Threats affecting pkg:npm/@thi.ng/paths

A vulnerability (CVE-2026-6726, also known as TCGVRT0010) has been identified in the Trusted Computing Group's TPM 2.0 reference implementation code, affecting all published revisions of the code (v1.16, v1.38, v1.59, v1.83, v184). This flaw could allow a privileged local attacker to obtain credentials from a TPM-aware Certificate Authority for a falsified TPM key, enabling the creation of fraudulent TPM 2.0 attestations. Google will proactively update affected systems during standard maintenance windows, and no customer action is required.

An incorrect authorization vulnerability (CVE-2026-85299) was discovered in Google Cloud Compute Engine versions prior to August 31, 2026. This flaw allowed users to exfiltrate disk data without having the required IAM permissions. The vulnerability was patched on August 31, 2026, and no action is required from users.

CVE-2026-116506 is a critical command injection vulnerability in the TOTOLINK A950RG router, specifically affecting version 4.1.2cu.5268_B20221104. The flaw exists in the apmib_set function within the firewall.so component. This vulnerability allows remote attackers to execute arbitrary commands on the device. Public exploit code has been disclosed, but no known active exploitation in the wild has been reported.

A resource exhaustion vulnerability exists in seroval versions from 1.4.1 up to but not including 1.6.8. The fromJSON and fromCrossJSON functions do not properly validate that an array node's element list is an actual array, allowing an attacker to supply a crafted length that controls memory allocation and processing iterations. This can lead to denial of service by exhausting process memory or blocking the thread. The issue is a residual bypass of a previous fix and is resolved in version 1.6.8.

A cross-site scripting (XSS) vulnerability exists in the lxsmnsyc seroval library versions 1.6.0 through 1.6.10. The issue arises because the JavaScript-output APIs derive a typed array's constructor name from a property that can be attacker-controlled if untrusted properties are copied onto a typed array and then serialized. This allows execution of attacker-controlled JavaScript in the context of the receiving page. The vulnerability is fixed in version 1.6.11.

A cross-site scripting (XSS) vulnerability exists in the lxsmnsyc seroval library's JavaScript-output APIs prior to version 1.0.0 and from 1.5.5 up to but not including 1.6.10. The issue arises when regular expressions containing a less-than character are serialized without proper escaping for embedding in HTML script elements. This can allow an attacker to inject malicious scripts if untrusted input is serialized and embedded in a web page. The vulnerability is fixed in version 1.6.10.

CVE-2026-116505 is a critical command injection vulnerability in TOTOLINK A950RG version 4.1.2cu.5268_B20221104. It affects the getDeviceInfo function related to the /var/lib/misc/udhcpd.leases file in the device-information handler. The flaw allows remote attackers to inject commands by manipulating the MAC address argument. Public exploit code is available, increasing the risk of exploitation.

A vulnerability in Apple iOS and iPadOS prior to version 27.2 could allow an app to access sensitive user data due to an authorization issue. This flaw was addressed by improved state management in iOS 27.2 and iPadOS 27.2. The issue also affects macOS Golden Gate and visionOS 27.2, where it has been fixed. No public exploit or in-the-wild exploitation is currently known.

A heap corruption vulnerability exists in Apple iOS and iPadOS due to improper bounds checking when processing maliciously crafted images. This buffer overflow issue has been addressed in iOS 26.7.2, iPadOS 26.7.2, iOS 27, iPadOS 27, and macOS versions including Golden Gate 27, Sequoia 15.8, Tahoe 26.7.2, and visionOS 27. Processing a specially crafted image could lead to heap corruption, potentially impacting system stability or security.

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination.

A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A local attacker may be able to elevate their privileges.

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination.

A buffer overflow vulnerability in Apple iOS and iPadOS could allow memory corruption when processing a maliciously crafted audio file. This issue affects versions prior to iOS and iPadOS 26.7.2 and 27.2. Apple has fixed the vulnerability in iOS 26.7.2, iPadOS 26.7.2, iOS 27.2, and iPadOS 27.2. No public exploit or in-the-wild exploitation has been reported.

A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to modify protected parts of the file system.

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or read kernel memory.

A null pointer dereference vulnerability in Apple iOS and iPadOS could allow an app to cause unexpected system termination. This issue has been addressed with improved input validation and fixed in iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7.2, tvOS 27, visionOS 27, and watchOS 27.

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to an unexpected process crash.

An authorization issue was addressed with improved access control. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. An app may be able to access sensitive user data.

A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted file may bypass Gatekeeper checks.