Skip to content

Commit 2f48f50

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3xm7-qw7j-qc8v GHSA-4663-4mpg-879v GHSA-5rvc-5cwx-g5x8 GHSA-7g27-v5wj-jr75 GHSA-8qvf-mr4w-9x2c GHSA-958m-gxmc-mccm GHSA-gjgx-rvqr-6w6v GHSA-hh8v-hgvp-g3f5 GHSA-mmgp-wc2j-qcv7 GHSA-mvpm-v6q4-m2pf GHSA-p9hg-pq3q-v9gv GHSA-vv3x-j2x5-36jc
1 parent f9aff58 commit 2f48f50

12 files changed

Lines changed: 99 additions & 26 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-3xm7-qw7j-qc8v/GHSA-3xm7-qw7j-qc8v.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-3xm7-qw7j-qc8v",
4-
"modified": "2026-03-18T12:59:42Z",
4+
"modified": "2026-03-20T21:23:29Z",
55
"published": "2026-03-18T12:59:42Z",
66
"aliases": [
77
"CVE-2026-33060"
@@ -40,6 +40,10 @@
4040
"type": "WEB",
4141
"url": "https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-3xm7-qw7j-qc8v"
4242
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33060"
46+
},
4347
{
4448
"type": "WEB",
4549
"url": "https://github.com/kysely-org/kysely/commit/0a602bff2f442f6c26d5e047ca8f8715179f6d24"
@@ -56,6 +60,6 @@
5660
"severity": "MODERATE",
5761
"github_reviewed": true,
5862
"github_reviewed_at": "2026-03-18T12:59:42Z",
59-
"nvd_published_at": null
63+
"nvd_published_at": "2026-03-20T08:16:11Z"
6064
}
6165
}

‎advisories/github-reviewed/2026/03/GHSA-4663-4mpg-879v/GHSA-4663-4mpg-879v.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-4663-4mpg-879v",
4-
"modified": "2026-03-18T16:09:24Z",
4+
"modified": "2026-03-20T21:23:36Z",
55
"published": "2026-03-18T16:09:24Z",
66
"aliases": [
77
"CVE-2026-33066"
@@ -40,6 +40,10 @@
4040
"type": "WEB",
4141
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4663-4mpg-879v"
4242
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33066"
46+
},
4347
{
4448
"type": "WEB",
4549
"url": "https://github.com/siyuan-note/siyuan/commit/b382f50e1880ed996364509de5a10a72d7409428"
@@ -56,6 +60,6 @@
5660
"severity": "MODERATE",
5761
"github_reviewed": true,
5862
"github_reviewed_at": "2026-03-18T16:09:24Z",
59-
"nvd_published_at": null
63+
"nvd_published_at": "2026-03-20T09:16:14Z"
6064
}
6165
}

‎advisories/github-reviewed/2026/03/GHSA-5rvc-5cwx-g5x8/GHSA-5rvc-5cwx-g5x8.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-5rvc-5cwx-g5x8",
4-
"modified": "2026-03-18T20:11:27Z",
4+
"modified": "2026-03-20T21:24:36Z",
55
"published": "2026-03-18T20:11:27Z",
66
"aliases": [
77
"CVE-2026-33192"
@@ -40,6 +40,10 @@
4040
"type": "WEB",
4141
"url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-5rvc-5cwx-g5x8"
4242
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33192"
46+
},
4347
{
4448
"type": "WEB",
4549
"url": "https://github.com/free5gc/free5gc/issues/784"
@@ -60,6 +64,6 @@
6064
"severity": "HIGH",
6165
"github_reviewed": true,
6266
"github_reviewed_at": "2026-03-18T20:11:27Z",
63-
"nvd_published_at": null
67+
"nvd_published_at": "2026-03-20T09:16:16Z"
6468
}
6569
}

‎advisories/github-reviewed/2026/03/GHSA-7g27-v5wj-jr75/GHSA-7g27-v5wj-jr75.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-7g27-v5wj-jr75",
4-
"modified": "2026-03-18T20:06:36Z",
4+
"modified": "2026-03-20T21:24:03Z",
55
"published": "2026-03-18T20:06:36Z",
66
"aliases": [
77
"CVE-2026-33064"
@@ -40,6 +40,10 @@
4040
"type": "WEB",
4141
"url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-7g27-v5wj-jr75"
4242
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33064"
46+
},
4347
{
4448
"type": "WEB",
4549
"url": "https://github.com/free5gc/free5gc/issues/781"
@@ -59,11 +63,12 @@
5963
],
6064
"database_specific": {
6165
"cwe_ids": [
62-
"CWE-476"
66+
"CWE-476",
67+
"CWE-478"
6368
],
6469
"severity": "HIGH",
6570
"github_reviewed": true,
6671
"github_reviewed_at": "2026-03-18T20:06:36Z",
67-
"nvd_published_at": null
72+
"nvd_published_at": "2026-03-20T08:16:12Z"
6873
}
6974
}

‎advisories/github-reviewed/2026/03/GHSA-8qvf-mr4w-9x2c/GHSA-8qvf-mr4w-9x2c.json‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8qvf-mr4w-9x2c",
4-
"modified": "2026-03-18T20:01:21Z",
4+
"modified": "2026-03-20T21:23:22Z",
55
"published": "2026-03-18T20:01:21Z",
66
"aliases": [
77
"CVE-2026-33054"
@@ -43,9 +43,21 @@
4343
"type": "WEB",
4444
"url": "https://github.com/mesop-dev/mesop/security/advisories/GHSA-8qvf-mr4w-9x2c"
4545
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33054"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/mesop-dev/mesop/commit/c6b382f363b73ac32c402a2db3aadc7784f66a5b"
53+
},
4654
{
4755
"type": "PACKAGE",
4856
"url": "https://github.com/mesop-dev/mesop"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/mesop-dev/mesop/releases/tag/v1.2.3"
4961
}
5062
],
5163
"database_specific": {
@@ -55,6 +67,6 @@
5567
"severity": "CRITICAL",
5668
"github_reviewed": true,
5769
"github_reviewed_at": "2026-03-18T20:01:21Z",
58-
"nvd_published_at": null
70+
"nvd_published_at": "2026-03-20T07:16:13Z"
5971
}
6072
}

‎advisories/github-reviewed/2026/03/GHSA-958m-gxmc-mccm/GHSA-958m-gxmc-mccm.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-958m-gxmc-mccm",
4-
"modified": "2026-03-18T20:07:17Z",
4+
"modified": "2026-03-20T21:24:12Z",
55
"published": "2026-03-18T20:07:17Z",
66
"aliases": [
77
"CVE-2026-33065"
@@ -40,6 +40,10 @@
4040
"type": "WEB",
4141
"url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-958m-gxmc-mccm"
4242
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33065"
46+
},
4347
{
4448
"type": "WEB",
4549
"url": "https://github.com/free5gc/free5gc/issues/783"
@@ -64,6 +68,6 @@
6468
"severity": "MODERATE",
6569
"github_reviewed": true,
6670
"github_reviewed_at": "2026-03-18T20:07:17Z",
67-
"nvd_published_at": null
71+
"nvd_published_at": "2026-03-20T08:16:12Z"
6872
}
6973
}

‎advisories/github-reviewed/2026/03/GHSA-gjgx-rvqr-6w6v/GHSA-gjgx-rvqr-6w6v.json‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-gjgx-rvqr-6w6v",
4-
"modified": "2026-03-18T20:05:00Z",
4+
"modified": "2026-03-20T21:23:51Z",
55
"published": "2026-03-18T20:05:00Z",
66
"aliases": [
77
"CVE-2026-33057"
@@ -43,6 +43,14 @@
4343
"type": "WEB",
4444
"url": "https://github.com/mesop-dev/mesop/security/advisories/GHSA-gjgx-rvqr-6w6v"
4545
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33057"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/mesop-dev/mesop/commit/825f55970c20686de3f28e2c66df4d74e9d4db47"
53+
},
4654
{
4755
"type": "PACKAGE",
4856
"url": "https://github.com/mesop-dev/mesop"
@@ -55,6 +63,6 @@
5563
"severity": "CRITICAL",
5664
"github_reviewed": true,
5765
"github_reviewed_at": "2026-03-18T20:05:00Z",
58-
"nvd_published_at": null
66+
"nvd_published_at": "2026-03-20T08:16:11Z"
5967
}
6068
}

‎advisories/github-reviewed/2026/03/GHSA-hh8v-hgvp-g3f5/GHSA-hh8v-hgvp-g3f5.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-hh8v-hgvp-g3f5",
4-
"modified": "2026-03-19T19:04:24Z",
4+
"modified": "2026-03-20T21:25:29Z",
55
"published": "2026-03-19T19:04:24Z",
66
"aliases": [
77
"CVE-2026-33347"
88
],
99
"summary": "league/commonmark has an embed extension allowed_domains bypass",
10-
"details": "### Impact\n\nThe `DomainFilteringAdapter` in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attacker-controlled domain like `youtube.com.evil` passes the allowlist check when `youtube.com` is an allowed domain.\n\nThis enables two attack vectors:\n\n- **SSRF**: The `OscaroteroEmbedAdapter` makes server-side HTTP requests to the embed URL via the `embed/embed` library. A bypassed domain filter causes the server to make outbound requests to an attacker-controlled host, potentially probing internal services or exfiltrating request metadata.\n- **XSS**: `EmbedRenderer` outputs the oEmbed response HTML directly into the page with no sanitization. An attacker controlling the bypassed domain can return arbitrary HTML/JavaScript in their oEmbed response, which is rendered verbatim.\n\nAny application using the `Embed` extension and relying on `allowed_domains` to restrict domains when processing untrusted Markdown input is affected.\n\n### Patches\n\nThis has been patched in version **2.8.2**. The fix replaces the regex-based domain check with explicit hostname parsing using `parse_url()`, ensuring exact domain and subdomain matching only.\n\n### Workarounds\n\n- Disable the `Embed` extension, or restrict its use to trusted users\n- Provide your own domain-filtering implementation of `EmbedAdapterInterface`\n- Enable a [Content Security Policy (CSP)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) and outbound firewall restrictions",
10+
"details": "### Impact\n\nThe `DomainFilteringAdapter` in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attacker-controlled domain like `youtube.com.evil` passes the allowlist check when `youtube.com` is an allowed domain.\n\nThis enables two attack vectors:\n\n- **SSRF**: The `OscaroteroEmbedAdapter` makes server-side HTTP requests to the embed URL via the `embed/embed` library. A bypassed domain filter causes the server to make outbound requests to an attacker-controlled host, potentially probing internal services or exfiltrating request metadata.\n- **XSS**: `EmbedRenderer` outputs the oEmbed response HTML directly into the page with no sanitization. An attacker controlling the bypassed domain can return arbitrary HTML/JavaScript in their oEmbed response, which is rendered verbatim.\n\nAny application using the `Embed` extension and relying on `allowed_domains` to restrict domains when processing untrusted Markdown input is affected.\n\n### Patches\n\nThis has been patched in version **2.8.2**. The fix replaces the regex-based domain check with explicit hostname parsing using `parse_url()`, ensuring exact domain and subdomain matching only.\n\n### Workarounds\n\n- Disable the `Embed` extension, or restrict its use to trusted users\n- Provide your own domain-filtering implementation of `EmbedAdapterInterface`\n- Enable a [Content Security Policy (CSP)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) and outbound firewall restrictions\n\n### References\n\n- https://commonmark.thephpleague.com/2.x/extensions/embed/#configuration",
1111
"severity": [
1212
{
1313
"type": "CVSS_V4",
@@ -25,7 +25,7 @@
2525
"type": "ECOSYSTEM",
2626
"events": [
2727
{
28-
"introduced": "0"
28+
"introduced": "2.3.0"
2929
},
3030
{
3131
"fixed": "2.8.2"

‎advisories/github-reviewed/2026/03/GHSA-mmgp-wc2j-qcv7/GHSA-mmgp-wc2j-qcv7.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-mmgp-wc2j-qcv7",
4-
"modified": "2026-03-19T12:42:10Z",
4+
"modified": "2026-03-20T21:24:19Z",
55
"published": "2026-03-19T12:42:09Z",
66
"aliases": [
77
"CVE-2026-33068"
@@ -40,6 +40,10 @@
4040
"type": "WEB",
4141
"url": "https://github.com/anthropics/claude-code/security/advisories/GHSA-mmgp-wc2j-qcv7"
4242
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33068"
46+
},
4347
{
4448
"type": "PACKAGE",
4549
"url": "https://github.com/anthropics/claude-code"
@@ -52,6 +56,6 @@
5256
"severity": "HIGH",
5357
"github_reviewed": true,
5458
"github_reviewed_at": "2026-03-19T12:42:09Z",
55-
"nvd_published_at": null
59+
"nvd_published_at": "2026-03-20T09:16:15Z"
5660
}
5761
}

‎advisories/github-reviewed/2026/03/GHSA-mvpm-v6q4-m2pf/GHSA-mvpm-v6q4-m2pf.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-mvpm-v6q4-m2pf",
4-
"modified": "2026-03-18T16:09:34Z",
4+
"modified": "2026-03-20T21:23:43Z",
55
"published": "2026-03-18T16:09:34Z",
66
"aliases": [
77
"CVE-2026-33067"
@@ -40,6 +40,10 @@
4040
"type": "WEB",
4141
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-mvpm-v6q4-m2pf"
4242
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33067"
46+
},
4347
{
4448
"type": "PACKAGE",
4549
"url": "https://github.com/siyuan-note/siyuan"
@@ -52,6 +56,6 @@
5256
"severity": "MODERATE",
5357
"github_reviewed": true,
5458
"github_reviewed_at": "2026-03-18T16:09:34Z",
55-
"nvd_published_at": null
59+
"nvd_published_at": "2026-03-20T09:16:14Z"
5660
}
5761
}

0 commit comments

Comments
 (0)