https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 21:21:08 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-324646 EUVD-2026-324646 https://cve.radiocsirt.org/vuln/euvd-2026-324646 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41011 <p>PackagePersister.validate_tgz builds &#34;tar -tf #{tgz} 2&gt;&amp;1&#34; where tgz = File.join(release_dir, &#39;packages&#39;, &#34;#{name}.tgz&#34;) and name = package_meta[&#39;name&#39;] comes directly from release.MF inside the uploaded tarball. The string is passed to Bosh::Common::Exec.sh, which executes via %x{} — i.e., /bin/sh -c. No Shellwords.escape is applied. The Models::Package Sequel validation (VALID_ID = /^[-0-9A-Za-z_+.]+$/i) would reject the name, but in create_package (lines 74–79) the shell-out in save_package_source_blob runs before package.save, so validation fires too late.</p> <p>Affected versions: - BOSH: all versions prior to v282.1.12 (inclusive); fixed in v282.1.12 or later</p> <p>PackagePersister.validate_tgz builds &#34;tar -tf #{tgz} 2&gt;&amp;1&#34; where tgz = File.join(release_dir, &#39;packages&#39;, &#34;#{name}.tgz&#34;) and name = package_meta[&#39;name&#39;] comes directly from release.MF inside the uploaded tarball. The string is passed to Bosh::Common::Exec.sh, which executes via %x{} — i.e., /bin/sh -c. No Shellwords.escape is applied. The Models::Package Sequel validation (VALID_ID = /^[-0-9A-Za-z_+.]+$/i) would reject the name, but in create_package (lines 74–79) the shell-out in save_package_source_blob runs before package.save, so validation fires too late.</p> <p>Affected versions: - BOSH: all versions prior to v282.1.12 (inclusive); fixed in v282.1.12 or later</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41011 https://cve.radiocsirt.org/vuln/ghsa-96vc-39m3-22w5 <p>PackagePersister.validate_tgz builds &#34;tar -tf #{tgz} 2&gt;&amp;1&#34; where tgz = File.join(release_dir, &#39;packages&#39;, &#34;#{name}.tgz&#34;) and name = package_meta[&#39;name&#39;] comes directly from release.MF inside the uploaded tarball. The string is passed to Bosh::Common::Exec.sh, which executes via %x{} — i.e., /bin/sh -c. No Shellwords.escape is applied. The Models::Package Sequel validation (VALID_ID = /^[-0-9A-Za-z_+.]+$/i) would reject the name, but in create_package (lines 74–79) the shell-out in save_package_source_blob runs before package.save, so validation fires too late.</p> <p>Affected versions: - BOSH: all versions prior to v282.1.12 (inclusive); fixed in v282.1.12 or later</p> <p>PackagePersister.validate_tgz builds &#34;tar -tf #{tgz} 2&gt;&amp;1&#34; where tgz = File.join(release_dir, &#39;packages&#39;, &#34;#{name}.tgz&#34;) and name = package_meta[&#39;name&#39;] comes directly from release.MF inside the uploaded tarball. The string is passed to Bosh::Common::Exec.sh, which executes via %x{} — i.e., /bin/sh -c. No Shellwords.escape is applied. The Models::Package Sequel validation (VALID_ID = /^[-0-9A-Za-z_+.]+$/i) would reject the name, but in create_package (lines 74–79) the shell-out in save_package_source_blob runs before package.save, so validation fires too late.</p> <p>Affected versions: - BOSH: all versions prior to v282.1.12 (inclusive); fixed in v282.1.12 or later</p> https://cve.radiocsirt.org/vuln/ghsa-96vc-39m3-22w5