JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)
CVE-2026-73417
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit
#cwe-116
共收录 223 条相关情报。
← 返回所有主题gdu fails to strip terminal escape sequences from directory and file names when printing paths...
CVE-2026-73480
gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers
gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing e...
CVE-2026-73480
gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers
dua-cli Terminal Escape Sequence Injection via Marked Paths
CVE-2026-73479
dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attac
HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be accepted by the app...
CVE-2025-62315
HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validatio
Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape ~ after : or = when applicati...
CVE-2026-73411
Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/u
is affected by an Improper Encoding or Escaping of Output vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerabili...
CVE-2026-48376
is affected by an Improper Encoding or Escaping of Output vulnerability that could result in a Security feature bypass.
SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0, the minifyJson processing in crates/swc_ht...
CVE-2026-72925
SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swc_html_mi
Affected versions of cti-transmute improperly handle conversion-table values passed through the search highlighting feature. The highlight() function previously returned the und...
CVE-2026-73161
Affected versions of cti-transmute improperly handle conversion-table values passed through the search highlighting feat
Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields such as event IDs, ...
CVE-2026-73157
Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface usi
GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printe...
CVE-2026-66486
GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When list
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of we...
CVE-2026-70609
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7,
MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in \text{} and \mbox{} commands in Box.toMarkup at src/...
CVE-2026-54705
MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode conten
mathlive's Lack of Escaping of HTML allows for XSS
CVE-2026-54705
### Summary Despite the 0.104.0 patch escaping attribute-bearing constructs (`\htmlData`, `\href`), text-content reflec
diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application only strips ANSI SGR sequences while allowing other cont...
CVE-2026-50642
diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application
Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is app...
CVE-2026-59727
Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, trans
Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands
CVE-2026-59727
Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, trans
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may...
CVE-2026-64647
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 thr
Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies
CVE-2026-64647
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 thr
Shescape: Home-directory disclosure in assignment context on Unix with Dash
### Impact This impacts users of Shescape on Unix systems that explicitly configure `shell` to Dash, or `true` when the