Skip to content

Commit d9b2d4b

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-36p8-mvp6-cv38 GHSA-pchf-49fh-w34r GHSA-xxjr-mmjv-4gpg
1 parent ba832f2 commit d9b2d4b

File tree

3 files changed

+293
-0
lines changed

3 files changed

+293
-0
lines changed

‎advisories/github-reviewed/2026/01/GHSA-36p8-mvp6-cv38/GHSA-36p8-mvp6-cv38.json‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-36p8-mvp6-cv38",
4+
"modified": "2026-01-21T23:00:35Z",
5+
"published": "2026-01-21T23:00:35Z",
6+
"aliases": [
7+
"CVE-2026-0933"
8+
],
9+
"summary": "Wrangler affected by OS Command Injection in `wrangler pages deploy`",
10+
"details": "**Summary**\n\nA command injection vulnerability (CWE-78) has been found to exist in the `wrangler pages deploy` command. The issue occurs because the `--commit-hash` parameter is passed directly to a shell command without proper validation or sanitization, allowing an attacker with control of `--commit-hash` to execute arbitrary commands on the system running Wrangler.\n\n**Root cause**\n\nThe `commitHash` variable, derived from user input via the `--commit-hash` CLI argument, is interpolated directly into a shell command using template literals (e.g., ``execSync(`git show -s --format=%B ${commitHash}`)``). Shell metacharacters are interpreted by the shell, enabling command execution.\n\n**Impact**\n\nThis vulnerability is generally hard to exploit, as it requires `--commit-hash` to be attacker controlled. The vulnerability primarily affects CI/CD environments where `wrangler pages deploy` is used in automated pipelines and the `--commit-hash` parameter is populated from external, potentially untrusted sources. An attacker could exploit this to:\n\n- Run any shell command.\n- Exfiltrate environment variables.\n- Compromise the CI runner to install backdoors or modify build artifacts.\n\n**Mitigation**\n\n- Wrangler v4 users are requested to upgrade to Wrangler v4.59.1 or higher. \n- Wrangler v3 users are requested to upgrade to Wrangler v3.114.17 or higher. \n- Users on Wrangler v2 (EOL) should upgrade to a supported major version.\n\n**Credits**\n\nDisclosed responsibly by kny4hacker.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "wrangler"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "2.0.15"
29+
},
30+
{
31+
"fixed": "3.114.17"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "npm",
40+
"name": "wrangler"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "4.0.0"
48+
},
49+
{
50+
"fixed": "4.59.1"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-36p8-mvp6-cv38"
61+
},
62+
{
63+
"type": "ADVISORY",
64+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0933"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://github.com/cloudflare/workers-sdk/commit/99b1f328a9afe181b49f1114ed47f15f6d25f0be"
69+
},
70+
{
71+
"type": "PACKAGE",
72+
"url": "https://github.com/cloudflare/workers-sdk"
73+
},
74+
{
75+
"type": "WEB",
76+
"url": "https://github.com/cloudflare/workers-sdk/releases/tag/wrangler%403.114.17"
77+
},
78+
{
79+
"type": "WEB",
80+
"url": "https://github.com/cloudflare/workers-sdk/releases/tag/wrangler%404.59.1"
81+
}
82+
],
83+
"database_specific": {
84+
"cwe_ids": [
85+
"CWE-78"
86+
],
87+
"severity": "HIGH",
88+
"github_reviewed": true,
89+
"github_reviewed_at": "2026-01-21T23:00:35Z",
90+
"nvd_published_at": null
91+
}
92+
}

‎advisories/github-reviewed/2026/01/GHSA-pchf-49fh-w34r/GHSA-pchf-49fh-w34r.json‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-pchf-49fh-w34r",
4+
"modified": "2026-01-21T23:02:07Z",
5+
"published": "2026-01-21T23:02:07Z",
6+
"aliases": [],
7+
"summary": "Soft Serve Affected by an Authentication Bypass",
8+
"details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nThis issue impacts every Soft Serve instance.\n\nA critical authentication bypass allows an attacker to impersonate any user (including Admin) by \"offering\" the victim's public key during the SSH handshake before authenticating with their own valid key. This occurs because the user identity is stored in the session context during the \"offer\" phase and is not cleared if that specific authentication attempt fails.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nYes, please upgrade to version 0.11.3 as soon as possible.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nYou need to upgrade",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "Go",
19+
"name": "github.com/charmbracelet/soft-serve"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "0.11.3"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 0.11.2"
36+
}
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-pchf-49fh-w34r"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://github.com/charmbracelet/soft-serve/commit/8539f9ad39918b67d612a35785a2b4326efc8741"
47+
},
48+
{
49+
"type": "PACKAGE",
50+
"url": "https://github.com/charmbracelet/soft-serve"
51+
},
52+
{
53+
"type": "WEB",
54+
"url": "https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.3"
55+
}
56+
],
57+
"database_specific": {
58+
"cwe_ids": [
59+
"CWE-289"
60+
],
61+
"severity": "HIGH",
62+
"github_reviewed": true,
63+
"github_reviewed_at": "2026-01-21T23:02:07Z",
64+
"nvd_published_at": null
65+
}
66+
}

‎advisories/github-reviewed/2026/01/GHSA-xxjr-mmjv-4gpg/GHSA-xxjr-mmjv-4gpg.json‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-xxjr-mmjv-4gpg",
4+
"modified": "2026-01-21T23:01:22Z",
5+
"published": "2026-01-21T23:01:22Z",
6+
"aliases": [
7+
"CVE-2025-13465"
8+
],
9+
"summary": "Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions",
10+
"details": "### Impact\n\nLodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the `_.unset` and `_.omit` functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. \n\nThe issue permits deletion of properties but does not allow overwriting their original behavior. \n\n### Patches\n\nThis issue is patched on 4.17.23.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
15+
},
16+
{
17+
"type": "CVSS_V4",
18+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P"
19+
}
20+
],
21+
"affected": [
22+
{
23+
"package": {
24+
"ecosystem": "npm",
25+
"name": "lodash"
26+
},
27+
"ranges": [
28+
{
29+
"type": "ECOSYSTEM",
30+
"events": [
31+
{
32+
"introduced": "4.0.0"
33+
},
34+
{
35+
"fixed": "4.17.23"
36+
}
37+
]
38+
}
39+
],
40+
"database_specific": {
41+
"last_known_affected_version_range": "<= 4.17.22"
42+
}
43+
},
44+
{
45+
"package": {
46+
"ecosystem": "npm",
47+
"name": "lodash.unset"
48+
},
49+
"ranges": [
50+
{
51+
"type": "ECOSYSTEM",
52+
"events": [
53+
{
54+
"introduced": "4.0.0"
55+
},
56+
{
57+
"last_affected": "4.5.2"
58+
}
59+
]
60+
}
61+
]
62+
},
63+
{
64+
"package": {
65+
"ecosystem": "npm",
66+
"name": "lodash-es"
67+
},
68+
"ranges": [
69+
{
70+
"type": "ECOSYSTEM",
71+
"events": [
72+
{
73+
"introduced": "4.0.0"
74+
},
75+
{
76+
"fixed": "4.17.23"
77+
}
78+
]
79+
}
80+
],
81+
"database_specific": {
82+
"last_known_affected_version_range": "<= 4.17.22"
83+
}
84+
},
85+
{
86+
"package": {
87+
"ecosystem": "npm",
88+
"name": "lodash-amd"
89+
},
90+
"ranges": [
91+
{
92+
"type": "ECOSYSTEM",
93+
"events": [
94+
{
95+
"introduced": "4.0.0"
96+
},
97+
{
98+
"fixed": "4.17.23"
99+
}
100+
]
101+
}
102+
],
103+
"database_specific": {
104+
"last_known_affected_version_range": "<= 4.17.22"
105+
}
106+
}
107+
],
108+
"references": [
109+
{
110+
"type": "WEB",
111+
"url": "https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg"
112+
},
113+
{
114+
"type": "ADVISORY",
115+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13465"
116+
},
117+
{
118+
"type": "WEB",
119+
"url": "https://github.com/lodash/lodash/commit/edadd452146f7e4bad4ea684e955708931d84d81"
120+
},
121+
{
122+
"type": "PACKAGE",
123+
"url": "https://github.com/lodash/lodash"
124+
}
125+
],
126+
"database_specific": {
127+
"cwe_ids": [
128+
"CWE-1321"
129+
],
130+
"severity": "MODERATE",
131+
"github_reviewed": true,
132+
"github_reviewed_at": "2026-01-21T23:01:22Z",
133+
"nvd_published_at": "2026-01-21T20:16:05Z"
134+
}
135+
}

0 commit comments

Comments
 (0)