Threats affecting pkg:npm/xauendevs/lagarto-chivato

CVE-2026-126815 is an improper authentication vulnerability in XauenDevs Lagarto Chivato versions 0.1.0 through 0.4.2. It allows remote unauthenticated attackers to hijack accounts by planting a password on an unregistered email address that becomes valid when the victim first logs in without a password. This flaw affects the authentication flow and can lead to account takeover.

CVE-2026-126784 is a resource allocation vulnerability in Lagarto Chivato versions 0.1.0 through 0.4.1. The publicar_aviso RPC function lacks rate limiting, per-account submission quotas, and geographic validation, allowing remote authenticated users to flood the moderation queue with unlimited notice submissions containing arbitrary coordinates. This can lead to denial of service by exhausting moderation resources.