{"vulnerability": "CVE-2026-14257", "sightings": [{"uuid": "b32f2802-2726-43f7-a681-edcc585bad7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14257", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrdcvmlwzj22", "content": "\ud83d\udfe0 CVE-2026-14257 - High (7.5)\n\nbrace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expan...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-14257/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-23T17:02:05.936236Z"}, {"uuid": "f18abf58-e315-41fa-8efc-c07ae4bd978b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-14257", "type": "published-proof-of-concept", "source": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg", "content": "", "creation_timestamp": "2026-07-24T22:35:03.544948Z"}, {"uuid": "9a69cc8a-77a8-4e51-bc32-7287edb84225", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14257", "type": "seen", "source": "https://gist.github.com/BrendanPatric/94f86501f020c7775dbd8239cf371c2e", "content": "# Workflow Creator 1.2.1 Post-Advisory Security Notice\n\n## Status\n\nWorkflow Creator 1.2.1 is newly affected through its official Pi 0.81.1 host closure by `GHSA-mh99-v99m-4gvg` / `CVE-2026-14257`.\n\nThe exact independently reproduced host node is:\n\n```text\nnode_modules/@earendil-works/pi-coding-agent/node_modules/brace-expansion\nversion: 5.0.7\nfixed:   5.0.8\n```\n\nExact reachability verdict:\n\n```text\nreachable_with_untrusted_input\n```\n\n## User guidance\n\nThe unqualified canonical-default recommendation for 1.2.1 is withdrawn. Existing release bytes and tags remain unchanged for provenance and rollback integrity, but the release must not be described as clean or vulnerability-free.\n\nUntil a separately verified release uses an official Pi shrinkwrap installing `brace-expansion@5.0.8` or later, do not permit untrusted:\n\n- Pi package manifests or manifest glob entries;\n- Pi package-resource filter patterns;\n- Pi model-scope patterns;\n- extension- or tool-written configuration containing matching patterns.\n\nThis restriction is operational risk reduction, not a universal mitigation. Centralife project code does not intercept every Pi-owned package-manager, model-resolver, minimatch, and glob entry point.\n\n## Remediation\n\nMove to the first separately verified Workflow Creator release based on a compatible official Pi package whose clean isolated installation proves the nested dependency is `brace-expansion@5.0.8` or later.\n\nSee `STABLE-1.2.1-AUDIT.json` for exact source, package, Pi, shrinkwrap, installed-tree, call-site, and input-provenance bindings.\n\nThis notice grants no exception, promotion, installation, tag, push, or release authority.\n", "creation_timestamp": "2026-07-25T03:24:18.374964Z"}]}