CVE-2026-107333 is a high-severity vulnerability in CISA Malcolm's nginx-based reverse proxy. It arises from a URL path normalization inconsistency between the Lua-based RBAC authorization layer and nginx's request routing logic. This flaw allows an authenticated user to bypass role-based access controls and access administrative or restricted endpoints, including file upload, PHP server, htadmin, and authentication management interfaces. The vulnerability affects all restricted paths protected by the RBAC layer in Malcolm versions from 0 up to and including 26.07.1.
CVE-2026-107303 is a cross-site scripting (XSS) vulnerability in the JHipster generator-jhipster and react-jhipster components prior to versions 9.4.0 and 1.1.0 respectively. The vulnerability allows an authenticated user with write access to store malicious Blob data that can execute active HTML or SVG content under the application origin when accessed by a privileged user. This issue arises from improper neutralization of input during web page generation and depends on the generated application's content security policy and browser Blob behavior. The vulnerability is fixed in generator-jhipster 9.4.0 and react-jhipster 1.1.0.
The npm package 'dransay' version 99.0.0 contains a malicious preinstall script that performs network requests to a third-party collaborator domain during installation. This behavior leaks the installer's IP address, DNS resolver IP, hostname data, and timestamp to an external server. The package appears to be a dependency-confusion proof-of-concept but executes non-consensual outbound network communication.
CVE-2026-107336 is an authentication bypass vulnerability in CISA Malcolm's nginx reverse proxy configuration. The issue arises because a case-insensitive regex matcher allows requests with non-lowercase path segments to bypass a case-sensitive rewrite, leading to unauthenticated access to the Arkime backend. Additionally, the proxy forwards a client-supplied X-Forwarded-User header without overwriting it, and Arkime trusts this header for authentication. This combination allows an unauthenticated attacker to access Arkime with a forged identity.
CVE-2026-61801 is a medium severity vulnerability in the moby sys Go package before version 0.4.1. It involves uncontrolled resource consumption when parsing Unix-style user and group database files such as /etc/passwd or /etc/group. An attacker supplying a specially crafted file can cause excessive memory use, potentially terminating the affected process due to out-of-memory conditions. The issue is fixed in version 0.4.1. Mitigation includes upgrading to 0.4.1 or avoiding parsing untrusted user/group files.
CVE-2026-107302 is an out-of-bounds read vulnerability in the msgpack5 library for Node.js and browsers. Versions prior to 6.1.0 improperly read the length of a map32 value before fully validating the header, causing a RangeError instead of the expected IncompleteBufferError on truncated input. This can unexpectedly terminate requests, streams, or workers that rely on the IncompleteBufferError to wait for more data. The issue does not lead to memory disclosure and is fixed in version 6.1.0.
A prototype pollution vulnerability exists in msgpack5 versions prior to 6.1.0. When constructed with an empty or partial options object, the default protection against prototype pollution is disabled. This allows a decoded map containing a __proto__ key to replace the decoded object's prototype, potentially altering inherited properties or downstream behavior. The global Object.prototype is not affected. The issue is fixed in version 6.1.0.
### Impact
The streaming decoder recursively invokes itself for every complete value remaining in a chunk. A single chunk containing many small valid MessagePack values can exhaust the JavaScript call stack and interrupt the process or stream.
### Patches
The streaming decoder now drains concatenated values iteratively with constant call-stack depth.
### Workarounds
Limit the number of MessagePack values accepted in one chunk, or split large batches before passing them to the decoder stream.
The FakeGit malware campaign has resurfaced, distributing the SmartLoader malware through over 17,000 fake GitHub repositories. These repositories use convincing README files with download links to ZIP archives containing SmartLoader, which then delivers additional malware such as the StealC infostealer. The campaign leverages both throwaway and apparently legitimate developer accounts to maintain a large and persistent malicious repository fleet. Attempts to remove these repositories are ineffective due to the attackers' use of multiple backup copies and alternative download locations within GitHub. Users are advised to verify repository ownership and rely on official sources for software installations.
A vulnerability in msgpack5 prior to version 6.1.0 allows a remote attacker to cause a denial of service by exhausting memory. The streaming decoder incorrectly treats the reserved MessagePack byte 0xc1 as incomplete input rather than invalid, causing it to buffer data indefinitely while waiting for bytes that will never form a valid value. This issue is fixed in version 6.1.0.
msgpack5 versions prior to 6.1.0 have an uncontrolled recursion vulnerability in their array and map decoding paths. This allows an attacker to submit deeply nested MessagePack input that exhausts the JavaScript call stack, causing process interruption. The issue is fixed in version 6.1.0.
### Impact
The streaming decoder reparses an incomplete container from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack value across many small chunks, causing quadratic CPU usage and blocking the event loop.
### Patches
The decoder now preserves incremental container state so completed elements are not parsed again when more input arrives.
### Workarounds
Buffer each complete MessagePack value before decoding it, or limit the number of chunks accepted for a single value.
CVE-2026-107296 is a low-severity vulnerability in the msgpack5 library for Node.js and browsers. Before version 6.1.0, decoding a negative signed 64-bit integer causes modification of the input buffer bytes used for decoding. This silent corruption affects applications that reuse or retain the encoded input for integrity checks, logging, or later processing. Positive integers and other MessagePack types are not affected. The issue is fixed in msgpack5 version 6.1.0.
### Summary
The Pydantic AI development web chat UI (`Agent.to_web()`, `clai web`) did not check the content type of requests to its chat endpoint. This allowed a website visited by a developer to submit a request to a chat UI running on that developer's machine, causing the served agent to run and to execute its tools with the privileges and credentials of the local process.
Binding the web UI to localhost — the default — does not prevent this, because a page open in the developer's browser can reach the loopback address.
### Impact
Applications and developers serving an agent through `Agent.to_web()` or `clai web`. The consequences depend on the tools the served agent exposes, and can include data disclosure as well as unwanted tool side effects. Tools marked `requires_approval=True` were not protected either, because the endpoint trusts approval decisions relayed by the client.
### Mitigation
Upgrade to a patched version. The chat endpoint now requires `Content-Type: application/json` and rejects other requests before the request body is parsed and before the agent runs. The bundled chat UI already sends this header; scripts and other non-browser clients that call the endpoint directly may need to be updated to send it.
If you cannot upgrade, don't run the web UI while browsing untrusted sites, stop it when you aren't using it, and don't serve an agent with side-effecting tools through it.
### Credits
- Thai Son Dinh from VinSOC Labs (R&D)
CVE-2026-105436 is a high-severity vulnerability in MainWP Child plugin versions prior to 6.2.2. It involves deserialization of untrusted data, which allows an attacker to perform object injection. This vulnerability can lead to complete compromise of confidentiality, integrity, and availability of the affected system. The issue affects all versions from initial releases up to 6.2.1 inclusive.
CVE-2026-107294 is a medium severity vulnerability in pydantic-ai, a Python agent framework for Generative AI applications. Versions from 1.77.0 up to but not including 1.107.2, and from 2.0.0b1 up to but not including 2.24.0, are affected. The issue involves uncontrolled resource consumption due to buffering the entire HTTP response body before applying content-size controls in certain media download components. This can allow an attacker to cause a denial of service by exhausting process memory and crashing the worker. The vulnerability affects media types such as ImageUrl, DocumentUrl, VideoUrl, and AudioUrl. SSRF protections remain effective, limiting the impact to availability. The issue is fixed in versions 1.107.2 and 2.24.0.
CVE-2026-107709 is a path traversal vulnerability in Bower decompress-zip versions up to 0.3.3. It occurs due to improper validation of archive entry paths during ZIP extraction, allowing crafted ZIP files to write files outside the intended directory. This can lead to arbitrary file overwrite, application compromise, or remote code execution depending on the environment and writable sibling directories.
### Summary
Pydantic AI's OpenTelemetry instrumentation supports `InstrumentationSettings(include_content=False)` to exclude message content — user prompts, model completions, tool call arguments and responses — from exported telemetry, so that agents can be monitored without sending sensitive content to the observability backend.
Retry prompts — the feedback messages Pydantic AI sends back to the model when its output fails validation or an output validator raises `ModelRetry` — were not covered by this setting when they were not associated with a tool call, as with structured output modes that don't use tool calls (e.g. `NativeOutput` or `PromptedOutput`) and output validators applied to text output. Their full content was recorded on model request spans even with `include_content=False`. Since validation feedback can quote invalid values from the model's response, message content that the setting was configured to withhold could reach the telemetry backend.
### Details
Retry prompts without an associated tool call were serialized into span message attributes (such as `gen_ai.input.messages` and `pydantic_ai.all_messages`) as regular text parts, and this path did not apply the `include_content` check that every other message part applies. Retry prompts tied to a tool call, and all other message content, were redacted correctly.
### Impact
This does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario `include_content=False` exists for. The disclosed content is limited to retry feedback: validation error details, which can quote invalid values from the model's output, or output-validator `ModelRetry` messages.
### Who Is Affected
You are affected if you enabled instrumentation with `include_content=False` and your agent can produce retry prompts outside of tool calls: it uses a structured output mode that doesn't rely on tool calls (such as `NativeOutput` or `PromptedOutput`), or output validators on text output. You are not affected if you don't set `include_content=False`, or if all of your agent's retries come from tool calls (including the default tool-based structured output mode), which were redacted correctly.
### Remediation
Upgrade to a patched version; retry prompt content now honors `include_content=False` like all other message content. If you rely on this setting, consider reviewing previously exported traces for retry prompt content that should not have been recorded.
### Workaround for Unpatched Versions
If you cannot upgrade, scrub or drop the message attributes (`gen_ai.input.messages`, `gen_ai.output.messages`, `pydantic_ai.all_messages`) in your telemetry pipeline (for example with an OpenTelemetry Collector processor), or use tool-based structured output modes, whose retry feedback honors `include_content=False`.
### Credits
Reported privately by the University of Sydney Security Research Team (Liyi Zhou, Ziyue Wang, Strick, Maurice, Chenchen Yu), and later independently discovered and reported publicly, with a fix, by @sean-kim05.
This report describes two new Python scripts designed for forensic analysis of AI coding assistants OpenCode and Hermes. These scripts reconstruct AI agent activity from stored session data and logs, enabling investigators to review chat histories, tool usage, API requests, and related evidence. The tools focus on making recorded AI interactions accessible for incident response investigations rather than running or replaying AI agents. They require Python 3.10+ and operate on local data extracted from user systems or forensic images.
Obsidian Desktop versions before 1.14.0 contain a cross-site scripting (XSS) vulnerability in the bundled MathJax 3.2.2 Safe component. This vulnerability allows attackers to bypass URL filtering by embedding a crafted \href value containing a TAB byte, resulting in an empty protocol that circumvents safeProtocols restrictions. An attacker can craft a malicious MathJax formula that renders as a javascript: URL anchor. When clicked in Live Preview, this executes code in the Node-integration-enabled vault renderer, enabling arbitrary OS command execution as the desktop user.