Page 11
A high-severity Denial of Service vulnerability (CVE-2026-13149) was discovered in the `brace-expansion` package, a transitive dependency used across many Node.js projects. The flaw allows attackers to trigger exponential-time processing by supplying crafted brace patterns, potentially freezing the application. The fix upgrades `brace-expansion` to patched versions (2.1.2, 1.1.16, 5.0.7) and restructures how nested dependencies resolve the package within the `@sentry/bundler-plugin-core` depende
CVE-2026-39244 is a high-severity Denial of Service vulnerability in the adm-zip npm package (versions prior to 0.6.0) that allows an attacker to cause excessive memory allocation by supplying a specially crafted ZIP file. The fix upgrades adm-zip from 0.5.16 to 0.6.0 and pins the version via a package.json override to ensure no transitive dependency can silently pull in the vulnerable release. Left unpatched, any Node.js application that processes user-supplied ZIP archives with adm-zip is expo
CVE-2026-9277 is a critical command injection vulnerability in the `shell-quote` npm package (versions before 1.8.4) caused by improper handling of unescaped line terminators, which could allow attackers to inject and execute arbitrary shell commands. The fix upgrades `shell-quote` from 1.8.1 to 1.8.4 across `package.json`, `package-lock.json`, and `yarn.lock`, and pins the version using both `overrides` and `resolutions` to ensure no transitive dependency pulls in the vulnerable version. This i
CVE-2026-13149 is a high-severity Denial of Service vulnerability in the `brace-expansion` npm package, where crafted brace patterns trigger exponential-time processing that can freeze or crash Node.js applications. The fix upgrades `brace-expansion` from the vulnerable `2.0.3` to the patched `2.1.2` (and aligns related versions to `1.1.16` and `5.0.7`), replacing the nested-scoped vulnerable copy under `node_modules/filelist` and `node_modules/glob` with a single, safe top-level resolution. Any
A vulnerability in the `tmp` Node.js package (CVE-2026-44705) was discovered lurking as a transitive dependency via `tmp-promise@3.0.3`, leaving applications exposed to unsafe temporary file handling. The fix pins `tmp` to version `0.2.7` using a pnpm override across `package.json`, `dist/cli.js`, and `pnpm-lock.yaml`, eliminating the vulnerable code path without affecting any valid application behavior.
CVE-2026-39244 is a high-severity Denial of Service vulnerability in the `adm-zip` Node.js package (versions prior to 0.6.0) where a specially crafted ZIP file can trigger excessive memory allocation, potentially crashing the host process. The vulnerability was present in the Haven self-hosted chat application, which used `adm-zip ^0.5.16` as a direct dependency. The fix upgrades the dependency to `^0.6.0`, which includes hardened ZIP entry parsing that prevents unbounded memory allocation from
A high-severity command injection vulnerability was discovered in `scripts/pass.js` where git commands were constructed by interpolating unsanitized arguments directly into shell strings passed to `execSync()`. The fix replaces shell-string execution with `execFileSync()` using argument arrays, eliminating the shell interpolation layer entirely, and adds strict input validation for task names before they reach the filesystem or process spawning logic.
A high-severity command injection vulnerability was discovered in `bin/index.js` of a Node.js application, where the `createWindowsShortcut` function passed a user-controllable `destDir` argument directly into a dynamically constructed PowerShell command string. The fix eliminates the string interpolation entirely by moving all path data into environment variables and using `execFileSync` with a static script, removing any possibility of shell metacharacter injection. This is a textbook example
A high-severity command injection vulnerability was discovered in `bin/git-commands.js`, where the `exec()` function from Node.js's `child_process` module was used to construct shell commands by directly interpolating arguments like branch names and file paths into template strings. The fix replaces `exec()` with `execFile()` and passes arguments as discrete array elements, eliminating the shell entirely and preventing any injected shell metacharacters from being interpreted. This is a critical
A critical heap buffer overflow vulnerability was discovered in `TKLiveSync/unzip.cpp`, where ZIP archive entry names were copied into a `PATH_MAX`-sized heap buffer using `strcpy()` without any length validation. Since the ZIP specification allows entry names up to 65,535 bytes — far exceeding typical `PATH_MAX` values of 1,024 to 4,096 bytes — a crafted archive could overflow the buffer and corrupt heap memory. The fix replaces the unsafe `strcpy`/`dirname` pattern with `std::string` operation
A high-severity path traversal vulnerability (GHSA-r28c-9q8g-f849) in PostCSS versions prior to 8.5.18 allowed attackers to manipulate `sourceMappingURL` comments to load arbitrary `.map` files from the filesystem. The fix upgrades PostCSS from 8.5.15 to 8.5.18 using a pnpm override, ensuring that all transitive dependencies consuming PostCSS are protected. While not confirmed reachable in this specific project, the vulnerability represents an exploit primitive that could be chained with other w
A command injection vulnerability in `update-po.sh` allowed maliciously crafted filenames in `po/POTFILES.in` to be interpreted as shell commands via unquoted command substitution. The fix replaces `$(cat po/POTFILES.in)` with `xgettext`'s native `--files-from=` flag, eliminating the shell word-splitting attack surface entirely. This is a textbook example of how a single unquoted substitution can become a dangerous exploit primitive.