https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 09:05:48 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-09394 bdu:2026-09394 https://cve.radiocsirt.org/vuln/bdu:2026-09394 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0581 certfr-2026-avi-0581 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0581 https://cve.radiocsirt.org/vuln/cleanstart-2026-ad27625 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: mongosh</p> <p>Multiple security vulnerabilities affect the mongosh package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: mongosh</p> <p>Multiple security vulnerabilities affect the mongosh package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ad27625 https://cve.radiocsirt.org/vuln/euvd-2026-278137 EUVD-2026-278137 https://cve.radiocsirt.org/vuln/euvd-2026-278137 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33916 <p>Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without guarding against prototype-chain traversal. When `Object.prototype` has been polluted with a string value whose key matches a partial reference in a template, the polluted string is used as the partial body and rendered without HTML escaping, resulting in reflected or stored XSS. Version 4.7.9 fixes the issue. Some workarounds are available. Apply `Object.freeze(Object.prototype)` early in application startup to prevent prototype pollution. Note: this may break other libraries, and/or use the Handlebars runtime-only build (`handlebars/runtime`), which does not compile templates and reduces the attack surface.</p> <p>Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without guarding against prototype-chain traversal. When `Object.prototype` has been polluted with a string value whose key matches a partial reference in a template, the polluted string is used as the partial body and rendered without HTML escaping, resulting in reflected or stored XSS. Version 4.7.9 fixes the issue. Some workarounds are available. Apply `Object.freeze(Object.prototype)` early in application startup to prevent prototype pollution. Note: this may break other libraries, and/or use the Handlebars runtime-only build (`handlebars/runtime`), which does not compile templates and reduces the attack surface.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33916 https://cve.radiocsirt.org/vuln/ghsa-2qvq-rjwj-gvw9 <p><strong>Affected:</strong> npm: handlebars</p> <p>## Summary</p> <p>`resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without guarding against prototype-chain traversal. When `Object.prototype` has been polluted with a string value whose key matches a partial reference in a template, the polluted string is used as the partial body and rendered **without HTML escaping**, resulting in reflected or stored XSS.</p> <p>## Description</p> <p>The root cause is in `lib/handlebars/runtime.js` inside `resolvePartial()` and `invokePartial()`:</p> <p>```javascript // Vulnerable: plain bracket access traverses Object.prototype partial = options.partials[options.name]; ```</p> <p>`hasOwnProperty` is never checked, so if `Object.prototype` has been seeded with a key whose name matches a partial reference in the template (e.g. `widget`), the lookup succeeds and the polluted string is returned. The runtime emits a prototype-access warning, but the partial is still resolved and its content is inserted into the rendered output unescaped. This contradicts the documented security model and is distinct from CVE-2021-23369 and CVE-2021-23383, which addressed data property access rather than partial template resolution.</p> <p>**Prerequisites for exploitation:** 1. The target application must be vulnerable to prototype pollution (e.g. via `qs`, `minimist`, or any querystring/JSON merge sink). 2. The attacker must know or guess the name of a partial reference used in a template.</p> <p>## Proof of Concept</p> <p>```javascript…</p> <p><strong>Affected:</strong> npm: handlebars</p> <p>## Summary</p> <p>`resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without guarding against prototype-chain traversal. When `Object.prototype` has been polluted with a string value whose key matches a partial reference in a template, the polluted string is used as the partial body and rendered **without HTML escaping**, resulting in reflected or stored XSS.</p> <p>## Description</p> <p>The root cause is in `lib/handlebars/runtime.js` inside `resolvePartial()` and `invokePartial()`:</p> <p>```javascript // Vulnerable: plain bracket access traverses Object.prototype partial = options.partials[options.name]; ```</p> <p>`hasOwnProperty` is never checked, so if `Object.prototype` has been seeded with a key whose name matches a partial reference in the template (e.g. `widget`), the lookup succeeds and the polluted string is returned. The runtime emits a prototype-access warning, but the partial is still resolved and its content is inserted into the rendered output unescaped. This contradicts the documented security model and is distinct from CVE-2021-23369 and CVE-2021-23383, which addressed data property access rather than partial template resolution.</p> <p>**Prerequisites for exploitation:** 1. The target application must be vulnerable to prototype pollution (e.g. via `qs`, `minimist`, or any querystring/JSON merge sink). 2. The attacker must know or guess the name of a partial reference used in a template.</p> <p>## Proof of Concept</p> <p>```javascript…</p> https://cve.radiocsirt.org/vuln/ghsa-2qvq-rjwj-gvw9 https://cve.radiocsirt.org/vuln/msrc_cve-2026-33916 msrc_CVE-2026-33916 https://cve.radiocsirt.org/vuln/msrc_cve-2026-33916 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33916 <p><strong>Affected:</strong> Ubuntu:18.04:LTS: node-handlebars, Ubuntu:20.04:LTS: node-handlebars, Ubuntu:22.04:LTS: node-handlebars, Ubuntu:24.04:LTS: node-handlebars, Ubuntu:25.10: node-handlebars, Ubuntu:26.04:LTS: node-handlebars</p> <p>Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without guarding against prototype-chain traversal. When `Object.prototype` has been polluted with a string value whose key matches a partial reference in a template, the polluted string is used as the partial body and rendered without HTML escaping, resulting in reflected or stored XSS. Version 4.7.9 fixes the issue. Some workarounds are available. Apply `Object.freeze(Object.prototype)` early in application startup to prevent prototype pollution. Note: this may break other libraries, and/or use the Handlebars runtime-only build (`handlebars/runtime`), which does not compile templates and reduces the attack surface.</p> <p><strong>Affected:</strong> Ubuntu:18.04:LTS: node-handlebars, Ubuntu:20.04:LTS: node-handlebars, Ubuntu:22.04:LTS: node-handlebars, Ubuntu:24.04:LTS: node-handlebars, Ubuntu:25.10: node-handlebars, Ubuntu:26.04:LTS: node-handlebars</p> <p>Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without guarding against prototype-chain traversal. When `Object.prototype` has been polluted with a string value whose key matches a partial reference in a template, the polluted string is used as the partial body and rendered without HTML escaping, resulting in reflected or stored XSS. Version 4.7.9 fixes the issue. Some workarounds are available. Apply `Object.freeze(Object.prototype)` early in application startup to prevent prototype pollution. Note: this may break other libraries, and/or use the Handlebars runtime-only build (`handlebars/runtime`), which does not compile templates and reduces the attack surface.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33916 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1407 <p>Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise Certified Container ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise Certified Container ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1407