Threats Tagged 'cwe-436'

CVE-2026-53538 is a low-severity vulnerability in the python-multipart library prior to version 0.0.30. The issue arises because the QuerystringParser treated the semicolon (;) as a field separator in application/x-www-form-urlencoded bodies, whereas modern standards and browsers treat only the ampersand (&) as a separator. This discrepancy allows an attacker to smuggle extra form fields past upstream body inspection components. The vulnerability is fixed in version 0.0.30.

Python-Multipart versions prior to 0.0.30 improperly parse Content-Disposition headers by applying RFC 2231/5987 decoding, which is not compliant with RFC 7578 §4.2 for multipart/form-data. This allows an attacker to smuggle altered field names or filenames past upstream inspectors to the backend. The vulnerability is fixed in version 0.0.30.

A vulnerability in node-tar prior to version 7.5.16 allows a crafted tar archive to cause interpretation conflicts due to incorrect handling of PAX extended headers. This leads to a desynchronization of the stream cursor compared to other tar implementations, enabling an attacker to hide archive members from some parsers while exposing them to others. The issue is fixed in version 7.5.16.

Remark42 versions 1.6.0 through 1.15.0 contain a Cross-Site Scripting (XSS) vulnerability due to inconsistent content-type validation in its image proxy. An attacker can host a malicious URL that advertises an image content-type but serves HTML/JavaScript, causing the proxy to serve attacker-controlled scripts under Remark42's origin. Exploitation requires no user account and can be triggered by delivering the malicious proxy link to victims. This vulnerability is fixed in version 1.16.0.

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify interprets it without changing its Linked Data Signature, allowing them to alter a third-party signed activity they have received. Versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3 fix the issue.

When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.

A vulnerability in libpng version 1.8.0 involves an interpretation conflict in the APNG parser's handling of ancillary chunks. Specifically, certain discard paths clear the chunk-header flag without consuming the chunk body and CRC, which may allow attacker-controlled data to be misinterpreted as new chunk headers. This issue is identified as CWE-436 and has a CVSS score of 5.4, indicating medium severity.