Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start() during decryption through forge.cipher.createDecipher(). When an application derived tagLength from received data or used an unset or zero-like configuration value, a value that converted to zero together with an empty or missing authentication tag caused the calculated and supplied tags to compare as empty, so decipher.finish() accepted unauthenticated ciphertext. Applications that omit tagLength to use the 128-bit default or pass a fixed valid tag length are unaffected. This issue is fixed in version 1.4.1.
ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This vulnerability could enable an authenticated user with the admin role to bypass Rhino sandbox restrictions and execute arbitrary code on the underlying host operating system, potentially enabling further unintended access.
ServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
A vulnerability in digitalbazaar forge prior to version 1.4.1 allows bypassing password-based integrity checks in PKCS#12 processing due to acceptance of zero or negative iteration counts. This leads to predictable encryption keys and IVs in certain PKCS#12 password-based encryption schemes, compromising integrity verification. The issue is fixed in version 1.4.1.
ServiceNow has addressed a domain separation bypass security issue that was identified in the ServiceNow SR – CSM – Task Plan Templates Store application. This vulnerability could enable an authenticated user with a specific role to create records in domains they do not have access to, potentially leading to unauthorized data creation across domain boundaries.
We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
CVE-2026-118781 is a low severity vulnerability in the digitalbazaar forge library prior to version 1.4.1. The issue is an infinite loop triggered by the BigInteger.prototype.modInverse() function when it receives a negative value or modulus during RSA key generation or direct calls. This can cause the Node.js event loop to block at full CPU usage. The vulnerability cannot be triggered by parsed DER, PEM, JWK, PKCS#12, X.509, or TLS values as they are unsigned. The issue is fixed in forge version 1.4.1.
A vulnerability in digitalbazaar's forge (node-forge) prior to version 1.4.1 involves improper certificate validation. The issue occurs during the verification of certificate chains when certificates share a subject name, causing the CA store to be modified incorrectly. This can lead to the permanent removal of trusted CA certificates from the store, resulting in persistent availability issues for applications that reuse the store. The vulnerability is fixed in version 1.4.1.
The orderbook-volt-plugin npm package versions 0.0.0-stage, 0.0.1, and 0.0.2 contain malicious code. Any computer with this package installed or running should be considered fully compromised. Secrets and keys stored on the affected system must be rotated immediately from a different, clean machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in pem.decode(), including when searching for a matching END line and parsing encapsulated headers. An unauthenticated attacker able to supply PEM input to any high-level parser could consume excessive CPU with a long malformed message and cause denial of service. This issue is fixed in version 1.4.1.
A NULL pointer dereference vulnerability exists in digitalbazaar's forge library prior to version 1.4.1. The TLS client incorrectly checks the server certificate presence, leading to a crash when a malicious server omits the Certificate message. This results in an uncaught exception that terminates the connection or process. The issue is fixed in version 1.4.1.
A prototype pollution vulnerability exists in digitalbazaar forge versions prior to 1.4.1. The forge.http client improperly stores cookie names and paths from Set-Cookie headers in plain JavaScript objects, allowing a malicious server to manipulate Object.prototype properties via specially crafted cookie names such as __proto__ or constructor. This can lead to modification or deletion of inherited properties. The issue is fixed in version 1.4.1.
ServiceNow has remediated an information disclosure vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could cause a user's plaintext password to be persisted in a system table, potentially exposing that password to a user who otherwise would not be entitled to view it.
ServiceNow remediated the vulnerability through security updates that address the unintended persistence of plaintext credentials. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
A vulnerability in digitalbazaar's forge library (prior to version 1.4.1) involves improper input validation of PKCS#7 padding during CBC and ECB mode decryption. The library only validated the final byte of padding and accepted malformed padding, which could lead to silent removal of up to four plaintext blocks. This causes an integrity failure in applications relying on successful decryption as proof of valid padding. The issue is fixed in version 1.4.1.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer() in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encoded it with asn1.oidToDer() could emit DER representing a different, trusted OID from the one that was checked. DER parsing is not affected. This issue is fixed in version 1.4.1.
The react-native-drago-callkit npm package contains malicious code that can fully compromise any computer on which it is installed or running. This compromise may allow an attacker to gain full control over the affected system. Immediate removal of the package is recommended, but due to the potential for persistent malicious software, complete remediation may require additional measures such as rotating all secrets and keys from a different, secure computer.
A cryptographic signature verification flaw exists in digitalbazaar's forge library versions prior to 1.4.1. The vulnerability involves improper verification of the signature scheme, where the library incorrectly uses the issuer certificate's RSA padding and RSASSA-PSS parameters instead of those from the child certificate. This could allow a child certificate labeled as RSASSA-PSS to be accepted with a PKCS#1 v1.5 signature if the issuer uses PKCS#1 v1.5. The flaw does not allow certificate identity forgery but may bypass policies enforcing specific signature schemes. The issue is resolved in version 1.4.1.
A security vulnerability in flatpak-builder allows host code execution via the execution of a git am hook during patch source extraction when using the 'use-git-am' option. This issue is identified as CVE-2026-86320 and affects Red Hat Enterprise Linux 8.4 versions. Red Hat has issued a security update to address this vulnerability.
SuperAGI versions up to 0.0.14 have an improper access control vulnerability in the agent controller endpoint /api/agents/get/project/{project_id}. This flaw allows authenticated users from one organization to access the full list of agents belonging to projects of other organizations, due to lack of verification that the project_id belongs to the user's organization. The issue is fixed in version 0.0.15.
SuperAGI version 0.0.14 has an improper access control vulnerability in the get_agent_by_latest_execution function. This flaw allows a remote authenticated attacker from one organization to access the latest execution and agent metadata of another organization's project by providing the victim's project ID via a specific API endpoint.
TransformerOptimus SuperAGI version 0.0.14 has an incorrect access control vulnerability in the get_agent_execution_configuration function. This flaw allows a remote authenticated attacker from one organization to access another organization's agent execution configuration by providing specific agent and execution IDs. The affected endpoint does not verify organization ownership, leading to unauthorized data exposure.
OpenBMB XAgent version 1.0.0 contains a directory traversal vulnerability in the main-upload_file function located in ToolServer/ToolServerNode/main.py at line 46. This vulnerability could allow an attacker to access files outside the intended directory structure.