NIXPKGS-2026-2208

GitHub issue published 1 week, 1 day ago

PyTorch Lightning Arbitrary Code Execution via _instantiator Hyperparameter

Permalink CVE-2026-58659

8.4 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

PyTorch Lightning Arbitrary Code Execution via _instantiator Hyperparameter

• Researcher Disclosure technical-descriptionexploit
• Pull Request issue-tracking
• Patch Commit patch
• https://www.vulncheck.com/advisories/pytorch-lightning-arbitrary-code-execution… third-party-advisory

---

pytorch-lightning

• ==d710d689510d50e800f53b3cd773cbca20b1f86f
• =<2.6.5

Needs a backport

NIXPKGS-2026-2207

GitHub issue published 1 week, 1 day ago

Soup Sieve: Regular Expression Denial of Service (ReDoS) in soupsieve Selector Parser

Permalink CVE-2026-49477

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

Soup Sieve: Regular Expression Denial of Service (ReDoS) in soupsieve Selector Parser

• https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37 x_refsource_CONFIRM
• https://github.com/facelessuser/soupsieve/commit/eb4397618709186c109400448c6043b728217dc3 x_refsource_MISC
• https://github.com/facelessuser/soupsieve/releases/tag/2.8.4 x_refsource_MISC

---

soupsieve

• ==< 2.8.4

NIXPKGS-2026-2206

GitHub issue published 1 week, 1 day ago

Libsoup: soupwebsocketconnection: libsoup: websocket remote denial of service via oversized control frame protocol violation

Permalink CVE-2026-15711

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

Libsoup: soupwebsocketconnection: libsoup: websocket remote denial of service via oversized control frame protocol violation

• https://access.redhat.com/security/cve/CVE-2026-15711 x_refsource_REDHATvdb-entry
• RHBZ#2499924 issue-trackingx_refsource_REDHAT
• https://gitlab.gnome.org/GNOME/libsoup/-/issues/515

---

libsoup

libsoup3

Pending MR: https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/542

NIXPKGS-2026-2205

GitHub issue published 1 week, 1 day ago

Libsoup: soupcache: libsoup: http/2 frame window exhaustion remote denial of service via memory leak

Permalink CVE-2026-15713

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

Libsoup: soupcache: libsoup: http/2 frame window exhaustion remote denial of service via memory leak

• https://access.redhat.com/security/cve/CVE-2026-15713 x_refsource_REDHATvdb-entry
• RHBZ#2499941 issue-trackingx_refsource_REDHAT
• https://gitlab.gnome.org/GNOME/libsoup/-/work_items/541

---

libsoup

libsoup3

NIXPKGS-2026-2204

GitHub issue published 1 week, 1 day ago

Soupwebsocketextensiondeflate: libsoup: libsoup: websocket permessage-deflate unbounded decompression remote denial of service

Permalink CVE-2026-15709

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

Soupwebsocketextensiondeflate: libsoup: libsoup: websocket permessage-deflate unbounded decompression remote denial of service

• https://access.redhat.com/security/cve/CVE-2026-15709 x_refsource_REDHATvdb-entry
• RHBZ#2499922 issue-trackingx_refsource_REDHAT
• https://gitlab.gnome.org/GNOME/libsoup/-/issues/511

---

libsoup

libsoup3

Pending MR: https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/543

NIXPKGS-2026-2203

GitHub issue published 1 week, 1 day ago

Soup Sieve: Memory Exhaustion via Large Comma-Separated Selector Lists in soupsieve

Permalink CVE-2026-49476

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

Soup Sieve: Memory Exhaustion via Large Comma-Separated Selector Lists in soupsieve

• https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x x_refsource_CONFIRM
• https://github.com/facelessuser/soupsieve/commit/28108ab805818c832d9568142a99844fd95a0d39 x_refsource_MISC
• https://github.com/facelessuser/soupsieve/releases/tag/2.8.4 x_refsource_MISC

---

soupsieve

• ==< 2.8.4

NIXPKGS-2026-2202

GitHub issue published 1 week, 1 day ago

CrewAI < 1.15.1 SSRF Filter Bypass via HTTP Redirect in Scrape Tools

Permalink CVE-2026-62240

8.3 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 2 weeks ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

CrewAI < 1.15.1 SSRF Filter Bypass via HTTP Redirect in Scrape Tools

• Release Notes release-notes
• Researcher Disclosure technical-descriptionexploit
• Pull Request issue-tracking
• Patch Commit patch
• https://www.vulncheck.com/advisories/crewai-ssrf-filter-bypass-via-http-redirec… third-party-advisory

---

crewAI

• <1.15.1

NIXPKGS-2026-2201

GitHub issue published 1 week, 1 day ago

PeerTube: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Permalink CVE-2026-57167

5.1 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 2 weeks ago
• @LeSuisse ignored package peertube-viewer 1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

PeerTube: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

• https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-jxwq-h9xv-hr28 x_refsource_CONFIRM
• https://github.com/Chocobozzz/PeerTube/commit/45394d701b08e87d72b8f0c1866b881f2becbde3 x_refsource_MISC
• https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.2 x_refsource_MISC

---

PeerTube

• ==< 8.2.2

NIXPKGS-2026-2200

GitHub issue published 1 week, 1 day ago

puma: security issues < 7.2.1

Permalink CVE-2026-47737

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

• https://github.com/puma/puma/security/advisories/GHSA-2vqw-3mp8-cgmx x_refsource_CONFIRM
• https://github.com/puma/puma/pull/3944 x_refsource_MISC
• https://github.com/puma/puma/pull/3947 x_refsource_MISC
• https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f x_refsource_MISC
• https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58 x_refsource_MISC
• https://github.com/puma/puma/releases/tag/v7.2.1 x_refsource_MISC
• https://github.com/puma/puma/releases/tag/v8.0.2 x_refsource_MISC

---

puma

• ==>= 8.0.0, < 8.0.2
• ==>= 5.5.0, < 7.2.1

Permalink CVE-2026-47736

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion

• https://github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8 x_refsource_CONFIRM
• https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f x_refsource_MISC
• https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58 x_refsource_MISC
• https://github.com/puma/puma/releases/tag/v7.2.1 x_refsource_MISC
• https://github.com/puma/puma/releases/tag/v8.0.2 x_refsource_MISC

---

puma

• ==>= 8.0.0, < 8.0.2
• ==>= 5.5.0, < 7.2.1

NIXPKGS-2026-2199

GitHub issue published 1 week, 1 day ago

jadx: security issues < 1.5.6

Permalink CVE-2026-54684

7.0 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

jadx: XAPK archive entries with absolute paths can plant drop-in plugins and achieve code execution on the next jadx run

• https://github.com/skylot/jadx/security/advisories/GHSA-gpvc-ccw7-744v x_refsource_CONFIRM
• https://github.com/skylot/jadx/commit/a74bb07d6eebaf4da5c2b2cbc4d3c0c3cb7517cb x_refsource_MISC
• https://github.com/skylot/jadx/releases/tag/v1.5.6 x_refsource_MISC

---

jadx

• ==>= 1.5.2, < 1.5.6

Permalink CVE-2026-42447

3.6 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

jadx: HTML Injection in Summary panel

• https://github.com/skylot/jadx/security/advisories/GHSA-jwv3-q635-w9m4 x_refsource_CONFIRM
• https://github.com/skylot/jadx/commit/7713655feeb8e1c4b80797e8fc0e8eb1550b65ef x_refsource_MISC
• https://github.com/skylot/jadx/releases/tag/v1.5.6 x_refsource_MISC

---

jadx

• ==< 1.5.6

Permalink CVE-2026-42049

8.4 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

jadx: RCE Via Groovy Code Injection in Gradle Export

• https://github.com/skylot/jadx/security/advisories/GHSA-w6f5-h4x4-rfpj x_refsource_CONFIRM
• https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611 x_refsource_MISC
• https://github.com/skylot/jadx/releases/tag/v1.5.6 x_refsource_MISC

---

jadx

• ==< 1.5.6