Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-63490

  CVE-2026-63490: handlebars-springmvc Arbitrary File Read via URL Fragment Suffix Bypass

  A Spring MVC application using Handlebars as its view engine can be tricked into reading any file on the server just by adding a '#' character to a user-controlled view name, bypassing the only…

• highCVE-2026-62677

  CVE-2026-62677: Omnigent Path Traversal via Unvalidated os_env.cwd in Agent Bundle

  Any authenticated Omnigent user can upload an agent bundle that sets its working directory to an arbitrary host path, giving the agent read and write access to the entire runner filesystem and…

• highCVE-2026-62669

  CVE-2026-62669: Grav CMS 2FA Bypass via Unauthenticated Secret Rotation

  Grav CMS lets an attacker who knows a victim's password silently rotate their TOTP secret during login, compute a valid code from the new secret, and log in as that user, completely bypassing…

• highCVE-2026-61704

  CVE-2026-61704: link-preview-js DNS Rebinding SSRF Bypass

  link-preview-js versions up to 4.0.3 let an attacker bypass the documented SSRF protection by controlling DNS so the first resolution returns a public IP (passing the check) and the second returns an…

• highCVE-2026-62388

  CVE-2026-62388: NLTK pathsec Insecure Default Allows Security Bypass

  NLTK's security module defaults to a warn-only mode, meaning path traversal and pickle deserialization protections silently allow attacks through instead of blocking them.

• highCVE-2026-76172

  CVE-2026-76172: fast-uri Host Confusion via Percent-Encoded Scheme Normalization

  fast-uri decodes percent-encoded characters in the URI scheme using the legacy unescape() function and writes the decoded result back verbatim, letting an attacker craft a scheme that becomes…

• highCVE-2026-75899

  CVE-2026-75899: fast-uri SSRF via Double Hostname Percent-Decoding

  A double-decoding bug in fast-uri lets an attacker disguise an internal address like localhost inside nested percent-encoding, so it passes host-allowlist checks but resolves to the real internal…

• highCVE-2026-75975

  CVE-2026-75975: fast-uri SSRF via Malformed IPv6 Normalization

  A malformed IPv6 address in a URL fed to fast-uri's normalize() function is silently rewritten into a valid private or loopback address, letting an attacker bypass host-policy checks and trigger…

• highCVE-2026-75931

  CVE-2026-75931: fast-uri Host Confusion via Skipped IDN Canonicalization on Scheme-Relative References

  fast-uri skips Unicode hostname conversion when resolving scheme-relative URLs like //attacker.com against a real base, so an app can allowlist one host and silently reach a completely different one.

• high

  CVE-2026-80206: nltk tgrep ReDoS via User-Supplied Regex

  Passing a crafted tgrep pattern to NLTK's tree-search functions lets an attacker embed a pathological regular expression that pins the Python process at 100% CPU indefinitely.

• criticalCVE-2026-71866

  CVE-2026-71866: orval Import-time RCE via Zod Object Property Name Injection

  When orval generates a Zod validation client from an OpenAPI spec, it writes schema property names directly into the output file as unescaped JavaScript string keys, so a malicious property name…

• highCVE-2026-81726

  CVE-2026-81726: NLTK Model-Artifact APIs Path Traversal Bypass (pathsec sandbox escape)

  Six model persistence APIs in NLTK ignore the pathsec sandbox and use raw file I/O directly, letting an attacker read or write files anywhere on disk even when the app enforces pathsec restrictions.