Threats affecting pkg:bitnami/brotli

A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypass buffer size checks, triggering a heap-based buffer overflow. A remote attacker could exploit this by enticing a victim or automated service to open the malicious content, potentially resulting in a Denial of Service (DoS) crash or arbitrary code execution.

CVE-2026-118959 is a vulnerability in the Red Hat Build of Keycloak involving improper authentication. The flaw arises when the kc_action query parameter is set to a mandatory user action, such as profile verification or terms acceptance. Due to incorrect handling, Keycloak may skip these mandatory challenges and issue an authorization code, allowing users to bypass administrative requirements. Exploitation requires valid user credentials and affects only specific mandatory actions. No patch or mitigation meeting Red Hat's criteria is currently available.

CVE-2026-118947 is a vulnerability in the UMA resource registration endpoint of the keycloak-services component in Red Hat Build of Keycloak. When remote resource management is enabled, an authenticated user with the uma_protection role and knowledge of a target resource ID can update resources they do not own. This allows unauthorized modification of resource configurations such as names, URIs, and scopes. Exploitation requires valid credentials and specific permissions. The vulnerability is due to a missing ownership check in the resource registration code path.

GitPython's Submodule.move() API does not properly handle symbolic links in intermediate path components, allowing an attacker-controlled symlink to redirect submodule moves outside the parent repository worktree. This can cause the submodule checkout to be moved to an attacker-chosen directory outside the repository, corrupting the repository's index and configuration state. The issue affects GitPython 3.1.62 and the current main branch. No code execution or confidentiality impact has been demonstrated.

GitPython's Remote.pull() method improperly handles its positional refspec argument, allowing an attacker controlling this input to inject a --upload-pack option that bypasses unsafe option guards. This leads to arbitrary command execution with the privileges of the calling process when pulling from local-path or SSH transports. The vulnerability arises because the unsafe option check only inspects keyword arguments, not the positional refspec, and git pull forwards the refspec to an internal fetch without a separator, enabling the injected option to be executed.

GitPython versions 2.12.0 and later contain vulnerabilities in three wrapper methods that omit critical unsafe protocol and option checks. The ls_remote method forwards URLs without checking for unsafe protocols, allowing remote code execution (RCE) if the victim's git transport policy permits the 'ext' transport. The merge_base and IndexFile.move methods forward caller-controlled arguments without proper option checks, creating latent argument-injection surfaces. These issues were verified on the main branch as of September 2026 and remain unpatched in the latest release 3.1.62. The severity is high due to the potential for RCE in certain configurations.

A regular expression in GitPython's parse_actor_and_date() function can cause quadratic backtracking on malformed author/committer/tagger lines missing or having malformed trailing epoch or timezone data. This leads to CPU exhaustion when processing crafted commit or tag objects. The issue affects GitPython versions from 2.12.0 onward. A fix has been proposed to change the regex pattern to eliminate the backtracking.

GitPython's _clone() method improperly expands environment variables in the separate_git_dir parameter derived from attacker-controlled .gitmodules submodule names. This leads to leakage of environment variable values as directory names on disk and in debug logs when cloning and updating submodules from a malicious repository. The flaw arises because Git.polish_url() is called without disabling variable expansion on untrusted input. This vulnerability affects GitPython versions starting from 2.12.0 and has a CVSS score of 6.5.

GitPython versions up to 3.1.62 contain a vulnerability in the Head.checkout() method where an attacker-controlled branch name can be used to perform an arbitrary file read. This occurs because the branch name is passed as a positional argument to git checkout without proper sanitization or argument separation, allowing injection of git options like --pathspec-from-file. The flaw was incompletely fixed in prior advisories, leaving Head.checkout vulnerable. An attacker who can cause the application to clone a repository they control can exploit this to read any file accessible by the application process, with no authentication or privileges required.

Out of bounds read in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Improper input validation in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Integer overflow in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)