Node.js versions 22.23.3, 24.22.0, and 26.12.0 contain a flaw in the filesystem permission model where fs.realpathSync() does not enforce required read permission checks. This incomplete fix of a previous vulnerability allows code running with restricted filesystem read permissions to bypass these restrictions and access filesystem paths outside permitted directories. The vulnerability has a low severity score and does not impact integrity or availability.
Tandoor Recipes versions from 2.0.0 up to but not including 2.7.0 contain a server-side request forgery (SSRF) vulnerability in the Pestle importer. This flaw allows authenticated low-privileged users to craft malicious image URLs in Pestle JSON import files that cause the server to issue arbitrary GET requests. The vulnerability arises from a raw requests.get call that bypasses the application's centralized SSRF protections, enabling attackers to access internal-only endpoints, perform port and service discovery, and exfiltrate internal responses via stored recipe images.
The jobwharf package on PyPI version 0.1.0 is part of a malicious campaign involving loader packages that execute code from remote URLs. These packages do not contain the payload themselves but facilitate downloading and running malicious scripts. The campaign is coordinated and intended to deceive users into executing harmful code.
The PyPI package 'slatejob' version 0.1.0 is part of a malicious campaign involving loader packages that download and execute remote malicious scripts. Although the package itself does not contain the payload, it acts as a delivery mechanism for potentially harmful code. This coordinated campaign aims to provide multiple deceptive methods to load malicious code remotely.
The reedworker package on PyPI version 0.1.0 is part of a malicious campaign involving loader packages that execute code from remote URLs. These packages do not contain the malicious payload themselves but are designed to download and run remote malicious scripts, indicating a coordinated effort to facilitate malicious code execution.
The loadferry package on PyPI version 0.1.0 is part of a coordinated malicious campaign involving loader packages that download and execute remote malicious scripts. Although the package itself does not contain the payload, its functionality enables execution of potentially harmful code from external sources.
The runpier package on PyPI version 0.1.0 is part of a coordinated campaign involving multiple loader packages designed to download and execute remote malicious scripts. Although the package itself does not contain the payload, its functionality enables execution of potentially harmful code from external sources. This campaign is identified as malicious with intent similar to infostealers.
The sedgehaul package on PyPI version 0.1.0 is part of a coordinated malicious campaign involving loader packages that download and execute remote malicious scripts. These packages do not contain the payload themselves but serve as deceptive loaders to facilitate malicious code execution. The campaign is identified as having clear malicious intent, including potential infostealing activities.
The taskquay package on PyPI version 0.1.0 is part of a malicious campaign involving loader packages that download and execute remote malicious scripts. While the packages themselves do not contain the payload, their coordinated use facilitates executing harmful code from external sources. This campaign is identified as having clear malicious intent, such as infostealing.
The marshrunner package on PyPI version 0.1.0 is part of a coordinated malicious campaign involving loader packages that execute code from remote URLs. Although the packages themselves do not contain the payload, they facilitate downloading and executing remote malicious scripts. This campaign is identified as having clear malicious intent, including potential infostealing activities.
The 'workslip' package on PyPI version 0.1.0 is part of a malicious campaign involving loader packages that execute code from remote URLs. Although the packages themselves do not contain the payload, they serve as a mechanism to download and run malicious scripts. This coordinated campaign aims to provide multiple deceptive methods to load malicious code remotely.
The brookworker package on PyPI version 0.1.0 is part of a malicious campaign involving loader packages that download and execute remote malicious scripts. These packages do not contain the payload themselves but serve as deceptive loaders to execute code from external URLs. The campaign is identified as having clear malicious intent, such as infostealing.
The cobbleload package on PyPI version 0.1.0 is part of a coordinated campaign involving multiple loader packages designed to download and execute remote malicious scripts. Although the package itself does not contain the payload, its functionality enables execution of potentially harmful code from external URLs. This campaign is identified as malicious with intent similar to infostealers.
The brambletask package on PyPI version 0.1.0 is part of a coordinated malicious campaign involving loader packages that execute code from remote URLs. Although the packages themselves do not contain the payload, they facilitate downloading and executing remote malicious scripts. This campaign is identified as having clear malicious intent, such as infostealing.
The ferretqueue package on PyPI version 0.1.0 is part of a malicious campaign involving loader packages that execute code from remote URLs. These packages do not contain the malicious payload themselves but serve as a mechanism to download and run malicious scripts. The campaign is coordinated and aims to provide multiple deceptive methods to load malicious code remotely.
The otterload package on PyPI version 0.1.0 is part of a coordinated campaign involving multiple loader packages designed to download and execute remote malicious scripts. Although the packages do not contain the payload themselves, their intent is clearly malicious, facilitating the execution of potentially harmful code from external sources.
The badgertask package on PyPI version 0.1.0 is part of a coordinated campaign involving multiple loader packages designed to download and execute remote malicious scripts. While the packages themselves do not contain the payload, their intent is clearly malicious, facilitating the execution of potentially harmful code from external sources.
The larchworker package on PyPI version 0.1.0 is part of a malicious campaign involving loader packages that execute code from remote URLs. Although the package itself does not contain the payload, it facilitates downloading and executing remote malicious scripts, indicating coordinated malicious intent.
The thornqueue package on PyPI version 0.1.0 is part of a malicious campaign involving loader packages that download and execute remote malicious scripts. These packages do not contain the payload themselves but serve as a mechanism to load malicious code from external URLs. This coordinated campaign aims to provide multiple deceptive methods to execute malicious code remotely.
The thistlerun package on PyPI version 0.1.0 is part of a coordinated malicious campaign involving loader packages that download and execute remote malicious scripts. While the packages themselves do not contain the payload, their intent is to facilitate execution of harmful code from external sources.