https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 04:00:37 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-326605 EUVD-2026-326605 https://cve.radiocsirt.org/vuln/euvd-2026-326605 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42462 <p>Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify interprets it without changing its Linked Data Signature, allowing them to alter a third-party signed activity they have received. Versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3 fix the issue.</p> <p>Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify interprets it without changing its Linked Data Signature, allowing them to alter a third-party signed activity they have received. Versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3 fix the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-42462 https://cve.radiocsirt.org/vuln/ghsa-9rfg-v8g9-9367 <p><strong>Affected:</strong> npm: @fedify/fedify</p> <p>As told on Discord earlier, multiple projects are affected, and we would like to coordinate. For now, we are aiming at a May 6th release date, but this is not set in stone yet.</p> <p>### Summary</p> <p>An attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify interprets it without changing its Linked Data Signature, allowing them to alter a third-party signed activity they have received.</p> <p>### Details</p> <p>The vulnerability essentially boils down to the signature being on the canonical RDF graph representation of the JSON-LD document, and JSON-LD offering many ways to represent the same graph.</p> <p>One of the issues is that by taking a signed `Activity` with an embedded `object`, an attacker can move the top-level `Activity` to a `@graph` property and move the activity&#39;s `object` to the top-level. Such a transformation preserves the signature and changes how the payload is interpreted by pretty much all ActivityPub implementations, making them process the object and ignore the formely-top-level activity. This can be used when the graph contains an embedded activity. In Mastodon, that is the case of `{ &#34;type&#34;: &#34;Undo&#34;, &#34;object&#34;: { &#34;type&#34;: &#34;Announce&#34; } }`, but other implementations may sign other activities that can be exploited in the same way.</p> <p>The `@reverse` keyword can also be used to change the shape of a JSON-LD document without changing the underlying graph, and could be used in a similar way to reverse an `Activity` and its `object`.</p> <p>Anoth…</p> <p><strong>Affected:</strong> npm: @fedify/fedify</p> <p>As told on Discord earlier, multiple projects are affected, and we would like to coordinate. For now, we are aiming at a May 6th release date, but this is not set in stone yet.</p> <p>### Summary</p> <p>An attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify interprets it without changing its Linked Data Signature, allowing them to alter a third-party signed activity they have received.</p> <p>### Details</p> <p>The vulnerability essentially boils down to the signature being on the canonical RDF graph representation of the JSON-LD document, and JSON-LD offering many ways to represent the same graph.</p> <p>One of the issues is that by taking a signed `Activity` with an embedded `object`, an attacker can move the top-level `Activity` to a `@graph` property and move the activity&#39;s `object` to the top-level. Such a transformation preserves the signature and changes how the payload is interpreted by pretty much all ActivityPub implementations, making them process the object and ignore the formely-top-level activity. This can be used when the graph contains an embedded activity. In Mastodon, that is the case of `{ &#34;type&#34;: &#34;Undo&#34;, &#34;object&#34;: { &#34;type&#34;: &#34;Announce&#34; } }`, but other implementations may sign other activities that can be exploited in the same way.</p> <p>The `@reverse` keyword can also be used to change the shape of a JSON-LD document without changing the underlying graph, and could be used in a similar way to reverse an `Activity` and its `object`.</p> <p>Anoth…</p> https://cve.radiocsirt.org/vuln/ghsa-9rfg-v8g9-9367