Skip to content

Commit acfcbcd

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-38c4-r59v-3vqw GHSA-cvhv-6xm6-c3v4 GHSA-g433-pq76-6cmf GHSA-cvhv-6xm6-c3v4
1 parent b0da1d5 commit acfcbcd

4 files changed

Lines changed: 199 additions & 40 deletions

File tree

advisories/unreviewed/2026/02/GHSA-38c4-r59v-3vqw/GHSA-38c4-r59v-3vqw.json renamed to advisories/github-reviewed/2026/02/GHSA-38c4-r59v-3vqw/GHSA-38c4-r59v-3vqw.json

Lines changed: 31 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-38c4-r59v-3vqw",
4-
"modified": "2026-02-12T06:30:13Z",
4+
"modified": "2026-02-13T20:04:39Z",
55
"published": "2026-02-12T06:30:13Z",
66
"aliases": [
77
"CVE-2026-2327"
88
],
9+
"summary": "markdown-it is has a Regular Expression Denial of Service (ReDoS)",
910
"details": "Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\\*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.",
1011
"severity": [
1112
{
@@ -14,10 +15,30 @@
1415
},
1516
{
1617
"type": "CVSS_V4",
17-
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"
19+
}
20+
],
21+
"affected": [
22+
{
23+
"package": {
24+
"ecosystem": "npm",
25+
"name": "markdown-it"
26+
},
27+
"ranges": [
28+
{
29+
"type": "ECOSYSTEM",
30+
"events": [
31+
{
32+
"introduced": "13.0.0"
33+
},
34+
{
35+
"fixed": "14.1.1"
36+
}
37+
]
38+
}
39+
]
1840
}
1941
],
20-
"affected": [],
2142
"references": [
2243
{
2344
"type": "ADVISORY",
@@ -31,9 +52,13 @@
3152
"type": "WEB",
3253
"url": "https://gist.github.com/ltduc147/c9abecae1b291ede4f692f2ab988c917"
3354
},
55+
{
56+
"type": "PACKAGE",
57+
"url": "https://github.com/markdown-it/markdown-it"
58+
},
3459
{
3560
"type": "WEB",
36-
"url": "https://github.com/markdown-it/markdown-it/blob/14.1.0/lib/rules_inline/linkify.mjs%23L33"
61+
"url": "https://github.com/markdown-it/markdown-it/blob/14.1.0/lib/rules_inline/linkify.mjs#L33"
3762
},
3863
{
3964
"type": "WEB",
@@ -45,8 +70,8 @@
4570
"CWE-1333"
4671
],
4772
"severity": "MODERATE",
48-
"github_reviewed": false,
49-
"github_reviewed_at": null,
73+
"github_reviewed": true,
74+
"github_reviewed_at": "2026-02-13T20:04:39Z",
5075
"nvd_published_at": "2026-02-12T06:16:02Z"
5176
}
5277
}

‎advisories/github-reviewed/2026/02/GHSA-cvhv-6xm6-c3v4/GHSA-cvhv-6xm6-c3v4.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cvhv-6xm6-c3v4",
4+
"modified": "2026-02-13T20:04:56Z",
5+
"published": "2026-02-13T03:31:23Z",
6+
"aliases": [
7+
"CVE-2026-1721"
8+
],
9+
"summary": "Cloudflare Agents is Vulnerable to Reflected Cross-Site Scripting in the AI Playground's OAuth callback handler",
10+
"details": "Summary\n\nA Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the AI Playground's OAuth callback handler. The `error_description` query parameter was directly interpolated into an HTML script tag without proper escaping, allowing attackers to execute arbitrary JavaScript in the context of the victim's session.\n\nRoot cause\n\nThe OAuth callback handler in `site/ai-playground/src/server.ts` directly interpolated the `authError` value, sourced from the `error_description` query parameter, into an inline `<script>` tag.\n\nImpact\n\nAn attacker could craft a malicious link that, when clicked by a victim, would:\n\n * Steal user chat message history - Access all LLM interactions stored in the user's session.\n\n\n * Access connected MCP Servers - Interact with any MCP servers connected to the victim's session (public or authenticated/private), potentially allowing the attacker to perform actions on the victim's behalf\n\n\nMitigation:\n\n * PR:  https://github.com/cloudflare/agents/pull/841 https://github.com/cloudflare/agents/pull/841 \n * Agents-sdk users should upgrade to agents@0.3.10\n * Developers using configureOAuthCallback with custom error handling in their own applications should ensure all user-controlled input is escaped before interpolation.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "agents"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.3.10"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1721"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/cloudflare/agents/pull/841"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/cloudflare/agents/commit/3f490d045844e4884db741afbb66ca1fe65d4093"
50+
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/cloudflare/agents"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-79"
59+
],
60+
"severity": "MODERATE",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-02-13T20:04:55Z",
63+
"nvd_published_at": "2026-02-13T03:15:52Z"
64+
}
65+
}

‎advisories/github-reviewed/2026/02/GHSA-g433-pq76-6cmf/GHSA-g433-pq76-6cmf.json‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-g433-pq76-6cmf",
4+
"modified": "2026-02-13T20:05:10Z",
5+
"published": "2026-02-13T20:05:10Z",
6+
"aliases": [],
7+
"summary": "Bug fixes in hpke-rs, hpke-rs-rust-crypto",
8+
"details": "We publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the hpke-rs and hpke-rs-rust-crypto crates contain the following bug-fixes:\n\n## hpke-rs\n- [#127](https://github.com/cryspen/hpke-rs/pull/127): Fix `KemAlgorithm::TryFrom<u16>` mapping where `0x004D` incorrectly resolved to `XWingDraft06` instead of `XWingDraft06Obsolete`.\n- [#123](https://github.com/cryspen/hpke-rs/pull/123): Fix potential overflow in context counter and switch to use u64.\n- [#128](https://github.com/cryspen/hpke-rs/pull/128): Return errors when trying to use open/seal with export only ciphersuite and when using kdf export with an output that's too long (instead of truncating it)\n\nThe issue fixed in #123 was first reported by Nadim Kobeissi.\nThe issues fixed in #127 and #128 were first reported by Scott Arciszewski.\n\n## hpke-rs-rust-crypto\n- [#124](https://github.com/cryspen/hpke-rs/pull/124): Error out on x25519 0 keys\n\nThe issue fixed in #124 was first reported by Nadim Kobeissi.",
9+
"severity": [],
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "crates.io",
14+
"name": "hpke-rs"
15+
},
16+
"ranges": [
17+
{
18+
"type": "ECOSYSTEM",
19+
"events": [
20+
{
21+
"introduced": "0"
22+
},
23+
{
24+
"fixed": "0.6.0"
25+
}
26+
]
27+
}
28+
]
29+
},
30+
{
31+
"package": {
32+
"ecosystem": "crates.io",
33+
"name": "hpke-rs-rust-crypto"
34+
},
35+
"ranges": [
36+
{
37+
"type": "ECOSYSTEM",
38+
"events": [
39+
{
40+
"introduced": "0"
41+
},
42+
{
43+
"fixed": "0.6.0"
44+
}
45+
]
46+
}
47+
]
48+
}
49+
],
50+
"references": [
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/cryspen/hpke-rs/security/advisories/GHSA-g433-pq76-6cmf"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://github.com/cryspen/hpke-rs/pull/123"
58+
},
59+
{
60+
"type": "WEB",
61+
"url": "https://github.com/cryspen/hpke-rs/pull/124"
62+
},
63+
{
64+
"type": "WEB",
65+
"url": "https://github.com/cryspen/hpke-rs/pull/127"
66+
},
67+
{
68+
"type": "WEB",
69+
"url": "https://github.com/cryspen/hpke-rs/pull/128"
70+
},
71+
{
72+
"type": "WEB",
73+
"url": "https://github.com/cryspen/hpke-rs/commit/1c247b5c9aeca602ad2971c9bd49817fe2c308e6"
74+
},
75+
{
76+
"type": "WEB",
77+
"url": "https://github.com/cryspen/hpke-rs/commit/25248bd624cc0325c98a05c169a0c9aa0aced632"
78+
},
79+
{
80+
"type": "WEB",
81+
"url": "https://github.com/cryspen/hpke-rs/commit/3a8254938f43bdc4e0c9c4f987f8071f19779066"
82+
},
83+
{
84+
"type": "WEB",
85+
"url": "https://github.com/cryspen/hpke-rs/commit/b54c8bb83906331bdf4f606cafa30cd7fd20b531"
86+
},
87+
{
88+
"type": "PACKAGE",
89+
"url": "https://github.com/cryspen/hpke-rs"
90+
}
91+
],
92+
"database_specific": {
93+
"cwe_ids": [
94+
"CWE-190",
95+
"CWE-20",
96+
"CWE-697"
97+
],
98+
"severity": "MODERATE",
99+
"github_reviewed": true,
100+
"github_reviewed_at": "2026-02-13T20:05:10Z",
101+
"nvd_published_at": null
102+
}
103+
}

‎advisories/unreviewed/2026/02/GHSA-cvhv-6xm6-c3v4/GHSA-cvhv-6xm6-c3v4.json‎

Lines changed: 0 additions & 34 deletions
This file was deleted.

0 commit comments

Comments
 (0)