NIXPKGS-2026-2047

GitHub issue published 8 hours ago

Spice-vdagent: integer overflow in udscs_write() leading to heap buffer overflow

Permalink CVE-2026-57965

5.1 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): High (H)

updated 8 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 16 hours ago
• @LeSuisse accepted 1 day, 8 hours ago
• @LeSuisse published on GitHub 8 hours ago

Spice-vdagent: integer overflow in udscs_write() leading to heap buffer overflow

• https://access.redhat.com/security/cve/CVE-2026-57965 vdb-entryx_refsource_REDHAT
• RHBZ#2493581 x_refsource_REDHATissue-tracking

---

spice-vdagent

mingw-spice-vdagent

NIXPKGS-2026-2046

GitHub issue published 8 hours ago

Rancher Privilege Escalation from Project Owner to Host

Permalink CVE-2026-41052

9.4 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): High (H)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 8 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 16 hours ago
• @LeSuisse ignored
  2 packages

  • terraform-providers.rancher2
  • terraform-providers.rancher_rancher2
  1 day, 8 hours ago
• @LeSuisse accepted 1 day, 8 hours ago
• @LeSuisse published on GitHub 8 hours ago

Rancher Privilege Escalation from Project Owner to Host

• https://github.com/rancher/rancher/security/advisories/GHSA-vx8h-4prv-g744 vendor-advisory

---

Rancher

• <2.13.6
• <2.12.10
• <2.14.2

Needs a backport to stable.

NIXPKGS-2026-2045

GitHub issue published 8 hours ago

Nitter - Server-Side Request Forgery in /video Media Proxy Endpoint

Permalink CVE-2026-56285

7.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 8 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 16 hours ago
• @LeSuisse accepted 1 day, 8 hours ago
• @LeSuisse published on GitHub 8 hours ago

Nitter - Server-Side Request Forgery in /video Media Proxy Endpoint

• Researcher Disclosure exploitissue-tracking
• Patch Commmit patch
• https://www.vulncheck.com/advisories/nitter-server-side-request-forgery-in-vide… third-party-advisory

---

nitter

• <44b2f096f67da2cc257a0e262a94a7ae79e95d47

NIXPKGS-2026-2044

GitHub issue published 8 hours ago

Documenso Google OAuth Login handle-oauth-callback-url.ts improper authentication

Permalink CVE-2026-13543

2.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 8 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 16 hours ago
• @LeSuisse ignored
  4 references

  • https://github.com/documenso/documenso/
  • Submit #842579 | documenso v2.11.0 Auth…
  • CVE-2026-13543 | CVE Analysis and Report
  • VDB-374551 | CTI Indicators (IOB, IOC, …
  1 day, 8 hours ago
• @LeSuisse accepted 1 day, 8 hours ago
• @LeSuisse published on GitHub 8 hours ago

Documenso Google OAuth Login handle-oauth-callback-url.ts improper authentication

• VDB-374551 | Documenso Google OAuth Login handle-oauth-callback-url.ts improper authentication vdb-entry
• https://github.com/documenso/documenso/issues/2758 exploitissue-tracking
• https://github.com/documenso/documenso/pull/2837 patchissue-tracking

Ignored references (4)

• https://github.com/documenso/documenso/ product
• Submit #842579 | documenso v2.11.0 Authentication Bypass third-party-advisory
• CVE-2026-13543 | CVE Analysis and Report third-party-advisory
• VDB-374551 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature

---

Documenso

• ==2.11.0
• ==2.5
• ==2.7
• ==2.0
• ==2.3
• ==2.1
• ==2.10
• ==2.2
• ==2.9
• ==2.4
• ==2.8
• ==2.6

NIXPKGS-2026-2043

GitHub issue published 8 hours ago

Nmap - Integer Underflow in IPv6 Extension Header Parsing

Permalink CVE-2026-58058

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 8 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 16 hours ago
• @LeSuisse ignored
  2 references

  • Nmap Change Log
  • VulnCheck Advisory: Nmap - Integer Unde…
  1 day, 8 hours ago
• @LeSuisse ignored
  29 packages

  • asnmap
  • genmap
  • zenmap
  • nmapsi4
  • nmap-parse
  • nmap-formatter
  • python312Packages.chainmap
  • python313Packages.chainmap
  • python314Packages.chainmap
  • coqPackages.mathcomp-finmap
  • python312Packages.nmapthon2
  • python313Packages.nmapthon2
  • python314Packages.nmapthon2
  • rocqPackages.mathcomp-finmap
  • python312Packages.python-nmap
  • python313Packages.python-nmap
  • python314Packages.python-nmap
  • python312Packages.dragonmapper
  • python313Packages.dragonmapper
  • python313Packages.python3-nmap
  • python314Packages.dragonmapper
  • python314Packages.python3-nmap
  • python312Packages.deep-chainmap
  • python313Packages.deep-chainmap
  • python314Packages.deep-chainmap
  • python312Packages.python-libnmap
  • python313Packages.python-libnmap
  • python314Packages.python-libnmap
  • home-assistant-component-tests.nmap_tracker
  1 day, 8 hours ago
• @LeSuisse accepted 1 day, 8 hours ago
• @LeSuisse published on GitHub 8 hours ago

Nmap - Integer Underflow in IPv6 Extension Header Parsing

• Proof of Concept exploitthird-party-advisory
• Fix commit (dev tree) patch

Ignored references (2)

• Nmap Change Log release-notes
• VulnCheck Advisory: Nmap - Integer Underflow in IPv6 Extension Header Parsing third-party-advisory

---

Nmap

• =<7.99

NIXPKGS-2026-2042

GitHub issue published 8 hours ago

Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()

Permalink CVE-2026-14164

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 8 hours ago by @LeSuisse Activity log

• Created suggestion 16 hours ago
• @LeSuisse ignored
  27 packages

  • libarchive-qt
  • haskellPackages.libarchive
  • kodiPackages.vfs-libarchive
  • perlPackages.ArchiveLibarchive
  • python312Packages.libarchive-c
  • python313Packages.libarchive-c
  • python314Packages.libarchive-c
  • perl5Packages.ArchiveLibarchive
  • perl538Packages.ArchiveLibarchive
  • perl540Packages.ArchiveLibarchive
  • haskellPackages.archive-libarchive
  • haskellPackages.libarchive-conduit
  • perlPackages.ArchiveLibarchivePeek
  • perlPackages.TestArchiveLibarchive
  • perl5Packages.ArchiveLibarchivePeek
  • perl5Packages.TestArchiveLibarchive
  • perl538Packages.ArchiveLibarchivePeek
  • perl538Packages.TestArchiveLibarchive
  • perl540Packages.ArchiveLibarchivePeek
  • perl540Packages.TestArchiveLibarchive
  • perlPackages.ArchiveLibarchiveExtract
  • perl5Packages.ArchiveLibarchiveExtract
  • perl538Packages.ArchiveLibarchiveExtract
  • perl540Packages.ArchiveLibarchiveExtract
  • python312Packages.extractcode-libarchive
  • python313Packages.extractcode-libarchive
  • python314Packages.extractcode-libarchive
  10 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 8 hours ago

Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()

• RHSA-2026:30333 vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/security/cve/CVE-2026-14164 vdb-entryx_refsource_REDHAT
• RHBZ#2493411 issue-trackingx_refsource_REDHAT
• https://github.com/libarchive/libarchive/issues/3069 exploit
• https://github.com/libarchive/libarchive/pull/3071

---

rhcos

libarchive

libarchive-main

• *

Patch: https://github.com/libarchive/libarchive/commit/42453cf16255800726b4efedab25138639ceef20

NIXPKGS-2026-2040

GitHub issue published 8 hours ago

Dolibarr - SQL Injection via sqlfilters Parameter in Multiple REST API List Endpoints

Permalink CVE-2026-58376

7.2 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 8 hours ago by @LeSuisse Activity log

• Created suggestion 16 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 8 hours ago

Dolibarr - SQL Injection via sqlfilters Parameter in Multiple REST API List Endpoints

• Researcher Disclosure exploittechnical-description
• Fix PR issue-tracking
• Fix Commit patch
• https://www.vulncheck.com/advisories/dolibarr-sql-injection-via-sqlfilters-para… third-party-advisory

---

dolibarr

• ==14db36e8486ef725b0d493d97abb2950a54358d3
• =<23.0.3

NIXPKGS-2026-2041

GitHub issue published 8 hours ago

txtai - Unauthenticated Remote Code Execution via Unsafe Reflection in API /reindex function Parameter

Permalink CVE-2026-58449

9.3 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 8 hours ago by @LeSuisse Activity log

• Created suggestion 16 hours ago
• @LeSuisse ignored
  3 packages

  • python312Packages.llama-index-readers-txtai
  • python313Packages.llama-index-readers-txtai
  • pkgsRocm.python3Packages.llama-index-readers-txtai
  9 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 8 hours ago

txtai - Unauthenticated Remote Code Execution via Unsafe Reflection in API /reindex function Parameter

• Original GitHub Issue issue-tracking
• Identical Report issue-tracking
• Fix Commit patch
• https://www.vulncheck.com/advisories/txtai-unauthenticated-remote-code-executio… third-party-advisory

---

txtai

• ==11b32da720f03276199ebc5583c15fc5d1ccafd3
• =<9.10.0

NIXPKGS-2026-2039

GitHub issue published 8 hours ago

In hostapd before 2.12, a missing bounds check in AP-mode …

Permalink CVE-2026-58374

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 8 hours ago by @LeSuisse Activity log

• Created suggestion 16 hours ago
• @LeSuisse ignored package hostapd-mana 9 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 8 hours ago

In hostapd before 2.12, a missing bounds check in AP-mode …

• hostap security advisory 2026-1: Missing multi-link parsing validation in wpa_supplicant and hostapd vendor-advisory
• hostap security advisory 2026-1 patch directory patchvendor-advisory
• Fix commit 46dd5a4 - missing link ID bounds check patch
• Fix commit aa9d345 - BSS bounds check for link_id patch
• https://www.openwall.com/lists/oss-security/2026/06/30/1

---

hostapd

• <2.12

NIXPKGS-2026-2038

GitHub issue published 8 hours ago

n8n - AST Validator Bypass in Python Code Node

Permalink CVE-2026-56777

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 8 hours ago by @LeSuisse Activity log

• Created suggestion 16 hours ago
• @LeSuisse ignored
  3 packages

  • n8n-nodes-carbonejs
  • n8n-nodes-evolution-api
  • n8n-task-runner-launcher
  9 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 8 hours ago

n8n - AST Validator Bypass in Python Code Node

• GitHub Security Advisory (GHSA-jwm3-qcfw-c5pp) vendor-advisory
• VulnCheck Advisory: n8n - AST Validator Bypass in Python Code Node third-party-advisory

---

n8n

• <2.25.7
• ==2.26.2
• <2.26.2
• ==2.25.7