{"vulnerability": "cve-2026-6915", "sightings": [{"uuid": "8f376fee-bdd1-42c5-a98a-fbcb4db0e530", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69152", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117037977349070761", "content": "Some increased actor activities are shown targeting juliangruber brace-expansion (CVE-2026-69152) https://vuldb.com/vuln/385629/cti", "creation_timestamp": "2026-08-04T15:36:49.248351Z"}, {"uuid": "c5c322af-7348-4af8-b118-c6df65c85026", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69152", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3msaxo2gbwq2g", "content": "\n\ud83d\udea8 New HIGH CVE detected in AWS Lambda \ud83d\udea8\nCVE-2026-69152 impacts brace-expansion in 3 Lambda base images.\n\nDetails: https://github.com/aws/aws-lambda-base-images/issues/640\nMore: https://lambdawatchdog.com/\n\n#AWS #Lambda #CVE #CloudSecurity #Serverless", "creation_timestamp": "2026-08-04T12:00:52.897369Z"}, {"uuid": "02150ce7-9740-415e-8045-30438836d805", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69151", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3ms6xhvahdl2o", "content": "CVE-2026-69151 - compiler\nA security issue in Angular's internationalization (i18n) feature allows hackers to inject malicious JavaScript code into web pages. This can happen if an attacker controls\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#compiler #angular #npm #CVE #infosec", "creation_timestamp": "2026-08-03T16:52:06.541925Z"}, {"uuid": "734c6ca3-30ea-4949-adb7-2f12ab232774", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69152", "type": "seen", "source": "https://gist.github.com/alon710/d80e5d80b7549449b84a63552411d4ec", "content": "# CVE-2026-69152: CVE-2026-69152: Denial of Service via Resource Exhaustion in brace-expansion\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69152\n\n## Summary\nCVE-2026-69152 is a high-severity Denial of Service (DoS) vulnerability in brace-expansion that allows remote, unauthenticated attackers to cause a process crash or infinite thread-blocking condition. The vulnerability stems from a complete mitigation bypass of the security checks implemented for CVE-2026-14257.\n\n## TL;DR\nA resource exhaustion vulnerability in the brace-expansion library permits unauthenticated remote attackers to trigger process termination via heap memory exhaustion or lock the Node.js event loop by supplying crafted nested brace structures.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400, CWE-770\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5\n- **EPSS Score**: Not available\n- **Impact**: Denial of Service (Availability)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Node.js applications using brace-expansion package\n- **brace-expansion**: < 1.1.18 (Fixed in: `1.1.18`)\n- **brace-expansion**: >= 2.0.0, < 2.1.4 (Fixed in: `2.1.4`)\n- **brace-expansion**: >= 3.0.0, < 3.0.6 (Fixed in: `3.0.6`)\n- **brace-expansion**: >= 4.0.0, < 5.0.9 (Fixed in: `5.0.9`)\n\n## Mitigation\n\n- Limit input length before passing to brace-expansion\n- Sandbox execution within isolated threads or workers\n- Upgrade brace-expansion to patched versions\n\n**Remediation Steps:**\n1. Verify brace-expansion version in package-lock.json\n2. Update dependencies using npm update brace-expansion or yarn upgrade brace-expansion\n3. Incorporate length checks on untrusted inputs before expansion parsing.\n\n## References\n\n- [v1.x Line Fix Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n- [v3.x Line Fix Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [v5.x Line Fix Commit A](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [v5.x Line Fix Commit B](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69152) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-03T17:31:36.975302Z"}, {"uuid": "cdfb620f-277f-43c0-91e2-63bd0bc2361b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69151", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/cpivbdhgtqa6k", "content": "CVE-2026-69151 - Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes\nCVE ID : CVE-2026-69151\n \n Published : Aug. 3, 2026, 5:16 p.m. | 41\u00a0minutes ago\n \n Description : Angular is a development platform for building mobile and desktop web applications using Type...", "creation_timestamp": "2026-08-03T18:20:14.070826Z"}, {"uuid": "d92407fb-3033-4810-97c9-c4cf3383759f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69152", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/hlxnpa6jl7kfg", "content": "CVE-2026-69152 - brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation\nCVE ID : CVE-2026-69152\n \n Published : Aug. 3, 2026, 5:16 p.m. | 41\u00a0minutes ago\n \n Description : The brace-expansion library generates arbitrary strings containing ...", "creation_timestamp": "2026-08-03T18:26:13.143396Z"}, {"uuid": "a4013369-4e50-4079-b2a9-aacd084c2dfa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69153", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/gp5oyt6frvyqh", "content": "CVE-2026-69153 - PostCSS: incomplete fix of CVE-2026-45623 \u2014 attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset\nCVE ID : CVE-2026-69153\n \n Published : Aug. 3, 2026, 5:16 p.m. | 41\u00a0minutes ago\n \n Description : PostCSS takes a CSS file and provi...", "creation_timestamp": "2026-08-03T18:28:13.250893Z"}, {"uuid": "f73d90ae-d394-4298-b37a-9fd843e2d745", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69153", "type": "seen", "source": "https://gist.github.com/alon710/cea21195fa5b2fd7a130b5ccd15ff053", "content": "# CVE-2026-69153: CVE-2026-69153: Arbitrary File Read via Path Traversal in PostCSS\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69153\n\n## Summary\nA directory traversal and arbitrary file read vulnerability exists in PostCSS due to an incomplete fix of CVE-2026-45623. When parsing a CSS file containing a sourceMappingURL comment with the 'from' parameter unset, path traversal and absolute path validations are bypassed, enabling attackers to read arbitrary local .map files.\n\n## TL;DR\nPostCSS fails to validate sourceMappingURL paths when the 'from' option is omitted, allowing unauthenticated attackers to read arbitrary local .map files.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS v4.0**: 6.3\n- **Impact**: Confidentiality (Partial File Disclosure)\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications running server-side PostCSS compilation libraries without configuring the 'from' parameter.\n- **postcss**: < 8.5.19 (Fixed in: `8.5.19`)\n- **postcss**: >= 8.5.20 < 8.5.23 (Fixed in: `8.5.23`)\n\n## Mitigation\n\n- Upgrade PostCSS to version 8.5.19, 8.5.23 or newer.\n- Always set the 'from' option in options when running PostCSS on untrusted input.\n- WAF rules to filter or sanitize CSS files containing directory traversal indicators in sourceMappingURL.\n\n**Remediation Steps:**\n1. Run 'npm install postcss@latest' to update the dependency to the secure version.\n2. Inspect source code for usages of postcss().process() or postcss.parse().\n3. Verify that the 'from' option is configured with a valid path prefix on all input CSS parsing pipelines.\n\n## References\n\n- [NVD - CVE-2026-69153](https://nvd.nist.gov/vuln/detail/CVE-2026-69153)\n- [GitHub Security Advisory GHSA-fxqj-rqcc-2cmp](https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp)\n- [PostCSS 8.5.19 Release Notes](https://github.com/postcss/postcss/releases/tag/8.5.19)\n- [CVE.org - CVE-2026-69153](https://www.cve.org/CVERecord?id=CVE-2026-69153)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69153) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-03T18:31:17.253645Z"}, {"uuid": "885ff785-6e03-4d51-838c-0bf9b7d9e23d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-69153", "type": "published-proof-of-concept", "source": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp", "content": "", "creation_timestamp": "2026-08-03T18:35:03.587873Z"}, {"uuid": "6058a6b7-4a95-44d0-b666-274527705da6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69151", "type": "seen", "source": "https://gist.github.com/alon710/bdd530b55ab23396bc2ee2dc380962dc", "content": "# CVE-2026-69151: CVE-2026-69151: Stored Cross-Site Scripting (XSS) in Angular Compiler i18n Pipeline via Event-Handler Attributes\n\n> **CVSS Score:** 7.6\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69151\n\n## Summary\nA high-severity security vulnerability has been identified within the Angular compiler's internationalization (i18n) metadata collection and translation pipeline. Angular implements strict defenses against client-side execution injection by validating standard attribute and property bindings. However, when parsing elements containing both i18n translation attributes and inline event-handler elements (such as `i18n-onerror`), the compiler failed to assert the safety of the target attribute. Consequently, compromised or untrusted localization translation source files can supply arbitrary JavaScript payloads that replace static event-handler bindings. This arbitrary code is compiled directly into the localized build bundle and executed dynamically by the web browser, bypassing runtime sanitization, security checks, and standard binding constraints.\n\n## TL;DR\nAn input validation flaw in the Angular compiler's i18n translation metadata pipeline enables unauthenticated stored Cross-Site Scripting (XSS) when utilizing untrusted translation assets. Attackers who compromise translation databases or localization files can inject arbitrary JavaScript executable payloads into translated attributes like `i18n-onerror`. Standard Angular runtime property-binding security validations fail to catch this injection because the malicious payloads are rendered as static attributes in the compiled HTML document, enabling full client-side session compromise.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **Vulnerability Type**: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n- **Attack Vector**: Network / Content Supply Chain Injection\n- **Attack Complexity**: Low (No special conditions required)\n- **Authentication Requirements**: None (Requires access to influence external translation resources)\n- **CVSS v4.0 Base Score**: 7.6 (High)\n- **Exploit Status**: Proof-of-Concept (No known active exploitation in the wild)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Angular compiler (@angular/compiler)\n- Angular core runtime (@angular/core)\n- **@angular/compiler**: < 20.3.27 (Fixed in: `20.3.27`)\n- **@angular/compiler**: >= 21.0.0-next.0, < 21.2.19 (Fixed in: `21.2.19`)\n- **@angular/compiler**: >= 22.0.0-next.0, < 22.0.1 (Fixed in: `22.0.1`)\n- **@angular/core**: < 20.3.27 (Fixed in: `20.3.27`)\n- **@angular/core**: >= 21.0.0-next.0, < 21.2.19 (Fixed in: `21.2.19`)\n- **@angular/core**: >= 22.0.0-next.0, < 22.0.1 (Fixed in: `22.0.1`)\n\n## Mitigation\n\n- Upgrade Angular compiler and core libraries to patched versions (20.3.27, 21.2.19, or 22.0.1)\n- Audit existing HTML templates to ensure event handlers are never marked for translation via i18n-on* attributes\n- Treat translation metadata files (XLF, XLIFF, JSON) as high-risk assets and enforce strict code review pipelines\n- Enforce a rigorous Content Security Policy (CSP) that bans the 'unsafe-inline' script directive\n\n**Remediation Steps:**\n1. Open the project package.json file and identify the versions of @angular/compiler and @angular/core.\n2. Execute the update command matching your current release branch (e.g., 'npm install @angular/core@20.3.27 @angular/compiler@20.3.27' or corresponding yarn/pnpm equivalent).\n3. Configure static analysis linter rules to flag patterns matching i18n-on* attributes in template HTML structures.\n4. Validate the build logs post-upgrade to confirm that any accidental event-handler translation directives throw compile-time exceptions.\n\n## References\n\n- [NVD CVE Record - CVE-2026-69151](https://www.cve.org/CVERecord?id=CVE-2026-69151)\n- [GitHub Security Advisory GHSA-jj27-h5hq-8x99](https://github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99)\n- [Angular Git Core Fix Commit](https://github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865)\n- [Angular Git Follow-up Refinement Commit](https://github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69151) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-03T19:31:37.187220Z"}, {"uuid": "30cb15fb-7ceb-40ef-956a-ac8da0a465ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69151", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mschryfjmu2l", "content": "CVE-2026-69151 - angular.js\nPrior versions of Angular's compiler allowed a malicious translation file to inject executable JavaScript code into web applications. This could potentially\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#angularjs #canonical #UbuntuPro1604LTS #CVE #infosec", "creation_timestamp": "2026-08-05T02:22:04.349661Z"}]}