NIXPKGS-2026-2396

GitHub issue published 12 hours ago

npm-check-updates 23.0.2 Terminal Injection via Unsanitized Escape Sequences

Permalink CVE-2026-73035

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 12 hours ago by @LeSuisse Activity log

• Created suggestion 17 hours ago
• @LeSuisse accepted 12 hours ago
• @LeSuisse published on GitHub 12 hours ago

npm-check-updates 23.0.2 Terminal Injection via Unsanitized Escape Sequences

• Researcher Disclosure technical-description
• Pull Request issue-tracking
• Patch Commit patch
• https://www.vulncheck.com/advisories/npm-check-updates-terminal-injection-via-u… third-party-advisory

---

npm-check-updates

• =<23.0.2
• ==b554b84848fc0b08a9d2b3d3db15e351387168cf

NIXPKGS-2026-2395

GitHub issue published 12 hours ago

goose: Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor

Permalink CVE-2026-72718

7.0 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 12 hours ago by @LeSuisse Activity log

• Created suggestion 17 hours ago
• @LeSuisse ignored
  4 packages

  • mongoose
  • goose
  • goose-lang
  • imapgoose
  12 hours ago
• @LeSuisse accepted 12 hours ago
• @LeSuisse published on GitHub 12 hours ago

goose: Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor

• https://github.com/aaif-goose/goose/security/advisories/GHSA-r5pp-p5r8-466r x_refsource_CONFIRMexploit
• https://github.com/aaif-goose/goose/commit/f8b5b7ba1fe6d006ccf6942f6b85a1bae985a2de x_refsource_MISC
• https://github.com/aaif-goose/goose/releases/tag/v1.44.0 x_refsource_MISC

---

goose

• ==< 1.44.0

NIXPKGS-2026-2394

GitHub issue published 12 hours ago

Koito - Authenticated Server-Side Request Forgery via Album Image URL Parameter

Permalink CVE-2026-72591

7.7 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 12 hours ago by @LeSuisse Activity log

• Created suggestion 17 hours ago
• @LeSuisse accepted 12 hours ago
• @LeSuisse published on GitHub 12 hours ago

Koito - Authenticated Server-Side Request Forgery via Album Image URL Parameter

• Product third-party-advisory

---

Koito

• =<0.3.2

NIXPKGS-2026-2393

GitHub issue published 12 hours ago

Grafana - Incomplete Fix for CVE-2026-21724 Allows Editor Role to Delete Protected Contact Points

Permalink CVE-2026-72585

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 12 hours ago by @LeSuisse Activity log

• Created suggestion 17 hours ago
• @LeSuisse ignored
  36 packages

  • grafanactl
  • mcp-grafana
  • grafana-loki
  • grafana-alloy
  • grafana-kiosk
  • garmin-grafana
  • grafana-to-ntfy
  • grafana-dash-n-grab
  • grafana-image-renderer
  • dhallPackages.dhall-grafana
  • terraform-providers.grafana
  • python313Packages.grafanalib
  • python314Packages.grafanalib
  • haskellPackages.amazonka-grafana
  • grafanaPlugins.grafana-oncall-app
  • grafanaPlugins.grafana-clock-panel
  • terraform-providers.grafana_grafana
  • grafanaPlugins.grafana-pyroscope-app
  • python313Packages.mypy-boto3-grafana
  • python314Packages.mypy-boto3-grafana
  • grafanaPlugins.grafana-piechart-panel
  • grafanaPlugins.grafana-polystat-panel
  • grafanaPlugins.grafana-worldmap-panel
  • grafanaPlugins.grafana-lokiexplore-app
  • grafanaPlugins.grafana-mqtt-datasource
  • vscode-extensions.grafana.grafana-alloy
  • grafanaPlugins.grafana-exploretraces-app
  • grafanaPlugins.grafana-github-datasource
  • grafanaPlugins.grafana-sentry-datasource
  • grafanaPlugins.grafana-discourse-datasource
  • grafanaPlugins.grafana-metricsdrilldown-app
  • python313Packages.types-aiobotocore-grafana
  • python314Packages.types-aiobotocore-grafana
  • grafanaPlugins.grafana-clickhouse-datasource
  • grafanaPlugins.grafana-opensearch-datasource
  • grafanaPlugins.grafana-googlesheets-datasource
  12 hours ago
• @LeSuisse accepted 12 hours ago
• @LeSuisse published on GitHub 12 hours ago

Grafana - Incomplete Fix for CVE-2026-21724 Allows Editor Role to Delete Protected Contact Points

• Related Advisory (CVE-2026-21724) vendor-advisory
• Product third-party-advisory
• Vulnerable File technical-description

---

Grafana

• =<13.2.0

NIXPKGS-2026-2392

GitHub issue published 12 hours ago

unearth 0.18.2 Path Traversal via Unnormalized Paths and Symlink Escape

Permalink CVE-2026-73030

7.2 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 12 hours ago by @LeSuisse Activity log

• Created suggestion 17 hours ago
• @LeSuisse accepted 12 hours ago
• @LeSuisse published on GitHub 12 hours ago

unearth 0.18.2 Path Traversal via Unnormalized Paths and Symlink Escape

• Researcher Disclosure exploittechnical-description
• Pull Request issue-tracking
• Patch Commit patch
• https://www.vulncheck.com/advisories/unearth-path-traversal-via-unnormalized-pa… third-party-advisory

---

unearth

• ==6c78164e7bfa28b8b3d6f247b87e560692e3c8ba
• =<0.18.2

NIXPKGS-2026-2391

GitHub issue published 12 hours ago

Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences

Permalink CVE-2026-72913

7.3 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 12 hours ago by @LeSuisse Activity log

• Created suggestion 17 hours ago
• @LeSuisse ignored
  9 packages

  • kittysay
  • kitty-img
  • kitty-themes
  • kittycad-kcl-lsp
  • mailman-hyperkitty
  • haskellPackages.discokitty
  • mailmanPackages.hyperkitty
  • mailmanPackages.mailman-hyperkitty
  • vimPlugins.nvim-treesitter-parsers.kitty
  12 hours ago
• @LeSuisse accepted 12 hours ago
• @LeSuisse published on GitHub 12 hours ago

Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences

• https://github.com/kovidgoyal/kitty/security/advisories/GHSA-ccp2-q4v6-rw94 x_refsource_CONFIRM
• https://github.com/kovidgoyal/kitty/commit/9dca948e9bec3c926ab3370f2cd10f9b9b10821f x_refsource_MISC
• https://github.com/kovidgoyal/kitty/releases/tag/v0.48.2 x_refsource_MISC
• https://sw.kovidgoyal.net/kitty/changelog/#id1 x_refsource_MISC

---

kitty

• ==< 0.48.2

Needs a fix for kitty-bin and backports

NIXPKGS-2026-2390

GitHub issue published 12 hours ago

fosrl Pangolin - Access Token Scope Bypass Allows Cross-Resource Authentication

Permalink CVE-2026-72564

9.6 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 12 hours ago by @LeSuisse Activity log

• Created suggestion 17 hours ago
• @LeSuisse ignored package pangolin-cli 12 hours ago
• @LeSuisse accepted 12 hours ago
• @LeSuisse published on GitHub 12 hours ago

fosrl Pangolin - Access Token Scope Bypass Allows Cross-Resource Authentication

• Product third-party-advisory
• Vulnerable File technical-description

---

Pangolin

• =<1.20.0

NIXPKGS-2026-2389

GitHub issue published 12 hours ago

Hugging Face Accelerate 1.14.0 Path Traversal and DoS via weight_map

Permalink CVE-2026-69112

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 12 hours ago by @LeSuisse Activity log

• Created suggestion 17 hours ago
• @LeSuisse ignored
  16 packages

  • haskellPackages.accelerate
  • haskellPackages.accelerate-io
  • haskellPackages.accelerate-llvm
  • typstPackages.accelerated-jacow
  • haskellPackages.colour-accelerate
  • haskellPackages.mwc-random-accelerate
  • python313Packages.pyopengl-accelerate
  • python314Packages.pyopengl-accelerate
  • typstPackages.accelerated-jacow_0_1_0
  • typstPackages.accelerated-jacow_0_1_1
  • typstPackages.accelerated-jacow_0_1_2
  • typstPackages.accelerated-jacow_0_1_3
  • haskellPackages.gogol-acceleratedmobilepageurl
  • haskellPackages.accelerate-io-serialise
  • typstPackages.accelerated-jacow_0_14_0
  • typstPackages.accelerated-jacow_0_1_4
  12 hours ago
• @LeSuisse accepted 12 hours ago
• @LeSuisse published on GitHub 12 hours ago

Hugging Face Accelerate 1.14.0 Path Traversal and DoS via weight_map

• Researcher Disclosure exploittechnical-description
• Pull Request (1) issue-tracking
• Pull Request (2) issue-tracking
• https://www.vulncheck.com/advisories/hugging-face-accelerate-path-traversal-and… third-party-advisory

---

accelerate

• =<1.14.0

NIXPKGS-2026-2388

GitHub issue published 12 hours ago

CyberChef’s pretty-recipe parser vulnerable to client-side ReDoS / CPU exhaustion when parsing a malformed #recipe= URL

Permalink CVE-2026-72912

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 12 hours ago by @LeSuisse Activity log

• Created suggestion 17 hours ago
• @LeSuisse accepted 12 hours ago
• @LeSuisse published on GitHub 12 hours ago

CyberChef’s pretty-recipe parser vulnerable to client-side ReDoS / CPU exhaustion when parsing a malformed #recipe= URL

• https://github.com/gchq/CyberChef/security/advisories/GHSA-w74r-jxjh-gwr6 x_refsource_CONFIRM
• https://github.com/gchq/CyberChef/pull/2687 x_refsource_MISC
• https://github.com/gchq/CyberChef/commit/f77ddf489050b339faa978bb28da954bafd289ae x_refsource_MISC
• https://github.com/gchq/CyberChef/releases/tag/v11.3.0 x_refsource_MISC

---

CyberChef

• ==< 11.3.0

NIXPKGS-2026-2387

GitHub issue published 12 hours ago

metabase: security issues < 0.59.21

Permalink CVE-2026-72900

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 12 hours ago by @LeSuisse Activity log

• Created suggestion 17 hours ago
• @LeSuisse accepted 12 hours ago
• @LeSuisse published on GitHub 12 hours ago

Metabase information exposure

• url vendor-advisory
• url vdb-entry
• url third-party-advisory

---

Metabase

• ==x.58.24
• <x.63.5
• ==x.59.21
• ==x.63.5
• <x.58.24
• ==x.60.17
• ==x.61.11
• ==x.62.9
• <x.60.17
• <x.61.11
• <x.62.9
• <x.59.21

Permalink CVE-2026-72899

10.0 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): High (H)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 12 hours ago by @LeSuisse Activity log

• Created suggestion 17 hours ago
• @LeSuisse accepted 12 hours ago
• @LeSuisse published on GitHub 12 hours ago

Metabase SQL injection via public card or dashboard

• url vendor-advisory
• url vdb-entry
• url third-party-advisory

---

Metabase

• <x.63.5
• ==x.58.24
• ==x.59.21
• ==x.63.5
• <x.58.24
• ==x.60.17
• ==x.62.9
• ==x.61.11
• <x.60.17
• <x.62.9
• <x.61.11
• <x.59.21

Permalink CVE-2026-72898

10.0 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): High (H)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 12 hours ago by @LeSuisse Activity log

• Created suggestion 17 hours ago
• @LeSuisse accepted 12 hours ago
• @LeSuisse published on GitHub 12 hours ago

Metabase SQL injection via password reset endpoint

• url vendor-advisory
• url vendor-advisory
• url vdb-entry
• url third-party-advisory

---

Metabase

• ==x.58.24
• <x.63.5
• ==x.59.21
• <x.58.24
• ==x.60.17
• ==x.63.5
• ==x.61.11
• ==x.62.9
• <x.60.17
• <x.61.11
• <x.62.9
• <x.59.21