Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-80206

  CVE-2026-80206: NLTK tgrep Regular Expression Denial of Service

  NLTK's tgrep module passes user-supplied regex patterns directly to Python's re engine with no timeout, letting an attacker hang the entire process with a single crafted tree-search query.

• highCVE-2026-50646

  CVE-2026-50646: .NET WPF XAML Parser Remote Code Execution

  Certain internal XAML load paths in Windows Presentation Foundation skip the type-safe reader, letting a crafted XAML document instantiate dangerous types like ObjectDataProvider and execute…

• highCVE-2026-83607

  CVE-2026-83607: @xmldom/xmldom Element Name Injection via createElement()

  Passing any string to createElement() in @xmldom/xmldom lets an attacker inject arbitrary attributes and event handlers into serialized XML or HTML output, bypassing the requireWellFormed: true…

• highCVE-2026-83605

  CVE-2026-83605: @xmldom/xmldom Attribute Name Injection via setAttribute()

  A flaw in @xmldom/xmldom lets an attacker smuggle extra HTML attributes, including event handlers like onclick, into serialized XML output by passing a crafted string as an attribute name to…

• criticalCVE-2026-77635

  CVE-2026-77635: CakePHP FunctionsBuilder::jsonValue() SQL Injection via PostgreSQL Driver

  CakePHP's jsonValue() query helper lets attackers inject arbitrary SQL when using the PostgreSQL driver, because the JSON path argument is concatenated directly into the query string instead of being…

• highCVE-2026-77634

  CVE-2026-77634: CakePHP SmtpTransport CRLF Header Injection

  CakePHP's SMTP mailer passes user-supplied header values to the mail server without stripping carriage-return and line-feed characters, letting an attacker inject arbitrary email headers.

• highCVE-2026-83614

  CVE-2026-83614: @xmldom/xmldom Quadratic-Time Parsing ReDoS (DoS)

  A crafted XML document of just tens of kilobytes can stall a Node.js server for multiple seconds because xmldom's error-recovery path and its normalize() call both do quadratic work on malformed…

• highCVE-2026-84370

  CVE-2026-84370: svgo removeScripts Plugin XSS via Namespace and Control-Character Bypass

  SVGO's removeScripts plugin could be tricked into leaving executable JavaScript links intact by using a namespace-prefixed SVG anchor or hiding a javascript: URL behind an embedded tab or newline…

• critical

  Next.js: Unauthenticated Remote Code Execution via AVIF Image Optimization (CVE-2026-84383 / libheif)

  A crafted AVIF image sent to Next.js's built-in image optimizer triggers a heap buffer overflow deep in the libheif C library, letting a remote attacker execute arbitrary code on the server without…

• highCVE-2026-84445

  CVE-2026-84445: gRPC-Go xDS Server Denial of Service via Missing :authority Header

  gRPC-Go servers using the xDS API crash and terminate when an attacker sends an HTTP/2 request that omits both the :authority pseudo-header and the Host header, taking down the entire service.

• critical

  Astro: Remote Code Execution via Malicious AVIF Image Optimization

  Astro's built-in image optimizer passes AVIF files to Sharp, which uses a vulnerable libheif version that can be exploited to execute arbitrary code on the server by sending a specially crafted AVIF…

• high

  @tiptap/core Quadratic ReDoS in Markdown Attribute Parsing

  Two regular expressions in @tiptap/core's Markdown parsers have quadratic backtracking behavior, letting an attacker freeze a browser tab or stall a Node.js server with a few kilobytes of crafted…