vuln-osv update 2026-11-13T18:44:15Z

data/PyPI/GHSA-6655-6qjp-jx7x.json

@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-6655-6qjp-jx7x","published":"2026-11-13T16:39:43Z","modified":"2026-11-13T16:45:03.387641194Z","aliases":["CVE-2026-126191"],"summary":"Soup Sieve: Exponential ReDoS in selector compilation via \\9-run in CSS_ESCAPES/IDENTIFIER","details":"### Summary\nThe IDENTIFIER/CSS_ESCAPES regex (css_parser.py:119-124) exhibits exponential backtracking on a run of ambiguous digit-escapes (`\\9`) in an attribute-name or tag position of an otherwise well-formed selector. It fires at compile time (before the SELECTOR_LIMIT guard) via the public `soupsieve.compile()` and BeautifulSoup `.select()`.\n\n### PoC (verified on soupsieve 2.9.2)\n\n    import soupsieve as sv\n    sv.compile('[a' + '\\\\9'*26 + '=x]')   # ~57 bytes -> ~10s; ~16x time per +4 chars\n\n### Novelty\nDistinct from the patched GHSA-836r-... (VALUE regex) and GHSA-2wc2-... (comma-list) advisories, which are fixed in 2.9.2; this is a different regex/vector.\n\n### Reachability\nCSS selectors are usually developer-controlled, so exposure requires an application that compiles UNTRUSTED selector strings (web-scraping-as-a-service, no-code/query builders, user-defined extraction rules). Where selectors are user-supplied, a ~60-byte string hangs the worker.\n\n### Note\nThis issue was fixed in version 3.0.0, which has been yanked from the PyPI registry. Use versions 3.0.2 and above to upgrade.","affected":[{"package":{"name":"soupsieve","ecosystem":"PyPI","purl":"pkg:pypi/soupsieve"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2"}]}],"versions":["0.4","0.5","0.5.1","0.5.2","0.5.3","0.6","1.0","1.0.1","1.0.2","1.0b1","1.0b2","1.1","1.2","1.2.1","1.3","1.3.1","1.4","1.5","1.6","1.6.1","1.6.2","1.7","1.7.1","1.7.2","1.7.3","1.8","1.9","1.9.1","1.9.2","1.9.3","1.9.4","1.9.5","1.9.6","2.0","2.0.1","2.1","2.10","2.2","2.2.1","2.3","2.3.1","2.3.2","2.3.2.post1","2.4","2.4.1","2.5","2.6","2.7","2.8","2.8.1","2.8.2","2.8.3","2.8.4","2.9","2.9.1","2.9.2","3.0","3.0.1"],"database_specific":{"last_known_affected_version_range":"<= 2.10","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6655-6qjp-jx7x/GHSA-6655-6qjp-jx7x.json"}}],"references":[{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/security/advisories/GHSA-6655-6qjp-jx7x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126191"},{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/pull/300"},{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/commit/dbfa2854ff31a863326bd6660d4e55c6f068db9e"},{"type":"PACKAGE","url":"https://github.com/facelessuser/soupsieve"},{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/releases/tag/3.0"}],"database_specific":{"cwe_ids":["CWE-1333"],"github_reviewed":true,"github_reviewed_at":"2026-11-13T16:39:43Z","nvd_published_at":"2026-11-12T17:17:32Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}

data/PyPI/GHSA-7g44-g9rc-x53w.json

@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-7g44-g9rc-x53w","published":"2026-11-13T16:34:59Z","modified":"2026-11-13T16:45:03.468864320Z","aliases":["CVE-2026-126193"],"summary":"Soup Sieve: Uncontrolled recursion in CSS parser lets nested pseudo-class selectors exhaust the Python call stack","details":"## Summary\n\nThe Soup Sieve CSS selector parser recurses once per level of nested pseudo-class selector (`:is()`, `:not()`, `:where()`, `:has()`) without any limit on nesting depth. An unauthenticated attacker who can supply a CSS selector string to `soupsieve.compile()`, `soupsieve.select()`, or Beautiful Soup's `soup.select()` / `soup.select_one()` can force the parser to exceed Python's recursion limit with a small crafted input (about 1.6 KB, roughly 330 nesting levels), raising an uncontrolled `RecursionError`. Because this exception is not part of the parser's documented error contract, applications that catch only `ValueError` or `SelectorSyntaxError` see an unexpected failure of the request or task that parsed the selector.\n\n## Root Cause\n\nThe parser dispatches each opening pseudo-class token to `parse_pseudo_open`, which calls back into `parse_selectors` to parse the pseudo-class body. Every nesting level therefore adds Python stack frames, and no counter, depth guard, or `RecursionError` handler bounds this descent. The token-count guard `SELECTOR_LIMIT = 8192` (added for the earlier comma-separated-list memory issue) counts parsed tokens, not recursion depth; at the failing nesting depth the token count is only about 330, roughly four percent of that limit, so the guard never fires. The security invariant that untrusted selector input must not be able to exhaust interpreter resources is not enforced for nesting depth.\n\n```text\nsoupsieve/css_parser.py\n  CSSParser.parse_pseudo_open (line 985): sel.selectors.append(self.parse_selectors(iselector, index, flags))\n  CSSParser.parse_selectors  (line 1137): recursive target; dispatches pseudo-class tokens back into parse_pseudo_class -> parse_pseudo_open\n  CSSParser.increment_count  (lines 707-712): SELECTOR_LIMIT token guard; increments once per nesting level, cannot bound depth\n```\n\n## Impact\n\nAny application that compiles or evaluates untrusted CSS selectors through Soup Sieve (directly or via Beautiful Soup) is affected. No authentication, privilege, or user interaction is required; the failure occurs during selector parsing, before any document is matched. A single crafted selector of about 1.6 KB reliably raises `RecursionError`. The demonstrated capability is a transient denial of the individual request, task, or invocation that parsed the malicious selector: the exception propagates uncaught unless the caller handles `RecursionError` (or a broad `except Exception`). The `RecursionError` in CPython 3.x is a recoverable stack unwind, not an interpreter crash or persistent resource exhaustion, and it carries no confidentiality or integrity impact. Applications following the parser's documented error pattern (catching `ValueError` / `SelectorSyntaxError`) will not catch it, so a repeated stream of such selectors can plausibly cause repeated per-request failures; this per-request availability effect is the demonstrated consequence, not a service-wide or amplified outage.\n\n## Proof of Concept\n\nRequires only an installed Soup Sieve (any release from 0.4 through 2.10) and a default CPython recursion limit of 1000. No Beautiful Soup document or network setup is needed.\n\n```python\nimport soupsieve as sv\n\n# ~330 levels of nested :is() around a single tag: about 1.6 KB of input.\ndepth = 330\nselector = \":is(\" * depth + \"a\" + \")\" * depth\nprint(\"selector length:\", len(selector))\nsv.compile(selector)\n```\n\n```text\nselector length: 1651\nTraceback (most recent call last):\n  ...\n  File \".../soupsieve/css_parser.py\", line 985, in parse_pseudo_open\n    sel.selectors.append(self.parse_selectors(iselector, index, flags))\nRecursionError: maximum recursion depth exceeded\n```\n\nThe same failure was reproduced with `:not()`, `:where()`, and `:has()`, and through `BeautifulSoup(...).select(selector)`. A negative control at depth 100 compiles successfully with a token count of 101, confirming the token guard is far from firing.\n\n## Attack Chain\n\n1. **Exposure:** The application exposes `soupsieve.compile()` / `select()` or Beautiful Soup's `.select()` / `.select_one()` to attacker-influenced CSS selector input. These are the library's primary public API and ship enabled by default; Soup Sieve is an automatic dependency of Beautiful Soup 4.\n2. **Control:** The attacker fully controls the selector string. The nested pseudo-class pattern (`:is(:is(...a...))`) survives tokenization and normalization unchanged.\n3. **Path:** `compile()` reaches `CSSParser.process_selectors()` and then `parse_selectors()`, which dispatches each pseudo-class token through `parse_pseudo_class()` into `parse_pseudo_open()`, which calls `parse_selectors(Line truncated

data/PyPI/GHSA-jv6m-48w5-5rpr.json

@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-jv6m-48w5-5rpr","published":"2026-11-13T18:05:15Z","modified":"2026-11-13T18:15:07.541730589Z","aliases":["CVE-2026-128079"],"summary":"envd: Host file disclosure through requirements path traversal and TOCTOU","details":"### Summary\n\nenvd’s `install.python_packages(requirements=...)` could read files outside the build context on the host. Content interpreted as dependency entries could appear in build logs and build-step metadata.\n\nCommit f576c92, released in v1.3.5, added path containment validation but left a time-of-check/time-of-use (TOCTOU) race between symlink resolution and opening the requirements file. Commit 9d575b3 addresses this race by opening requirements files through a directory-rooted filesystem handle.\n\n### Details\n\nenvd reads requirements files on the host to determine whether their contents can be embedded directly into a pip installation build step.\n\nThe vulnerable host-side requirements read was introduced in v0.3.38. Version v1.3.5 added containment checks for static path escapes but remained vulnerable to a TOCTOU race. The complete fix is included in v1.3.6.\n\nBefore f576c92, this host read lacked a build-context containment check. That commit added frontend path validation and a compile-time check using filepath.EvalSymlinks followed by a containment comparison.\n\nHowever, symlink resolution returns a pathname rather than a pinned filesystem object. The subsequent os.Open independently resolves that pathname. Concurrent filesystem changes could therefore invalidate the containment check before the file was opened.\n\nThe complete fix uses os.OpenRoot and Root.Open to enforce containment during filesystem traversal.\n\nResources:\n- first commit: be783264fdd79ad7262cea0485b7d449ca514f80\n- Initial containment fix: f576c92\n- TOCTOU fix: 9d575b3\n\n### Proof of concept\n\nThe security-relevant condition is a requirements-file pathname whose filesystem resolution changes between validation and opening. The containment check describes the filesystem at validation time, while the later pathname-based open may access a different object.\n\nThe fix includes a deterministic regression test for the underlying object-pinning guarantee. It opens a context directory handle, moves that directory, and creates a replacement directory at the original pathname containing different requirements. The rooted reader continues reading the original context; a pathname-based reader reads the replacement.\n\nThis regression test demonstrates the distinction between rooted and pathname-based reads. It is not an end-to-end demonstration of host file disclosure.\n\n### Impact\n\nAn attacker who can influence the build input—and, for the residual race in v1.3.5, concurrently modify the relevant filesystem paths—may cause envd to read files outside the intended build context, subject to the permissions of the envd process.\n\nDepending on the file contents and requirements parsing, information may be exposed through dependency debug logs and build-step metadata. This issue does not establish arbitrary code execution or unrestricted disclosure of every file.\n\nv1.3.5 remains affected by the TOCTOU variant. Earlier versions containing the host requirements-reading behavior are affected by the original containment issue; confirm the earliest affected release before setting the advisory’s version range.\n\nPatched version: v1.3.6.","affected":[{"package":{"name":"envd","ecosystem":"PyPI","purl":"pkg:pypi/envd"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.38"},{"fixed":"1.3.6"}]}],"versions":["0.3.38","0.3.39","0.3.40","0.3.42","0.3.43","0.3.44","0.3.45","0.3.46","0.3.47","0.4.0","0.4.1","0.4.3","1.0.0a2","1.0.0a3","1.0.1","1.1.0","1.2.0","1.2.1","1.2.6","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-jv6m-48w5-5rpr/GHSA-jv6m-48w5-5rpr.json"}}],"references":[{"type":"WEB","url":"https://github.com/tensorchord/envd/security/advisories/GHSA-jv6m-48w5-5rpr"},{"type":"WEB","url":"https://github.com/tensorchord/envd/pull/2112"},{"type":"WEB","url":"https://github.com/tensorchord/envd/pull/2119"},{"type":"WEB","url":"https://github.com/tensorchord/envd/commit/9d575b354ce17a02ef9698b6ff0d5d14296c5734"},{"type":"WEB","url":"https://github.com/tensorchord/envd/commit/f576c92c1e6dcb9b00b60995534aeb2a83b0b407"},{"type":"PACKAGE","url":"https://github.com/tensorchord/envd"},{"type":"WEB","url":"https://github.com/tensorchord/envd/releases/tag/v1.3.6"}],"database_specific":{"cwe_ids":["CWE-22","CWE-367"],"github_reviewed":true,"github_reviewed_at":"2026-11-13T18:05:15Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}

data/PyPI/GHSA-mf5v-w3w3-f6cg.json

@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-mf5v-w3w3-f6cg","published":"2026-11-13T16:43:18Z","modified":"2026-11-13T17:00:03.925479166Z","aliases":["CVE-2026-126360"],"summary":"OpenTelemetry Python API: Denial of service through quadratic-time traceparent parsing","details":"## Summary\n\n`TraceContextTextMapPropagator.extract()` in `opentelemetry-api` is vulnerable to regular expression denial of service (ReDoS) when processing a specially crafted `traceparent` value.\n\nA malformed value containing a trace-context prefix followed by a long whitespace sequence and an embedded newline triggers quadratic-time regex backtracking. Applications that extract trace context from untrusted carriers accepting such strings can experience excessive CPU consumption and request-processing delays.\n\nWhen extraction runs on an asynchronous server’s event-loop thread, a single malicious message can delay unrelated requests handled by that event loop.\n\n## Exposure conditions\n\nExploitation requires attacker-controlled input to reach the affected propagator through a carrier that preserves embedded newlines and permits a sufficiently large value.\n\nConforming HTTP header values cannot contain embedded newlines. However, OpenTelemetry carriers are not restricted to HTTP headers. JSON strings can contain escaped newlines that become newline characters after decoding.\n\nMCP request metadata is one relevant integration path: applications may extract trace context from JSON `params._meta`. Exposure depends on the MCP SDK or instrumentation version, whether extraction invokes the W3C Trace Context propagator, and applicable message-size limits. HTTP header validation does not constrain a `traceparent` string carried inside a JSON body.\n\nAuthentication requirements depend on the application exposing the carrier.\n\n## Impact\n\nThe demonstrated impact is denial of service through excessive CPU consumption and blocked request processing. Repeated malicious messages may sustain service degradation.\n\nThis finding does not demonstrate data disclosure, data modification, or code execution.\n\n## Remediation\n\nUpgrade `opentelemetry-api` to `1.45.2` or a later release containing the fix.\n\nVersion `1.45.2` rejects `traceparent` values longer than 512 characters before regex matching and removes the overlapping suffix and trailing-whitespace expressions.\n\nWhere upgrading is temporarily unavailable, reject oversized values and embedded CR/LF characters before passing untrusted trace-context values to the affected propagator.","affected":[{"package":{"name":"opentelemetry-api","ecosystem":"PyPI","purl":"pkg:pypi/opentelemetry-api"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.45.2"}]}],"versions":["0.10b0","0.11b0","0.12b0","0.13b0","0.14b0","0.15b0","0.16b0","0.16b1","0.17b0","0.1a0","0.2a0","0.3a0","0.4a0","0.4a1","0.5b0","0.6b0","0.7b0","0.7b1","0.8b0","0.9b0","1.0.0","1.0.0rc1","1.1.0","1.10.0","1.10a0","1.11.0","1.11.1","1.12.0","1.12.0rc1","1.12.0rc2","1.13.0","1.14.0","1.15.0","1.16.0","1.17.0","1.18.0","1.19.0","1.2.0","1.20.0","1.21.0","1.22.0","1.23.0","1.24.0","1.25.0","1.26.0","1.27.0","1.28.0","1.28.1","1.28.2","1.29.0","1.3.0","1.30.0","1.31.0","1.31.1","1.32.0","1.32.1","1.33.0","1.33.1","1.34.0","1.34.1","1.35.0","1.36.0","1.37.0","1.38.0","1.39.0","1.39.1","1.4.0","1.4.1","1.40.0","1.41.0","1.41.1","1.42.0","1.42.1","1.43.0","1.44.0","1.45.0","1.45.1","1.5.0","1.6.0","1.6.1","1.6.2","1.7.0","1.7.1","1.8.0","1.9.0","1.9.1"],"database_specific":{"last_known_affected_version_range":"<= 1.45.1","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-mf5v-w3w3-f6cg/GHSA-mf5v-w3w3-f6cg.json"}}],"references":[{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-mf5v-w3w3-f6cg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126360"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-python/pull/5818"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-python/pull/5856"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-python/commit/78123a2755c907c602e02352aebed4be86aa5350"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-python/commit/faa72dae511ae64a7bf8ca63eff9ad4387d0b939"},{"type":"PACKAGE","url":"https://github.com/open-telemetry/opentelemetry-python"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.2"}],"database_specific":{"cwe_ids":["CWE-1333"],"github_reviewed":true,"github_reviewed_at":"2026-11-13T16:43:18Z","nvd_published_at":"2026-11-13T00:20:11Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}

data/PyPI/MAL-2026-19247.json

@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"MAL-2026-19247","published":"2026-11-13T17:50:00Z","modified":"2026-11-13T18:15:06.673106723Z","summary":"Malicious code in testing1345 (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (15bab830cd8343859ac220ef87e821719169a4e2ccb50da37032d97ef02c27dd)\nDuring installation, the package downloads and executes a script from a remote location. The server delivers different payload versions, some of them being benign, and others containing next-stage installation. The final payload is a RAT.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-testing1345\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote malicious script.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n - rat\n","affected":[{"package":{"name":"testing1345","ecosystem":"PyPI","purl":"pkg:pypi/testing1345"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/testing1345/MAL-2026-19247.json"}}],"references":[{"type":"EVIDENCE","url":"https://tria.ge/261113-wal5qset2s"},{"type":"EVIDENCE","url":"https://www.virustotal.com/gui/file/ce97b675a86bfff5e73e218e8d9d17458857d2328b1b55acd87f644001ca865f/detection"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/testing1345"}],"database_specific":{"iocs":{"domains":["helper-exe.vercel.app"],"urls":["https://helper-exe.vercel.app/hello.bat","https://file.garden/autlsl_4glu4x2U5/c_b8a1b1.zip","https://file.garden/autlsl_4glu4x2U5/m_7cf722","https://pomf2.lain.la/f/qj4sh0sj.png"]},"malicious-packages-origins":[{"id":"pypi/2026-11-testing1345/testing1345","import_time":"2026-11-13T18:12:41.089861858Z","modified_time":"2026-11-13T17:50:00.683461Z","sha256":"15bab830cd8343859ac220ef87e821719169a4e2ccb50da37032d97ef02c27dd","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}