:32:51Z","modified":"2026-11-11T01:00:31.771669003Z","withdrawn":"2026-11-11T00:39:39Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-114152 - Visual Studio Remote Code Execution Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-xf35-v9jh-g65w. This link is maintained to preserve external references.\n\n## Original Description\nStack-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.","affected":[{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9","11.0.0","8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.34","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8","9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.23","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"< 8.0.34","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-hm4p-mv9w-4w8f/GHSA-hm4p-mv9w-4w8f.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114152"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114152"}],"database_specific":{"cwe_ids":["CWE-121"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:39:39Z","nvd_published_at":"2026-11-10T19:19:08Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}
|
||||
File diff suppressed because one or more lines are too long
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"GHSA-mqcg-252r-5fj7","published":"2026-11-10T21:32:51Z","modified":"2026-11-11T00:45:03.946197977Z","withdrawn":"2026-11-11T00:34:51Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-114151 - Visual Studio Remote Code Execution Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-fpxj-5c99-g7vj. This link is maintained to preserve external references.\n\n## Original Description\nDeserialization of untrusted data in Visual Studio allows an unauthorized attacker to execute code over a network.","affected":[{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9","11.0.0","8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.34","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8","9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.23","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"< 8.0.34","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-mqcg-252r-5fj7/GHSA-mqcg-252r-5fj7.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114151"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114151"}],"database_specific":{"cwe_ids":["CWE-121"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:34:51Z","nvd_published_at":"2026-11-10T19:19:08Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.0","id":"GHSA-v3m3-f69x-jf25","published":"2026-01-13T21:31:46Z","modified":"2026-04-10T19:50:16.959742Z","aliases":["CVE-2025-15056"],"summary":"Quill is vulnerable to XSS via HTML export feature","details":"A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS).\n\nThis issue affects Quill: 2.0.3.","affected":[{"package":{"name":"quill","ecosystem":"npm","purl":"pkg:npm/quill"},"versions":["2.0.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-v3m3-f69x-jf25/GHSA-v3m3-f69x-jf25.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15056"},{"type":"WEB","url":"https://fluidattacks.com/advisories/diomedes"},{"type":"PACKAGE","url":"https://github.com/slab/quill"}],"database_specific":{"cwe_ids":["CWE-74","CWE-79"],"github_reviewed":true,"github_reviewed_at":"2026-01-16T16:58:02Z","nvd_published_at":"2026-01-13T21:15:49Z","severity":"LOW"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P"}]}
|
||||
{"schema_version":"1.9.0","id":"GHSA-v3m3-f69x-jf25","published":"2026-01-13T21:31:46Z","modified":"2026-11-11T02:56:08.527587723Z","aliases":["CVE-2025-15056","CVE-2026-120350"],"summary":"Quill is vulnerable to XSS via HTML export feature","details":"A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS).\n\nThis issue affects Quill: 2.0.3.","affected":[{"package":{"name":"quill","ecosystem":"npm","purl":"pkg:npm/quill"},"versions":["2.0.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-v3m3-f69x-jf25/GHSA-v3m3-f69x-jf25.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15056"},{"type":"WEB","url":"https://fluidattacks.com/advisories/diomedes"},{"type":"PACKAGE","url":"https://github.com/slab/quill"}],"database_specific":{"cwe_ids":["CWE-74","CWE-79"],"github_reviewed":true,"github_reviewed_at":"2026-01-16T16:58:02Z","nvd_published_at":"2026-01-13T21:15:49Z","severity":"LOW"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-18830","published":"2026-10-27T00:00:00Z","modified":"2026-11-09T23:15:21.343630205Z","summary":"Malicious code in @fadelsm/baileys (npm)","details":"@fadelsm/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel ID(s) 120363400362472743@newsletter, 120363406524087186@newsletter, 120363407144637058@newsletter, 120363408367338249@newsletter, 120363409508273158@newsletter, 12036340982021544@newsletter and 4 more (stored as character-code arrays), using the victim's authenticated session and without telling them. Same behaviour as the PhantomSub family (MAL-2026-17342).","affected":[{"package":{"name":"@fadelsm/baileys","ecosystem":"npm","purl":"pkg:npm/%40fadelsm/baileys"},"versions":["7.0.1","7.0.2","7.0.3","7.0.4","7.0.5","7.0.6","7.0.7","7.0.8","7.0.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@fadelsm/baileys/MAL-2026-18830.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@fadelsm/baileys"},{"type":"WEB","url":"https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/"}],"database_specific":{"iocs":{"domains":[],"files":[{"digests":{"sha256":"6124f083369ee555d0d0b32a9702f3f4c0008e4cac4a03195081e861e61297d4"},"paths":["lib/Socket/newsletter.js"]},{"digests":{"sha256":"71dfb4222ed6acd3f788c1e7fd58548e1a631d3b41256ba37b9b19c10d7b65d4"},"paths":["lib/Socket/newsletter.js"]},{"digests":{"sha256":"8ce0541a2fa8de1851064d401c13d8d7546e3bc347746ca969199a5aac48b850"},"paths":["lib/Socket/newsletter.js"]},{"digests":{"sha256":"bdf0161f9e9e7f14d77a8049da5cad6876c64882899f55b59875d3c9088b1676"},"paths":["lib/Socket/newsletter.js"]},{"digests":{"sha256":"cca01b5bd1ff6181b1db9209d77f3e7faf3b8a399a21631543e782d58ffbf35a"},"paths":["lib/Socket/newsletter.js"]},{"digests":{"sha256":"cf6c5a6b325c4e5a68fe43dd9d83002e1f19e1b522090540ff84e0b35e4fddab"},"paths":["lib/Socket/newsletter.js"]}],"ips":[],"urls":[]}},"credits":[{"name":"CyberXYZ","contact":["https://cyberxyz.io"],"type":"FINDER"}]}
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-18830","published":"2026-10-27T00:00:00Z","modified":"2026-11-11T02:30:05.223569772Z","aliases":["GHSA-wf3c-x3cj-jjqq"],"summary":"Malicious code in @fadelsm/baileys (npm)","details":"@fadelsm/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel ID(s) 120363400362472743@newsletter, 120363406524087186@newsletter, 120363407144637058@newsletter, 120363408367338249@newsletter, 120363409508273158@newsletter, 12036340982021544@newsletter and 4 more (stored as character-code arrays), using the victim's authenticated session and without telling them. Same behaviour as the PhantomSub family (MAL-2026-17342).\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (f80e051ed0ff14355e74f63440e3a822906ea192ae9a33d99c0db99517cc7278)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"@fadelsm/baileys","ecosystem":"npm","purl":"pkg:npm/%40fadelsm/baileys"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["7.0.1","7.0.2","7.0.3","7.0.4","7.0.5","7.0.6","7.0.7","7.0.8","7.0.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@fadelsm/baileys/MAL-2026-18830.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@fadelsm/baileys"},{"type":"WEB","url":"https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wf3c-x3cj-jjqq"}],"database_specific":{"iocs":{"domains":[],"files":[{"digests":{"sha256":"6124f083369ee555d0d0b32a9702f3f4c0008e4cac4a03195081e861e61297d4"},"paths":["lib/Socket/newsletter.js"]},{"digests":{"sha256":"71dfb4222ed6acd3f788c1e7fd58548e1a631d3b41256ba37b9b19c10d7b65d4"},"paths":["lib/Socket/newsletter.js"]},{"digests":{"sha256":"8ce0541a2fa8de1851064d401c13d8d7546e3bc347746ca969199a5aac48b850"},"paths":["lib/Socket/newsletter.js"]},{"digests":{"sha256":"bdf0161f9e9e7f14d77a8049da5cad6876c64882899f55b59875d3c9088b1676"},"paths":["lib/Socket/newsletter.js"]},{"digests":{"sha256":"cca01b5bd1ff6181b1db9209d77f3e7faf3b8a399a21631543e782d58ffbf35a"},"paths":["lib/Socket/newsletter.js"]},{"digests":{"sha256":"cf6c5a6b325c4e5a68fe43dd9d83002e1f19e1b522090540ff84e0b35e4fddab"},"paths":["lib/Socket/newsletter.js"]}],"ips":[],"urls":[]},"malicious-packages-origins":[{"id":"GHSA-wf3c-x3cj-jjqq","import_time":"2026-11-11T02:21:06.369579088Z","modified_time":"2026-11-11T01:29:44Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"f80e051ed0ff14355e74f63440e3a822906ea192ae9a33d99c0db99517cc7278","source":"ghsa-malware"}]},"credits":[{"name":"CyberXYZ","contact":["https://cyberxyz.io"],"type":"FINDER"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19104","published":"2026-11-11T00:56:31Z","modified":"2026-11-11T01:30:04.202933342Z","aliases":["GHSA-w3r9-3pw6-qg6q"],"summary":"Malicious code in rex-react-diag-tools-v1 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (aed5165f50b2beb552e0472d6c4edaad82d46104ffe7f1c2e5ffebd9f0e89399)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"rex-react-diag-tools-v1","ecosystem":"npm","purl":"pkg:npm/rex-react-diag-tools-v1"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/rex-react-diag-tools-v1/MAL-2026-19104.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-w3r9-3pw6-qg6q"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-w3r9-3pw6-qg6q","import_time":"2026-11-11T01:16:44.067768437Z","modified_time":"2026-11-11T00:56:32Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"aed5165f50b2beb552e0472d6c4edaad82d46104ffe7f1c2e5ffebd9f0e89399","source":"ghsa-malware"}]}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19105","published":"2026-11-11T01:29:42Z","modified":"2026-11-11T02:30:05.177738400Z","aliases":["GHSA-7gq6-hj7j-wgh8"],"summary":"Malicious code in @fadelsm/libsignal-node (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (aff0386ff1ec2f5430a6ecadff8bcb770bb30ee67dfea1bfb8e22d702f9227a7)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"@fadelsm/libsignal-node","ecosystem":"npm","purl":"pkg:npm/%40fadelsm/libsignal-node"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@fadelsm/libsignal-node/MAL-2026-19105.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-7gq6-hj7j-wgh8"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-7gq6-hj7j-wgh8","import_time":"2026-11-11T02:21:06.328312284Z","modified_time":"2026-11-11T01:29:42Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"aff0386ff1ec2f5430a6ecadff8bcb770bb30ee67dfea1bfb8e22d702f9227a7","source":"ghsa-malware"}]}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19106","published":"2026-11-11T01:20:39Z","modified":"2026-11-11T02:30:05.194303187Z","aliases":["GHSA-hf56-v7wj-mjc9"],"summary":"Malicious code in pt-logger-telemetry-eax0x1 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (858ddb3c9812cdc7939d412116506a7a4613611f13958f1a1fefdf91bfc299f8)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"pt-logger-telemetry-eax0x1","ecosystem":"npm","purl":"pkg:npm/pt-logger-telemetry-eax0x1"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pt-logger-telemetry-eax0x1/MAL-2026-19106.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hf56-v7wj-mjc9"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-hf56-v7wj-mjc9","import_time":"2026-11-11T02:21:06.361267707Z","modified_time":"2026-11-11T01:20:41Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"858ddb3c9812cdc7939d412116506a7a4613611f13958f1a1fefdf91bfc299f8","source":"ghsa-malware"}]}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19107","published":"2026-11-11T01:41:29Z","modified":"2026-11-11T02:30:05.187514495Z","aliases":["GHSA-v9xg-mgjf-74xm"],"summary":"Malicious code in yummy-bolts (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (0033b56430d000f0165fce7fa13288fe5c4eec20456e47076f76d52c2d456a53)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"yummy-bolts","ecosystem":"npm","purl":"pkg:npm/yummy-bolts"},"versions":["1.4.0","1.3.1","1.3.0","1.2.0","1.1.0","1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/yummy-bolts/MAL-2026-19107.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-v9xg-mgjf-74xm"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-v9xg-mgjf-74xm","import_time":"2026-11-11T02:21:06.367803444Z","modified_time":"2026-11-11T01:41:30Z","sha256":"0033b56430d000f0165fce7fa13288fe5c4eec20456e47076f76d52c2d456a53","source":"ghsa-malware","versions":["1.4.0","1.3.1","1.3.0","1.2.0","1.1.0","1.0.0"]}]}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19108","published":"2026-11-03T14:17:26Z","modified":"2026-11-11T04:15:05.495656773Z","summary":"Malicious code in raiden-baileys (npm)","details":"Malicious package. `raiden-baileys` is a trojanized fork of the Baileys WhatsApp library (@whiskeysockets/baileys). on connection it issues an authenticated `w:mex` newsletter FOLLOW mutation (query_id 7871414976211147) that silently subscribes every victim to attacker-controlled WhatsApp channels — hardcoded newsletter JIDs: 120363407277177688@newsletter, 120363407702752541@newsletter, 120363411769951302@newsletter. Legitimate Baileys never hardcodes a channel JID or auto-follows on connect; all published versions are malicious.","affected":[{"package":{"name":"raiden-baileys","ecosystem":"npm","purl":"pkg:npm/raiden-baileys"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["0.0.0-stage","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/raiden-baileys/MAL-2026-19108.json"}}],"references":[{"type":"WEB","url":"https://wormsign.io/portfolio/raiden-baileys/"}],"database_specific":{"iocs":{}},"credits":[{"name":"wormsign","contact":["https://x.com/w0rmsign"],"type":"FINDER"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19109","published":"2026-11-03T14:18:12Z","modified":"2026-11-11T04:30:05.421619460Z","summary":"Malicious code in @lekzsync/baileys (npm)","details":"Malicious package. `@lekzsync/baileys` is a trojanized fork of the Baileys WhatsApp library (@whiskeysockets/baileys). it silently subscribes every victim (via the injected WhatsApp newsletter/channel FOLLOW on connect) to attacker-controlled WhatsApp channels — hardcoded newsletter JIDs: 120363399602691477@newsletter, 120363421563597486@newsletter. Legitimate Baileys never hardcodes a channel JID or auto-follows on connect; all published versions are malicious.","affected":[{"package":{"name":"@lekzsync/baileys","ecosystem":"npm","purl":"pkg:npm/%40lekzsync%2Fbaileys"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["0.0.0-stage","1.0.5"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@lekzsync/baileys/MAL-2026-19109.json"}}],"references":[{"type":"WEB","url":"https://wormsign.io/portfolio/@lekzsync/baileys/"}],"database_specific":{"iocs":{}},"credits":[{"name":"wormsign","contact":["https://x.com/w0rmsign"],"type":"FINDER"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19110","published":"2026-11-11T04:07:10Z","modified":"2026-11-11T04:30:05.427668488Z","aliases":["GHSA-rq54-jmqc-j8qj"],"summary":"Malicious code in @solana-trade/core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (f9176979cfaf900e7e7daa2c479895c66659c6239842ae8c33a8fac2a76a090f)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"@solana-trade/core","ecosystem":"npm","purl":"pkg:npm/%40solana-trade/core"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@solana-trade/core/MAL-2026-19110.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-rq54-jmqc-j8qj"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-rq54-jmqc-j8qj","import_time":"2026-11-11T04:19:18.173540254Z","modified_time":"2026-11-11T04:07:11Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"f9176979cfaf900e7e7daa2c479895c66659c6239842ae8c33a8fac2a76a090f","source":"ghsa-malware"}]}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19111","published":"2026-11-11T04:07:10Z","modified":"2026-11-11T04:30:05.422765083Z","aliases":["GHSA-cm5x-2764-c8p9"],"summary":"Malicious code in chalks-log (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (0989c6b31e99988848556608782ed4e28d21b14b9360324463765752195636d2)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"chalks-log","ecosystem":"npm","purl":"pkg:npm/chalks-log"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chalks-log/MAL-2026-19111.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-cm5x-2764-c8p9"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-cm5x-2764-c8p9","import_time":"2026-11-11T04:19:18.166115677Z","modified_time":"2026-11-11T04:07:11Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"0989c6b31e99988848556608782ed4e28d21b14b9360324463765752195636d2","source":"ghsa-malware"}]}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19112","published":"2026-11-11T03:52:30Z","modified":"2026-11-11T04:30:05.419737112Z","aliases":["GHSA-8cvx-wq76-pcwg"],"summary":"Malicious code in kbmathlessons (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (d751bbc7fdf5dfe21c87f18a21fbc1a35c748605158ac6e36b2188989c1e1046)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"kbmathlessons","ecosystem":"npm","purl":"pkg:npm/kbmathlessons"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/kbmathlessons/MAL-2026-19112.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-8cvx-wq76-pcwg"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-8cvx-wq76-pcwg","import_time":"2026-11-11T04:19:18.165120837Z","modified_time":"2026-11-11T03:52:31Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"d751bbc7fdf5dfe21c87f18a21fbc1a35c748605158ac6e36b2188989c1e1046","source":"ghsa-malware"}]}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19113","published":"2026-11-11T04:07:10Z","modified":"2026-11-11T04:30:05.426707884Z","aliases":["GHSA-7m86-chx9-8rr7"],"summary":"Malicious code in prettlog (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (c9360f4fd522539accffc042d86ef137413d37ca411e10caf0546e5523c4649f)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"prettlog","ecosystem":"npm","purl":"pkg:npm/prettlog"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/prettlog/MAL-2026-19113.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-7m86-chx9-8rr7"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-7m86-chx9-8rr7","import_time":"2026-11-11T04:19:18.164355052Z","modified_time":"2026-11-11T04:07:10Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"c9360f4fd522539accffc042d86ef137413d37ca411e10caf0546e5523c4649f","source":"ghsa-malware"}]}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19114","published":"2026-11-11T04:07:10Z","modified":"2026-11-11T04:30:05.419664594Z","aliases":["GHSA-727x-2mvh-8r5c"],"summary":"Malicious code in termchalk (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (b41f585c4e82520cf84ca20367823520bced473a6fbc03f50ab77c7c5bb83e77)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"termchalk","ecosystem":"npm","purl":"pkg:npm/termchalk"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/termchalk/MAL-2026-19114.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-727x-2mvh-8r5c"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-727x-2mvh-8r5c","import_time":"2026-11-11T04:19:18.101987731Z","modified_time":"2026-11-11T04:07:10Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"b41f585c4e82520cf84ca20367823520bced473a6fbc03f50ab77c7c5bb83e77","source":"ghsa-malware"}]}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19115","published":"2026-11-03T14:18:58Z","modified":"2026-11-11T04:30:05.424272107Z","summary":"Malicious code in @zhengliyoux/baileys (npm)","details":"Malicious package. `@zhengliyoux/baileys` is a trojanized fork of the Baileys WhatsApp library (@whiskeysockets/baileys). it silently subscribes every victim (via the injected WhatsApp newsletter/channel FOLLOW on connect) to attacker-controlled WhatsApp channels — hardcoded newsletter JIDs: 120363430894218102@newsletter. Legitimate Baileys never hardcodes a channel JID or auto-follows on connect; all published versions are malicious.","affected":[{"package":{"name":"@zhengliyoux/baileys","ecosystem":"npm","purl":"pkg:npm/%40zhengliyoux%2Fbaileys"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["0.0.0-stage","1.0.2","1.0.3","1.0.4"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zhengliyoux/baileys/MAL-2026-19115.json"}}],"references":[{"type":"WEB","url":"https://wormsign.io/portfolio/@zhengliyoux/baileys/"}],"database_specific":{"iocs":{}},"credits":[{"name":"wormsign","contact":["https://x.com/w0rmsign"],"type":"FINDER"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.7.5","id":"MAL-2026-2907","published":"2026-04-16T02:50:55Z","modified":"2026-04-23T21:21:34.761597Z","summary":"Malicious code in nj-logger (npm)","details":"nj-logger is a malicious npm package that when imported in file dist/logger/telemetry.js downloads a trojan (for Windows only, W64.AIDetectMalware / Trojan.Malware.300983.susgen) from http://178.128.88[.]40:8080/download/svc to path node_modules/.cache/nj-logger/nj-transport-win32-x64.node and executes it. Downloader is obfuscated as telemetry module, urls & paths are base64 and XOR encoded.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (35414b2bda6d20336301bfdc5c0147a6434ee0e712f1fd5962a61ef34d6e53e9)\nThe package nj-logger was found to contain malicious code.\n","affected":[{"package":{"name":"nj-logger","ecosystem":"npm","purl":"pkg:npm/nj-logger"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nj-logger/MAL-2026-2907.json"}}],"database_specific":{"iocs":{"urls":["http://178.128.88.40:8080/download/svc"]},"malicious-packages-origins":[{"import_time":"2026-04-23T20:49:04.387597334Z","modified_time":"2026-04-23T20:43:56Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"35414b2bda6d20336301bfdc5c0147a6434ee0e712f1fd5962a61ef34d6e53e9","source":"amazon-inspector"}]},"credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"indece","contact":["https://indece.com"],"type":"FINDER"}]}
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-2907","published":"2026-04-16T02:50:55Z","modified":"2026-11-11T01:30:04.260793519Z","aliases":["GHSA-6q28-3q3p-8x7c"],"summary":"Malicious code in nj-logger (npm)","details":"nj-logger is a malicious npm package that when imported in file dist/logger/telemetry.js downloads a trojan (for Windows only, W64.AIDetectMalware / Trojan.Malware.300983.susgen) from http://178.128.88[.]40:8080/download/svc to path node_modules/.cache/nj-logger/nj-transport-win32-x64.node and executes it. Downloader is obfuscated as telemetry module, urls & paths are base64 and XOR encoded.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (35414b2bda6d20336301bfdc5c0147a6434ee0e712f1fd5962a61ef34d6e53e9)\nThe package nj-logger was found to contain malicious code.\n\n## Source: ghsa-malware (1d4672fb4d84dc0356e950e69c102c85477dbf05fffc2991a5bf974e3dd88ef6)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"nj-logger","ecosystem":"npm","purl":"pkg:npm/nj-logger"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nj-logger/MAL-2026-2907.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6q28-3q3p-8x7c"}],"database_specific":{"iocs":{"urls":["http://178.128.88.40:8080/download/svc"]},"malicious-packages-origins":[{"import_time":"2026-04-23T20:49:04.387597334Z","modified_time":"2026-04-23T20:43:56Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"35414b2bda6d20336301bfdc5c0147a6434ee0e712f1fd5962a61ef34d6e53e9","source":"amazon-inspector"},{"id":"GHSA-6q28-3q3p-8x7c","import_time":"2026-11-11T01:16:44.035958687Z","modified_time":"2026-11-11T00:53:19Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"1d4672fb4d84dc0356e950e69c102c85477dbf05fffc2991a5bf974e3dd88ef6","source":"ghsa-malware"}]},"credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"indece","contact":["https://indece.com"],"type":"FINDER"}]}
|
||||
Reference in New Issue
Block a user