Changes

2026-10

• 

  vite: launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

  npm · vite✕security
  Quote

  “launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors”

  osv.dev ›
• 

  vite: Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

  npm · vite✕security
  Quote

  “Vite: Files outside server.fs.allow could be served when project paths match system paths on non-Windows machine”

  osv.dev ›
• 

  vite: Vite: `server.fs.deny` bypassed with queries

  npm · vite✕security
  Quote

  “Vite: server.fs.deny bypassed with queries”

  osv.dev ›
• 

  vite: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

  npm · vite✕security
  Quote

  “launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows”

  osv.dev ›
• 

  vite: Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

  npm · vite✕security
  Quote

  “Vite: First 4 bytes of files outside of server.fs setting is exposed by ?vite-wasm-instance”

  osv.dev ›
• 

  vite: Websites were able to send any requests to the development server and read the response in vite

  npm · vite✕security
  Quote

  “Websites were able to send any requests to the development server and read the response in vite”

  osv.dev ›
• 

  vite: Vite bypasses server.fs.deny when using ?raw??

  npm · vite✕security
  Quote

  “Vite bypasses server.fs.deny when using ?raw??”

  osv.dev ›
• 

  vite: Vite allows server.fs.deny to be bypassed with .svg or relative paths

  npm · vite✕security
  Quote

  “Vite allows server.fs.deny to be bypassed with .svg or relative paths”

  osv.dev ›
• 

  vitest: When Vitest UI server is listening, arbitrary file can be read and executed

  npm · vitest✕security
  Quote

  “When Vitest UI server is listening, arbitrary file can be read and executed”

  osv.dev ›
• 

  vitest: Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

  npm · vitest✕security
  Quote

  “Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock”

  osv.dev ›
• 

  web3-core-method: web3-core-method is vulnerable to prototype pollution

  npm · web3-core-method✕security
  Quote

  “web3-core-method is vulnerable to prototype pollution”

  osv.dev ›
• 

  web3-core-subscriptions: web3-core-subscriptions has a Prototype Pollution vulnerability

  npm · web3-core-subscriptions✕security
  Quote

  “web3-core-subscriptions has a Prototype Pollution vulnerability”

  osv.dev ›
• 

  web3: Insecure Credential Storage in web3

  npm · web3✕security
  Quote

  “Insecure Credential Storage in web3”

  osv.dev ›
• 

  webpack: webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence

  npm · webpack✕security
  Quote

  “webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence”

  osv.dev ›
• 

  webpack: Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS

  npm · webpack✕security
  Quote

  “Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS”

  osv.dev ›
• 

  webpack: webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior

  npm · webpack✕security
  Quote

  “webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior”

  osv.dev ›
• 

  websocket-driver: websocket-driver: Resource limit bypass via message compression

  npm · websocket-driver✕security
  Quote

  “websocket-driver: Resource limit bypass via message compression”

  osv.dev ›
• 

  websocket-driver: websocket-driver: Message corruption via abuse of protocol length headers

  npm · websocket-driver✕security
  Quote

  “websocket-driver: Message corruption via abuse of protocol length headers”

  osv.dev ›
• 

  ws: ws affected by a DoS when handling a request with many HTTP headers

  npm · ws✕security
  Quote

  “ws affected by a DoS when handling a request with many HTTP headers”

  osv.dev ›
• 

  ws: ws: Uninitialized memory disclosure

  npm · ws✕security
  Quote

  “ws: Uninitialized memory disclosure”

  osv.dev ›
• 

  ws: ws: Memory exhaustion DoS from tiny fragments and data chunks

  npm · ws✕security
  Quote

  “ws: Memory exhaustion DoS from tiny fragments and data chunks”

  osv.dev ›
• 

  yaml: yaml is vulnerable to Stack Overflow via deeply nested YAML collections

  npm · yaml✕security
  Quote

  “yaml is vulnerable to Stack Overflow via deeply nested YAML collections”

  osv.dev ›
• 

  yaml: Uncaught Exception in yaml

  npm · yaml✕security
  Quote

  “Uncaught Exception in yaml”

  osv.dev ›
• 

  yargs-parser: yargs-parser Vulnerable to Prototype Pollution

  npm · yargs-parser✕security
  Quote

  “yargs-parser Vulnerable to Prototype Pollution”

  osv.dev ›
• 

  anyio: AnyIO process-pool workers can block indefinitely on undrained stderr

  PyPI · anyio✕security
  Quote

  “AnyIO process-pool workers can block indefinitely on undrained stderr”

  osv.dev ›
• 

  anyio: AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

  PyPI · anyio✕security
  Quote

  “AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing”

  osv.dev ›
• 

  certifi: certifi bundles emSign root CAs with compromised intermediate CA keys

  PyPI · certifi✕security
  Quote

  “certifi bundles emSign root CAs with compromised intermediate CA keys”

  osv.dev ›
• 

  cryptography: cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

  PyPI · cryptography✕security
  Quote

  “cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing”

  osv.dev ›
• 

  dnspython: dnspython dns.name.from_wire_parser() excessive CPU use

  PyPI · dnspython✕security
  Quote

  “dnspython dns.name.from_wire_parser() excessive CPU use”

  osv.dev ›
• 

  filelock: filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break

  PyPI · filelock✕security
  Quote

  “filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break”

  osv.dev ›
• 

  filelock: filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold

  PyPI · filelock✕security
  Quote

  “filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold”

  osv.dev ›
• 

  filelock: filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path

  PyPI · filelock✕security
  Quote

  “filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path”

  osv.dev ›
• 

  filelock: filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL

  PyPI · filelock✕security
  Quote

  “filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL”

  osv.dev ›
• 

  filelock: filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion

  PyPI · filelock✕security
  Quote

  “filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion”

  osv.dev ›
• 

  filelock: filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database

  PyPI · filelock✕security
  Quote

  “filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database”

  osv.dev ›
• 

  filelock: filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout

  PyPI · filelock✕security
  Quote

  “filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout”

  osv.dev ›
• 

  filelock: filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders

  PyPI · filelock✕security
  Quote

  “filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders”

  osv.dev ›
• 

  filelock: filelock: ReadWriteLock follows a symlink at the lock path into SQLite

  PyPI · filelock✕security
  Quote

  “filelock: ReadWriteLock follows a symlink at the lock path into SQLite”

  osv.dev ›
• 

  filelock: filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses

  PyPI · filelock✕security
  Quote

  “filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses”

  osv.dev ›
• 

  filelock: filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock

  PyPI · filelock✕security
  Quote

  “filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock”

  osv.dev ›
• 

  filelock: filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker

  PyPI · filelock✕security
  Quote

  “filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker”

  osv.dev ›
• 

  filelock: filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files

  PyPI · filelock✕security
  Quote

  “filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files”

  osv.dev ›
• 

  filelock: filelock has a TOCTOU race condition which allows symlink attacks during lock file creation

  PyPI · filelock✕security
  Quote

  “filelock has a TOCTOU race condition which allows symlink attacks during lock file creation”

  osv.dev ›
• 

  flask: Flask session does not add `Vary: Cookie` header when accessed in some ways

  PyPI · flask✕security
  Quote

  “Flask session does not add Vary: Cookie header when accessed in some ways”

  osv.dev ›
• 

  flask: Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

  PyPI · flask✕security
  Quote

  “Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header”

  osv.dev ›
• 

  gitpython: GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution

  PyPI · gitpython✕security
  Quote

  “GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution”

  osv.dev ›
• 

  gitpython: GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)

  PyPI · gitpython✕security
  Quote

  “GitPython: arbitrary file read via attacker-controlled branch name in Head.checkout() (incomplete fix of CVE-2026-78679)”

  osv.dev ›
• 

  gitpython: GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE

  PyPI · gitpython✕security
  Quote

  “GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE”

  osv.dev ›
• 

  gitpython: GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

  PyPI · gitpython✕security
  Quote

  “GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist”

  osv.dev ›
• 

  gitpython: GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read

  PyPI · gitpython✕security
  Quote

  “GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read”

  osv.dev ›
• 

  gitpython: GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)

  PyPI · gitpython✕security
  Quote

  “GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)”

  osv.dev ›
• 

  gitpython: GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)

  PyPI · gitpython✕security
  Quote

  “GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)”

  osv.dev ›
• 

  gitpython: GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite

  PyPI · gitpython✕security
  Quote

  “GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite”

  osv.dev ›
• 

  gitpython: GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()

  PyPI · gitpython✕security
  Quote

  “GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()”

  osv.dev ›
• 

  gitpython: GitPython submodule update path traversal can write outside the repository

  PyPI · gitpython✕security
  Quote

  “GitPython submodule update path traversal can write outside the repository”

  osv.dev ›
• 

  gitpython: GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()

  PyPI · gitpython✕security
  Quote

  “GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()”

  osv.dev ›
• 

  gitpython: GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks

  PyPI · gitpython✕security
  Quote

  “GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks”

  osv.dev ›
• 

  gitpython: GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository

  PyPI · gitpython✕security
  Quote

  “GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository”

  osv.dev ›

2026-11

• 

  word-wrap: word-wrap vulnerable to Regular Expression Denial of Service

  npm · word-wrap✕security
  Quote

  “word-wrap vulnerable to Regular Expression Denial of Service”

  osv.dev ›
• 

  zod: Zod can exhaust memory while validating oversized constrained collections

  npm · zod✕security
  Quote

  “Zod can exhaust memory while validating oversized constrained collections”

  osv.dev ›