The Black Hole theme for Drupal websites has a vulnerability where menu link titles are not properly sanitized before being used in HTML class attributes. This flaw requires the attacker to have permissions to create or modify menu link titles, limiting the attack surface. A patch is available to address this issue.
The ZeroPoint theme for Drupal websites has a vulnerability where menu link titles are not properly sanitized before being used in HTML class attributes. This flaw requires an attacker to have permissions to create or modify menu link titles to exploit it. The vulnerability affects certain versions of the theme and a patch is available.
The Drupal UI Icons module allows users to select and configure icons through various interfaces. A vulnerability exists due to insufficient validation of user-provided icon settings before rendering. This could potentially lead to security issues related to improper input handling. A patch is available to address this issue.
The Drupal ffmpeg_image_toolkit module allows image conversion using ffmpeg but does not sufficiently sanitize file names passed to the ffmpeg command line tool. This vulnerability requires an attacker to have the ability to upload images to the site, which mitigates the risk. A patch is available for versions prior to 1.0.3.
## Summary
`FlexAssembler`, the custom-container assembler shipped in the `stream-json` package (`src/core/utils/flex-assembler.js`, re-exported at `stream-json/utils/flex-assembler.js` and `stream-json/web/utils/flex-assembler.js`), compiles a string or RegExp path `filter` into a matcher that runs `keyStack.join(separator)` on every container start. Because the key stack grows one entry per open object or array with no depth bound, a JSON document nested to depth D drives D container-start tokens that each perform an O(D) join, for O(D^2) total CPU on the single-threaded event loop. An unauthenticated party who can supply JSON bytes to a pipeline that uses a `FlexAssembler` with a string or RegExp rule filter can stall the process with a small input: roughly 96 KB (depth 16000) blocks the event loop for over a second, and the cost grows quadratically.
## Root Cause
`FlexAssembler` reconstructs JavaScript values from the parser token stream and supports custom containers selected by path-matching rules. When a rule `filter` is a string or RegExp, `compileFilter` returns a matcher that computes the joined path from the full key stack before making any match decision. That join is O(current depth), and it is invoked unconditionally for every rule on every container start. The key stack that feeds the join has no depth cap. The package does have a depth guard (`maxDepth`), but it exists only in the unrelated filter base state machine and never executes on the `FlexAssembler` code path, so nested input is unbounded here.
```text
src/core/utils/flex-assembler.js
compileFilter (lines 5-21): string branch computes `path.join(separator)` (line 10)
before the `=== filter || startsWith(...)` comparison; RegExp branch computes
`filter.test(path.join(separator))` (line 17). The join runs first, unconditionally.
FlexAssembler._matchRule (lines 160-166): calls `rule.filter(this.keyStack)` for every
rule; invoked from startObject (line 184) and startArray (line 197) on every
container start.
FlexAssembler._pushState (lines 168-176): pushes one entry onto `keyStack` per open
container with no depth bound.
```
## Impact
An attacker who can deliver JSON to a pipeline whose `FlexAssembler` is configured with a string or RegExp rule filter (a documented, tested, first-class option: `Filter = string | RegExp | FilterFunction`) can cause quadratic CPU consumption. The join runs regardless of whether the rule ultimately matches, so no attacker knowledge of the schema is required beyond nesting depth, which the attacker fully controls. The demonstrated capability is an availability impact: a small crafted document blocks the Node.js event loop, stalling all concurrent work on the process. There is no confidentiality or integrity impact. A consumer that uses only a function filter or no rules is not affected, which narrows the vulnerable population but does not raise attack complexity once such a configuration is in use.
## Proof of Concept
`Node.js and the published stream-json@3.6.0 package. Drive a FlexAssembler configured with a string rule filter, comparing against a function filter as a negative control.`
1. Install `stream-json@3.6.0`.
2. Construct a deeply nested object token stream (or equivalently parse a document like `'{"k":'` repeated D times, a `1`, then `'}'` repeated D times, through `parser`/`parserStream`).
3. Feed it to a `FlexAssembler` whose `objectRules` contains a rule with a string `filter`.
4. Observe wall-clock time scaling as roughly 4x per doubling of D (quadratic), while a function-filter configuration stays flat.
```js
import FlexAssembler from 'stream-json/utils/flex-assembler.js';
function run(filter, D) {
const asm = new FlexAssembler(filter ? {objectRules: [{filter, create: () => ({})}]} : undefined);
const t = performance.now();
asm.startObject();
for (let i = 0; i < D; i++) { asm.keyValue('k'); asm.startObject(); }
return performance.now() - t;
}
for (const D of [4000, 8000, 16000, 32000]) console.log('string', D, run('k', D).toFixed(1), 'ms');
for (const D of [4000, 8000, 16000, 32000]) console.log('function(control)', D, run(p => p.length > 0, D).toFixed(1), 'ms');
```
```text
string filter (path.join per token): function filter (negative control, no join):
D=4000 91.9 ms D=4000 1.6 ms
D=8000 341.9 ms D=8000 0.9 ms
D=16000 1359.2 ms (~4x per doubling) D=16000 1.7 ms (flat)
D=32000 5430.0 ms (= O(D^2)) D=32000 2.6 ms
```
End to end through a real `parserStream`, roughly 96 KB (depth 16000) of attacker-supplied JSON stalls the event loop for over 1.3 seconds.
## Attack Chain
1. **Exposure:** The attacker supplies JSON bytes to a service pipeline that assembles values with a `FlexAssembler` configured with a string or RegExp rule filter; `FlexAssembler` is a documented submodule of the published package on both the Node and Web Streams surfaces.
2.
Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML without distinguishing compiler-generated literal content from dynamic expression values. An application that passes attacker-controlled data directly as a dynamic child can allow a value containing a closing script or style tag to terminate the element and inject arbitrary HTML and JavaScript. Other JSX expression contexts escape dynamic strings automatically; the issue is limited to script and style children rendered through the astro:jsx renderer, including MDX components. Successful exploitation can produce reflected or stored cross-site scripting under the application's origin. This issue is fixed in 7.3.2.
A vulnerability was identified in ProjectWorlds Advanced Library Management System 1.0. The affected element is the function mysqli_query of the file individual_report_search.php. Such manipulation of the argument roll_number leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.
CVE-2026-114127 is a low-severity cross-site scripting (XSS) vulnerability in the Astro web framework versions 7.1.0 through 7.3.2. It arises from improper neutralization of input in the server-side View Transition CSS generator, allowing attacker-controlled data to inject CSS rules into server-rendered pages. Although the vulnerability does not permit direct injection of HTML or JavaScript, the injected CSS can alter the page's appearance or expose data via DOM attributes. This issue is fixed in version 7.3.3.
This content is a user inquiry about creating subdomains for two domains, discussing DNS management options. It does not describe a security vulnerability or threat.
Electron versions prior to 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5 have a vulnerability where HID and USB permission checks made from iframes can be attributed to the wrong origin. This occurs because the permission check handler receives the top-level frame's origin instead of the requesting iframe's origin, potentially allowing embedded frames to gain access intended only for the top-level page. The issue affects apps using origin-based logic in setPermissionCheckHandler for HID or USB permissions and embedding cross-origin iframes with these permissions allowed. The vulnerability has a medium severity with a CVSS score of 5.4 and has been fixed in the specified versions.
Storybook versions from 8.0.0 up to but not including 8.6.19, 9.0.0 up to 9.1.21, 10.0.0 up to 10.6.2, and 11.0.0-alpha.0 up to 11.0.0-alpha.6 contain a vulnerability where the development server exposes its WebSocket authentication token over a local network. An attacker on the LAN can obtain this token and exploit weak validation in story file writing to place malicious code. If the Vitest addon is installed with an outdated Vitest version, this can lead to arbitrary file writes or command execution with developer privileges. The issue is fixed in versions 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.
CVE-2026-92202 is a high-severity vulnerability in Luxion KeyShot version 2026.1.0 involving uncontrolled search path elements during BIP file parsing. This flaw allows remote attackers to execute arbitrary code by tricking a user into opening a malicious file or visiting a malicious page. The vulnerability arises from loading a library from an insecure location, enabling code execution in the context of the current process.
CVE-2026-89035 is a critical vulnerability in MikroTik RouterOS up to version 7.24.5 that allows attackers to bypass authentication by replaying captured session tokens in the WebFig interface. The issue arises because session tokens are generated using fixed salts without channel- or session-specific input, and token validation does not verify channel context. This enables stolen tokens to grant persistent administrative access until the token store is cleared. This vulnerability builds on a previously identified transport-layer exposure (CVE-2025-61481) without a fix.
CVE-2026-114262 is a medium severity vulnerability in the file-management-system affecting the store function in FileController.php. It allows unrestricted file upload due to improper handling of the File argument. The vulnerability can be exploited remotely without authentication. The product uses a rolling release model, so specific affected versions are not available. The issue was reported early but no vendor response or patch is currently known. Exploit code has been publicly disclosed but there are no confirmed exploits in the wild.
**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.
## Who is impacted?
You are impacted if you run a Storybook dev server in the affected versions.
You are not impacted if:
- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)
- You run or visit a built version of Storybook
Recent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.
## Recommended actions
### Upgrade Storybook
Storybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur.
Upgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server until you can apply the fix.
- 11.0.0-alpha.6
- 10.6.2
- 9.1.21
- 8.6.19
### Review potentially breaking changes
Due to the exceptional nature of the reported vulnerabilities, the Storybook team has decided to change the default behavior of Storybook, including versions 8 and 9, for several network-related features that are not essential to most Storybook users' workflow. If your team relies on the affected features, we've added feature flags that can disable specific security updates to support your existing workflows.
Please carefully read the introduced flags and the consequences of using them.
#### Iframe embedding over the network is disabled by default
Storybook no longer allows the manager or preview to be embedded as an iframe on a website with a different host name. Built versions of Storybook are unaffected and can be freely embedded.
If you rely on embedding a Storybook dev server through a separate web app, run that separate app on `localhost`. You may also use the `security.insecureRemoteIframeEmbed` feature flag to re-enable iframe embedding from any origin.
#### The preview iframe rejects messages sent by an unknown host
Both the Storybook preview and manager now restrict the origin of iframes and parent windows that they can send messages to and receive messages from using the `postMessage` API.
By default, Storybook in dev mode only accepts communication with its own origin and other `localhost` services. Built Storybooks continue to accept communication from unknown origins.
A Storybook addon or integration could hypothetically rely on `postMessage` to update a live story's args. If you do that, reach out to the Storybook team to explore safer alternatives.
Storybook composition also relies on `postMessage`, so a composed Storybook on a different origin now fails to load unless it has been built. The `security.insecureIframeMessaging` feature flag disables this protection, but we recommend you build composed Storybooks instead.
#### The `highlight` event signature has changed
Storybook’s own accessibility addon uses the `highlight` event to inject highlights into the preview, which a user can click. Clicking the highlight opens a menu with a link to a documentation page.
The API for that event was too permissive and could be used to trigger arbitrary events, including events processed by the user’s dev server. We reworked the API to prevent abuse. Besides the accessibility addon, Chromatic's Visual Tests addon uses this API to link to documentation from highlighted ignored elements. Update the Visual Tests addon to version 5.5.1 or later to keep that link working. Because no other addons use this API as far as we know, we have not added a feature flag to restore the old API.
## Disclosure timeline
On September 30th, the Storybook team received a responsible disclosure showing how a malicious website can embed a Storybook dev server's preview iframe and send events to the dev server on the developer's machine.
They combined this information with findings from an ongoing security audit to come up with a worst-case-scenario exploitation of the disclosed vulnerability, and the ones we independently discovered. They then worked to address all layers necessary for this worst-case scenario to happen. We have not received evidence of exploitation in real Storybook projects. The attack outlined in this advisory relies on correctly exploiting a sequence of many vulnerabilities, some of which were never disclosed to the Storybook team.
### Worst-case attack scenario
An attacker-controlled website can interact with the preview of a running Storybook dev server. With user interaction, it may cause the dev server to make unauthorized changes to story files. If a malicious file is subsequently executed by a loc
CVE-2026-114261 is a medium severity vulnerability in the MomoTommy file-management-system. It involves missing authentication in several functions (index, store, update, destroy) within the Files API component. The flaw allows remote attackers to manipulate requests without authentication. The product does not use versioning, so affected versions cannot be precisely identified. The vendor has been notified but has not responded or issued a fix. Public exploit code exists, increasing the risk of exploitation.
Google has enhanced Chrome's security features to protect users against scams, social engineering, and insecure HTTP connections. New protections include two levels of Safe Browsing site warnings, server-side Gemini scam analysis, and detection of ClickFix attack commands. Chrome now warns users before connecting to unencrypted HTTP sites by default. These improvements aim to reduce phishing and social engineering risks, especially for users with Enhanced Protection enabled.
Girafit camera app (Android and iOS) version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration. Attackers can extract the static TURN username and session token, which are identical across all installs and not tied to any user or device, potentially enabling tracking, impersonation, or further exploitation if combined with the TURN relay password.
CVE-2026-114123 is a vulnerability in dynamics365ninja's d365fo-mcp-server prior to version 1.11.0 where missing authentication allows unauthenticated access to critical read-only functions. The default deployment leaves the API key unset or empty, causing the server to accept unauthenticated JSON-RPC requests. This exposes proprietary X++ source code snippets and metadata, including business logic and security roles. The issue is fixed in version 1.11.0.
Two critical remote code execution vulnerabilities, collectively known as PHP2Shell, affect PHP versions back to 5.4 and impact widely used web applications such as WordPress, Drupal, and Joomla. These vulnerabilities involve memory management and error handling components of PHP and allow unauthenticated attackers to execute arbitrary code. Exploitation attempts have been detected in the wild shortly after patches were released. The flaws also enable reading sensitive process memory, potentially exposing credentials and secrets. Patches are available in PHP versions 8.5.12, 8.4.27, 8.3.36, 8.2.35, and backports for 7.4, 8.0, and 8.1. The PHP Foundation and security firms urge immediate patching due to the severity and active exploitation attempts.