Skip to content

Commit 053e477

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2vg4-rrx4-qcpq GHSA-38hg-ww64-rrwc GHSA-3v7m-qg4x-58h9 GHSA-5jg4-p4qw-cgfr GHSA-8m32-p958-jg99 GHSA-8x9r-hvwg-c55h GHSA-99j6-hj87-6fcf GHSA-cf45-hxwj-4cfj GHSA-hg8q-8wqr-35xx GHSA-p9ff-h696-f583 GHSA-ph52-67fq-75wj GHSA-q75c-4gmv-mg9x GHSA-qqmv-5p3g-px89 GHSA-wv3h-5fx7-966h GHSA-wxwm-3fxv-mrvx
1 parent dc835a4 commit 053e477

15 files changed

Lines changed: 87 additions & 30 deletions

File tree

‎advisories/github-reviewed/2026/04/GHSA-2vg4-rrx4-qcpq/GHSA-2vg4-rrx4-qcpq.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2vg4-rrx4-qcpq",
4-
"modified": "2026-04-04T06:16:49Z",
4+
"modified": "2026-04-07T14:20:51Z",
55
"published": "2026-04-04T06:16:49Z",
66
"aliases": [
77
"CVE-2026-35450"
@@ -40,6 +40,10 @@
4040
"type": "WEB",
4141
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-2vg4-rrx4-qcpq"
4242
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35450"
46+
},
4347
{
4448
"type": "PACKAGE",
4549
"url": "https://github.com/WWBN/AVideo"
@@ -52,6 +56,6 @@
5256
"severity": "MODERATE",
5357
"github_reviewed": true,
5458
"github_reviewed_at": "2026-04-04T06:16:49Z",
55-
"nvd_published_at": null
59+
"nvd_published_at": "2026-04-06T22:16:23Z"
5660
}
5761
}

‎advisories/github-reviewed/2026/04/GHSA-38hg-ww64-rrwc/GHSA-38hg-ww64-rrwc.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-38hg-ww64-rrwc",
4-
"modified": "2026-04-04T06:13:57Z",
4+
"modified": "2026-04-07T14:20:19Z",
55
"published": "2026-04-04T06:13:57Z",
66
"aliases": [
77
"CVE-2026-35442"
@@ -40,6 +40,10 @@
4040
"type": "WEB",
4141
"url": "https://github.com/directus/directus/security/advisories/GHSA-38hg-ww64-rrwc"
4242
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35442"
46+
},
4347
{
4448
"type": "PACKAGE",
4549
"url": "https://github.com/directus/directus"
@@ -53,6 +57,6 @@
5357
"severity": "HIGH",
5458
"github_reviewed": true,
5559
"github_reviewed_at": "2026-04-04T06:13:57Z",
56-
"nvd_published_at": null
60+
"nvd_published_at": "2026-04-06T22:16:22Z"
5761
}
5862
}

‎advisories/github-reviewed/2026/04/GHSA-3v7m-qg4x-58h9/GHSA-3v7m-qg4x-58h9.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-3v7m-qg4x-58h9",
4-
"modified": "2026-04-04T06:15:37Z",
4+
"modified": "2026-04-07T14:20:43Z",
55
"published": "2026-04-04T06:15:37Z",
66
"aliases": [
77
"CVE-2026-35448"
@@ -40,6 +40,10 @@
4040
"type": "WEB",
4141
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-3v7m-qg4x-58h9"
4242
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35448"
46+
},
4347
{
4448
"type": "PACKAGE",
4549
"url": "https://github.com/WWBN/AVideo"
@@ -52,6 +56,6 @@
5256
"severity": "LOW",
5357
"github_reviewed": true,
5458
"github_reviewed_at": "2026-04-04T06:15:37Z",
55-
"nvd_published_at": null
59+
"nvd_published_at": "2026-04-06T22:16:23Z"
5660
}
5761
}

‎advisories/github-reviewed/2026/04/GHSA-5jg4-p4qw-cgfr/GHSA-5jg4-p4qw-cgfr.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-5jg4-p4qw-cgfr",
4-
"modified": "2026-04-04T05:33:09Z",
4+
"modified": "2026-04-07T14:22:35Z",
55
"published": "2026-04-04T05:33:09Z",
66
"aliases": [],
77
"summary": "@stablelib/cbor: Stack exhaustion Denial of Service via deeply nested CBOR arrays, maps, or tags",
8-
"details": "### Summary\n\n`@stablelib/cbor` decodes nested CBOR structures recursively and does not enforce a maximum nesting depth. A sufficiently deep attacker-controlled CBOR payload can therefore crash decoding with `RangeError: Maximum call stack size exceeded`.\n\n### Details\n\nThe decoder processes arrays, maps, and tagged values through recursive calls. Each nested container causes another descent into `_decodeValue()` until a leaf value is reached.\n\nThere is no depth limit, no iterative fallback, and no protection against pathological nesting. An attacker can therefore supply a payload made of thousands of nested arrays, maps, or tags and force the decoder to recurse until the JavaScript call stack is exhausted.\n\n### PoC\n\n```js\nimport { decode } from \"@stablelib/cbor\";\n\nconst depth = 12000;\nconst payload = new Uint8Array(depth + 1);\n\n// Build [[[...[null]...]]]\npayload.fill(0x81, 0, depth); // array(1)\npayload[depth] = 0xf6; // null\n\ndecode(payload);\n// RangeError: Maximum call stack size exceeded\n```\n\n### Impact\n\nAny application that decodes attacker-controlled CBOR can be forced into a reliable denial of service with a single crafted payload.\n\nThe immediate result is an exception during decoding. In services that do not catch that exception safely, the request fails and the worker or process handling the decode may terminate.",
8+
"details": "### Summary\n\n`@stablelib/cbor` decodes nested CBOR structures recursively and does not enforce a maximum nesting depth. A sufficiently deep attacker-controlled CBOR payload can therefore crash decoding with `RangeError: Maximum call stack size exceeded`.\n\n### Details\n\nThe decoder processes arrays, maps, and tagged values through recursive calls. Each nested container causes another descent into `_decodeValue()` until a leaf value is reached.\n\nThere is no depth limit, no iterative fallback, and no protection against pathological nesting. An attacker can therefore supply a payload made of thousands of nested arrays, maps, or tags and force the decoder to recurse until the JavaScript call stack is exhausted.\n\n### PoC\n\n```js\nimport { decode } from \"@stablelib/cbor\";\n\nconst depth = 12000;\nconst payload = new Uint8Array(depth + 1);\n\n// Build [[[...[null]...]]]\npayload.fill(0x81, 0, depth); // array(1)\npayload[depth] = 0xf6; // null\n\ndecode(payload);\n// RangeError: Maximum call stack size exceeded\n```\n\n### Impact\n\nAny application that decodes attacker-controlled CBOR can be forced into a reliable denial of service with a single crafted payload.\n\nThe immediate result is an exception during decoding. In services that do not catch that exception safely, the request fails and the worker or process handling the decode may terminate.\n\n\n### Solution\n\nUpgrade to version 2.0.4. The stack is limited to 128 by default, but can be configured using the `maxDepth` option. Catch the `CBORMaxDepthExceededError` exception.",
99
"severity": [
1010
{
1111
"type": "CVSS_V4",

‎advisories/github-reviewed/2026/04/GHSA-8m32-p958-jg99/GHSA-8m32-p958-jg99.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8m32-p958-jg99",
4-
"modified": "2026-04-04T06:06:00Z",
4+
"modified": "2026-04-07T14:19:49Z",
55
"published": "2026-04-04T06:06:00Z",
66
"aliases": [
77
"CVE-2026-35408"
@@ -40,6 +40,10 @@
4040
"type": "WEB",
4141
"url": "https://github.com/directus/directus/security/advisories/GHSA-8m32-p958-jg99"
4242
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35408"
46+
},
4347
{
4448
"type": "PACKAGE",
4549
"url": "https://github.com/directus/directus"
@@ -53,6 +57,6 @@
5357
"severity": "HIGH",
5458
"github_reviewed": true,
5559
"github_reviewed_at": "2026-04-04T06:06:00Z",
56-
"nvd_published_at": null
60+
"nvd_published_at": "2026-04-06T22:16:21Z"
5761
}
5862
}

‎advisories/github-reviewed/2026/04/GHSA-8x9r-hvwg-c55h/GHSA-8x9r-hvwg-c55h.json‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,19 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8x9r-hvwg-c55h",
4-
"modified": "2026-04-04T06:26:02Z",
4+
"modified": "2026-04-07T14:21:34Z",
55
"published": "2026-04-04T06:26:02Z",
66
"aliases": [
77
"CVE-2026-35454"
88
],
99
"summary": "Code Extension Marketplace: Zip Slip Path Traversal",
1010
"details": "# Zip Slip Path Traversal in coder/code-marketplace\n\n## Summary\n\nA Zip Slip (CWE-22) vulnerability in `coder/code-marketplace` ≤ v2.4.1 allowed a malicious VSIX file to write arbitrary files outside the extension directory. `ExtractZip` passed raw zip entry names to a callback that wrote files via `filepath.Join` with no boundary check; `filepath.Join` resolved `..` components but did not prevent the result from escaping the base path.\n\n\n## Root Cause\n\n`ExtractZip` passed the raw, attacker-controlled `zf.Name` to a caller-supplied callback:\n\n```go\nreturn false, fn(zf.Name, zr) // zf.Name not sanitized\n```\n\n`AddExtension` constructed the output path with `filepath.Join` and no boundary check:\n\n```go\npath := filepath.Join(dir, name) // zip loop\npath := filepath.Join(dir, file.RelativePath) // extra files loop\n```\n\n`filepath.Clean` resolved `..` lexically but did not confine the result to `dir`:\n\n```\nfilepath.Join(\"/srv/ext/pub/1.0\", \"../../../../etc/cron.d/evil\")\n → \"/etc/cron.d/evil\"\n```\n\n## Attack Scenario\n\nAn authenticated user (any upload-capable role) would submit a VSIX containing path-traversal entries.\n\nOn extraction, files would land at attacker-chosen paths writable by the marketplace process, enabling persistence (cron/init injection), SSH key injection, `ld.so.preload` hijacking, or binary overwrite depending on process privileges.\n\n## Fix\n\nAddressed in https://github.com/coder/code-marketplace/releases/tag/v2.4.2\n\n## Recognition\nCoder would like to thank [Kandlaguduru Vamsi](https://www.linkedin.com/in/vamsi-k-5419632a9/) for responsibly disclosing this issue in accordance with https://coder.com/security/policy",
11-
"severity": [],
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
1217
"affected": [
1318
{
1419
"package": {
@@ -35,6 +40,10 @@
3540
"type": "WEB",
3641
"url": "https://github.com/coder/code-marketplace/security/advisories/GHSA-8x9r-hvwg-c55h"
3742
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35454"
46+
},
3847
{
3948
"type": "WEB",
4049
"url": "https://github.com/coder/code-marketplace/commit/988440dee05fceef8400ed725badc604dbf90792"
@@ -55,6 +64,6 @@
5564
"severity": "HIGH",
5665
"github_reviewed": true,
5766
"github_reviewed_at": "2026-04-04T06:26:02Z",
58-
"nvd_published_at": null
67+
"nvd_published_at": "2026-04-06T22:16:23Z"
5968
}
6069
}

‎advisories/github-reviewed/2026/04/GHSA-99j6-hj87-6fcf/GHSA-99j6-hj87-6fcf.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-99j6-hj87-6fcf",
4-
"modified": "2026-04-04T06:17:17Z",
4+
"modified": "2026-04-07T14:20:54Z",
55
"published": "2026-04-04T06:17:17Z",
66
"aliases": [
77
"CVE-2026-35452"
@@ -40,6 +40,10 @@
4040
"type": "WEB",
4141
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-99j6-hj87-6fcf"
4242
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35452"
46+
},
4347
{
4448
"type": "PACKAGE",
4549
"url": "https://github.com/WWBN/AVideo"
@@ -52,6 +56,6 @@
5256
"severity": "MODERATE",
5357
"github_reviewed": true,
5458
"github_reviewed_at": "2026-04-04T06:17:17Z",
55-
"nvd_published_at": null
59+
"nvd_published_at": "2026-04-06T22:16:23Z"
5660
}
5761
}

‎advisories/github-reviewed/2026/04/GHSA-cf45-hxwj-4cfj/GHSA-cf45-hxwj-4cfj.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-cf45-hxwj-4cfj",
4-
"modified": "2026-04-04T06:09:55Z",
4+
"modified": "2026-04-07T14:19:59Z",
55
"published": "2026-04-04T06:09:55Z",
66
"aliases": [
77
"CVE-2026-35410"
@@ -40,6 +40,10 @@
4040
"type": "WEB",
4141
"url": "https://github.com/directus/directus/security/advisories/GHSA-cf45-hxwj-4cfj"
4242
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35410"
46+
},
4347
{
4448
"type": "PACKAGE",
4549
"url": "https://github.com/directus/directus"
@@ -54,6 +58,6 @@
5458
"severity": "MODERATE",
5559
"github_reviewed": true,
5660
"github_reviewed_at": "2026-04-04T06:09:55Z",
57-
"nvd_published_at": null
61+
"nvd_published_at": "2026-04-06T22:16:22Z"
5862
}
5963
}

‎advisories/github-reviewed/2026/04/GHSA-hg8q-8wqr-35xx/GHSA-hg8q-8wqr-35xx.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-hg8q-8wqr-35xx",
4-
"modified": "2026-04-04T06:16:18Z",
4+
"modified": "2026-04-07T14:20:47Z",
55
"published": "2026-04-04T06:16:18Z",
66
"aliases": [
77
"CVE-2026-35449"
@@ -40,6 +40,10 @@
4040
"type": "WEB",
4141
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-hg8q-8wqr-35xx"
4242
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35449"
46+
},
4347
{
4448
"type": "PACKAGE",
4549
"url": "https://github.com/WWBN/AVideo"
@@ -52,6 +56,6 @@
5256
"severity": "MODERATE",
5357
"github_reviewed": true,
5458
"github_reviewed_at": "2026-04-04T06:16:18Z",
55-
"nvd_published_at": null
59+
"nvd_published_at": "2026-04-06T22:16:23Z"
5660
}
5761
}

‎advisories/github-reviewed/2026/04/GHSA-p9ff-h696-f583/GHSA-p9ff-h696-f583.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-p9ff-h696-f583",
4-
"modified": "2026-04-06T23:44:10Z",
4+
"modified": "2026-04-07T14:21:49Z",
55
"published": "2026-04-06T18:03:24Z",
66
"aliases": [
77
"CVE-2026-39363"

0 commit comments

Comments
 (0)