Labs
Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.
- criticalCVE-2026-64849
CVE-2026-64849: MLflow Unauthenticated Full-Read SSRF via Webhook HTTP Redirect
A flaw in MLflow's webhook delivery lets an unauthenticated attacker trick the server into fetching any internal URL, including cloud instance-metadata credentials, and read the response back through…
- highCVE-2026-69148
CVE-2026-69148: MLflow Missing Authorization on CreateModelVersion run_id
An authenticated MLflow user can reference another user's private run_id when creating a model version, then read files from that run's artifact directory without having any READ permission on the…
- highCVE-2026-47683
CVE-2026-47683: vm2 bufferAllocLimit DoS Bypass via Buffer.concat and Buffer.from
Sandbox code in vm2 can bypass the bufferAllocLimit cap by calling Buffer.concat or Buffer.from with a fake array length, allocating hundreds of megabytes of host memory in one synchronous call that…
- criticalCVE-2026-47686
CVE-2026-47686: vm2 Missing Error.cause Sanitization Sandbox Escape to RCE
A missing sanitization step in vm2's exception handler lets sandboxed code read an unscrubbed host object out of a thrown error's .cause property, giving an attacker full shell access on the host.
- highCVE-2026-55090
CVE-2026-55090: Etherpad Stored XSS via Unescaped HTML Export Attribute Values
Any pad collaborator with write access can inject a crafted attribute value into the pad's attribute pool that, when another user exports the pad as HTML, executes arbitrary JavaScript in their…
- highCVE-2026-54284
CVE-2026-54284: sqlparse TokenList O(n*depth) CPU Denial of Service
A small SQL string with deeply nested parentheses or CASE WHEN blocks can pin a Python worker for 10+ seconds, because sqlparse rebuilds the entire token subtree from scratch on every grouping step…
- highCVE-2026-59893
CVE-2026-59893: sqlparse ReDoS via Dollar-Quoted and Multiline-Comment Regexes
A crafted SQL string containing many unclosed dollar-quote or block-comment openers can force sqlparse's lexer into O(n²) regex backtracking, pinning a CPU core and denying service to every other…
- high
uniget CLI: Inverted Signature-Guard Condition Allows Unsigned Metadata RCE
A one-character logic mistake in uniget's metadata loader means the Sigstore signature check is skipped on every normal run, letting a tampered metadata.json execute arbitrary shell commands as the…
- highCVE-2026-59902
CVE-2026-59902: netty-transport-sctp SctpMessageCompletionHandler Memory Exhaustion
Netty's SCTP message reassembler buffers incoming fragments without any byte-size limit, so an unauthenticated attacker can fill server memory and trigger an OutOfMemoryError with just a few…
- criticalCVE-2026-47698
CVE-2026-47698: vm2 Sandbox Breakout via Indirect Call Proto Mutation
A bypass of a previous vm2 sandbox fix lets attackers run arbitrary commands on the host by using a double indirect call pattern to mutate host object prototypes, escaping the sandbox entirely.
- critical
vm2: NodeVM builtin wildcard exposes os and dns host-process read/write primitives
In vm2, sandboxed code using the builtin wildcard can call dns.setServers() to hijack every DNS lookup the host process makes, and read host identity and network topology via os, all from a single…
- high
vm2 Memory Exhaustion DoS via ArrayBuffer bufferAllocLimit Bypass
Sandboxed code in vm2 can exhaust host process memory and trigger an OOM crash by using ArrayBuffer or TypedArray constructors, bypassing the bufferAllocLimit cap that was supposed to prevent exactly…