https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 07:14:24 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-321918 EUVD-2026-321918 https://cve.radiocsirt.org/vuln/euvd-2026-321918 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44214 <p>eventsource-encoder encodes events as well-formed EventSource/Server Sent Event (SSE) messages. Prior to 1.0.2, eventsource-encoder does not sanitize the event or id fields of an EventSourceMessage before serializing them. An attacker who controls either field can inject arbitrary Server-Sent Events line terminators (\n, \r, or \r\n) and thereby forge additional SSE fields or entire messages on the stream. This vulnerability is fixed in 1.0.2.</p> <p>eventsource-encoder encodes events as well-formed EventSource/Server Sent Event (SSE) messages. Prior to 1.0.2, eventsource-encoder does not sanitize the event or id fields of an EventSourceMessage before serializing them. An attacker who controls either field can inject arbitrary Server-Sent Events line terminators (\n, \r, or \r\n) and thereby forge additional SSE fields or entire messages on the stream. This vulnerability is fixed in 1.0.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44214 https://cve.radiocsirt.org/vuln/ghsa-m9g3-3g99-mhpx <p><strong>Affected:</strong> npm: eventsource-encoder</p> <p>### Summary</p> <p>`eventsource-encoder` does not sanitize the `event` or `id` fields of an `EventSourceMessage` before serializing them. An attacker who controls either field can inject arbitrary Server-Sent Events line terminators (`\n`, `\r`, or `\r\n`) and thereby forge additional SSE fields or entire messages on the stream. This is similar in spirit to [GHSA-4hxc-9384-m385](https://github.com/advisories/GHSA-4hxc-9384-m385) (h3), but the vulnerable fields are `event`/`id` rather than `data`/`comment`. These are less likely to be user-controllable, but should still be sanitized.</p> <p>### Details</p> <p>In `src/encode.ts`, `encodeMessage` interpolates `event` and `id` into the output without inspecting them for line terminators:</p> <p>```ts if (message.event) { output += `event: ${message.event}\n` } // ... if (typeof message.id === &#39;string&#39; || typeof message.id === &#39;number&#39;) { output += `id: ${message.id}\n` } ```</p> <p>The SSE specification treats `\r`, `\n`, and `\r\n` as line terminators. A `\n` (or `\r`) embedded in either field is rendered as the end of that field, allowing the rest of the input to be interpreted by the client as new SSE fields.</p> <p>By contrast, `data` and `comment` already normalize all three line-terminator forms via `NEWLINES_RE = /(\r\n|\r|\n)/g`, so they are not affected.</p> <p>### Proof of concept</p> <p>```js import {encode} from &#39;eventsource-encoder&#39;</p> <p>// Attacker-controlled value flows into `event` const userSuppliedTopic = &#39;message\nevent: admin\ndata: {&#34;role&#34;:&#34;admin&#34;}&#39;</p> <p>cons…</p> <p><strong>Affected:</strong> npm: eventsource-encoder</p> <p>### Summary</p> <p>`eventsource-encoder` does not sanitize the `event` or `id` fields of an `EventSourceMessage` before serializing them. An attacker who controls either field can inject arbitrary Server-Sent Events line terminators (`\n`, `\r`, or `\r\n`) and thereby forge additional SSE fields or entire messages on the stream. This is similar in spirit to [GHSA-4hxc-9384-m385](https://github.com/advisories/GHSA-4hxc-9384-m385) (h3), but the vulnerable fields are `event`/`id` rather than `data`/`comment`. These are less likely to be user-controllable, but should still be sanitized.</p> <p>### Details</p> <p>In `src/encode.ts`, `encodeMessage` interpolates `event` and `id` into the output without inspecting them for line terminators:</p> <p>```ts if (message.event) { output += `event: ${message.event}\n` } // ... if (typeof message.id === &#39;string&#39; || typeof message.id === &#39;number&#39;) { output += `id: ${message.id}\n` } ```</p> <p>The SSE specification treats `\r`, `\n`, and `\r\n` as line terminators. A `\n` (or `\r`) embedded in either field is rendered as the end of that field, allowing the rest of the input to be interpreted by the client as new SSE fields.</p> <p>By contrast, `data` and `comment` already normalize all three line-terminator forms via `NEWLINES_RE = /(\r\n|\r|\n)/g`, so they are not affected.</p> <p>### Proof of concept</p> <p>```js import {encode} from &#39;eventsource-encoder&#39;</p> <p>// Attacker-controlled value flows into `event` const userSuppliedTopic = &#39;message\nevent: admin\ndata: {&#34;role&#34;:&#34;admin&#34;}&#39;</p> <p>cons…</p> https://cve.radiocsirt.org/vuln/ghsa-m9g3-3g99-mhpx