Vulnerability-Lookup

OPENSUSE-SU-2026:11946-1

Vulnerability from csaf_opensuse - Published: 2026-10-01 00:00 - Updated: 2026-10-02 10:46

Summary

python313-langchain-anthropic-1.7.5-1.1 on GA media

Severity

Moderate

Notes

Title of the patch: python313-langchain-anthropic-1.7.5-1.1 on GA media

Description of the patch: These are all security issues fixed in the python313-langchain-anthropic-1.7.5-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2026-11946

CVE-2026-55443

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:python313-langchain-anthropic-0:1.7.5-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-langchain-anthropic-0:1.7.5-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-langchain-anthropic-0:1.7.5-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-langchain-anthropic-0:1.7.5-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-langchain-anthropic-0:1.7.5-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-langchain-anthropic-0:1.7.5-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-langchain-anthropic-0:1.7.5-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-langchain-anthropic-0:1.7.5-1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

References

4 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://www.suse.com/security/cve/CVE-2026-55443/	self
https://www.suse.com/security/cve/CVE-2026-55443	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "python313-langchain-anthropic-1.7.5-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the python313-langchain-anthropic-1.7.5-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-11946",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11946-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-55443 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-55443/"
      }
    ],
    "title": "python313-langchain-anthropic-1.7.5-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-10-02T10:46:48Z",
      "generator": {
        "date": "2026-10-01T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:11946-1",
      "initial_release_date": "2026-10-01T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-10-01T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-10-02T10:46:48Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-langchain-anthropic-0:1.7.5-1.1.aarch64",
                "product": {
                  "name": "python313-langchain-anthropic-0:1.7.5-1.1.aarch64",
                  "product_id": "python313-langchain-anthropic-0:1.7.5-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python313-langchain-anthropic@1.7.5-1.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-langchain-anthropic-0:1.7.5-1.1.aarch64",
                "product": {
                  "name": "python314-langchain-anthropic-0:1.7.5-1.1.aarch64",
                  "product_id": "python314-langchain-anthropic-0:1.7.5-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-langchain-anthropic@1.7.5-1.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-langchain-anthropic-0:1.7.5-1.1.ppc64le",
                "product": {
                  "name": "python313-langchain-anthropic-0:1.7.5-1.1.ppc64le",
                  "product_id": "python313-langchain-anthropic-0:1.7.5-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python313-langchain-anthropic@1.7.5-1.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-langchain-anthropic-0:1.7.5-1.1.ppc64le",
                "product": {
                  "name": "python314-langchain-anthropic-0:1.7.5-1.1.ppc64le",
                  "product_id": "python314-langchain-anthropic-0:1.7.5-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-langchain-anthropic@1.7.5-1.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-langchain-anthropic-0:1.7.5-1.1.s390x",
                "product": {
                  "name": "python313-langchain-anthropic-0:1.7.5-1.1.s390x",
                  "product_id": "python313-langchain-anthropic-0:1.7.5-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python313-langchain-anthropic@1.7.5-1.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-langchain-anthropic-0:1.7.5-1.1.s390x",
                "product": {
                  "name": "python314-langchain-anthropic-0:1.7.5-1.1.s390x",
                  "product_id": "python314-langchain-anthropic-0:1.7.5-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-langchain-anthropic@1.7.5-1.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-langchain-anthropic-0:1.7.5-1.1.x86_64",
                "product": {
                  "name": "python313-langchain-anthropic-0:1.7.5-1.1.x86_64",
                  "product_id": "python313-langchain-anthropic-0:1.7.5-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python313-langchain-anthropic@1.7.5-1.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-langchain-anthropic-0:1.7.5-1.1.x86_64",
                "product": {
                  "name": "python314-langchain-anthropic-0:1.7.5-1.1.x86_64",
                  "product_id": "python314-langchain-anthropic-0:1.7.5-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-langchain-anthropic@1.7.5-1.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-langchain-anthropic-0:1.7.5-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-langchain-anthropic-0:1.7.5-1.1.aarch64"
        },
        "product_reference": "python313-langchain-anthropic-0:1.7.5-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-langchain-anthropic-0:1.7.5-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-langchain-anthropic-0:1.7.5-1.1.ppc64le"
        },
        "product_reference": "python313-langchain-anthropic-0:1.7.5-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-langchain-anthropic-0:1.7.5-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-langchain-anthropic-0:1.7.5-1.1.s390x"
        },
        "product_reference": "python313-langchain-anthropic-0:1.7.5-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-langchain-anthropic-0:1.7.5-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-langchain-anthropic-0:1.7.5-1.1.x86_64"
        },
        "product_reference": "python313-langchain-anthropic-0:1.7.5-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-langchain-anthropic-0:1.7.5-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-langchain-anthropic-0:1.7.5-1.1.aarch64"
        },
        "product_reference": "python314-langchain-anthropic-0:1.7.5-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-langchain-anthropic-0:1.7.5-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-langchain-anthropic-0:1.7.5-1.1.ppc64le"
        },
        "product_reference": "python314-langchain-anthropic-0:1.7.5-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-langchain-anthropic-0:1.7.5-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-langchain-anthropic-0:1.7.5-1.1.s390x"
        },
        "product_reference": "python314-langchain-anthropic-0:1.7.5-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-langchain-anthropic-0:1.7.5-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-langchain-anthropic-0:1.7.5-1.1.x86_64"
        },
        "product_reference": "python314-langchain-anthropic-0:1.7.5-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-55443",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-55443"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "LangChain is a framework for building agents and LLM-powered applications. Prior to 1.3.9, several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source - including an LLM acting on untrusted input - the result can be disclosure of files outside the intended boundary. This vulnerability is fixed in 1.3.9.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-langchain-anthropic-0:1.7.5-1.1.aarch64",
          "openSUSE Tumbleweed:python313-langchain-anthropic-0:1.7.5-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-langchain-anthropic-0:1.7.5-1.1.s390x",
          "openSUSE Tumbleweed:python313-langchain-anthropic-0:1.7.5-1.1.x86_64",
          "openSUSE Tumbleweed:python314-langchain-anthropic-0:1.7.5-1.1.aarch64",
          "openSUSE Tumbleweed:python314-langchain-anthropic-0:1.7.5-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-langchain-anthropic-0:1.7.5-1.1.s390x",
          "openSUSE Tumbleweed:python314-langchain-anthropic-0:1.7.5-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-55443",
          "url": "https://www.suse.com/security/cve/CVE-2026-55443"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-langchain-anthropic-0:1.7.5-1.1.aarch64",
            "openSUSE Tumbleweed:python313-langchain-anthropic-0:1.7.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-langchain-anthropic-0:1.7.5-1.1.s390x",
            "openSUSE Tumbleweed:python313-langchain-anthropic-0:1.7.5-1.1.x86_64",
            "openSUSE Tumbleweed:python314-langchain-anthropic-0:1.7.5-1.1.aarch64",
            "openSUSE Tumbleweed:python314-langchain-anthropic-0:1.7.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-langchain-anthropic-0:1.7.5-1.1.s390x",
            "openSUSE Tumbleweed:python314-langchain-anthropic-0:1.7.5-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-langchain-anthropic-0:1.7.5-1.1.aarch64",
            "openSUSE Tumbleweed:python313-langchain-anthropic-0:1.7.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-langchain-anthropic-0:1.7.5-1.1.s390x",
            "openSUSE Tumbleweed:python313-langchain-anthropic-0:1.7.5-1.1.x86_64",
            "openSUSE Tumbleweed:python314-langchain-anthropic-0:1.7.5-1.1.aarch64",
            "openSUSE Tumbleweed:python314-langchain-anthropic-0:1.7.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-langchain-anthropic-0:1.7.5-1.1.s390x",
            "openSUSE Tumbleweed:python314-langchain-anthropic-0:1.7.5-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-01T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-55443"
    }
  ]
}

CVE-2026-55443 (GCVE-0-2026-55443)

Vulnerability from cvelistv5 – Published: 2026-06-22 17:21 – Updated: 2026-06-22 19:52

Title

LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders

Summary

LangChain is a framework for building agents and LLM-powered applications. Prior to 1.3.9, several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. This vulnerability is fixed in 1.3.9.

Severity

5.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-22 19:51 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Assigner

GitHub_M mitre root Scorecard

References

2 references

URL	Tags
https://github.com/langchain-ai/langchain/securit…	x_refsource_CONFIRM
https://github.com/langchain-ai/langchain/commit/…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
langchain-ai	langchain	Affected: < 1.3.9
langchain-ai	langchain-anthropic	Affected: < 1.4.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55443",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-22T19:51:55.399642Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-22T19:52:02.637Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "langchain",
          "vendor": "langchain-ai",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.3.9"
            }
          ]
        },
        {
          "product": "langchain-anthropic",
          "vendor": "langchain-ai",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LangChain is a framework for building agents and LLM-powered applications. Prior to 1.3.9, several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source \u2014 including an LLM acting on untrusted input \u2014 the result can be disclosure of files outside the intended boundary. This vulnerability is fixed in 1.3.9."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-22T17:22:06.808Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/langchain-ai/langchain/security/advisories/GHSA-gr75-jv2w-4656",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/langchain-ai/langchain/security/advisories/GHSA-gr75-jv2w-4656"
        },
        {
          "name": "https://github.com/langchain-ai/langchain/commit/dcaf7795a3e6590af55c3ff7bda6add6355e9ea6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/langchain-ai/langchain/commit/dcaf7795a3e6590af55c3ff7bda6add6355e9ea6"
        }
      ],
      "source": {
        "advisory": "GHSA-gr75-jv2w-4656",
        "discovery": "UNKNOWN"
      },
      "title": "LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55443",
    "datePublished": "2026-06-22T17:21:46.121Z",
    "dateReserved": "2026-06-16T21:59:57.018Z",
    "dateUpdated": "2026-06-22T19:52:02.637Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OPENSUSE-SU-2026:11946-1

CVE-2026-55443 (GCVE-0-2026-55443)

Tags

Sightings

Nomenclature

Related by attack behaviour