Supply Chain · Watch Friday · 24 July 2026 End-of-day synthesis 4 watches · 34 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — A fourth critical landed after First Watch — npm shell-escaping library Shescape ships its own shell-injection bypass on Windows CMD — capping a day that already saw seven criticals across Budibase and OpenAM/OpenDJ.

The day's shape locked at First Watch around a single ~50-advisory GHSA publish run: Budibase took three criticals (SQL injection, cross-origin credential leak, OIDC account-takeover) and the ForgeRock-descended OpenAM/OpenDJ identity stack took two unauthenticated RCEs, on top of a morning that opened with a fake corepack.org infostealer campaign and a critical SCIM account-takeover in better-auth.

Late escalation at 21:00 ET: the same GHSA feed kept firing for another forty minutes past First Watch and added a fourth critical. Shescape — an npm library that exists specifically to make shell arguments safe — misses unescaped parentheses when the configured shell is Windows CMD, letting a crafted payload survive `escape()`/`escapeAll()` and execute as a conditional command block; that's the worst-case failure mode for a security-hardening library. The same window added five high-severity batches: two AWS-authored fixes (an API MCP Server security-policy fail-open, and a Bedrock AgentCore Code Interpreter sandbox escape via argument injection), a pair of etcd bugs that reach Kubernetes control planes, three HTTP request-smuggling primitives in http4s-blaze-server, a template-injection RCE in Oh My Posh's default prompt config, and three path-isolation breaks in OpenList.

→ Operational priority for the night if you run Bedrock AgentCore, patch to 1.18.1 first — a sandbox escape in an agent's own code-execution tool defeats the reason sandboxing exists. Everyone else, work down the list in order: Shescape to 2.1.14/3.0.1 if any Windows CMD shell is in your build path, then etcd if it backs a Kubernetes control plane, then Budibase and OpenAM/OpenDJ from First Watch if you haven't already.

21:00 ET · Last Watch

Critical · GHSA · critical · npm · shescape — CMD shell-injection escape bypass, 4-advisory batch ·added 21:00 ET

Shescape: a shell-escaping library ships a shell-injection bypass on its own Windows/CMD path, plus three narrower disclosures

Shescape exists to make shell arguments safe, and its `escape`/`escapeAll` APIs miss unescaped parentheses when the configured shell is Windows CMD — a payload like `x) else if a==a (echo y)` survives escaping and executes as a conditional command block (GHSA-w4hw, patched in 2.1.14/3.0.1). That's the worst-case shape for a security library: a bypass in the exact primitive callers trust to be safe. The same release also fixes a quadratic-time DoS in the flag-protection path (GHSA-gm3r, high) and two lower-severity information-disclosure bugs on Unix Zsh/Dash (GHSA-6v4m, GHSA-q53c, both medium). If you call Shescape with `shell: 'cmd.exe'` or a default-CMD `shell: true` anywhere in a Windows build pipeline, upgrade to 2.1.14 or 3.0.1 tonight.

High · GHSA · high · AWS — API MCP Server policy fail-open + Bedrock AgentCore sandbox escape ·added 21:00 ET

Two AWS-authored high-severity fixes land back to back: MCP server security policy silently disabled on startup failure, AgentCore sandbox escape via argument injection

aws-api-mcp-server has a fail-open bug: if the data backing its optional deny/gate security policy fails to load at startup, the per-request policy check is silently skipped for the life of the process while IAM permissions stay in effect underneath it — patch to 1.3.47, or scope credentials to least privilege as a stopgap (GHSA-29w2, CVSS 7.0). Separately, bedrock-agentcore's Python SDK `install_packages()` doesn't neutralize argument delimiters, so a remote authenticated user who can influence package-name arguments gets arbitrary command execution inside the Code Interpreter sandbox — patch to 1.18.1, and until then never pass untrusted or model-generated strings into `install_packages()` (GHSA-j6g5, CVSS 7.3). If you're running AgentCore-based agents, patch this one first — a sandbox escape via a code-execution tool is exactly the failure mode agent sandboxing exists to prevent.

High · GHSA · high · Go · etcd — unbounded TLS handshake DoS + Watch API RBAC bypass ·added 21:00 ET

etcd gets two high-severity fixes: a memory-exhaustion DoS via stalled TLS handshakes, and a Watch API authorization bypass that leaks beyond a granted key

A network attacker who can reach an etcd TLS listener can open connections and never send a ClientHello — each spawns a goroutine that blocks indefinitely in the handshake and is tracked in an unbounded map, exhausting memory and taking down the etcd process, and any Kubernetes control plane it backs (GHSA-6vch). Separately, a client granted READ on one exact key can use `clientv3.WithFromKey()` on the Watch gRPC API to receive events for every key lexicographically after it — an RBAC enforcement gap specific to Watch, not Range/Get/Delete, and only relevant on clusters with auth enabled (GHSA-xg4h). If etcd backs a Kubernetes control plane you operate, patch both; the DoS is reachable pre-auth.

High · GHSA · high · Scala · http4s-blaze-server — three request-smuggling/desync primitives ·added 21:00 ET

http4s-blaze-server: parser conformance gaps collapse into three advisories — request smuggling, trailer-header injection, and unbounded WebSocket aggregation

blaze's hand-written HTTP/1.1 parser disagrees with stricter front-end proxies on message boundaries in five distinct ways, the classic setup for request smuggling: front-end ACL bypass, response-queue poisoning, or cache poisoning depending on what's in front of it (GHSA-mhvj, CVSS 7.4). A second bug lets chunked-body trailer fields — attacker-controlled — get merged into `Request.headers`, so an unauthenticated client can forge `X-Forwarded-For` or internal-auth headers a fronting proxy already stripped from the header section (GHSA-46q4, CVSS 7.4). A third has no size or fragment-count limit on WebSocket message reassembly, so one connection can drive unbounded JVM heap growth to OOM (GHSA-7ppr, CVSS 7.5). All three are reachable on a default `BlazeServerBuilder` — if you front an http4s/blaze service with anything that also parses HTTP/1.1, patch now and don't rely on the proxy layer alone.

High · GHSA · high · Go · OpenList — three path-validation bypasses across rename, share, and search APIs ·added 21:00 ET

OpenList: the same non-separator-aware path check breaks isolation three different ways — rename, share links, and search metadata

Batch rename validates the destination directory but not `src_name`, so an authenticated user can rename files outside their base path with `../` traversal segments (GHSA-95cv, CVSS 7.6, high). The share-creation API has the identical class of bug — a path-prefix check that isn't separator-aware lets a user generate share links for files outside their assigned base directory, exposing arbitrary reads (GHSA-86cx, CVSS 6.5, medium). And the Bleve-backed search API leaks metadata/counts for sibling directories outside a user's BasePath via the same non-separator-aware prefix check (GHSA-p6ph, CVSS 4.3, medium). Three endpoints, one root cause — if you self-host OpenList for multi-tenant file storage, patch and re-test tenant isolation directly, not just the individual CVEs.

High · GHSA · high · Go · Oh My Posh — template-injection RCE in the default config, plus ANSI escape injection ·added 21:00 ET

Oh My Posh: a directory named with a Go template expression gets arbitrary command execution as soon as your shell is inside it

Oh My Posh re-renders the resolved path string — including raw folder names straight from the filesystem — through Go's `text/template` engine, whose function map exposes a `cmd` function that runs OS commands. A directory named with a template expression executes on prompt render, and the built-in default configuration is affected (GHSA-6xj8, CVSS 7.8). A separately-rooted bug fails to neutralize ANSI/OSC escape sequences in prompt segment data — path, git metadata, env vars, command output — letting an attacker-controlled value execute terminal escape sequences on every prompt render (GHSA-fwjx, CVSS 6.1). If you `cd` into untrusted archives or repos with Oh My Posh active, both are reachable with default config — patch before your next `git clone` of something you don't control.

Medium · GHSA · medium · mixed — six more late items, narrower footprint ·added 21:00 ET

Six more late-arriving advisories, noted for completeness — worth a lockfile scan, not an all-hands

Smithy-RS's default aws-smithy-http-server allocates resources without limits (GHSA-jvxp, high); libp2p's yamux transport has a DoS via oversized data frames (GHSA-hmj8, high); OmniFaces lets combined-resource IDs be forged, affecting output/push boundaries (GHSA-fp43, high); Quasar has prototype pollution in its `extend()` utility (GHSA-3r53, medium); kin-openapi's openapi3filter panics unauthenticated on a content-parameter with no schema (GHSA-jpcw, medium); and FrontMCP's OpenAPI adapter poller bypasses its own SSRF guard on periodic re-fetch (GHSA-8q49, medium). None individually critical — check dependency trees against this list rather than chasing each one separately.

18:00 ET · First Watch

Critical · GHSA · critical · npm · @budibase/server — 19-advisory disclosure batch, 3 critical ·added 18:00 ET

Budibase: nineteen advisories land in one batch — SQL injection, unauthenticated credential theft, and an OIDC account-takeover among three criticals

Budibase's low-code server shipped `multipleStatements: true` on its MySQL integration, giving any user who can reach that datasource full SQL injection (CVSS 9.6, GHSA-q6x4); a second flaw lets an unauthenticated caller resolve a REST datasource cross-origin and recover masked credentials in cleartext, reopening a vector an earlier fix (GHSA-3gp5) only partially closed (GHSA-mqhr); a third lets OIDC identities link to existing accounts by email with no `email_verified` check, handing account takeover to anyone who controls a same-address IdP registration (GHSA-hp6v). Sixteen more advisories in the same batch cover privilege escalation via the public role-assignment API, two separate NoSQL/Mongo injection paths, two SSRF-via-DNS-rebinding variants, an S3 presigned-URL authorization regression, and several IDOR/enumeration/token-leak bugs — the whole trust boundary between builder and end-user got restructured in one release. Patch @budibase/server to the current release across the board; don't cherry-pick just the critical CVEs, the SSRF and injection paths chain together.

Critical · GHSA · critical · maven · OpenAM + OpenDJ (Open Identity Platform) — four criticals in one window ·added 18:00 ET

OpenAM and OpenDJ (ForgeRock-descended identity stack) take two unauthenticated RCEs and two auth-bypasses in the same hour

OpenAM's `/authservice` endpoint resolves an attacker-supplied class name via `Class.forName` in `AuthXMLUtils.createCustomCallback` with no auth required — full unauthenticated RCE on default settings, CVSS 9.8, credited to an independent researcher at TikTok (GHSA-wg5r); a second OpenAM bug lets a WebAuthn `readObject` gadget chain execute pre-authentication because the deserialization allowlist only checks the root class, not the nested graph (GHSA-gf8h). OpenDJ, the companion LDAP directory, drew its own pair: the DSMLv2 gateway dereferences arbitrary `anyURI` values for SSRF against internal services and cloud metadata, local file read, and memory-exhaustion DoS (CVSS 9.4, GHSA-68r5), and a SASL PLAIN authzid path skips the proxy-scope ACI check entirely, letting an unauthenticated client impersonate any DN it names (CVSS 9.6, GHSA-p279). Anyone running this ForgeRock fork as SSO/directory infrastructure should treat all four as one incident: upgrade OpenAM to 16.1.2 and OpenDJ to 5.1.2, and until then block external access to `/authservice` and the DSMLv2 gateway.

Critical · GHSA · critical · npm · sm-crypto predictable SM2 key generation ·added 18:00 ET

sm-crypto: Node.js key generation defaults to Math.random() seeded by wall-clock time, making SM2 private keys guessable

sm-crypto's SM2 keypair generator falls back to `Math.random()` seeded by the system clock instead of a CSPRNG when run under Node.js (CVSS 9.1) — anyone who knows roughly when a key was generated can narrow the RNG state and brute-force the private key. sm-crypto implements China's SM2/SM3/SM4 national cryptographic standards and is the default choice for apps needing GB/T compliance, so this sits under signing and encryption paths, not just TLS. Rotate any SM2 keypairs generated with an affected version and patch immediately; treat existing keys as compromised if the generation time is discoverable from commit history or logs.

Critical · GHSA · critical · composer · Pheditor authentication bypass (CVSS 10) + terminal RCE bypass ·added 18:00 ET

Pheditor: forced password-change flow never checks the current password, and a second advisory reopens the terminal-RCE vector a prior patch tried to close

Pheditor's forced password-change flow accepts a new password without verifying the caller supplied the correct current one — full authentication bypass, CVSS 10.0 (GHSA-f25v). A second advisory in the same batch documents that the `php -r ...` terminal command-allowlist bypass fixed in v2.0.7 (GHSA-g3hq) has a surviving argument-injection vector to RCE that the metacharacter sanitization didn't cover. Patch to the current release for both; if you can't patch immediately, disable the terminal feature and force-expire all sessions.

High · GHSA · high · composer · Poweradmin — three advisories, same disclosure window ·added 18:00 ET

Poweradmin: OIDC subject collation lets an attacker resolve to a victim's session, plus an IDOR and a password-reset-to-superuser path

Poweradmin's OIDC link table used `utf8mb4_unicode_ci`, an accent-insensitive collation, for the `oidc_subject` column, so an attacker who registers `victím-login` with their own OIDC IdP password gets authenticated as the account holding `victim-login` — MySQL treats the two strings as equal (CVSS 8.1, GHSA-cmwh, credited to DEVCORE's internship program). The same batch adds an IDOR letting any zone owner modify DNS records in zones they don't own (CVSS 8.1) and an API user-update endpoint that lets a non-admin reset any user's password, including the superuser's (CVSS 8.8). Patch to 4.2.5 / 4.3.4 / 4.4.0 and run the included SQL migration — the OIDC fix requires a schema collation change, not just a code update.

High · GHSA · high · pip · Open WebUI — five advisories, terminal proxy identity spoofing leads ·added 18:00 ET

Open WebUI: terminal proxy trusts a client-supplied user ID, and a second advisory bypasses the path-traversal guard with 9x URL-encoding

Open WebUI's terminal proxy accepts a spoofable `X-User-Id` header and a `ws_terminal` session-ID query parameter with no integrity binding, so a caller can impersonate another user's terminal session (CVSS 8.0). A second advisory shows the terminal proxy's path-traversal guard only decodes standard URL encoding once, letting 9x-nested encoding walk past it (CVSS 7.7). Three medium advisories round out the batch: the `WEB_FETCH_FILTER_LIST` host allowlist is bypassable via path tricks and non-label-boundary matching, a model's `meta.knowledge` read-only file grant can be escalated to write/delete, and Arena task endpoints skip the underlying model's access controls. If you self-host Open WebUI with the terminal feature enabled, patch now and audit terminal session logs for cross-user access.

High · GHSA · high · npm · brace-expansion unbounded-expansion DoS ·added 18:00 ET

brace-expansion: a crafted pattern expands without bound and OOM-kills the process, CVSS 7.5

brace-expansion — the library minimatch, glob, and by extension npm's own tooling pull in transitively — has no cap on expansion length, so a pattern like `{a,b}{a,b}{a,b}...` nested deep enough grows combinatorially and exhausts memory before it ever finishes. Anything that runs glob matching or minimatch-style patterns against user-supplied strings (CI config, file-search UIs, package-manager tooling) is exposed by proxy even if it never imports brace-expansion directly. Patch to the fixed release and audit whether any user input reaches a glob/minimatch call without a length limit in front of it.

High · GHSA · high · pip · GitPython environment-variable exfiltration (incomplete prior fix) ·added 18:00 ET

GitPython: Repo.create_remote() / Remote.add() still leak environment variables through a crafted remote URL, closing a gap the original fix missed

GitPython's remote-add path passes a caller- or repo-controlled URL to git in a way that can exfiltrate environment variables — a follow-up to GHSA-rwj8-pgh3-r573, whose original fix didn't cover this code path (CVSS 7.5). GitPython sits underneath a lot of CI automation and increasingly agentic tooling that clones or configures repos programmatically from untrusted input (PR branches, webhook payloads, LLM-agent-supplied URLs); the exposure is bigger than it looks if your pipeline passes remote URLs through without validation. Patch to the fixed release and treat this as the second half of the earlier CVE, not a new class of bug.

Medium · GHSA · medium · go · Cloudreve — three advisories around OAuth Admin.Read scope ·added 18:00 ET

Cloudreve: the OAuth Admin.Read scope keeps turning out to authorize more than "read" across three separate endpoints

Three Cloudreve advisories in the same batch all trace to the same root cause — the `Admin.Read` OAuth scope, which should be read-only, actually authorizes state-changing actions: updating OneDrive storage-policy credentials (CVSS 7.1), writing files and ignoring the WOPI access-token secret in WOPI view sessions (CVSS 6.3), and triggering server-side node test requests (CVSS 5.4). If you've issued any OAuth tokens scoped to `Admin.Read` on the assumption they're read-only, revoke and reissue after patching — the scope name has been misleading since it was introduced.

Context · GHSA · context · mixed · narrower-blast-radius disclosures from the same batch ·added 18:00 ET

Nine more advisories from today's batch, noted for completeness — smaller footprint, still worth a scan of your dependency tree

react-server-dom (React Server Components) has a DoS in Server Functions (GHSA-wx67); frp's SSH tunnel gateway has an unauthenticated integer-overflow DoS (GHSA-26gq); webtransport-go buffers unknown capsules without a cap, enabling memory exhaustion (GHSA-g35j); swift-nio-http2 doesn't validate CR/LF/NUL in header values (GHSA-q3g2); vantage6 lets one algorithm developer edit another's pending algorithm (GHSA-47w6); the Rust `hubuum_client` library has three separate issues — diagnostics data exposure, bypassable custom transports, and base-path escape via redirects; Kite's Kubernetes proxy has a path-traversal RBAC bypass (GHSA-c534); and `@anephenix/hub` has an unauthenticated WebSocket RPC resource-exhaustion DoS (GHSA-g5vv). None individually critical — check your lockfiles against this list rather than chasing each CVE separately.

Context · The Hacker News · BlueNoroff (DPRK) Zoom/Teams phishing kit profiles crypto wallets before payload ·added 18:00 ET

BlueNoroff runs an active phishing kit impersonating Zoom/Teams via typosquat domains, profiling crypto wallets before dropping malware

North Korea's BlueNoroff is operating typosquatted Zoom and Microsoft Teams domains as a ClickFix-style social-engineering kit, using compromised industry contacts to build trust before profiling a target's crypto wallet holdings and then delivering malware. Not a package-compromise vector, but the same actor family behind prior npm/PyPI campaigns targeting crypto-adjacent developers — treat unsolicited Zoom/Teams links from industry contacts as suspect, especially if the conversation pivots toward a video call under time pressure.

12:00 ET · Forenoon Watch

Critical · Socket · corepack.org impersonation (npm ecosystem) · published 2026-07-24 14:55 UTC ·added 12:00 ET

Fake corepack.org site distributes infostealer and proxyware to npm/Yarn developers

A typosquat site impersonating corepack.org — the package-manager shim bundled with Node.js — serves an infostealer and proxyware payload to developers who download from it instead of running `corepack enable`. Same social-engineering shape as fake-CLI-installer campaigns from earlier this year: the attacker banks on devs searching for “corepack download” instead of trusting the binary Node already ships. Corepack ships with Node ≥14.19 — there's never a reason to fetch it from a third-party site; audit any recent installs that didn't come through Node itself.

Critical · GHSA · critical · npm · @better-auth/scim provider-ID collision account takeover ·added 12:00 ET

@better-auth/scim: SCIM provider-ID collision lets an authenticated user take over SSO/OAuth-provisioned accounts

@better-auth/scim reuses the same provider-ID namespace for SCIM configuration and account ownership, so any authenticated user who can generate a SCIM token can mint one whose provider ID collides with an existing SSO, SAML, OIDC, or social-login account — the SCIM routes then treat that victim account as SCIM-managed and let the attacker deprovision it or rewrite its email (CVSS 9.9). First of three better-auth advisories filed today; upgrade @better-auth/scim to 1.6.22 (or 1.7.0-beta.10) and audit whether `canGenerateToken` was left at the default policy.

Critical · GHSA · critical · nuget · Microsoft Kiota Copilot plugin manifest path traversal ·added 12:00 ET

Microsoft Kiota: attacker-controlled OpenAPI spec injects a path-traversal file reference into generated Copilot/Teams plugin manifests

`kiota plugin add`/`generate -t APIPlugin` copies the `x-ai-adaptive-card`/`x-ai-capabilities` file path straight from the OpenAPI spec into the generated `-apiplugin.json` manifest's `static_template.file`, with no path validation, so a compromised or untrusted OpenAPI description can embed a `../../etc/passwd`-style path that the AI host resolves when the plugin deploys. If you regenerate Copilot/Teams plugins from third-party or remote OpenAPI specs in CI, treat that pipeline as untrusted input. Patched in Kiota 1.32.5.

High · GHSA · high · npm · better-auth pre-account hijack via magic-link/email-OTP ·added 12:00 ET

better-auth: passwordless sign-in doesn't revoke a pre-registered password, enabling pre-account hijacking

With open registration and the magic-link or email-OTP plugin enabled, an attacker can sign up with a victim's email and a password of their choosing while the account sits unverified; when the real owner later signs in via magic link or OTP, that flow verifies the account but never revokes the attacker's password, so both credentials work afterward. Same bug class as the OAuth pre-hijack advisory GHSA-g38m-r43w-p2q7, now hitting the passwordless flows — second better-auth advisory in today's batch. Patch to better-auth ≥1.6.22; if you can't patch immediately, force a session/password reset on first passwordless verification of a pre-existing unverified account.

High · GHSA · high · npm · @better-auth/stripe cross-organization billing tampering ·added 12:00 ET

@better-auth/stripe: org-subscription actions authorize against one org ID but execute against another

The Stripe plugin's middleware checks a caller's `authorizeReference` permission against the org ID in the request query string, but the actual cancel/change-plan/restore/billing-portal handler reads the org ID from the request body instead — a user who belongs to two orgs can pass the org they're authorized for in the query string while targeting a different org's subscription in the body. Third and final better-auth advisory in today's batch; upgrade @better-auth/stripe past 1.6.21 and, if you wrote custom `authorizeReference` logic, verify it checks the same ID the handler ultimately acts on.

High · GHSA · high · nuget · Kiota code-generation literal injection (PHP, Python, Ruby, C#) ·added 12:00 ET

Microsoft Kiota: the same code-generation literal-injection bug recurs across four target-language generators

Kiota's OpenAPI-to-client generators embed spec-derived strings (descriptions, enum values, doc comments) into target-language string literals without escaping that language's own interpolation/comment-escape character — PHP's `$`, Ruby's `#`, and unescaped newlines in Python enum descriptions and C# XML doc comments — so a tampered OpenAPI spec injects code that runs when the generated client is imported or compiled. Four separate advisories (GHSA-jqwh-526h-c92j PHP, GHSA-7f3j-j7jj-r3vr Python, GHSA-xg2h-5xr2-29jw Ruby, GHSA-3hrf-2gc2-mx32 C#) for the same root cause, alongside today's critical Kiota manifest path-traversal bug — treat any CI pipeline that regenerates Kiota clients from remote or third-party OpenAPI specs as untrusted input. Patch to Kiota ≥1.32.5.

High · GHSA · high · pip · Ray read_webdataset() pickle/torch.load RCE ·added 12:00 ET

Ray: read_webdataset() deserializes attacker-controlled pickle/torch.load payloads with no opt-in

`ray.data.read_webdataset(paths=...)`'s default decoder routes `.pickle`/`.pkl` files to `pickle.loads()` and `.pt`/`.pth` files to `torch.load(..., weights_only=False)` with no flag or opt-in, so a TAR file pulled from S3, a HuggingFace mirror, or any URL passed to the reader achieves arbitrary code execution in the Ray process during a standard `.take_all()`/`.iter_batches()` call. Same deserialization-gadget class as GHSA-mw35-8rx3-xf9r (patched in Ray 2.55.0) but a different code path the earlier fix didn't touch. Patch to Ray ≥2.56.0; until then, don't call `read_webdataset` against data sources you don't fully control.

High · GHSA · high · pip · httplib2 unbounded gzip/deflate decompression bomb ·added 12:00 ET

httplib2: unbounded gzip/deflate decompression lets a ~150KB response OOM-kill the client

httplib2's `_decompressContent()` calls `gzip.GzipFile(...).read()` and `zlib.decompress()` with no size cap, and runs automatically on any response carrying `Content-Encoding: gzip`/`deflate` — so a malicious or compromised HTTP server can return a small compressed body that expands to 150MB+ in memory and OOM-kills the calling process. Classic decompression-bomb shape; anything using `httplib2.Http().request()` against attacker-influenced endpoints (webhooks, user-supplied URLs, third-party APIs) is exposed. Patch to httplib2 ≥0.32.0.

High · GHSA · high · npm · React Router manifest-endpoint DoS (follow-up) ·added 12:00 ET

React Router: unauthenticated manifest-endpoint requests can still overload Framework Mode servers

Follow-up to GHSA-8x6r-g9mw-2r78 — additional unauthenticated request patterns against the manifest endpoint still put heavy load on the server in React Router Framework Mode apps, versions 7.0.0 through <7.18.0. Doesn't affect Declarative or Data Mode. Patch to react-router ≥7.18.0; if you're on Framework Mode and already applied the first fix, don't assume it's closed.

High · GHSA · high · npm · LiquidJS pop filter memoryLimit bypass ·added 12:00 ET

LiquidJS: the `pop` array filter silently skips the memoryLimit accounting every sibling filter enforces

`pop` clones its input array (`[...toArray(v)]`) but is the one array filter in liquidjs that forgets to charge that allocation against `context.memoryLimit` — every comparable filter (`shift`, `slice`, `map`, `uniq`, etc.) enforces it. A template rendering `{{ huge_array | pop }}` on an attacker-influenced array bypasses whatever memory ceiling you configured, no matter how strict. Third instance of this exact CWE-770 gap in liquidjs (siblings: GHSA-8xx9-69p8-7jp3, GHSA-2546-xv4c-mc8g) — if you allow user templates, audit other filters for the same oversight rather than trusting this fix to be complete.

High · GHSA · high · npm · electron-updater credential leak + AppImage DLL search-path hijack ·added 12:00 ET

electron-updater/app-builder-lib: cross-origin credential leak on redirect, and a separate AppImage DLL-search-path hijack

builder-util-runtime's redirect handler only strips a header key matching exact lowercase `authorization`, so `PRIVATE-TOKEN` (GitLab PAT) and mixed-case `Authorization` (GitLab OAuth) survive a cross-origin redirect and leak to the redirect target — patch builder-util-runtime ≥9.7.0. Separately, AppImage builds from app-builder-lib set `LD_LIBRARY_PATH` with a trailing empty path component, which the dynamic linker resolves to the current working directory — same class as CVE-2024-41817 in ImageMagick — letting an attacker who controls the launch directory drop a malicious `.so` for code execution; patch app-builder-lib ≥26.15.0. Both ship in the same electron-builder release train, so one upgrade covers both (GHSA-p2f4-r6v6-j797, GHSA-7g7r-gx96-252g).

High · GHSA · high · rust · quinn-proto unbounded stream reassembly memory exhaustion ·added 12:00 ET

Quinn (QUIC): unbounded out-of-order stream reassembly lets a peer exhaust receiver memory

quinn-proto's stream `Assembler` buffers non-contiguous fragments without a cap, so a peer that sends stream data with deliberate gaps — fragments that can't be defragmented — forces the receiving connection to accumulate buffer overhead until memory is exhausted. Any Rust service accepting untrusted QUIC connections via quinn is exposed to remote peers. Patch to quinn-proto ≥0.11.15.

Medium · GHSA · medium · npm · SvelteKit remote-function forms prototype pollution + payload-size DoS ·added 12:00 ET

SvelteKit: remote-function forms have a prototype-pollution gap and a payload-size DoS

Remote form functions with a `file`-type input that accepts user-controlled path names are vulnerable to prototype pollution on file deletion, letting an attacker strip methods off the prototype (CVSS 4.3); separately, oversized remote-form payloads can crash the Node process outright, and repeating the request is a DoS (CVSS 5.3). Two distinct bugs in the same relatively new remote-functions feature (GHSA-866w-xmhq-wj7x, GHSA-wqjv-9729-c5q2) — if you've adopted SvelteKit's remote form functions, patch @sveltejs/kit past 2.69.0 and add a body-size limit in front regardless.

Medium · GHSA · medium · nuget · ImageMagick six medium-severity issues incl. two incomplete fixes ·added 12:00 ET

ImageMagick: six medium-severity issues, including two incomplete fixes of last month's CVEs

Two of today's six ImageMagick medium advisories are incomplete fixes — CVE-2026-25797 (HTML-encoder code injection) and CVE-2026-49219 (policy bypass) both reopen with the same root cause after their original patches — plus a fresh policy-check gap in `-concatenate`, a JP2-encoder heap overwrite, an MVG-decoder stack overflow, and a use-after-free in 8BIM profile parsing (CVSS 4.7-6.1). If you patched either named CVE and considered it closed, it isn't; take the latest ImageMagick release rather than cherry-picking the earlier point fix.

Medium · GHSA · medium · pip · AWS CLI world-readable credential files ·added 12:00 ET

AWS CLI: codeartifact login, iam create-virtual-mfa-device, and deploy register wrote credential files world-readable

On Unix hosts with a default umask, `aws codeartifact login`, `aws iam create-virtual-mfa-device`, and `aws deploy register` wrote credential/config files at 0644 instead of 0600, so any other local user on the same host could read them. Fixed in AWS CLI v1 1.44.78 / v2 2.34.29 (CVE-2026-13769); on shared or multi-tenant hosts, upgrade and re-check permissions (`chmod 600`) on any files those three subcommands already wrote, since the fix doesn't retroactively correct existing files.

Context · GHSA · context · nuget · ImageMagick ~28 low-severity memory-safety advisories ·added 12:00 ET

ImageMagick: ~28 low-severity memory-safety advisories published in the same batch

Same disclosure round as today's six ImageMagick mediums also includes roughly two dozen low-severity memory leaks, minor heap over-writes, and policy-bypass variants across TIFF/MIFF/VIFF/JNG/YUV/ICON encoders and X11/freetype paths (CVSS ≤3.7) — none individually actionable. Noted here for completeness rather than itemized; if you vendor ImageMagick, take the latest point release in one pass instead of triaging each CVE separately.