A security update for the beets software addresses a vulnerability identified as CVE-2026-42052. Prior to version 2.10.0, the bundled web UI of beets uses Underscore template interpolation mode <%= ... %> for untrusted metadata fields, which can lead to security issues. This vulnerability is rated medium severity. No specific affected versions or patch links are provided in the data.
A security update for gpg2 addresses a low severity vulnerability (CVE-2026-57062) involving improper handling of the CMS format for AES-GCM in the gpgsm component, which could cause parsing errors. No specific affected versions or patch details are provided in the available data.
Multiple security issues affecting chromedriver versions prior to 150.0.7871.128 have been fixed in the chromedriver-150.0.7871.128-1.1 package for openSUSE Tumbleweed. These vulnerabilities include use-after-free (CWE-416) and others, collectively rated with medium severity. The issues are addressed in this updated package, which is available for affected architectures including aarch64 and ppc64le.
This security update for opam addresses multiple vulnerabilities by updating the software to versions 2.5.0, 2.5.1, and 2.5.2. Notably, CVE-2026-41082 and CVE-2026-57825 are fixed in these updates. The update is provided by the SUSE Product Security Team and is classified as high severity. No CVSS score is available for these vulnerabilities.
This security update for vim addresses multiple vulnerabilities fixed in version 9.2.0780. The key issues include arbitrary code execution vulnerabilities via PHP and C omni-completion due to improper escaping, and an out-of-bounds write in SAL soundfolding caused by improper bounds checking. The update also includes other bug fixes unrelated to security.
This update for gzip fixes the following issue
- CVE-2026-41991: insecure temporary file handling in the gzexe utility when the mktemp utility is not available in the
user's PATH (bsc#1269622).
Multiple security vulnerabilities have been identified and fixed in the gstreamer-plugins-bad component used in SUSE. These include out-of-bounds reads and writes, heap and stack buffer overflows, and improper validation issues affecting various parsers such as H.264, H.265, H.266, WebRTC, IPv4/TCP headers, and DTLS handshake processing. The vulnerabilities could lead to memory corruption or application crashes. The severity is assessed as high due to the nature of these issues. No CVSS score is provided. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.
This security update for Grafana addresses two vulnerabilities: CVE-2026-33382, which limits the size of the request body at several API endpoints to prevent potential issues, and CVE-2026-8595, which fixes a stored cross-site scripting (XSS) vulnerability in the table panel. Both vulnerabilities have been fixed in this update.
A vulnerability in the Linux kernel's Bluetooth HCI event handling allowed a short HCI event frame to reach a memory copy operation without proper bounds checking. This was due to the function hci_store_wake_reason() being called before minimum payload length checks. The issue was fixed by moving wake reason storage into validated event handlers and enforcing lock contracts to prevent improper access.
# Summary
`pymdownx.snippets` has a regression of the CVE-2023-32309 / GHSA-jh85-wwv9-24hv fix. With `restrict_base_path: True` (the default), the current `filename.startswith(base)` containment check does not enforce a directory boundary. As a result, a markdown snippet directive can read files from sibling paths that share the same prefix as `base_path`, such as `docs` vs `docs_internal`.
The regression was introduced in PR #2039 / commit `7c13bda5b7793b172efd1abb6712e156a83fe07d`, which replaced the original directory-identity check with a plain string-prefix comparison.
# Details
The regression was introduced in commit `7c13bda5b7793b172efd1abb6712e156a83fe07d` (2023-05-15, #2039 *"Fix regression of snippets nested deeply under specified base path"*), which relaxed the original `os.path.samefile(base, os.path.dirname(filename))` check to a plain `startswith(base)`.
`SnippetPreprocessor.get_snippet_path()` in `pymdownx/snippets.py`:
```python
if self.restrict_base_path:
filename = os.path.abspath(os.path.join(base, path))
# If the absolute path is no longer under the specified base path, reject the file
if not filename.startswith(base):
continue
```
`base` is `os.path.abspath(b)` and has no trailing separator. `str.startswith(base)` is `True` for any `filename` whose string representation begins with the same characters as `base`, regardless of whether those characters end at a directory boundary.
Concrete example:
* `base = "/x/docs"`
* `path = "../docs_secret/leak.txt"` (inside the markdown snippet directive)
* `os.path.join(base, path)` → `"/x/docs/../docs_secret/leak.txt"`
* `os.path.abspath(...)` → `"/x/docs_secret/leak.txt"`
* `filename.startswith(base)` → `True`, because `"/x/docs_secret/..."` begins with the literal string `"/x/docs"`.
All releases from **10.0.1 (2023-05-15) through 10.21.2 (current)** are affected.
# Impact
Arbitrary file read within the host the build runs on, bounded by the prefix match. With `base_path = /x/docs` the attacker can read files from any sibling directory whose path begins with the literal string `/x/docs` followed by any non-separator character — for example `/x/docs_internal/`, `/x/docs.bak/`, `/x/docs2/`.
The threat model is the same as the original CVE-2023-32309: markdown content processed by the snippets preprocessor in a build pipeline (typical scenario: an MkDocs documentation site built in CI from PR contributions or otherwise less-trusted markdown) can read files outside the configured base. CI builds that publish the generated HTML expose the read file to the public; CI builds with secrets on disk leak those secrets.
# Reproduction
Minimal local PoC, non-destructive:
```python
import os, shutil, tempfile, markdown
work = tempfile.mkdtemp(prefix="pmx_poc_")
try:
base = os.path.join(work, "docs")
sibling = os.path.join(work, "docs_secret")
os.makedirs(base)
os.makedirs(sibling)
with open(os.path.join(sibling, "leak.txt"), "w") as f:
f.write("TOP_SECRET_FROM_SIBLING_DIR\n")
out = markdown.markdown(
'--8<-- "../docs_secret/leak.txt"\n',
extensions=["pymdownx.snippets"],
extension_configs={
"pymdownx.snippets": {
"base_path": [base],
"restrict_base_path": True,
"check_paths": True,
}
},
)
print(out) # -> <p>TOP_SECRET_FROM_SIBLING_DIR</p>
finally:
shutil.rmtree(work)
```
Default `restrict_base_path: True` is sufficient — no non-default option is required.
# Suggested fix
Minimal change — require the separator after the base prefix:
```diff
- if not filename.startswith(base):
+ # Append `os.sep` so a sibling directory whose name shares a prefix
+ # (e.g. `/x/docs` vs `/x/docs_evil`) cannot satisfy the check.
+ if not filename.startswith(base + os.sep):
continue
```
This preserves the original intent (allow snippets nested at any depth under `base_path`) while restoring the directory-boundary check. It does not affect the `os.path.isdir(base)` branch where `base` is a file (that branch still uses `os.path.samefile`).
Alternative: `os.path.commonpath([base, filename]) == base` is equivalent and slightly more idiomatic, though it raises `ValueError` on different drives on Windows and would need a `try/except`. The `startswith(base + os.sep)` fix is the smaller diff.
Note: this fix does not change behaviour for symlinks inside `base_path`. The existing implementation uses `os.path.abspath` (not `os.path.realpath`), so a symlink within `base_path` pointing outside is still followed. That is a separate concern — symlinks require write access to `base_path`, a much higher bar than the current bypass — and matches the behaviour the CVE-2023 fix established.
# Regression test
A regression test class `TestSnippetsSiblingPrefix` was added in `tests/tes
A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI lengths. Processing this crafted signature could lead to a denial of service in automated package or repository processing workflows.
A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By sending a specially crafted compressed remote message before authentication, an attacker can cause memory corruption, leading to a denial of service (DoS) in the CIB remote listener. This can result in the affected service crashing.
This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.35.1 fixes various security issues
The following security issues were fixed:
- CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267893).
- CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267723).
- CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267698).
- CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268662).
- CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269023).
- CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269495).
This security update for the SUSE Linux Enterprise Kernel 4.12.14-122.280 addresses multiple vulnerabilities affecting various kernel components including netfilter, ip6_tunnel, ALSA pcm, bonding, and SMB client. The fixes resolve issues such as invalid packet handling, use-after-free conditions, and improper user-space input acceptance. These vulnerabilities were collectively addressed in Live Patch 74 for SUSE Linux Enterprise 12 SP5.
Multiple security issues were addressed in the aws-nitro-enclaves-binaryblobs-upstream-1.4.5~git0.18a5f6f-1.1 package for openSUSE Tumbleweed. These fixes improve the security posture of the SUSE product by resolving vulnerabilities present in prior versions. No specific details about the nature of the vulnerabilities or affected versions are provided.