---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (1dcfb8ede925ca9e0cf7574c2ba3f81ced56682ef6c54439cc00ad5fc5b960fd)
The package's preinstall lifecycle script runs automatically on `npm install`. It reads the installer's username (from USER/USERNAME environment variables) and the machine hostname (via os.hostname()), then embeds those identifiers along with the package name and a timestamp into both a DNS lookup and an HTTPS GET request directed at a hardcoded Burp Collaborator subdomain, 4otph6fase1x2won0hrfzul2wt2qqge5.oastify.com. The package name and scope (@wbnr) and its self-description indicate a dependency-confusion payload targeting an internal organization scope; any environment that resolves @wbnr/design from public npm will leak installer host identifiers to the attacker-controlled out-of-band endpoint. The 'harmless bug bounty PoC' framing in the package description does not change the observable behavior: installer-owned identifiers leave the machine to a third-party OOB collector on install.
## Source: ossf-package-analysis (dbd908eecacbb587e9534c244be33296e6fa11092200cba8428351bb66afe844)
The OpenSSF Package Analysis project identified '@wbnr/design' @ 99.3.0 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
This security update provides a functional equivalent of RHSA-2026:62583.
The original Red Hat(R) advisory is available from the Red Hat web site at
https://access.redhat.com/errata/RHSA-2026:62583.
## Summary
When an application using Pydantic AI opts a URL into `force_download='allow-local'` (which disables the default block on private/internal IPs), the cloud-metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form (IPv4-mapped IPv6, 6to4, or NAT64). Dual-stack and translated networks route the IPv6 wrapper to the underlying IPv4 endpoint, exposing cloud IAM short-term credentials.
This is an incomplete fix of [GHSA-2jrp-274c-jhv3](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-2jrp-274c-jhv3) / [CVE-2026-25580](https://nvd.nist.gov/vuln/detail/CVE-2026-25580). The parent advisory's remediation guaranteed that "cloud metadata endpoints are always blocked, even with `allow-local`." That guarantee did not hold for IPv6-encoded forms of the metadata IPs.
## Severity
Same impact metrics as the parent CVE, but materially narrower attack surface (AC:H instead of AC:L), because exploitation requires the application to have opted into `allow-local` on a URL influenced by untrusted input.
## Who Is Affected
Applications are affected **only if** they explicitly opt for `FileUrl` (`ImageUrl`, `AudioUrl`, `VideoUrl`, `DocumentUrl`) into `force_download='allow-local'` on a URL that is, or could be, influenced by untrusted input.
Applications are **not** affected if they use any of the bundled integrations to ingest user input, because they do not propagate `force_download` from external data:
- `Agent.to_web` / `clai web`
- `VercelAIAdapter`
- `AGUIAdapter` / `Agent.to_ag_ui`
Applications that only download from developer-controlled URLs are not affected.
## Remediation
Upgrade to `1.99.0` or later. The cloud-metadata and private-IP blocklists now apply to IPv6 transition forms that route to a blocked IPv4 endpoint (IPv4-mapped IPv6, 6to4, and NAT64 well-known prefix). The blocklists have also been extended to cover additional IANA-reserved IPv4 and IPv6 special-purpose ranges.
## Workaround for Unpatched Versions
Avoid passing `force_download='allow-local'` on any URL that could be influenced by untrusted input. If developers must, resolve the hostname themselves and validate the result against their own metadata blocklist — including IPv6-encoded forms — before constructing the `FileUrl`.
## Credits
Reported by [j0hndo](mailto:dohyun4466@gmail.com).
An update is now available for the Red Hat build of Cryostat 4 on RHEL 9.
Security Fix(es):
* netty-handler: Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416)
* netty-resolver-dns: Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674)
* netty-handler: Improper trust manager handling leads to hostname verification bypass (CVE-2026-50010)
* io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691)
* netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers (CVE-2026-48059)
* netty-codec-http2: Denial of Service due to resource leak (CVE-2026-48043)
* netty-codec-haproxy: Denial of Service via malformed HAProxy message (CVE-2026-44893)
* netty-handler: IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249)
* io.quarkus/quarkus-vertx-http: Authorization bypass in HTTP path-based policies via encoded characters (CVE-2026-50559)
* jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512)
* jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513)
* eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name (CVE-2026-6860)
* golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation (CVE-2026-46595)
* golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829)
* golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions (CVE-2026-39828)
* golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835)
* golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830)
* golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)
* golang.org/x/net/html: Cross-Site Scripting allowing arbitrary code execution (CVE-2026-25681)
* golang.org/x/image/tiff: Denial of Service via crafted PackBits-compressed data (CVE-2026-46599)
* github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: Integer Overflow in Avro Decoder (CVE-2026-46384)
* github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: CPU Exhaustion in Avro Decoder via Unbounded Block-Count Iteration (CVE-2026-46385)
* net: golang: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
* mime: golang: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)
* form-data: Form field override via CRLF injection (CVE-2026-12143)
* ws: Denial of Service via memory exhaustion from small WebSocket fragments (CVE-2026-48779)
* ws: Uninitialized memory disclosure via websocket.close() with TypedArray (CVE-2026-45736)
* undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
* undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
* undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)
* js-cookie: Cookie attribute manipulation via prototype pollution (CVE-2026-46625)
* brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)
* protobufjs: Denial of Service via crafted schema (CVE-2026-44290)
* protobufjs: Data integrity impact due to prototype pollution (CVE-2026-44292)
* protobufjs: Denial of Service via crafted JSON descriptors (CVE-2026-45740)
* protobufjs: Arbitrary Code Execution via prototype pollution (CVE-2026-44291)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the target site.
Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins.
CVE-2026-65943 is a high severity vulnerability in the RO CSVI extension for Joomla by rolandd.com. It allows unauthenticated attackers to create directories due to improper access control in versions prior to 9.11.0. The vulnerability does not require user interaction or privileges and impacts confidentiality but not integrity or availability.
A cross-site scripting (XSS) vulnerability exists in the RO CSVI extension for Joomla versions 1.0.0 through 9.11.0. The issue arises from improper neutralization of input in AJAX endpoint handlers, allowing potential injection of malicious scripts. This vulnerability has a medium severity rating with a CVSS score of 6.1. No official patch or remediation guidance is currently available from the vendor.
Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can be created by the attacker.
A critical remote code execution vulnerability exists in the Aimy Captcha-Less Form Guard plugin for Joomla versions 18.0 through 20.0. This vulnerability arises from deserialization of untrusted data via a forged 'clfgd' field, enabling PHP object injection. The flaw allows unauthenticated attackers to execute arbitrary code on the affected system without user interaction.
Multiple npm packages across @tanstack, @mistralai, @uipath, @squawk, and safe-action namespaces were compromised in a worm-like attack affecting over 50 packages. The malicious code executes during installation, downloading the Bun runtime and running a payload that harvests GitHub credentials and cloud secrets. The attack specifically targets AWS environments by querying the IMDS and attempting privilege escalation through STS and SSM endpoints across multiple regions. Stolen credentials are automatically used to publish additional malicious package versions across different maintainer accounts, creating a self-propagating infection chain. The attack patterns mirror previous Shai-Hulud compromises, using a drop-and-execute technique and command-and-control infrastructure at git-tanstack.com, a domain designed to mimic legitimate tanstack.com traffic. Organizations should rotate GitHub credentials, audit AWS credentials, and check for suspicious activity.
Red Hat Advanced Cluster Management for Kubernetes provides the
capabilities to address common challenges that administrators and site
reliability engineers face as they work across a range of public and
private cloud environments. Clusters and applications are all visible and
managed from a single console—with security policy built in.
This advisory contains the container images for Red Hat Advanced Cluster
Management for Kubernetes, which add new features and enhancements, bug
fixes, and updated container images. See the following
Release Notes documentation, which will be updated shortly for this
release, for additional details about this release:
https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.13/html-single/release_notes/index#acm-release-notes
A lexical path validation flaw in the SanitizeFilePath function of github.com/fission/fission allowed sibling-directory escape due to improper use of strings.HasPrefix without enforcing path-separator boundaries. This permitted tenants controlling sibling directories to read or write outside intended safe directories. The issue affected all versions through v1.24.0 and was fixed in v1.25.0 by replacing SanitizeFilePath with kernel-enforced directory confinement helpers.