Skip to content

Commit 6c09dc8

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-4q3h-vp4r-prv2 GHSA-mphv-75cg-56wg GHSA-v9fg-3cr2-277j
1 parent 2a33903 commit 6c09dc8

3 files changed

Lines changed: 252 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/02/GHSA-4q3h-vp4r-prv2/GHSA-4q3h-vp4r-prv2.json‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4q3h-vp4r-prv2",
4+
"modified": "2026-02-25T23:00:49Z",
5+
"published": "2026-02-25T23:00:49Z",
6+
"aliases": [
7+
"CVE-2026-27804"
8+
],
9+
"summary": "Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter",
10+
"details": "### Impact\n\nAn unauthenticated attacker can forge a Google authentication token with `alg: \"none\"` to log in as any user linked to a Google account, without knowing their credentials. All deployments with Google authentication enabled are affected.\n\n### Patches\n\nThe fix hardcodes the expected `RS256` algorithm instead of trusting the JWT header, and replaces the Google adapter's custom key fetcher with `jwks-rsa` which rejects unknown key IDs.\n\n### Workarounds\n\nDisable Google authentication until you can upgrade.\n\n### References\n\n- GitHub advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-4q3h-vp4r-prv2\n- Fixed in Parse Server 9.3.1-alpha.4: https://github.com/parse-community/parse-server/releases/tag/9.3.1-alpha.4\n- Fixed in Parse Server 8.6.3: https://github.com/parse-community/parse-server/releases/tag/8.6.3",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "parse-server"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "9.0.0"
29+
},
30+
{
31+
"fixed": "9.3.1-alpha.4"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 9.3.1-alpha.3"
38+
}
39+
},
40+
{
41+
"package": {
42+
"ecosystem": "npm",
43+
"name": "parse-server"
44+
},
45+
"ranges": [
46+
{
47+
"type": "ECOSYSTEM",
48+
"events": [
49+
{
50+
"introduced": "0"
51+
},
52+
{
53+
"fixed": "8.6.3"
54+
}
55+
]
56+
}
57+
],
58+
"database_specific": {
59+
"last_known_affected_version_range": "<= 8.6.2"
60+
}
61+
}
62+
],
63+
"references": [
64+
{
65+
"type": "WEB",
66+
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-4q3h-vp4r-prv2"
67+
},
68+
{
69+
"type": "WEB",
70+
"url": "https://github.com/parse-community/parse-server/commit/9b94083accb7f3e72c6b8126c195c7a03dd2dfd7"
71+
},
72+
{
73+
"type": "WEB",
74+
"url": "https://github.com/parse-community/parse-server/commit/9d5942d50e55c822924c27b05aa98f1393e7a330"
75+
},
76+
{
77+
"type": "PACKAGE",
78+
"url": "https://github.com/parse-community/parse-server"
79+
},
80+
{
81+
"type": "WEB",
82+
"url": "https://github.com/parse-community/parse-server/releases/tag/8.6.3"
83+
},
84+
{
85+
"type": "WEB",
86+
"url": "https://github.com/parse-community/parse-server/releases/tag/9.3.1-alpha.4"
87+
}
88+
],
89+
"database_specific": {
90+
"cwe_ids": [
91+
"CWE-327",
92+
"CWE-345"
93+
],
94+
"severity": "CRITICAL",
95+
"github_reviewed": true,
96+
"github_reviewed_at": "2026-02-25T23:00:49Z",
97+
"nvd_published_at": null
98+
}
99+
}

‎advisories/github-reviewed/2026/02/GHSA-mphv-75cg-56wg/GHSA-mphv-75cg-56wg.json‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mphv-75cg-56wg",
4+
"modified": "2026-02-25T22:59:48Z",
5+
"published": "2026-02-25T22:59:48Z",
6+
"aliases": [
7+
"CVE-2026-27795"
8+
],
9+
"summary": "LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader",
10+
"details": "## Summary\nA redirect-based Server-Side Request Forgery (SSRF) bypass exists in `RecursiveUrlLoader` in `@langchain/community`. The loader validates the initial URL but allows the underlying fetch to follow redirects automatically, which permits a transition from a safe public URL to an internal or metadata endpoint without revalidation. This is a bypass of the SSRF protections introduced in 1.1.14 (CVE-2026-26019).\n\n## Affected Component\n- Package: `@langchain/community`\n- Component: `RecursiveUrlLoader`\n- Configuration: `preventOutside` (default: `true`) is insufficient to prevent this bypass when redirects are followed automatically.\n\n## Description\n`RecursiveUrlLoader` is a web crawler that recursively follows links from a starting URL. The existing SSRF mitigation validates the initial URL before fetching, but it does not re-validate when the request follows redirects. Because fetch follows redirects by default, an attacker can supply a public URL that passes validation and then redirects to a private network address, localhost, or cloud metadata endpoint.\n\nThis constitutes a “check‑then‑act” gap in the request lifecycle: the safety check occurs before the redirect chain is resolved, and the final destination is never validated.\n\n## Impact\nIf an attacker can influence content on a page being crawled (e.g., user‑generated content, untrusted external pages), they can cause the crawler to:\n- Fetch cloud instance metadata (AWS, GCP, Azure), potentially exposing credentials or tokens\n- Access internal services on private networks (`10.x`, `172.16.x`, `192.168.x`)\n- Connect to localhost services\n- Exfiltrate response data through attacker-controlled redirect chains\n\nThis is exploitable in any environment where `RecursiveUrlLoader` runs with access to internal networks or metadata services, which includes most cloud-hosted deployments.\n\n## Attack Scenario\n1. The crawler is pointed at a public URL that passes initial SSRF validation.\n2. That URL responds with a 3xx redirect to an internal target.\n3. The fetch follows the redirect automatically without revalidation.\n4. The crawler accesses the internal or metadata endpoint.\n\nExample redirector:\n```\nhttps://302.r3dir.me/--to/?url=http://169.254.169.254/latest/meta-data/\n```\n\n## Root Cause\n- SSRF validation (`validateSafeUrl`) is only performed on the initial URL.\n- Redirects are followed automatically by fetch (`redirect: \"follow\"` default), so the request can change destinations without additional validation.\n\n## Resolution\nUpgrade to `@langchain/community` **>= 1.1.18**, which validates every redirect hop by disabling automatic redirects and re-validating `Location` targets before following them.\n- Automatic redirects are disabled (`redirect: \"manual\"`).\n- Each 3xx `Location` is resolved and validated with `validateSafeUrl()` before the next request.\n- A maximum redirect limit prevents infinite loops.\n\n## Reources\n- Original SSRF fix (CVE-2026-26019): enforced origin comparison and added initial URL validation\n- https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-gf3v-fwqg-4vh7",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "@langchain/community"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.1.18"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 1.1.17"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-gf3v-fwqg-4vh7"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-mphv-75cg-56wg"
49+
},
50+
{
51+
"type": "ADVISORY",
52+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27795"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://github.com/langchain-ai/langchainjs/pull/9990"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/langchain-ai/langchainjs/commit/2812d2b2b9fd9343c4850e2ab906b8cf440975ee"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://github.com/langchain-ai/langchainjs/commit/d5e3db0d01ab321ec70a875805b2f74aefdadf9d"
65+
},
66+
{
67+
"type": "PACKAGE",
68+
"url": "https://github.com/langchain-ai/langchainjs"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://github.com/langchain-ai/langchainjs/releases/tag/%40langchain%2Fcommunity%401.1.14"
73+
},
74+
{
75+
"type": "WEB",
76+
"url": "https://github.com/langchain-ai/langchainjs/releases/tag/%40langchain%2Fcommunity%401.1.18"
77+
}
78+
],
79+
"database_specific": {
80+
"cwe_ids": [
81+
"CWE-918"
82+
],
83+
"severity": "MODERATE",
84+
"github_reviewed": true,
85+
"github_reviewed_at": "2026-02-25T22:59:48Z",
86+
"nvd_published_at": "2026-02-25T18:23:41Z"
87+
}
88+
}

‎advisories/github-reviewed/2026/02/GHSA-v9fg-3cr2-277j/GHSA-v9fg-3cr2-277j.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-v9fg-3cr2-277j",
4+
"modified": "2026-02-25T23:00:18Z",
5+
"published": "2026-02-25T23:00:18Z",
6+
"aliases": [
7+
"CVE-2026-27822"
8+
],
9+
"summary": "Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover",
10+
"details": "### Summary\nA Stored Cross-Site Scripting (XSS) vulnerability in the RustFS Console allows an attacker to execute arbitrary JavaScript in the context of the management console. By bypassing the PDF preview logic, an attacker can steal administrator credentials from `localStorage`, leading to full account takeover and system compromise.\n\n### Details\nThe vulnerability exists due to improper validation of the response content type during the file preview process and a lack of origin separation between the S3 object delivery and the management console.\n\n1. **Origin of Credentials**: The RustFS Console stores highly sensitive S3 credentials (AccessKey, SecretKey, SessionToken) in the browser's `localStorage`.\n - **File**: `console/composables/useAuth.ts`\n - **Evidence**: [Lines 14](https://github.com/rustfs/console/blob/c2bd75adacad0d0182c32d5271e8ff150c4a02db/composables/useAuth.ts#L14) and [18-25](https://github.com/rustfs/console/blob/c2bd75adacad0d0182c32d5271e8ff150c4a02db/composables/useAuth.ts#L18-L25) show that credentials are held in `useLocalStorage('auth.credentials', {})` and `useLocalStorage('auth.permanent', undefined)`.\n2. **Insecure Preview Implementation**: In `console/components/object/preview-modal.vue`, the application identifies a PDF file based on its extension or metadata and [renders it using an `<iframe>`](https://github.com/rustfs/console/blob/6ab024be1c49bc9549a24ed1d09348f5e7039876/components/object/preview-modal.vue#L10).\n3. **Same-Origin Vulnerability**: RustFS typically hosts the management console and the S3 API on the same origin (e.g., the same IP and port). \n4. **Bypass Attack**: An attacker can upload a file named `xss.pdf` but set its `Content-Type` metadata to `text/html`. Because the `iframe` is hosted on the same origin as the console, the executed script has unrestricted access to the parent window's `localStorage`.\n\n### PoC\n<img width=\"6006\" height=\"3096\" alt=\"CleanShot 2026-02-01 at 18 36 54@2x\" src=\"https://github.com/user-attachments/assets/f2f5dae6-1e19-4133-9a69-f7d8ec604dad\" />\n\nThis PoC demonstrates how to steal a victim's administrative credentials by tricking them into previewing a malicious file.\n\n**1. Create the malicious payload (`xss.html`):**\n```html\n<script>\n alert('XSS Success!\\nLocalStorage Data: ' + JSON.stringify(window.parent.localStorage));\n</script>\n```\n\n**2. Setup the environment and upload the payload:**\n```bash\n# 1. Create a target bucket\nmc mb rustfs/my-bucket\n\n# 2. Upload the HTML file as a PDF with HTML content type\nmc cp xss.html rustfs/my-bucket/xss.pdf --attr \"Content-Type=text/html\"\n```\n\n**3. Trigger the vulnerability:**\n1. Login to the RustFS Console as an administrator.\n2. Navigate to `my-bucket`.\n3. Click the \"Preview\" button for the `xss.pdf` file.\n4. The JavaScript executes, demonstrating access to the administrative session data.\n\n### Impact\n- **Character**: Stored Cross-Site Scripting (XSS).\n- **Target**: System Administrators using the Console.\n- **Result**: Full Account Takeover (ATO). An attacker gains the victim's `AccessKeyId`, `SecretAccessKey`, and `SessionToken`. This allows the attacker to perform any administrative action, including deleting data, creating backdoors, or downloading the entire filesystem via the S3 API.\n\n### Proposed Mitigation\n1. **Origin Separation**: Implement a dedicated domain for data delivery (e.g., `*.data.rustfs.io`) that is different from the console domain. This leverages the Same-Origin Policy (SOP) to isolate user-uploaded content.\n2. **Security Headers**: Implement strict security headers in the backend:\n - `Content-Security-Policy (CSP)`: Disallow inline scripts and restrict script execution.\n - `X-Content-Type-Options: nosniff`: Prevent browsers from sniffing and executing content that differs from the declared type.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "crates.io",
21+
"name": "rustfs"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.0.0-alpha.83"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/rustfs/rustfs/security/advisories/GHSA-v9fg-3cr2-277j"
42+
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27822"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/rustfs/rustfs"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.83"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-79"
59+
],
60+
"severity": "CRITICAL",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-02-25T23:00:18Z",
63+
"nvd_published_at": "2026-02-25T03:16:07Z"
64+
}
65+
}

0 commit comments

Comments
 (0)