Threat database

Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays with narrower inner bounds using the wider result type's memory layout. When a ternary selects the narrower array, inner arrays after the first are read at wrong offsets, causing contracts to silently store corrupted values or revert.

Vyper versions 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 have a vulnerability in the handling of Unicode encoding in the parsing of source code. The issue arises from mixing character-based line offsets with Python's UTF-8 byte column offsets, causing multi-byte characters to shift source slices used for reconstructing numeric literals. This allows an attacker to use non-ASCII identifiers that normalize to ASCII or invisible byte-order marks to silently substitute addresses, integers, or other constants in compiled code.

Sharp versions before 0.35.0 include a bundled libvips library with multiple vulnerabilities affecting GIF, TIFF, and VIPS image decoders. These vulnerabilities allow attackers to supply crafted image files to applications using sharp, potentially triggering the underlying libvips flaws. The issue is resolved in sharp 0.35.0 and later.

Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif decoding flaws to execute code.

A use-after-free vulnerability exists in the sharp library before version 0.35.5 due to a vulnerable librsvg dependency (CVE-2026-96889). This flaw can be triggered by processing a crafted SVG image, potentially leading to arbitrary code execution on glibc-based Linux systems. The vulnerability has a high severity score of 8.9 and affects versions of sharp from the initial release up to but not including 0.35.5.

Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to delete those files when the user uninstalls the package.

A path traversal vulnerability exists in astral-sh uv versions before 0.11.15. This flaw allows malicious Python wheel packages to write files outside the intended scripts directory by crafting console_scripts or gui_scripts entry point names. Exploitation can lead to placing executables in system PATH directories, potentially overwriting or shadowing binaries and enabling code execution.

HKUDS Vibe-Trading versions from 0.1.0 up to but not including 0.1.7 have a missing authentication vulnerability. This flaw allows unauthenticated attackers to access critical API endpoints because the require_auth() function returns early if the API_AUTH_KEY is not set. Exploitation enables attackers to execute root shell commands, upload malicious scripts, read session histories, and obtain partial API keys. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity.

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to subprocess.run with shell=True and no allow-list or approval step, and read_url fetches arbitrary URLs, enabling command execution and server-side request forgery.

HKUDS Vibe-Trading versions from 0.1.0 up to but not including 0.1.7 contain a path traversal vulnerability. This flaw allows remote attackers to read sensitive server files by exploiting LLM agent file-read tools that lack proper sandboxing. Attackers can use the read_document function or safe_user_path-gated tools to access critical files such as /etc/shadow, /proc/self/environ, and /root credentials. The vulnerability has a high severity with a CVSS score of 8.7.

Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting attacker-controlled executables gain elevated privileges when extracted as root and later run.

adm-zip versions before 0.6.1 have a vulnerability where ZIP archives with duplicate entry names cause inconsistent entry resolution. This allows attackers to bypass content validation because getEntry() returns the last duplicate entry while extractAllTo() writes the first, potentially writing unvalidated data to disk.

CVE-2026-114103 is a medium severity vulnerability in adm-zip version 0.6.0 that allows attackers to bypass decompression bomb protections. The flaw exists in the asynchronous getDataAsync() method where attackers can craft ZIP entries with small declared sizes but highly compressed payloads, leading to uncontrolled memory exhaustion.

adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data processed by readFileAsync, readAsTextAsync, extractAllToAsync, or getDataAsync, triggering an uncatchable exception that terminates all in-flight requests.

CVE-2026-114101 is a medium severity vulnerability in Coraza before version 3.8.1. It involves improper input validation during multipart upload filename extraction, where the software uses Go's mime.ParseMediaType which ignores RFC 5987 filename* parameters with charsets other than utf-8 or us-ascii. This allows unauthenticated attackers to craft filenames that bypass FILES-based security rules, potentially enabling dangerous uploads to reach backend systems that honor the filename* parameter.

Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-type parameter are never parsed. Unauthenticated attackers can send application/x-www-form-urlencoded; charset=UTF-8 to keep ARGS_POST and REQUEST_BODY empty, evading body rules while the backend still processes the payload.

Coraza versions from 3.0.0 up to but not including 3.8.1 contain an improper input validation vulnerability in their JSON body processor. This processor flattens nested JSON properties into dot-separated ARGS_POST names without escaping literal dots, causing distinct properties to collide. An unauthenticated attacker can exploit this by adding a dotted property such as account.role that overwrites a nested value, potentially hiding SQL injection payloads from OWASP CRS rules while still delivering them to the backend.

Dulwich versions from 0.22.5 up to but not including 1.2.8 contain a path traversal vulnerability in the stash.py pop() function. This flaw allows attackers to write arbitrary files outside the intended worktree by exploiting intermediate directory symlinks. A malicious repository can be crafted so that the popped stash writes a payload into the .git/hooks/post-checkout file, enabling code execution upon the next git checkout operation.

Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craft a repository where an ancestor commit's symlink redirects a descendant commit's file writes during filter_branch, enabling code execution by writing into .git/hooks.

Dulwich versions from 0.24.0 up to but not including 1.2.8 contain a vulnerability in the porcelain.checkout function where symbolic links are improperly resolved before file access. This allows attackers to write arbitrary files by exploiting the lack of O_NOFOLLOW flag in os.open calls. Specifically, an attacker can craft a repository with a worktree symlink pointing to .git/hooks/post-checkout, causing a malicious hook to be written during a tag restore operation, potentially enabling code execution.