https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 06:17:53 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-89011 <p>isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing &#39;__proto__&#39; path segments during ref negotiation. Attackers controlling a Git server can advertise a specially crafted ref such as &#39;__proto__/corsProxy&#39; to reroute all subsequent network operations through an attacker-controlled proxy, causing isomorphic-git to invoke the victim&#39;s onAuth callback and transmit credentials to the attacker when the victim calls getRemoteInfo with an attacker-supplied URL.</p> <p>isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing &#39;__proto__&#39; path segments during ref negotiation. Attackers controlling a Git server can advertise a specially crafted ref such as &#39;__proto__/corsProxy&#39; to reroute all subsequent network operations through an attacker-controlled proxy, causing isomorphic-git to invoke the victim&#39;s onAuth callback and transmit credentials to the attacker when the victim calls getRemoteInfo with an attacker-supplied URL.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-89011 https://vulnerability.circl.lu/vuln/rhsa-2026:72712 <p>multer: Multer: Denial of Service via aborted or malformed multipart uploads undici: undici: Denial of Service via unrequested WebSocket subprotocol vm2: vm2: Denial of Service due to memory allocation limit bypass urllib: urllib: Credential leakage via cross-origin redirects js-yaml: js-yaml: Denial of Service via crafted YAML documents immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations qs: qs: Denial of Service via improper validation in stringify function js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing compression: compression: Denial of Service via memory leak on premature response close multer: multer: Denial of Service via orphaned disk writes on aborted uploads isomorphic-git: isomorphic-git: Information disclosure via prototype pollution in getRemoteInfo function. adm-zip: adm-zip: Denial of Service via crafted ZIP archives with zero declared uncompressed size vm2: vm2: Denial of Service via timeout bypass in sandboxed code vm2: vm2: Sandbox escape via denylist bypass in NodeVM vm2: vm2: Asynchronous code execution bypass via Promise thenable assimilation vm2: vm2: Denial of Service via memory exhaustion</p> <p>multer: Multer: Denial of Service via aborted or malformed multipart uploads undici: undici: Denial of Service via unrequested WebSocket subprotocol vm2: vm2: Denial of Service due to memory allocation limit bypass urllib: urllib: Credential leakage via cross-origin redirects js-yaml: js-yaml: Denial of Service via crafted YAML documents immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations qs: qs: Denial of Service via improper validation in stringify function js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing compression: compression: Denial of Service via memory leak on premature response close multer: multer: Denial of Service via orphaned disk writes on aborted uploads isomorphic-git: isomorphic-git: Information disclosure via prototype pollution in getRemoteInfo function. adm-zip: adm-zip: Denial of Service via crafted ZIP archives with zero declared uncompressed size vm2: vm2: Denial of Service via timeout bypass in sandboxed code vm2: vm2: Sandbox escape via denylist bypass in NodeVM vm2: vm2: Asynchronous code execution bypass via Promise thenable assimilation vm2: vm2: Denial of Service via memory exhaustion</p> https://vulnerability.circl.lu/vuln/rhsa-2026:72712