Skip to content

Commit 0066eef

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-37mj-c2wf-cx96 GHSA-5cx5-wh4m-82fh GHSA-cgcg-q9jh-5pr2 GHSA-q485-cg9q-xq2r GHSA-w5g8-5849-vj76 GHSA-x4ff-q6h8-v7gw
1 parent a331f35 commit 0066eef

6 files changed

Lines changed: 60 additions & 15 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-37mj-c2wf-cx96/GHSA-37mj-c2wf-cx96.json‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-37mj-c2wf-cx96",
4-
"modified": "2026-03-24T20:17:02Z",
4+
"modified": "2026-03-27T21:55:02Z",
55
"published": "2026-03-24T20:17:02Z",
66
"aliases": [
77
"CVE-2026-33627"
@@ -59,6 +59,10 @@
5959
"type": "WEB",
6060
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-37mj-c2wf-cx96"
6161
},
62+
{
63+
"type": "ADVISORY",
64+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33627"
65+
},
6266
{
6367
"type": "WEB",
6468
"url": "https://github.com/parse-community/parse-server/pull/10278"
@@ -67,6 +71,14 @@
6771
"type": "WEB",
6872
"url": "https://github.com/parse-community/parse-server/pull/10279"
6973
},
74+
{
75+
"type": "WEB",
76+
"url": "https://github.com/parse-community/parse-server/commit/5b8998e6866bcf75be7b5bb625e27d23bfaf912c"
77+
},
78+
{
79+
"type": "WEB",
80+
"url": "https://github.com/parse-community/parse-server/commit/875cf10ac979bd60f70e7a0c534e2bc194d6982f"
81+
},
7082
{
7183
"type": "PACKAGE",
7284
"url": "https://github.com/parse-community/parse-server"
@@ -79,6 +91,6 @@
7991
"severity": "HIGH",
8092
"github_reviewed": true,
8193
"github_reviewed_at": "2026-03-24T20:17:02Z",
82-
"nvd_published_at": null
94+
"nvd_published_at": "2026-03-24T19:16:55Z"
8395
}
8496
}

‎advisories/github-reviewed/2026/03/GHSA-5cx5-wh4m-82fh/GHSA-5cx5-wh4m-82fh.json‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-5cx5-wh4m-82fh",
4-
"modified": "2026-03-20T19:48:53Z",
4+
"modified": "2026-03-27T21:57:21Z",
55
"published": "2026-03-19T17:56:37Z",
66
"aliases": [
77
"CVE-2026-33322"
@@ -40,18 +40,23 @@
4040
"type": "WEB",
4141
"url": "https://github.com/minio/minio/security/advisories/GHSA-5cx5-wh4m-82fh"
4242
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33322"
46+
},
4347
{
4448
"type": "PACKAGE",
4549
"url": "https://github.com/minio/minio"
4650
}
4751
],
4852
"database_specific": {
4953
"cwe_ids": [
54+
"CWE-287",
5055
"CWE-327"
5156
],
5257
"severity": "CRITICAL",
5358
"github_reviewed": true,
5459
"github_reviewed_at": "2026-03-19T17:56:37Z",
55-
"nvd_published_at": null
60+
"nvd_published_at": "2026-03-24T20:16:27Z"
5661
}
5762
}

‎advisories/github-reviewed/2026/03/GHSA-cgcg-q9jh-5pr2/GHSA-cgcg-q9jh-5pr2.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-cgcg-q9jh-5pr2",
4-
"modified": "2026-03-19T18:37:42Z",
4+
"modified": "2026-03-27T21:57:29Z",
55
"published": "2026-03-19T18:37:42Z",
66
"aliases": [
77
"CVE-2026-33326"
@@ -43,6 +43,10 @@
4343
"type": "WEB",
4444
"url": "https://github.com/keystonejs/keystone/security/advisories/GHSA-cgcg-q9jh-5pr2"
4545
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33326"
49+
},
4650
{
4751
"type": "PACKAGE",
4852
"url": "https://github.com/keystonejs/keystone"
@@ -55,6 +59,6 @@
5559
"severity": "MODERATE",
5660
"github_reviewed": true,
5761
"github_reviewed_at": "2026-03-19T18:37:42Z",
58-
"nvd_published_at": null
62+
"nvd_published_at": "2026-03-24T20:16:28Z"
5963
}
6064
}

‎advisories/github-reviewed/2026/03/GHSA-q485-cg9q-xq2r/GHSA-q485-cg9q-xq2r.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-q485-cg9q-xq2r",
4-
"modified": "2026-03-19T17:55:53Z",
4+
"modified": "2026-03-27T21:57:12Z",
55
"published": "2026-03-19T17:55:53Z",
66
"aliases": [
77
"CVE-2026-33314"
@@ -43,6 +43,10 @@
4343
"type": "WEB",
4444
"url": "https://github.com/pyload/pyload/security/advisories/GHSA-q485-cg9q-xq2r"
4545
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33314"
49+
},
4650
{
4751
"type": "PACKAGE",
4852
"url": "https://github.com/pyload/pyload"
@@ -56,6 +60,6 @@
5660
"severity": "MODERATE",
5761
"github_reviewed": true,
5862
"github_reviewed_at": "2026-03-19T17:55:53Z",
59-
"nvd_published_at": null
63+
"nvd_published_at": "2026-03-24T20:16:27Z"
6064
}
6165
}

‎advisories/github-reviewed/2026/03/GHSA-w5g8-5849-vj76/GHSA-w5g8-5849-vj76.json‎

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-w5g8-5849-vj76",
4-
"modified": "2026-03-19T18:48:27Z",
4+
"modified": "2026-03-27T21:57:40Z",
55
"published": "2026-03-19T18:48:27Z",
66
"aliases": [
77
"CVE-2026-33332"
@@ -47,18 +47,31 @@
4747
"type": "WEB",
4848
"url": "https://github.com/zauberzeug/nicegui/security/advisories/GHSA-w5g8-5849-vj76"
4949
},
50+
{
51+
"type": "ADVISORY",
52+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33332"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://github.com/zauberzeug/nicegui/commit/9026962b8c4f3f225c98b2fbc35aa6b60cb3495b"
57+
},
5058
{
5159
"type": "PACKAGE",
5260
"url": "https://github.com/zauberzeug/nicegui"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://github.com/zauberzeug/nicegui/releases/tag/v3.9.0"
5365
}
5466
],
5567
"database_specific": {
5668
"cwe_ids": [
69+
"CWE-20",
5770
"CWE-770"
5871
],
5972
"severity": "MODERATE",
6073
"github_reviewed": true,
6174
"github_reviewed_at": "2026-03-19T18:48:27Z",
62-
"nvd_published_at": null
75+
"nvd_published_at": "2026-03-24T20:16:28Z"
6376
}
6477
}

‎advisories/github-reviewed/2026/03/GHSA-x4ff-q6h8-v7gw/GHSA-x4ff-q6h8-v7gw.json‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-x4ff-q6h8-v7gw",
4-
"modified": "2026-03-24T16:04:12Z",
4+
"modified": "2026-03-27T21:57:02Z",
55
"published": "2026-03-24T16:04:12Z",
66
"aliases": [
77
"CVE-2026-32948"
88
],
99
"summary": "sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows",
10-
"details": "### Summary\nOn Windows, sbt uses `Process(\"cmd\", \"/c\", ...)` to run VCS commands (git, hg, svn). The URI fragment (branch, tag, revision) is user-controlled via the build definition and passed to these commands without validation. Because `cmd /c` interprets `&`, `|`, and `;` as command separators, a malicious fragment can execute arbitrary commands.\n\n### Details\n- [Resolvers.scala L84–95](https://github.com/sbt/sbt/blob/dc90f160dfb563f46fd1a7b97945c381d15e2a6c/main/src/main/scala/sbt/Resolvers.scala#L84-L95) — git resolver passes `uri.getFragment()` to `run()` without sanitization\n- [Resolvers.scala L137–145](https://github.com/sbt/sbt/blob/dc90f160dfb563f46fd1a7b97945c381d15e2a6c/main/src/main/scala/sbt/Resolvers.scala#L137-L145) — `run()` uses `Process(\"cmd\", \"/c\", ...)` on Windows, so `cmd` interprets `&&` as command separator\n\n### PoC\n```sh\n# build.properties\n# sbt.version=1.12.5 # Tested on those two versions of sbt\nsbt.version=2.0.0-RC9\n```\n\n```scala\n// build.sbt\n\nThisBuild / scalaVersion := \"2.12.19\"\n\nlazy val root = project\n .in(file(\".\"))\n .dependsOn(vulnerable)\n\nlazy val vulnerable = RootProject(\n uri(\"https://github.com/sbt/io.git#develop%26%26calc.exe\")\n)\n```\n\n### Impact\n\nWindows users are impacted. An attacker can execute arbitrary Windows commands if they control the dependency URI.",
10+
"details": "### Summary\nOn Windows, sbt uses `Process(\"cmd\", \"/c\", ...)` to run VCS commands (git, hg, svn). The URI fragment (branch, tag, revision) is user-controlled via the build definition and passed to these commands without validation. Because `cmd /c` interprets `&`, `|`, and `;` as command separators, a malicious fragment can execute arbitrary commands.\n\n### Patched version\n\nTechnically, sbt 1.12.7 is patched, but it has a bug that makes source dependency non-functional, so update to **sbt 1.12.8** or later instead.\n\n### Details\n- [Resolvers.scala L84–95](https://github.com/sbt/sbt/blob/dc90f160dfb563f46fd1a7b97945c381d15e2a6c/main/src/main/scala/sbt/Resolvers.scala#L84-L95) — git resolver passes `uri.getFragment()` to `run()` without sanitization\n- [Resolvers.scala L137–145](https://github.com/sbt/sbt/blob/dc90f160dfb563f46fd1a7b97945c381d15e2a6c/main/src/main/scala/sbt/Resolvers.scala#L137-L145) — `run()` uses `Process(\"cmd\", \"/c\", ...)` on Windows, so `cmd` interprets `&&` as command separator\n\n### PoC\n```sh\n# build.properties\n# sbt.version=1.12.5 # Tested on those two versions of sbt\nsbt.version=2.0.0-RC9\n```\n\n```scala\n// build.sbt\n\nThisBuild / scalaVersion := \"2.12.19\"\n\nlazy val root = project\n .in(file(\".\"))\n .dependsOn(vulnerable)\n\nlazy val vulnerable = RootProject(\n uri(\"https://github.com/sbt/io.git#develop%26%26calc.exe\")\n)\n```\n\n### Impact\n\nWindows users are impacted. An attacker can execute arbitrary Windows commands if they control the dependency URI.",
1111
"severity": [
1212
{
1313
"type": "CVSS_V4",
@@ -28,18 +28,25 @@
2828
"introduced": "0.9.5"
2929
},
3030
{
31-
"fixed": "1.12.7"
31+
"fixed": "1.12.8"
3232
}
3333
]
3434
}
35-
]
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "< 1.12.7"
38+
}
3639
}
3740
],
3841
"references": [
3942
{
4043
"type": "WEB",
4144
"url": "https://github.com/sbt/sbt/security/advisories/GHSA-x4ff-q6h8-v7gw"
4245
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32948"
49+
},
4350
{
4451
"type": "WEB",
4552
"url": "https://github.com/sbt/sbt/commit/1ce945b6b79cbe3cef6c0fe9efbbd2904e0f479e"
@@ -64,6 +71,6 @@
6471
"severity": "MODERATE",
6572
"github_reviewed": true,
6673
"github_reviewed_at": "2026-03-24T16:04:12Z",
67-
"nvd_published_at": null
74+
"nvd_published_at": "2026-03-24T20:16:27Z"
6875
}
6976
}

0 commit comments

Comments
 (0)