Search: ge.call

A symlink swap race condition in the SoftFileLock implementation allows a local user with write access to the lock directory to leak one bit of information about whether a path exists and is writable by the lock user. This occurs because the writability check follows symlinks after an lstat call, enabling a time-of-check to time-of-use (TOCTOU) leak. The vulnerability affects filelock versions 3.32.6 through 4.2.0 and is mitigated on Linux by the fs.protected_symlinks kernel setting in sticky world-writable directories like /tmp. The impact is limited to leaking existence and writability of a chosen path, with no integrity or availability effects. The vulnerability is rated low severity with a CVSS score of 2.5 due to high attack complexity and limited information leakage.

The filelock library's ReadWriteLock and AsyncReadWriteLock use an SQLite-backed lock database that runs PRAGMA journal_mode=MEMORY on every acquire, causing SQLite to load the entire schema of the lock file. A local unprivileged user who can create or overwrite the lock database file can craft a malicious database that causes every acquire_read or acquire_write call to stall indefinitely, ignoring timeout and blocking flags. This results in a denial of service affecting availability only, with no confidentiality or integrity impact. The issue affects filelock versions 3.20.4 through 4.2.0. A fix is available in version 4.7.0_1.

The Model Context Protocol (MCP) Python SDK client versions 1.10.0 through 1.29.1 and 2.0.0 through 2.1.1 have a vulnerability where the client fetches server-chosen $ref URLs during tool output schema validation. This causes the client to synchronously request external HTTP, HTTPS, or local file URLs on every tool call, potentially stalling the client if the target is unresponsive. The issue is fixed in versions 1.30.0 and 2.2.0 or later by restricting reference resolution to within the schema document only.

GitPython's Repo._clone() method improperly expands environment variables in the separate_git_dir parameter derived from attacker-controlled .gitmodules submodule names. This leads to leakage of environment variable values as directory names on disk and in debug logs when cloning and updating submodules from a malicious repository. The vulnerability arises because Git.polish_url() is called without disabling variable expansion on untrusted input, contrary to other similar call sites. This can expose sensitive environment variables persistently on disk and in verbose logs.

UnixFileLock, used by FileLock and AsyncFileLock on Unix systems, truncates and changes permissions of any regular file that another local user renames or hard-links onto the lock path before the lock user's next acquire call. This can lead to unintended file truncation and permission changes, allowing the other user to read and modify the file contents subsequently. The vulnerability affects all filelock releases up to and including 4.2.0, with the chmod behavior introduced since version 3.10.2. Exploitation requires local access and specific directory and kernel conditions, such as writable non-sticky directories or disabled fs.protected_hardlinks on Linux. The issue is fixed in filelock versions 2.9.3_2 and 2.29.3.

GitPython's Submodule.move() function does not properly handle symbolic links in intermediate path components of the destination, allowing an attacker-controlled symlink to redirect the move operation outside the parent repository worktree. This can cause the submodule checkout to be moved to an attacker-chosen directory outside the repository, corrupting the repository's index and configuration state. The issue affects GitPython 3.1.62 and the current main branch. The vulnerability requires the attacker to control the cloned repository and commit a symlink, and the application must explicitly call Submodule.move() with a path under that symlink. No automatic clone or update triggers this. The impact is an integrity violation with no demonstrated confidentiality or code execution impact. A fix is available in GitPython version 0.22.2.

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), TLS record processing, process() to process the relevant input or security decision. node-forge processed received TLS records recursively, consuming one JavaScript stack frame per record in a single input chunk. A remote peer could send thousands of small records together and exhaust the call stack, causing an uncaught exception and denial of service. This issue is fixed in version 1.4.1.

CVE-2026-102276 is a denial of service vulnerability in the brace-expansion component used by Red Hat Satellite's Lightspeed feature. An unauthenticated remote attacker can submit specially crafted brace patterns with excessive nested groups or large arrays, causing uncontrolled recursion that exhausts the call stack and crashes the application process. This results in service interruption but does not allow code execution or data compromise. No patch or mitigation meeting Red Hat's criteria is currently available.

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate sub-components to exceed the per-instance cap many times over, causing unbounded host memory growth.

Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability that allows a WebAssembly guest to trigger a host panic by transcoding overlapping strings in fused adapters. Attackers can make a same-instance component-to-component call transferring a string whose source and destination alias each other, crashing the host instead of raising a trap.

Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompt injection to make the agent call pandas.read_pickle on attacker-controlled paths for code execution, or call other readers to read local files.

JeeSite 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that allows authenticated users to access other users' conversations due to missing and reversed ownership checks. Attackers who know or derive a victim's conversation id can call /a/cms/chat/message, /a/cms/chat/delete, or /a/cms/chat/completions to read, delete, or append to the victim's AI chat transcripts.

Red Hat Discovery is a tool that inspects and reports environment data about Red Hat products on a network. Multiple vulnerabilities have been identified in components related to this tool, including a notable denial of service (DoS) vulnerability in the brace-expansion library used by Node.js services. This specific flaw allows unauthenticated remote attackers to crash services by submitting specially crafted patterns that exhaust the call stack. Red Hat has not yet released fixes for these vulnerabilities and currently does not offer mitigations that meet their criteria for ease of use and stability.