Skip to content

Commit e2391f6

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-53wg-r69p-v3r7 GHSA-846p-jg2w-w324 GHSA-9r42-rhw3-2222 GHSA-fphv-w9fq-2525 GHSA-mx8m-v8qm-xwr8
1 parent 37f666e commit e2391f6

5 files changed

Lines changed: 161 additions & 42 deletions

File tree

‎advisories/github-reviewed/2026/01/GHSA-53wg-r69p-v3r7/GHSA-53wg-r69p-v3r7.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-53wg-r69p-v3r7",
4-
"modified": "2026-01-16T21:56:53Z",
4+
"modified": "2026-01-21T16:20:01Z",
55
"published": "2026-01-16T21:09:08Z",
66
"aliases": [
77
"CVE-2026-23735"
88
],
99
"summary": "GraphQL Modules has a Race Condition issue",
10-
"details": "### Summary\nOriginally reported as an issue #2613 but should be elevated to a security issue as the ExecutionContext is often used to pass authentication tokens from incoming requests to services loading data from backend APIs.\n\n### Details\nWhen 2 or more parallel requests are made which trigger the same service, the context of the requests is mixed up in the service when the context is injected via `@ExecutionContext()`\n\n### PoC\n\nIn a new project/folder, create and install the following `package.json`:\n\n```json\n{\n \"name\": \"GHSA-53wg-r69p-v3r7\",\n \"scripts\": {\n \"test\": \"jest\"\n },\n \"dependencies\": {\n \"graphql-modules\": \"2.4.0\"\n },\n \"devDependencies\": {\n \"@babel/plugin-proposal-class-properties\": \"^7.18.6\",\n \"@babel/plugin-proposal-decorators\": \"^7.28.6\",\n \"babel-plugin-parameter-decorator\": \"^1.0.16\",\n \"jest\": \"^29.7.0\",\n \"reflect-metadata\": \"^0.2.2\"\n }\n}\n```\n\nwith:\n\n```\nnpm i\n```\n\nconfigure `babel.config.json` using:\n\n```json\n{\n \"plugins\": [\n [\"@babel/plugin-proposal-decorators\", { \"legacy\": true }],\n \"babel-plugin-parameter-decorator\",\n \"@babel/plugin-proposal-class-properties\"\n ]\n}\n```\n\nthen write the following test `GHSA-53wg-r69p-v3r7.spec.ts`:\n\n```js\nrequire(\"reflect-metadata\");\nconst {\n createApplication,\n createModule,\n Injectable,\n Scope,\n ExecutionContext,\n gql,\n testkit,\n} = require(\"graphql-modules\");\n\ntest(\"accessing a singleton provider context during another asynchronous execution\", async () => {\n @Injectable({ scope: Scope.Singleton })\n class IdentifierProvider {\n @ExecutionContext()\n context;\n\n getId() {\n return this.context.identifier;\n }\n }\n\n const { promise: gettingBefore, resolve: gotBefore } = createDeferred();\n\n const { promise: waitForGettingAfter, resolve: getAfter } = createDeferred();\n\n const mod = createModule({\n id: \"mod\",\n providers: [IdentifierProvider],\n typeDefs: gql`\n type Query {\n getAsyncIdentifiers: Identifiers!\n }\n\n type Identifiers {\n before: String!\n after: String!\n }\n `,\n resolvers: {\n Query: {\n async getAsyncIdentifiers(_0, _1, context) {\n const before = context.injector.get(IdentifierProvider).getId();\n gotBefore();\n await waitForGettingAfter;\n const after = context.injector.get(IdentifierProvider).getId();\n return { before, after };\n },\n },\n },\n });\n\n const app = createApplication({\n modules: [mod],\n });\n\n const document = gql`\n {\n getAsyncIdentifiers {\n before\n after\n }\n }\n `;\n\n const firstResult$ = testkit.execute(app, {\n contextValue: {\n identifier: \"first\",\n },\n document,\n });\n\n await gettingBefore;\n\n const secondResult$ = testkit.execute(app, {\n contextValue: {\n identifier: \"second\",\n },\n document,\n });\n\n getAfter();\n\n await expect(firstResult$).resolves.toEqual({\n data: {\n getAsyncIdentifiers: {\n before: \"first\",\n after: \"first\",\n },\n },\n });\n\n await expect(secondResult$).resolves.toEqual({\n data: {\n getAsyncIdentifiers: {\n before: \"second\",\n after: \"second\",\n },\n },\n });\n});\n\nfunction createDeferred() {\n let resolve, reject;\n const promise = new Promise((res, rej) => {\n resolve = res;\n reject = rej;\n });\n return {\n promise,\n resolve,\n reject,\n };\n}\n```\n\nand execute using:\n\n```\nnpm test\n```\n\nYour project tree should look like this:\n\n```\nGHSA-53wg-r69p-v3r7\n package.json\n package-lock.json\n babel.config.json\n GHSA-53wg-r69p-v3r7.spec.js\n```\n\n#### Expected vs. Actual Outcome\n\n```diff\n- Expected - 1\n+ Received + 1\n\n Object {\n \"data\": Object {\n \"getAsyncIdentifiers\": Object {\n- \"after\": \"first\",\n+ \"after\": \"second\",\n \"before\": \"first\",\n },\n },\n }\n```\n\n### Impact\n\nAny application that uses services that inject the context using `@ExecutionContext()` are at risk. The more traffic an application has, the higher the chance for parallel requests, the higher the risk.",
10+
"details": "### Summary\nOriginally reported as an issue #2613 but should be elevated to a security issue as the ExecutionContext is often used to pass authentication tokens from incoming requests to services loading data from backend APIs.\n\n### Details\nWhen 2 or more parallel requests are made which trigger the same service, the context of the requests is mixed up in the service when the context is injected via `@ExecutionContext()`\n\n### PoC\n\nIn a new project/folder, create and install the following `package.json`:\n\n```json\n{\n \"name\": \"GHSA-53wg-r69p-v3r7\",\n \"scripts\": {\n \"test\": \"jest\"\n },\n \"dependencies\": {\n \"graphql-modules\": \"2.4.0\"\n },\n \"devDependencies\": {\n \"@babel/plugin-proposal-class-properties\": \"^7.18.6\",\n \"@babel/plugin-proposal-decorators\": \"^7.28.6\",\n \"babel-plugin-parameter-decorator\": \"^1.0.16\",\n \"jest\": \"^29.7.0\",\n \"reflect-metadata\": \"^0.2.2\"\n }\n}\n```\n\nwith:\n\n```\nnpm i\n```\n\nconfigure `babel.config.json` using:\n\n```json\n{\n \"plugins\": [\n [\"@babel/plugin-proposal-decorators\", { \"legacy\": true }],\n \"babel-plugin-parameter-decorator\",\n \"@babel/plugin-proposal-class-properties\"\n ]\n}\n```\n\nthen write the following test `GHSA-53wg-r69p-v3r7.spec.ts`:\n\n```js\nrequire(\"reflect-metadata\");\nconst {\n createApplication,\n createModule,\n Injectable,\n Scope,\n ExecutionContext,\n gql,\n testkit,\n} = require(\"graphql-modules\");\n\ntest(\"accessing a singleton provider context during another asynchronous execution\", async () => {\n @Injectable({ scope: Scope.Singleton })\n class IdentifierProvider {\n @ExecutionContext()\n context;\n\n getId() {\n return this.context.identifier;\n }\n }\n\n const { promise: gettingBefore, resolve: gotBefore } = createDeferred();\n\n const { promise: waitForGettingAfter, resolve: getAfter } = createDeferred();\n\n const mod = createModule({\n id: \"mod\",\n providers: [IdentifierProvider],\n typeDefs: gql`\n type Query {\n getAsyncIdentifiers: Identifiers!\n }\n\n type Identifiers {\n before: String!\n after: String!\n }\n `,\n resolvers: {\n Query: {\n async getAsyncIdentifiers(_0, _1, context) {\n const before = context.injector.get(IdentifierProvider).getId();\n gotBefore();\n await waitForGettingAfter;\n const after = context.injector.get(IdentifierProvider).getId();\n return { before, after };\n },\n },\n },\n });\n\n const app = createApplication({\n modules: [mod],\n });\n\n const document = gql`\n {\n getAsyncIdentifiers {\n before\n after\n }\n }\n `;\n\n const firstResult$ = testkit.execute(app, {\n contextValue: {\n identifier: \"first\",\n },\n document,\n });\n\n await gettingBefore;\n\n const secondResult$ = testkit.execute(app, {\n contextValue: {\n identifier: \"second\",\n },\n document,\n });\n\n getAfter();\n\n await expect(firstResult$).resolves.toEqual({\n data: {\n getAsyncIdentifiers: {\n before: \"first\",\n after: \"first\",\n },\n },\n });\n\n await expect(secondResult$).resolves.toEqual({\n data: {\n getAsyncIdentifiers: {\n before: \"second\",\n after: \"second\",\n },\n },\n });\n});\n\nfunction createDeferred() {\n let resolve, reject;\n const promise = new Promise((res, rej) => {\n resolve = res;\n reject = rej;\n });\n return {\n promise,\n resolve,\n reject,\n };\n}\n```\n\nand execute using:\n\n```\nnpm test\n```\n\nYour project tree should look like this:\n\n```\nGHSA-53wg-r69p-v3r7\n package.json\n package-lock.json\n babel.config.json\n GHSA-53wg-r69p-v3r7.spec.js\n```\n\n#### Expected vs. Actual Outcome\n\n```diff\n- Expected - 1\n+ Received + 1\n\n Object {\n \"data\": Object {\n \"getAsyncIdentifiers\": Object {\n- \"after\": \"first\",\n+ \"after\": \"second\",\n \"before\": \"first\",\n },\n },\n }\n```\n\n### Impact\n\nAny application that uses services that inject the context using `@ExecutionContext()` from a singleton provider are at risk. The more traffic an application has, the higher the chance for parallel requests, the higher the risk.",
1111
"severity": [
1212
{
1313
"type": "CVSS_V4",

‎advisories/github-reviewed/2026/01/GHSA-846p-jg2w-w324/GHSA-846p-jg2w-w324.json‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-846p-jg2w-w324",
4+
"modified": "2026-01-21T16:19:28Z",
5+
"published": "2026-01-21T16:19:28Z",
6+
"aliases": [
7+
"CVE-2026-23991"
8+
],
9+
"summary": "go-tuf affected by client DoS via malformed server response",
10+
"details": "# Security Disclosure: Client DoS via malformed server response\n\n## Summary\n\nIf the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic _during parsing_, causing a DoS. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key.\n\n## Impact \n\nClient crashes upon receiving and parsing malformed TUF metadata. This can cause long running services to enter an restart/crash loop.\n\n## Workarounds\n\nNone currently. \n\n## Affected code\n\nThe `metadata.checkType` function did not properly type assert the (untrusted) input causing it to panic on malformed data.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/theupdateframework/go-tuf/v2"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.3.1"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Go",
40+
"name": "github.com/theupdateframework/go-tuf"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "0"
48+
},
49+
{
50+
"last_affected": "0.7.0"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-846p-jg2w-w324"
61+
},
62+
{
63+
"type": "PACKAGE",
64+
"url": "https://github.com/theupdateframework/go-tuf"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://github.com/theupdateframework/go-tuf/releases/tag/v2.3.1"
69+
}
70+
],
71+
"database_specific": {
72+
"cwe_ids": [
73+
"CWE-617",
74+
"CWE-754"
75+
],
76+
"severity": "MODERATE",
77+
"github_reviewed": true,
78+
"github_reviewed_at": "2026-01-21T16:19:28Z",
79+
"nvd_published_at": null
80+
}
81+
}

‎advisories/github-reviewed/2026/01/GHSA-9r42-rhw3-2222/GHSA-9r42-rhw3-2222.json‎

Lines changed: 1 addition & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-9r42-rhw3-2222",
4-
"modified": "2026-01-16T20:54:02Z",
4+
"modified": "2026-01-21T16:18:50Z",
55
"published": "2026-01-16T09:31:21Z",
66
"aliases": [
77
"CVE-2025-14822"
@@ -37,25 +37,6 @@
3737
"last_known_affected_version_range": "<= 10.11.8"
3838
}
3939
},
40-
{
41-
"package": {
42-
"ecosystem": "Go",
43-
"name": "github.com/mattermost/mattermost/server/v8"
44-
},
45-
"ranges": [
46-
{
47-
"type": "ECOSYSTEM",
48-
"events": [
49-
{
50-
"introduced": "0"
51-
},
52-
{
53-
"fixed": "8.0.0-20251201064648-4d86263f5430"
54-
}
55-
]
56-
}
57-
]
58-
},
5940
{
6041
"package": {
6142
"ecosystem": "Go",

‎advisories/github-reviewed/2026/01/GHSA-fphv-w9fq-2525/GHSA-fphv-w9fq-2525.json‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fphv-w9fq-2525",
4+
"modified": "2026-01-21T16:19:32Z",
5+
"published": "2026-01-21T16:19:32Z",
6+
"aliases": [
7+
"CVE-2026-23992"
8+
],
9+
"summary": "go-tuf improperly validates the configured threshold for delegations",
10+
"details": "# Security Disclosure: Improper validation of configured threshold for delegations\n\n## Summary\n\nA compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. \n\n## Impact\n\nUnathorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made.\n\n## Patches\n\nUpgrade to v2.3.1\n\n## Workarounds\n\nAlways make sure that the TUF metadata roles are configured with a threshold of at least 1.\n\n## Affected code:\n\nThe `metadata.VerifyDelegate` did not verify the configured threshold prior to comparison. This means that a misconfigured TUF repository could disable the signature verification by setting the threshold to 0, or a negative value (and so always make the signature threshold computation to pass).",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/theupdateframework/go-tuf/v2"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.3.1"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Go",
40+
"name": "github.com/theupdateframework/go-tuf"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "0"
48+
},
49+
{
50+
"last_affected": "0.7.0"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-fphv-w9fq-2525"
61+
},
62+
{
63+
"type": "PACKAGE",
64+
"url": "https://github.com/theupdateframework/go-tuf"
65+
}
66+
],
67+
"database_specific": {
68+
"cwe_ids": [
69+
"CWE-347"
70+
],
71+
"severity": "MODERATE",
72+
"github_reviewed": true,
73+
"github_reviewed_at": "2026-01-21T16:19:32Z",
74+
"nvd_published_at": null
75+
}
76+
}

‎advisories/github-reviewed/2026/01/GHSA-mx8m-v8qm-xwr8/GHSA-mx8m-v8qm-xwr8.json‎

Lines changed: 1 addition & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-mx8m-v8qm-xwr8",
4-
"modified": "2026-01-16T20:58:33Z",
4+
"modified": "2026-01-21T16:19:03Z",
55
"published": "2026-01-16T12:30:25Z",
66
"aliases": [
77
"CVE-2025-14435"
@@ -80,25 +80,6 @@
8080
"database_specific": {
8181
"last_known_affected_version_range": "<= 11.0.6"
8282
}
83-
},
84-
{
85-
"package": {
86-
"ecosystem": "Go",
87-
"name": "github.com/mattermost/mattermost/server/v8"
88-
},
89-
"ranges": [
90-
{
91-
"type": "ECOSYSTEM",
92-
"events": [
93-
{
94-
"introduced": "0"
95-
},
96-
{
97-
"fixed": "8.0.0-20251210072417-cc6b77b27132"
98-
}
99-
]
100-
}
101-
]
10283
}
10384
],
10485
"references": [

0 commit comments

Comments
 (0)