Security vulnerabilities and automated fixes for supply chain security issues
46 posts found
The `ip-address` npm package (version 10.2.0) parsed IPv4 addresses with leading-zero octets as decimal numbers, while operating system resolvers interpret them as octal. This inconsistency (CVE-2026-69192) allows attackers to bypass SSRF protections and trust-boundary checks by crafting IP addresses that appear safe to the library but resolve to internal network addresses. The fix upgrades `ip-address` to version 10.3.1, which correctly rejects or normalizes ambiguous octal notation.
A Dependabot configuration in `.github/dependabot.yml` was missing a `cooldown` block, meaning dependency update PRs could be opened immediately after a new package version was published — including potentially malicious or compromised packages. Adding a `cooldown: default-days: 7` setting ensures updates are only proposed after a 7-day waiting period, giving the security community time to identify and flag bad packages before they reach your codebase.
A high-severity arbitrary server-side file read vulnerability (GHSA-f4xh-w4cj-qxq8) was discovered in LangSmith SDK's `TracingMiddleware`, affecting versions prior to 0.8.18. An attacker able to influence tracing requests could potentially read arbitrary files from the server's filesystem. Upgrading from version 0.8.15 to 0.8.18 in `poetry.lock` and `pyproject.toml` closes the attack surface entirely.
A critical code injection vulnerability was discovered in `js/lib/jsencrypt.js` at line 195, where a direct `eval()` call executed a JavaScript string shim for the `process` object in browser environments. If an attacker could influence the string passed to `eval()`—through a compromised dependency, a man-in-the-middle attack, or supply chain tampering—they could achieve arbitrary JavaScript execution in any user's browser. The fix replaces the `eval()` call with the equivalent inline JavaScript
CVE-2026-13676 is a high-severity vulnerability in the `fast-uri` npm package where improper handling of Unicode hostnames during URI parsing could allow attackers to bypass security policies. By upgrading `fast-uri` from 3.1.2 to 3.1.3 (or 2.4.2 / 4.0.1 depending on the major version in use), the canonicalization logic is corrected to ensure that Unicode hostnames are normalized consistently before any policy checks are applied. This fix matters because URI parsing libraries are foundational co
A critical security vulnerability was discovered in `plugins/python-build/scripts/add_cpython.py` where `requests.get()` calls to the GitHub API and OpenSSL release endpoints lacked explicit TLS certificate verification enforcement and consistent error handling. While Python's `requests` library defaults to `verify=True`, the absence of explicit enforcement and centralized error handling left the build tool exposed to man-in-the-middle attacks that could inject malicious package data. The fix in
A high-severity path traversal vulnerability (GHSA-r28c-9q8g-f849) in PostCSS versions prior to 8.5.18 allowed attackers to abuse the `sourceMappingURL` comment auto-loading mechanism to read arbitrary `.map` files outside the intended directory. The fix upgrades PostCSS from 8.5.15 to 8.5.18 in `frontend/package-lock.json` and pins the version via an `overrides` block in `frontend/package.json`. This closes a file disclosure primitive that, while not independently exploitable in all configurati
A GitHub Actions workflow in `templates/devto/devto-readme.yml` referenced `actions/checkout@v4` and `actions/setup-node@v4` using mutable version tags instead of pinned commit SHAs. This pattern enables supply-chain attacks where a compromised action owner silently repoints a tag to malicious code. The fix pins both actions to their full 40-character commit SHAs while preserving version comments for maintainability.
A high-severity shell injection vulnerability was discovered in `setup-js/action.yml` where direct interpolation of `inputs.package-manager` in a `run:` step could allow attackers to execute arbitrary code on the GitHub Actions runner. The fix introduces intermediate environment variables to safely pass user-controlled inputs, preventing command injection while maintaining the same functionality.
A missing `trustPolicy` setting in `pnpm-workspace.yaml` left a Node.js workspace vulnerable to malicious packages silently downgrading security configurations. The fix adds `trustPolicy: no-downgrade` alongside `blockExoticSubdeps: true` and a stricter `minimumReleaseAge`, closing a supply-chain attack primitive before it could be chained with other weaknesses.
A high-severity Denial of Service vulnerability (CVE-2026-69152) was discovered in the `brace-expansion` npm package, where crafted input could generate unbounded intermediate arrays that exhaust system memory. This bypasses the earlier CVE-2026-14257 mitigation. The fix upgrades `brace-expansion` from version 1.1.12 (and 2.0.2) to patched versions 1.1.18 across the dependency tree in the `exia-invasion` project.
The apple-mail-mcp repository was vulnerable to supply chain timing attacks because its pnpm workspace configuration only enforced a 1-day (1440 minute) minimum release age for newly published packages. This allowed a 5-day-old transitive dependency (ip-address@10.5.0) to be installed despite Dependabot's 7-day cooldown, creating a window where malicious or unstable packages could enter the dependency tree. The fix raises minimumReleaseAge to 10080 minutes (7 days) to ensure all packages—includi