Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared
and no user interaction beyond launching it, can execute arbitrary shell
commands as uid 0 in the u:r:dumpstate:s0 SELinux domain. Two defects
combine: (a) OnePlus's atlasservice binder interface accepts
setEvent(String8 name, String8 value) from any caller without
authorization, and (b) one event handler
(OplusAtlasLogWriter::handleEvent, matching event name
atlas_event_multimedia_audio_dumpsys) copies the caller-supplied value
into the system property oplus.audio.dumpinfo.type and starts the root
init service audiodumpinfo, which passes that property value unsanitized
to system(). This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.
The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive.
The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allow, allowing an unauthenticated visitor to make the amount due resolve to zero and obtain a confirmed appointment and a recorded order without completing any payment.
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing users with the Contributor role and above to register attacker-chosen prices for existing products, which any visitor can then use to add those products to the cart at that price.
The Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly sanitize and escape a value before using it in a SQL statement, which could allow users with the author role and above to perform SQL injection attacks.
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in full account takeover.
Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-type parameter are never parsed. Unauthenticated attackers can send application/x-www-form-urlencoded; charset=UTF-8 to keep ARGS_POST and REQUEST_BODY empty, evading body rules while the backend still processes the payload.
SvelteKit versions before 3.0.0 have a cross-site scripting (XSS) vulnerability in prerendered pages. This occurs because a cache-control header value set via setHeaders is inserted without proper escaping into a <meta http-equiv="cache-control"> tag. An attacker able to influence this untrusted value at prerender time can inject HTML or JavaScript that executes when users visit the page. The vulnerability is fixed in version 3.0.0.
vLLM versions prior to 0.31.0 have an improper access control vulnerability involving cache aliasing. Authenticated attackers can manipulate cache keys by supplying controlled values like EXIF ImageID or cache_salt, enabling them to access cached processed media or reuse key-value state from other requests. This vulnerability is fixed in version 0.31.0.
CVE-2026-114045 is a heap-based buffer overflow vulnerability in FreeRDP versions before 3.32.1. It occurs in the server-side rdpsnd channel due to an integer wraparound in the rdpsnd_server_select_format() function's DVI_ADPCM block-alignment arithmetic. A malicious RDP client can exploit this by sending two SNDC_FORMATS PDUs with an nBlockAlign value too small for nChannels, causing an unbounded heap write during server audio playback. This may enable remote code execution on the server.
A vulnerability in curl causes it to write cookie records exceeding line-length limits when a remote HTTP server sets long cookie names and values in a Netscape cookie jar. This results in subsequent curl invocations silently aborting cookie parsing upon encountering the overly long line, ignoring valid cookies that follow.
CVE-2026-87863 is a high-severity vulnerability in curl where an authenticated HTTPS origin can supply an HSTS max-age value that causes a failure in time serialization on 64-bit systems. This failure leads to truncation and loss of the HSTS cache file during save operations, but curl exits successfully without reporting the error, resulting in silent data loss.
CVE-2026-113714 is a low-severity vulnerability in pypa virtualenv prior to version 21.14.9. It involves improper validation of integrity check values during package wheel downloads, allowing a controlled package index to inject misleading verification data. This can cause the system to cache and later select unverified or rejected archives, potentially undermining package integrity verification. The issue is fixed in version 21.14.9.
A security vulnerability (CVE-2026-99999) affecting the Linux kernel in Red Hat Enterprise Linux 10.0 Extended Update Support has been addressed. The flaw involves improper validation of the checksum_start value in the IPv4 implementation. Red Hat has released a kernel update to fix this issue and recommends applying the update and rebooting the system. The update is rated as having an Important security impact.
CVE-2026-113708 is a critical argument injection vulnerability in Argo CD, a GitOps continuous delivery tool for Kubernetes. Versions from 2.7.0 up to but not including 3.3.15, 3.4.0-rc1 up to 3.4.10, 3.5.0-rc1 up to 3.5.4, and 3.6.0-rc1 up to 3.6.0-rc2 are affected. The issue arises because Kustomize passes certain query values to git fetch without an end-of-options separator, allowing a leading hyphen value to be interpreted as a git command option when using local file transport. This can lead to command execution inside the argocd-repo-server pod with the privileges of the repo-server user. An attacker with Application get permission on an existing Application can exploit this by committing malicious Kustomizations or uploading files, without needing update, sync, or repository write permissions. The vulnerability is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.
ApostropheCMS versions prior to 4.33.0 are affected by a cross-site scripting (XSS) vulnerability due to unsafe handling of meta refresh elements in the sanitize-html library before version 2.18.0. This flaw allows unsafe script or redirect destinations to be retained in the refresh content value under a non-default configuration. The issue is fixed in sanitize-html 2.18.0 and ApostropheCMS 4.33.0.
CVE-2026-86471 is a critical vulnerability in Apache CouchDB involving an unvalidated runtime configuration value. It affects at least version 1.6.0-0ubuntu7. The flaw has a high CVSS 4.0 score of 9.3, indicating network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No public exploits or known active exploitation have been reported. Patch or remediation status is not confirmed from the available data.
## Summary
ApostropheCMS widget styles support project-defined schema fields. If a project defines a free-form `string` style field with a CSS `property` and no selector, an editor-controlled value is rendered as an inline CSS declaration. The resulting declaration is then inserted into the widget wrapper's `style="..."` attribute without HTML-attribute escaping.
An attacker who can edit the widget can include a double quote in the style value, terminate the `style` attribute, and inject new HTML event-handler attributes. The payload is stored with the widget and executes in the Apostrophe site origin whenever the affected published page is rendered.
This is a sibling of CVE-2026-33889 / `GHSA-97v6-998m-fp4g`. The earlier issue escaped from a `<style>` element through a malicious color value. This variant reaches a different sink related to the automatically generated widget wrapper's inline `style` and `class` attributes.
## Details
### Root Cause 1: Free-form string style values retain HTML metacharacters
The standard string field converter uses `launder.string()` and length validation. This performs type normalization, not output encoding for an HTML attribute context:
[`packages/apostrophe/modules/@apostrophecms/schema/lib/addFieldTypes.js:296-333`](https://github.com/apostrophecms/apostrophe/blob/aa5170c7df9ff9ea5ac2e72a008f12e28dae6ca8/packages/apostrophe/modules/%40apostrophecms/schema/lib/addFieldTypes.js#L296-L333)
```javascript
self.addFieldType({
name: 'string',
// ...
convert(req, field, data, destination) {
destination[field.name] = self.apos.launder.string(data[field.name]);
destination[field.name] = checkStringLength(
destination[field.name],
field.min,
field.max
);
}
});
```
Quotes therefore remain in a value supplied through a style field.
### Root Cause 2: The value is converted into inline CSS without value validation
For a field with `property` but no `selector` or media query, `renderScopedStyles()` selects inline rendering. The generic extractor concatenates the configured property and editor-controlled value:
[`packages/apostrophe/modules/@apostrophecms/styles/ui/apos/universal/render.mjs:171-228`](https://github.com/apostrophecms/apostrophe/blob/aa5170c7df9ff9ea5ac2e72a008f12e28dae6ca8/packages/apostrophe/modules/%40apostrophecms/styles/ui/apos/universal/render.mjs#L171-L228)
[`packages/apostrophe/modules/@apostrophecms/styles/ui/apos/universal/render.mjs:598-647`](https://github.com/apostrophecms/apostrophe/blob/aa5170c7df9ff9ea5ac2e72a008f12e28dae6ca8/packages/apostrophe/modules/%40apostrophecms/styles/ui/apos/universal/render.mjs#L598-L647)
```javascript
rule = `${property}: ${normalized.value}${normalized.unit}`;
// ...
if (isInline) {
return {
css: '',
classes: [ ...storage.classes ],
inline: stringifyRules(storage.styles, true)
};
}
```
For example, the value below becomes part of a `font-family` declaration:
```text
serif" tabindex="0" autofocus onfocus="document.body.dataset.inline='executed'
```
### Root Cause 3: Attribute values are serialized without HTML escaping
`getWidgetAttributes()` places the inline CSS into an attribute tuple, then concatenates every tuple into `key="value"` without encoding `&`, `<`, `>`, `'`, or `"`:
[`packages/apostrophe/modules/@apostrophecms/styles/lib/methods.js:251-322`](https://github.com/apostrophecms/apostrophe/blob/aa5170c7df9ff9ea5ac2e72a008f12e28dae6ca8/packages/apostrophe/modules/%40apostrophecms/styles/lib/methods.js#L251-L322)
```javascript
if (styleParts.length) {
attrs.push(
[ 'style', `${styleParts.join(';')};` ]
);
}
if (options.asObject) {
return Object.fromEntries(attrs);
}
return attrs
.map(([ key, value ]) => `${key}="${value}"`)
.join(' ');
```
The same raw serializer also makes a project-defined free-form `string` style with `class: true` a potential sibling path, because the string is added to `classes` and later serialized into `class="..."`. The inline-property path was the path dynamically verified.
### Root Cause 4: The unsafe string is used by the automatic public wrapper
Styled widgets use `getWidgetAttributes()` to create a wrapper around the rendered widget:
[`packages/apostrophe/modules/@apostrophecms/widget-type/index.js:448-457`](https://github.com/apostrophecms/apostrophe/blob/aa5170c7df9ff9ea5ac2e72a008f12e28dae6ca8/packages/apostrophe/modules/%40apostrophecms/widget-type/index.js#L448-L457)
```javascript
if (hasStyles && self.options.stylesWrapper !== false) {
const styles = self.apos.styles.prepareWidgetStyles(widget);
const styleTag = self.apos.styles
.getWidgetElements(styles, { scene: req.scene });
const wrapperAttrs = self.apos.styles.getWidgetAttributes(styles);
return `${styleTag}<div${wrapperAttrs ? ' ' + wrapperAttrs : ''}>${markup}</div>`;
}
```
Consequently, the injected attribute is present on normal public page renders, not only in the editor UI.
### Why the CVE-2026-33889 defense does
Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates arrays sized by unvalidated extended section and program header counts. Attackers can supply a crafted 128-byte ELF file that triggers an OutOfMemoryError during load-spec discovery at import or in headless analysis pipelines.