Threats Tagged 'cve-2026-2950'

Red Hat Developer Hub (RHDH) is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters (AKS, EKS, GKE). The core features of RHDH include a single pane of glass, a centralized software catalog, self-service via golden path templates, and Tech Docs. RHDH is extensible by plugins.

This update includes the following RPMs: rust-rpm-sequoia: * rpm-sequoia-1.10.1.1-1.2.hum1 (aarch64, x86_64) * rpm-sequoia-devel-1.10.1.1-1.2.hum1 (aarch64, x86_64) * rust-rpm-sequoia-1.10.1.1-1.2.hum1.src (src) Security Fix(es): rust-rpm-sequoia: * CVE-2026-2625

This update includes the following RPMs: yarnpkg: * yarnpkg-1.22.22-18.1.hum1 (aarch64, x86_64) * yarnpkg-1.22.22-18.1.hum1.src (src)

This update includes the following RPMs:

Multiple security vulnerabilities have been identified in the Node.js 22 package distributed with Red Hat Enterprise Linux 10.0 Extended Update Support. These include a denial of service, uninitialized memory exposure, and file permissions bypass issues. Red Hat has issued an important security advisory (RHSA-2026:2899) addressing these vulnerabilities with updated packages. The vulnerabilities affect Node.js 22.22.0-1.el10_0 across multiple architectures including x86_64, s390x, ppc64le, and aarch64. No CVSS scores are provided in the advisory. The update is available and should be applied to remediate these issues.

A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.