i18next-http-backend incomplete URL validation permits SSRF

CVE-2026-105800

There is an SSRF vulnerability when using `i18next-http-backend`. A colon in an attacker-controlled language value can m

历史摘要 · 未重新核验 · GitHub Advisory

LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values

CVE-2026-105799

## Summary `@langchain/redis` did not properly escape values used to construct structured RediSearch TAG and TEXT filte

历史摘要 · 未重新核验 · GitHub Advisory

simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection

CVE-2026-102829

# Security control bypass in `@simple-git/argv-parser`: Git's `VISUAL` editor fallback is not classified as `allowUnsafe

历史摘要 · 未重新核验 · GitHub Advisory

simple-git unsafe-operation guard does not block trailer command configuration

CVE-2026-102828

## Affected product The default `blockUnsafeOperationsPlugin` in `simple-git` when an application permits untrusted val

历史摘要 · 未重新核验 · GitHub Advisory

simple-git allows command execution through unblocked Git configuration includes

CVE-2026-102826

## Summary An OS command injection vulnerability in `git.clone()` allows any application that flows attacker-influenced

历史摘要 · 未重新核验 · GitHub Advisory

simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

CVE-2026-102827

simple-git's blockUnsafeOperationsPlugin blocks dangerous git options (--upload-pack/--receive-pack/--exec/...) unless t

历史摘要 · 未重新核验 · GitHub Advisory

Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

CVE-2026-102600

### Impact This is a **prototype pollution / improper client lookup** vulnerability in `@socket.io/cluster-engine`. Se

历史摘要 · 未重新核验 · GitHub Advisory

DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes

## Environment - dompurify 3.4.15 (current npm release); reproduced independently on jsdom 30.0.1 and 29.1.1 (Node.js 2

历史摘要 · 未重新核验 · GitHub Advisory

smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line

### Summary `parse()` has a quadratic-time path in `parseKey`, reachable on default options with ordinary valid input.

历史摘要 · 未重新核验 · GitHub Advisory

KaTeX: Existing prototype pollution can bypass trust restrictions

CVE-2026-103923

### Impact KaTeX can act as a read-side prototype pollution gadget in applications where `Object.prototype` has already

历史摘要 · 未重新核验 · GitHub Advisory

Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)

CVE-2026-104846

A fulfilled Promise node deserialized by `fromJSON()` can trigger unintended invocation of a plugin-produced callable th

历史摘要 · 未重新核验 · GitHub Advisory

Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization

CVE-2026-104845

# Summary deserializeTypedArray casts the source node to ArrayBuffer without checking it and never bounds the element c

历史摘要 · 未重新核验 · GitHub Advisory

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

CVE-2026-90711

### Impact `proxy-addr` determines which network hops are trusted proxies so that `X-Forwarded-For` can be believed. Wh

历史摘要 · 未重新核验 · GitHub Advisory

@nx/docker: OS command injection in the @nx/docker release pipeline

CVE-2026-104859

## Summary The `@nx/docker` release pipeline builds its `docker` invocations as shell command strings, interpolating `r

历史摘要 · 未重新核验 · GitHub Advisory

Nx: OS command injection via git revisions and remote refs

## Summary Nx core builds several `git` invocations as shell command strings with untrusted values interpolated into th

历史摘要 · 未重新核验 · GitHub Advisory

Nx daemon and plugin worker sockets are accessible to other local users

CVE-2026-104854

## Summary Nx creates the Unix domain sockets for its daemon and its plugin workers in a shared temporary directory wit

历史摘要 · 未重新核验 · GitHub Advisory

Nx: Path traversal in nx migrate package-migrations extraction

CVE-2026-104853

## Summary `nx migrate` reads each target package's `nx-migrations.migrations` value from its manifest and extracts the

历史摘要 · 未重新核验 · GitHub Advisory

compression vulnerable to Denial of Service via memory leak on premature response close

CVE-2026-87776

### Impact A vulnerability in compression `< 1.8.2` allows an attacker to trigger a Denial of Service (DoS) by disconne

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Channel read actions could skip target allowlists

### Summary Channel read actions could skip target allowlists. In affected versions, explicit read targets in Microsoft

历史摘要 · 未重新核验 · GitHub Advisory

vm2: NodeVM custom resolution bypasses external path boundaries

CVE-2026-100721

## Summary At source revision `91034466bfb7f56b95fd48083ec6ca36d058f164` of vm2 3.11.8, an untrusted `NodeVM` guest can

历史摘要 · 未重新核验 · GitHub Advisory