Skip to content

Commit ba832f2

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-8h3q-9fpp-c883 GHSA-r92c-9c7f-3pj8 GHSA-8h3q-9fpp-c883
1 parent 25f4e0f commit ba832f2

File tree

3 files changed

+127
-36
lines changed

3 files changed

+127
-36
lines changed

‎advisories/github-reviewed/2026/01/GHSA-8h3q-9fpp-c883/GHSA-8h3q-9fpp-c883.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8h3q-9fpp-c883",
4+
"modified": "2026-01-21T23:00:08Z",
5+
"published": "2026-01-21T00:31:43Z",
6+
"withdrawn": "2026-01-21T23:00:08Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: Wrangler affected by OS Command Injection in `wrangler pages deploy`",
9+
"details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-36p8-mvp6-cv38. This link is maintained to preserve external references.\n\n## Original Description\n\nSummaryA command injection vulnerability (CWE-78) has been found to exist in the `wrangler pages deploy` command. The issue occurs because the `--commit-hash` parameter is passed directly to a shell command without proper validation or sanitization, allowing an attacker with control of `--commit-hash` to execute arbitrary commands on the system running Wrangler.\n\n\n\n\nRoot causeThe commitHash variable, derived from user input via the --commit-hash CLI argument, is interpolated directly into a shell command using template literals (e.g.,  execSync(`git show -s --format=%B ${commitHash}`)). Shell metacharacters are interpreted by the shell, enabling command execution.\n\n\n\n\nImpactThis vulnerability is generally hard to exploit, as it requires --commit-hash to be attacker controlled. The vulnerability primarily affects CI/CD environments where `wrangler pages deploy` is used in automated pipelines and the \n\n--commit-hash parameter is populated from external, potentially untrusted sources. An attacker could exploit this to:\n\n * Run any shell command.\n * Exfiltrate environment variables.\n * Compromise the CI runner to install backdoors or modify build artifacts.\n\n\n\nCredits Disclosed responsibly by kny4hacker.\n\n\n\n\nMitigation\n * Wrangler v4 users are requested to upgrade to Wrangler v4.59.1 or higher.\n * Wrangler v3 users are requested to upgrade to Wrangler v3.114.17 or higher.\n * Users on Wrangler v2 (EOL) should upgrade to a supported major version.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [
17+
{
18+
"package": {
19+
"ecosystem": "npm",
20+
"name": "wrangler"
21+
},
22+
"ranges": [
23+
{
24+
"type": "ECOSYSTEM",
25+
"events": [
26+
{
27+
"introduced": "2.0.15"
28+
}
29+
]
30+
}
31+
],
32+
"database_specific": {
33+
"last_known_affected_version_range": "< 3.114.17"
34+
}
35+
}
36+
],
37+
"references": [
38+
{
39+
"type": "ADVISORY",
40+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0933"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/cloudflare/workers-sdk"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-20"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": true,
53+
"github_reviewed_at": "2026-01-21T23:00:08Z",
54+
"nvd_published_at": "2026-01-20T23:16:06Z"
55+
}
56+
}

‎advisories/github-reviewed/2026/01/GHSA-r92c-9c7f-3pj8/GHSA-r92c-9c7f-3pj8.json‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-r92c-9c7f-3pj8",
4+
"modified": "2026-01-21T22:58:42Z",
5+
"published": "2026-01-21T22:58:42Z",
6+
"aliases": [],
7+
"summary": "OpenTofu has High CPU usage in \"tofu init\" with maliciously-crafted module packages in .zip format",
8+
"details": "### Impact\nUnauthenticated denial of service.\n\n### Summary\nWhen installing module packages from attacker-controlled sources, `tofu init` may cause high CPU usage when encountering maliciously-crafted `.zip` archives for either provider or module distribution packages.\n\nThose who depend on modules or providers served from untrusted third-party servers may experience denial of service due to `tofu init` failing to complete in a timely manner. Other processes running on the same computer as OpenTofu may also have their performance degraded due to the high CPU usage.\n\nThese vulnerabilities **do not** permit arbitrary code execution or allow disclosure of confidential information.\n\n### Details\n\nOpenTofu relies on a third-party implementation of `.zip` archive extraction from the standard library of the Go programming language. The Go project has recently published a minor release (Go 1.25.6) to address a problem of potential excessive CPU usage when accessing files in a maliciously-crafted `.zip` archive.\n\nOpenTofu's threat model considers module and package dependencies to be arbitrary third-party code that operators must carefully review after installation. However, this particular problem affects the process of installing these dependencies with `tofu init`, and so can potentially occur before an operator has had the opportunity to review what is being installed.\n\nAn attacker can exploit this either by controlling the content of a package served when OpenTofu is expecting to receive a archive using the `.zip` format, during either provider or module package installation.\n\nHowever, the attacker must also coerce an OpenTofu operator into attempting dependency installation from a source that they control. Typical use of OpenTofu already requires caution in selection of third-party dependencies because they are arbitrary code, and so the vulnerability here is only in the addition of a potential denial of service in the `tofu init` process, which does not execute third-party dependency code itself.\n\n### Patches\n\nOpenTofu v1.11.4 addresses these vulnerabilities by being built against Go 1.25.6, which contains an improved version of the upstream implementation.\n\n### Workarounds\n\nThese vulnerabilities can be exploited only if an attacker can coerce an operator to add a dependency from an attacker-controlled source to their configuration before running `tofu init`. Those who are unable to immediately upgrade can therefore minimize risk by reviewing new dependencies before adding them to the configuration, such as by directly fetching the relevant artifacts using software other than OpenTofu.\n\nSuccessful exploitation requires that the attacker control a `.zip` archive that OpenTofu would fetch and extract during the provider or module installation processes. Note that OpenTofu modules can have their own dependencies on other providers and modules, so an attacker could potentially use a module served from a source such as GitHub or the OpenTofu Registry to indirectly request a provider or module package from a server that they control.\n\n### References\n\n- [OpenTofu v1..11.4 release notes](https://github.com/opentofu/opentofu/releases/tag/v1.11.4)\n- [golang/go#77102](https://github.com/golang/go/issues/77102)",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "Go",
19+
"name": "github.com/opentofu/opentofu"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "1.11.4"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/opentofu/opentofu/security/advisories/GHSA-r92c-9c7f-3pj8"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/golang/go/issues/77102"
44+
},
45+
{
46+
"type": "WEB",
47+
"url": "https://github.com/opentofu/opentofu/pull/3689"
48+
},
49+
{
50+
"type": "WEB",
51+
"url": "https://github.com/opentofu/opentofu/commit/f5d5cdf16615ea3c298e058b062951adb02805f3"
52+
},
53+
{
54+
"type": "PACKAGE",
55+
"url": "https://github.com/opentofu/opentofu"
56+
},
57+
{
58+
"type": "WEB",
59+
"url": "https://github.com/opentofu/opentofu/releases/tag/v1.11.4"
60+
}
61+
],
62+
"database_specific": {
63+
"cwe_ids": [
64+
"CWE-1395"
65+
],
66+
"severity": "LOW",
67+
"github_reviewed": true,
68+
"github_reviewed_at": "2026-01-21T22:58:42Z",
69+
"nvd_published_at": null
70+
}
71+
}

‎advisories/unreviewed/2026/01/GHSA-8h3q-9fpp-c883/GHSA-8h3q-9fpp-c883.json‎

Lines changed: 0 additions & 36 deletions
This file was deleted.

0 commit comments

Comments
 (0)