漏洞公告

Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records

Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)

React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

AWS CDK CodeBuild S3 Log Encryption Boolean Inversion

@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

@fastify/static vulnerable to route guard bypass via path traversal

GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution

GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks

GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)

node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection

PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer

Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)

GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)

Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)

@backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass

ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit builds

ImageMagick: Heap Buffer Over-Write in fx operation

ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided

PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path

Trix: Stored XSS via HTMLParser attribute injection on paste

Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

Valibot: record() issue paths can make flatten() throw for inherited Object property names