Publish Advisories

GHSA-33qg-7wpp-89cq
GHSA-65w6-pf7x-5g85
GHSA-6jwv-w5xf-7j27
GHSA-7853-gqqm-vcwx
GHSA-fjrm-76x2-c4q4
GHSA-g4v2-qx3q-4p64
GHSA-gpj5-g38j-94v9
GHSA-hj9c-p59c-vqph
GHSA-mx42-j6wv-px98
GHSA-w6c6-c85g-mmv6

Author: advisory-database[bot]

advisories/github-reviewed/2026/04/GHSA-33qg-7wpp-89cq/GHSA-33qg-7wpp-89cq.json

@@ -0,0 +1,64 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-33qg-7wpp-89cq",
+  "modified": "2026-04-08T00:15:08Z",
+  "published": "2026-04-08T00:15:08Z",
+  "aliases": [
+    "CVE-2026-39324"
+  ],
+  "summary": "Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization",
+  "details": "`Rack::Session::Cookie` incorrectly handles decryption failures when configured with `secrets:`. If cookie decryption fails, the implementation falls back to a default decoder instead of rejecting the cookie. This allows an unauthenticated attacker to supply a crafted session cookie that is accepted as valid session data without knowledge of any configured secret.\n\nBecause this mechanism is used to load session state, an attacker can manipulate session contents and potentially gain unauthorized access.\n\n## Details\n\nWhen `secrets:` is configured, `Rack::Session::Cookie` attempts to decrypt incoming session cookies using one of the configured encryptors. If all decrypt attempts fail, the implementation does not reject the cookie. Instead, it falls back to decoding the cookie using a default coder.\n\nThis fallback path processes attacker-controlled cookie data as trusted session state. The behavior is implicit and occurs even when encrypted cookies are expected.\n\nThe fallback decoder is applied automatically and does not require the application to opt into a non-encrypted session format. As a result, a client can send a specially crafted cookie value that bypasses the intended integrity protections provided by `secrets:`.\n\nThis issue affects both default configurations and those using alternative serializers for encrypted payloads.\n\n## Impact\n\nAny Rack application using `Rack::Session::Cookie` with `secrets:` may be affected.\n\n> [!NOTE]\n> Rails applications are typically not affected — Rails uses `ActionDispatch::Session::CookieStore`, which is a separate implementation backed by `ActiveSupport::MessageEncryptor` and does not share the vulnerable code path.\n\nAn unauthenticated attacker can supply a crafted session cookie that is accepted as valid session data. This can lead to authentication bypass or privilege escalation in applications that rely on session values for identity or authorization decisions.\n\nDepending on application behavior and available runtime components, processing of untrusted session data may also expose additional risks.\n\n## Mitigation\n\n* Update to a patched version of`rack-session` that rejects cookies when decryption fails under the `secrets:` configuration.\n  * After updating, rotate session secrets to invalidate existing session cookies, since attacker-supplied session data may have been accepted and re-issued prior to the fix.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "RubyGems",
+        "name": "rack-session"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.0.0"
+            },
+            {
+              "fixed": "2.1.2"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/rack/rack-session/security/advisories/GHSA-33qg-7wpp-89cq"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39324"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/rack/rack-session"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-287",
+      "CWE-345",
+      "CWE-502",
+      "CWE-565"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-04-08T00:15:08Z",
+    "nvd_published_at": "2026-04-07T18:16:43Z"
+  }
+}

advisories/github-reviewed/2026/04/GHSA-65w6-pf7x-5g85/GHSA-65w6-pf7x-5g85.json

@@ -0,0 +1,69 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-65w6-pf7x-5g85",
+  "modified": "2026-04-08T00:15:54Z",
+  "published": "2026-04-08T00:15:54Z",
+  "aliases": [
+    "CVE-2026-39397"
+  ],
+  "summary": "@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections",
+  "details": "### Impact\n\nAll `/api/puck/*` CRUD endpoint handlers registered by `createPuckPlugin()` called Payload's local API with the default `overrideAccess: true`, bypassing all collection-level access control. The `access` option passed to `createPuckPlugin()` and any `access` rules defined on Puck-registered collections were silently ignored on these endpoints.\n\nAn unauthenticated remote attacker could:\n\n- List all documents (including drafts) in any Puck-registered collection\n- Read any document by ID (including drafts)\n- Create new documents with arbitrary field values\n- Update any document (including bypassing field-level access rules)\n- Delete any document\n- Read version history and restore arbitrary versions\n\n**In typical installations**, the affected scope is the collection backing the website's pages (default slug: `pages`). For most users this means an attacker could read, modify, create, or delete every page on the website — including unpublished drafts and version history.\n\n**Scope is limited to collections explicitly registered with `createPuckPlugin()`** — the endpoints validate the collection slug against an allowlist, so attackers cannot pivot to other Payload collections such as `users`, `media`, or business data not exposed to the plugin. The auto-created `puck-templates`, `puck-ai-prompts`, and `puck-ai-context` collections are also outside the allowlist; they have their own dedicated endpoints with separate authentication.\n\nOther endpoints in the plugin (AI, styles, prompts, context, and the Next.js API route factories in `src/api/`) were unaffected — they had their own authentication checks.\n\n### Patches\n\nFixed in **0.6.23**. All endpoint handlers in `src/endpoints/index.ts` now pass `overrideAccess: false` and forward `req` to Payload's local API, so collection-level access rules are evaluated against the current user.\n\n### Workarounds\n\nIf you cannot upgrade immediately, place a reverse-proxy or middleware authentication check in front of `/api/puck/*` to require an authenticated session before requests reach the plugin's handlers.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "@delmaredigital/payload-puck"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.6.23"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/delmaredigital/payload-puck/security/advisories/GHSA-65w6-pf7x-5g85"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39397"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/delmaredigital/payload-puck/issues/7"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/delmaredigital/payload-puck/commit/9148201c6bbfa140d44546438027a2f8a70f79a4"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/delmaredigital/payload-puck"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-862"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-04-08T00:15:54Z",
+    "nvd_published_at": "2026-04-07T21:17:18Z"
+  }
+}

…-6jwv-w5xf-7j27/GHSA-6jwv-w5xf-7j27.json …-6jwv-w5xf-7j27/GHSA-6jwv-w5xf-7j27.jsonadvisories/unreviewed/2026/04/GHSA-6jwv-w5xf-7j27/GHSA-6jwv-w5xf-7j27.json renamed to advisories/github-reviewed/2026/04/GHSA-6jwv-w5xf-7j27/GHSA-6jwv-w5xf-7j27.json advisories/unreviewed/2026/04/GHSA-6jwv-w5xf-7j27/GHSA-6jwv-w5xf-7j27.json renamed to advisories/github-reviewed/2026/04/GHSA-6jwv-w5xf-7j27/GHSA-6jwv-w5xf-7j27.json

@@ -1,19 +1,40 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-6jwv-w5xf-7j27",
-  "modified": "2026-04-06T21:31:34Z",
+  "modified": "2026-04-08T00:15:13Z",
   "published": "2026-04-06T21:31:34Z",
   "aliases": [
     "CVE-2026-33817"
   ],
+  "summary": "go.etcd.io/bbolt affected by index out-of-range vulnerability",
   "details": "Index out-of-range when encountering a branch page with zero elements in go.etcd.io/bbolt",
   "severity": [
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "go.etcd.io/bbolt"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "1.4.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
@@ -27,6 +48,10 @@
       "type": "WEB",
       "url": "https://github.com/etcd-io/bbolt/pull/1171/changes/386d5b69785937d1aa20cb25c8439404cf398143"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/etcd-io/bbolt"
+    },
     {
       "type": "WEB",
       "url": "https://pkg.go.dev/vuln/GO-2026-4923"
@@ -37,8 +62,8 @@
       "CWE-125"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-04-08T00:15:13Z",
     "nvd_published_at": "2026-04-06T19:16:27Z"
   }
 }

advisories/github-reviewed/2026/04/GHSA-7853-gqqm-vcwx/GHSA-7853-gqqm-vcwx.json

@@ -0,0 +1,64 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7853-gqqm-vcwx",
+  "modified": "2026-04-08T00:16:09Z",
+  "published": "2026-04-08T00:16:09Z",
+  "aliases": [
+    "CVE-2026-39398"
+  ],
+  "summary": "openclaw-claude-bridge: sandbox is not effective - `--allowed-tools \"\"` does not restrict available tools",
+  "details": "## Affected\n\nopenclaw-claude-bridge v1.1.0\n\n## Issue\n\nv1.1.0 spawns the Claude Code CLI subprocess with `--allowed-tools \"\"` and the release notes + README claim this **\"disables all CLI tools\"** for sandboxing. This claim is incorrect.\n\nPer the Claude Code CLI documentation, `--allowed-tools` (alias `--allowedTools`) is an **auto-approve allowlist** of tools that execute without permission prompts — NOT a restriction on which tools are available. The correct flag to restrict the available tool set is `--tools`:\n\n> `--tools <tools...>`  Specify the list of available tools from the built-in set. **Use `\"\"` to disable all tools**, `\"default\"` to use all tools, or specify tool names (e.g. `\"Bash,Edit,Read\"`).\n\n## Impact\n\n- All CLI tools (Read/Write/Bash/WebFetch/...) remain nominally available to the spawned subprocess.\n- Actual execution behavior in `--print` non-interactive mode depends on undocumented CLI defaults (may auto-deny, may error out, may hang).\n- Users who deploy the bridge behind any interface that forwards untrusted prompts (e.g., publicly exposed OpenClaw gateway, automated pipelines with web-fetched context, agents that consume tool results from other systems) may be relying on a sandbox that does not exist.\n\nThe README explicitly makes a security claim the code does not uphold, creating a false sense of safety for downstream operators. If the underlying CLI behavior changes in a future version to auto-allow tools in `--print` mode, prompt-injection attacks could trigger arbitrary Read/Write/Bash operations in the gateway's process context.\n\n## Patches\n\nFixed in [v1.1.1](https://github.com/SeaL773/openclaw-claude-bridge/releases/tag/v1.1.1) (commit 8a296f5) by switching to `--tools \"\"`. The environment variable was also renamed from `CLAUDE_ALLOWED_TOOLS` to `CLAUDE_TOOLS` to match the flag.\n\n## Workarounds\n\nSetting `CLAUDE_ALLOWED_TOOLS` on v1.1.0 has no mitigating effect. Upgrade to v1.1.1 or manually edit `dist/cli-bridge.js` to replace `--allowed-tools` with `--tools`.\n\n## References\n\n- Fix: https://github.com/SeaL773/openclaw-claude-bridge/commit/8a296f5\n- v1.1.1 notes: https://github.com/SeaL773/openclaw-claude-bridge/releases/tag/v1.1.1\n- Claude Code CLI reference: https://docs.claude.com/en/docs/claude-code/cli-reference\n\n## Credit\n\nFound during a second-round code review.",
+  "severity": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "openclaw-claude-bridge"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.0.0"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 1.1.1"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/SeaL773/openclaw-claude-bridge/security/advisories/GHSA-7853-gqqm-vcwx"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/SeaL773/openclaw-claude-bridge/commit/8a296f5"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/SeaL773/openclaw-claude-bridge"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/SeaL773/openclaw-claude-bridge/releases/tag/v1.1.1"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-1188",
+      "CWE-276"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-04-08T00:16:09Z",
+    "nvd_published_at": null
+  }
+}

advisories/github-reviewed/2026/04/GHSA-fjrm-76x2-c4q4/GHSA-fjrm-76x2-c4q4.json

@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-fjrm-76x2-c4q4",
+  "modified": "2026-04-08T00:16:14Z",
+  "published": "2026-04-08T00:16:14Z",
+  "aliases": [
+    "CVE-2026-39373"
+  ],
+  "summary": "JWCrypto: JWE ZIP decompression bomb",
+  "details": "### Summary\nThe fix for GHSA-j857-7rvv-vj97 in v1.5.6 is weak in that it does not allow to fully control the amount of plaintext the receiver is willing to deal with and provides just a weak upper bound. The patch limits input token size to 250KB but does not validate the decompressed output size. An unauthenticated attacker can craft a JWE token under the 250KB input limit that decompresses to very large data that may exceed small devices memory availability, causing Denial of Service via memory exhaustion.\n\nAlthough this is technically not unbounded I do recognize that it may be too much for devices and is something that could be surprising to developers, and we can do better than that.\n\nNOTE: the original report was sloppy (probably AI slop) and claimed arbitrary memory consumption, but simple testing showed that while 100MB could be decompressed a 1GB output was denied because the token exceeded the 250K compressed serialization.\n\nNOTE WELL: The proposed solution was also sloppy, proposing to first decompress the data completely in memory (therefore causing the memory exhaustion) and then checking how much memory was already used to deny the operation. I _intentionally_ left the \"details\" section untouched to show how bad AI slop is and how _uncritical_ the submitter was, even as it was obvious the \"suggested fix\" is actually no solution at all, as it was using the very call that he claimed was causing \"arbitrary\" memory exhaustion and wrapping it around an \"if\" ... the actual solution is in the resolving commit in version 1.5.7\n\n### Details\nThe vulnerable code in `jwcrypto/jwe.py`:\n```python\nif len(data) > default_max_compressed_size:\n    raise InvalidJWEData('Compressed data exceeds maximum allowed size')\nself.plaintext = zlib.decompress(data, -zlib.MAX_WBITS)\n```\n\nThe check validates `data` which is the **compressed** bytes, not the decompressed output. A 132KB token (under the 250KB limit) can decompress to approximately 100MB with no error raised.\n\n### PoC\nTested on jwcrypto 1.5.6 (patched version):\n```python\nimport zlib\nfrom jwcrypto import jwe\nfrom jwcrypto.jwk import JWK\nimport time\n\nkey = JWK.generate(kty='oct', size=128)\nbomb_data = b\"A\" * 1024 * 1024 * 100  # 100MB uncompressed\n\ntoken = jwe.JWE(\n    plaintext=bomb_data,\n    protected={\"alg\": \"A128KW\", \"enc\": \"A128GCM\", \"zip\": \"DEF\"}\n)\ntoken.add_recipient(key)\nserialized = token.serialize(compact=True)\nprint(f\"Token size: {len(serialized)/1024:.1f} KB\")  # 132.8 KB — under 250KB limit\n\ntok2 = jwe.JWE()\ntok2.deserialize(serialized, key)\nprint(f\"Decompressed: {len(tok2.plaintext)/1024/1024:.0f} MB\")  # 100 MB\n```\n\nOutput:\n```\nToken size: 132.8 KB\nDecompressed: 100 MB\n```\n\n### Impact\nAn unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing patch (v1.5.6) does not prevent this attack. An unauthenticated attacker can cause memory exhaustion on memory-constrained systems. A token under the 250KB input limit can decompress to approximately 100MB.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "jwcrypto"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "1.5.6"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/latchset/jwcrypto/security/advisories/GHSA-fjrm-76x2-c4q4"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39373"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/latchset/jwcrypto"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-409"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-04-08T00:16:14Z",
+    "nvd_published_at": "2026-04-07T20:16:32Z"
+  }
+}