Labs
Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.
- highCVE-2026-83616
CVE-2026-83616: @xmldom/xmldom Processing Instruction Target Injection
A missing validation in @xmldom/xmldom lets an attacker embed a '>' character in a processing-instruction target, breaking the PI boundary during serialization and injecting arbitrary XML or script…
- highCVE-2026-83613
CVE-2026-83613: @xmldom/xmldom Quadratic-Time Attribute Deduplication DoS
Parsing a single XML element with a large number of distinct attributes causes @xmldom/xmldom to burn CPU time quadratically, letting an attacker stall a Node.js server with a small, well-formed…
- highCVE-2026-83618
CVE-2026-83618: @xmldom/xmldom requireWellFormed DocType Injection Bypass via Embedded Line Terminator
A newline character inside a publicId or systemId silently passes xmldom's well-formed serializer check and lets attackers inject arbitrary markup into the DOCTYPE declaration, defeating the…
- highCVE-2026-83609
CVE-2026-83609: @xmldom/xmldom XML Injection via Line Terminator in QName Validation
A newline character inside an XML element or attribute name tricks xmldom's name validator into accepting malformed input, letting an attacker inject raw markup into serialized XML output.
- highCVE-2026-83617
CVE-2026-83617: @xmldom/xmldom requireWellFormed QName Check Bypass via Embedded Line Terminator
A multiline flag on xmldom's internal regex lets an element or attribute name containing a newline slip past the requireWellFormed serializer check, allowing XML injection even when callers…
- criticalCVE-2026-84372
CVE-2026-84372: predis/predis Redis Command Injection via CRLF Smuggling in Pipelined Commands
Predis 3.x lets an attacker smuggle arbitrary Redis commands into a pipeline by embedding CRLF sequences in any key or value, enabling shard-wide cache wipes, data theft, and denial of service on…
- highCVE-2026-83612
CVE-2026-83612: @xmldom/xmldom HTML Raw-Text Closing-Tag Case Mismatch DoS
A tiny crafted HTML document with mixed-case closing tags on script, style, textarea, or title elements causes @xmldom/xmldom to produce output that grows quadratically, exhausting CPU and memory in…
- highCVE-2026-84382
CVE-2026-84382: httpx2 Decompression Amplification (CWE-409)
httpx2 fully inflated each compressed network chunk before passing data to the application, so a malicious server could exhaust a client process's memory with a tiny compressed response, even when…
- criticalCVE-2026-85061
CVE-2026-85061: maplibre-gl XSS Sanitizer Bypass via Live NamedNodeMap Iteration
A bug in MapLibre GL JS's HTML sanitizer lets attackers sneak a JavaScript event handler past the attribute-removal loop by placing two dangerous attributes back-to-back, leading to zero-click script…
- criticalCVE-2026-75604
CVE-2026-75604: Next.js Unauthenticated RCE via Windows Cache Path Traversal
A missing backslash escape in Next.js's filesystem cache lets unauthenticated attackers on Windows-hosted servers walk outside the cache directory, steal the Server Action encryption key, and execute…
- highCVE-2026-83606
CVE-2026-83606: @xmldom/xmldom Processing Instruction ReDoS
Sending a single crafted XML document with an unterminated processing instruction and a long whitespace run to any Node.js server using @xmldom/xmldom 0.9.x can stall the event loop for seconds…
- highCVE-2026-84374
CVE-2026-84374: Laravel Excel (maatwebsite/excel) Path Traversal File Overwrite
Laravel Excel lets an attacker overwrite any file the PHP process can write to, including PHP source files, because the export path is resolved against the server filesystem instead of the configured…