https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 11:21:47 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0500 certfr-2026-avi-0500 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0500 https://cve.radiocsirt.org/vuln/cleanstart-2026-pl93650 <p><strong>Affected:</strong> CleanStart: argo-workflows</p> <p>CVE-2026-33228 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: argo-workflows</p> <p>CVE-2026-33228 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-pl93650 https://cve.radiocsirt.org/vuln/euvd-2026-364331 EUVD-2026-364331 https://cve.radiocsirt.org/vuln/euvd-2026-364331 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33228 <p>flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key &#34;__proto__&#34; returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the global prototype. This issue has been patched in version 3.4.2.</p> <p>flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key &#34;__proto__&#34; returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the global prototype. This issue has been patched in version 3.4.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33228 https://cve.radiocsirt.org/vuln/ghsa-rf6f-7fwh-wjgh <p><strong>Affected:</strong> npm: flatted</p> <p>--- **Summary**</p> <p>The parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key &#34;\_\_proto\_\_&#34; returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the global prototype.</p> <p>--- **Root Cause**</p> <p>File: esm/index.js:29 (identical in cjs/index.js) ``` const resolver = (input, lazy, parsed, $) =&gt; output =&gt; { for (let ke = keys(output), {length} = ke, y = 0; y &lt; length; y++) { const k = ke[y]; const value = output[k]; if (value instanceof Primitive) { const tmp = input[value]; // Bug is here ```</p> <p>No validation that value is a safe numeric index input is built as a plain Array. JavaScript&#39;s property lookup on arrays traverses the prototype chain for non-numeric keys. The key &#34;\_\_proto\_\_&#34; resolves to Array.prototype, which:</p> <p>- has type &#34;object&#34; → passes the typeof tmp === object guard at line 30 - is not in the parsed Set yet → passes the !parsed.has(tmp) guard. - The reference to Array.prototype is then enqueued in lazy and later unconditionally assigned to the output object. --- **Replication S…</p> <p><strong>Affected:</strong> npm: flatted</p> <p>--- **Summary**</p> <p>The parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key &#34;\_\_proto\_\_&#34; returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the global prototype.</p> <p>--- **Root Cause**</p> <p>File: esm/index.js:29 (identical in cjs/index.js) ``` const resolver = (input, lazy, parsed, $) =&gt; output =&gt; { for (let ke = keys(output), {length} = ke, y = 0; y &lt; length; y++) { const k = ke[y]; const value = output[k]; if (value instanceof Primitive) { const tmp = input[value]; // Bug is here ```</p> <p>No validation that value is a safe numeric index input is built as a plain Array. JavaScript&#39;s property lookup on arrays traverses the prototype chain for non-numeric keys. The key &#34;\_\_proto\_\_&#34; resolves to Array.prototype, which:</p> <p>- has type &#34;object&#34; → passes the typeof tmp === object guard at line 30 - is not in the parsed Set yet → passes the !parsed.has(tmp) guard. - The reference to Array.prototype is then enqueued in lazy and later unconditionally assigned to the output object. --- **Replication S…</p> https://cve.radiocsirt.org/vuln/ghsa-rf6f-7fwh-wjgh https://cve.radiocsirt.org/vuln/msrc_cve-2026-33228 msrc_CVE-2026-33228 https://cve.radiocsirt.org/vuln/msrc_cve-2026-33228 https://cve.radiocsirt.org/vuln/rhsa-2026:13826 <p>axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization python-markdown: denial of service via malformed HTML-like sequences undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression undici: undici: Denial of Service via crafted WebSocket frame with large length undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter rhdh: GraphQL Injection Leading to Platform-Wide Denial of Service (DoS) in RH Developer Hub Orchestrator Plugin lodash: lodash: Arbitrary code execution via untrusted input in template imports path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions Underscore.js: Underscore.js: Denial of Service via recursive data structures in flatten and isEqual functions minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution svgo: SVGO: Denial of Service via XML entity expansion backstage/plugin-techdocs-node: TechDocs Mkdocs configuration key enables arbitrary code execution flatted: flatted: Unbounded recursion DoS in parse() revive phase crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building golang: internal/syscall/unix: Root.Chmod can follow symlinks out…</p> <p>axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization python-markdown: denial of service via malformed HTML-like sequences undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression undici: undici: Denial of Service via crafted WebSocket frame with large length undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter rhdh: GraphQL Injection Leading to Platform-Wide Denial of Service (DoS) in RH Developer Hub Orchestrator Plugin lodash: lodash: Arbitrary code execution via untrusted input in template imports path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions Underscore.js: Underscore.js: Denial of Service via recursive data structures in flatten and isEqual functions minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution svgo: SVGO: Denial of Service via XML entity expansion backstage/plugin-techdocs-node: TechDocs Mkdocs configuration key enables arbitrary code execution flatted: flatted: Unbounded recursion DoS in parse() revive phase crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building golang: internal/syscall/unix: Root.Chmod can follow symlinks out…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:13826 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33228 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: node-flatted, Ubuntu:22.04:LTS: node-flatted, Ubuntu:24.04:LTS: node-flatted, Ubuntu:25.10: node-flatted, Ubuntu:26.04:LTS: node-flatted</p> <p>flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key &#34;__proto__&#34; returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the global prototype. This issue has been patched in version 3.4.2.</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: node-flatted, Ubuntu:22.04:LTS: node-flatted, Ubuntu:24.04:LTS: node-flatted, Ubuntu:25.10: node-flatted, Ubuntu:26.04:LTS: node-flatted</p> <p>flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key &#34;__proto__&#34; returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the global prototype. This issue has been patched in version 3.4.2.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33228 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1220 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Dateien zu manipulieren, und um einen Denial of Service Angriff durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Dateien zu manipulieren, und um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1220