Threats affecting pkg:generic/osquery

GitPython's Remote.pull() method improperly handles the positional refspec argument, allowing an attacker to inject a malicious --upload-pack option that bypasses the unsafe-option guard. This leads to arbitrary command execution with the privileges of the calling process when using local-path or SSH transports. The vulnerability affects Snakemake versions from 7.20.0 up to but not including 9.27.0_1. A fix is available in version 9.27.0_1.

CVE-2026-110857 is a vulnerability in Snakemake's use of GitPython where three Git command wrapper methods omit critical checks for unsafe protocols and options. This omission allows potential remote code execution (RCE) when using the ls_remote method with certain git transport protocols, specifically the 'ext' transport if permitted by the victim's git configuration. The merge_base and IndexFile.move methods also forward caller-controlled arguments without proper sanitization, creating latent injection surfaces. The vulnerability affects Snakemake versions from 5.5.3 up to but not including 9.27.0_1. A fix is available in version 9.27.0_1.

Snakemake's use of GitPython contains a regex vulnerability in the parse_actor_and_date function that causes quadratic backtracking on malformed author/committer/tagger identity lines missing or having malformed trailing epoch or timezone data. This results in CPU exhaustion when processing crafted commit or tag objects with long malformed identity lines. The issue affects Snakemake versions from 5.5.3 up to but not including 9.27.0_1. A fix is available in version 9.27.0_1 that modifies the regex to prevent backtracking.

GitPython's _clone() method improperly expands environment variables in the separate_git_dir parameter derived from attacker-controlled .gitmodules submodule names. This leads to leakage of environment variable values as directory names on disk and in debug logs when cloning and updating submodules from a malicious repository. The flaw affects GitPython versions from 5.5.3 up to but not including 9.27.0_1 and has been fixed in 9.27.0_1.

Two security vulnerabilities have been identified in the expat C library used for XML parsing. The first is a denial of service vulnerability caused by an integer overflow in the expat_realloc function (CVE-2026-102633). The second is an information disclosure vulnerability due to a heap buffer over-read in the XML_ParseBuffer function (CVE-2026-77214). Red Hat has issued an important security update for expat in Red Hat Enterprise Linux 8 to address these issues.

A heap-based buffer overflow vulnerability exists in Ghostscript when processing specially crafted TrueType fonts or documents embedding them. This flaw arises from an accounting error during font rendering that bypasses buffer size checks. Exploitation requires local access with high privileges and user interaction, potentially leading to denial of service or arbitrary code execution on affected Red Hat Enterprise Linux 10 systems.

CVE-2026-118959 is a vulnerability in the Red Hat Build of Keycloak involving improper authentication. The flaw arises when the kc_action query parameter is set to a mandatory user action, such as profile verification or terms acceptance. Due to incorrect handling, Keycloak may skip these mandatory challenges and issue an authorization code, allowing users to bypass administrative requirements. Exploitation requires valid user credentials and affects only specific mandatory actions. No patch or mitigation meeting Red Hat's criteria is currently available.

CVE-2026-118947 is a vulnerability in the UMA resource registration endpoint of the keycloak-services component in Red Hat Build of Keycloak. When remote resource management is enabled, an authenticated user with the uma_protection role and knowledge of a target resource ID can update resources they do not own. This allows unauthorized modification of resource configurations such as names, URIs, and scopes. Exploitation requires valid credentials and specific permissions. The vulnerability is due to a missing ownership check in the resource registration code path.

GitPython's Submodule.move() API does not properly handle symbolic links in intermediate path components, allowing an attacker-controlled symlink to redirect submodule moves outside the parent repository worktree. This can cause the submodule checkout to be moved to an attacker-chosen directory outside the repository, corrupting the repository's index and configuration state. The issue affects GitPython 3.1.62 and the current main branch. No code execution or confidentiality impact has been demonstrated.

GitPython versions up to 3.1.62 contain a vulnerability in the Head.checkout() method where an attacker-controlled branch name can be used to perform an arbitrary file read. This occurs because the branch name is passed as a positional argument to git checkout without proper sanitization or argument separation, allowing injection of git options like --pathspec-from-file. The flaw was incompletely fixed in prior advisories, leaving Head.checkout vulnerable. An attacker who can cause the application to clone a repository they control can exploit this to read any file accessible by the application process, with no authentication or privileges required.