Labs
Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.
- criticalCVE-2026-63221
CVE-2026-63221: CodeIgniter4 Query Builder SQL Injection via deleteBatch() and where()
A SQL injection flaw in CodeIgniter4's Query Builder lets attackers inject arbitrary SQL through where() conditions when deleteBatch() is used, because the framework drops its own escaping logic for…
- highCVE-2026-63222
CVE-2026-63222: CodeIgniter4 Path Traversal in UploadedFile::move()
CodeIgniter4's file upload helper writes files to attacker-controlled paths when an application calls move() without a filename argument, because the raw client-supplied filename was never sanitized…
- criticalCVE-2026-63223
CVE-2026-63223: CodeIgniter4 Uploaded File Extension Validation Bypass in is_image and mime_in Rules
CodeIgniter4's is_image and mime_in upload validation rules checked only file content, not the client-supplied filename extension, letting an attacker sneak a PHP webshell past validation by…
- highCVE-2026-67422
CVE-2026-67422: pymdown-extensions ReDoS in caret, tilde, betterem, and magiclink
Four default-enabled inline processors in pymdown-extensions contain regular expressions that catastrophically backtrack on untrusted Markdown input under 50 bytes, letting any remote user pin a…
- high
GitPython unsafe-option guard bypass via split_single_char_options=False short-option smuggling
A logic gap in GitPython's command-injection guard lets an attacker smuggle the dangerous --upload-pack option past the denylist by using a single-character kwarg combined with…
- high
GitPython Submodule Name Path Traversal to Arbitrary Git Repository Creation
A malicious repository can write a path-traversal string as a submodule name in .gitmodules, causing GitPython to create a full Git repository at any attacker-chosen filesystem path outside the clone…
- high
GitPython: git-config Option-Name Injection via = and # Characters Enables RCE
An attacker who controls the option name passed to GitPython's config writer can inject arbitrary git-config directives, including core.sshCommand, leading to remote code execution on the next git…
- highCVE-2026-67434
CVE-2026-67434: PHP_CodeSniffer OS Command Injection via Crafted Filename in Blame Reports
PHP_CodeSniffer passes unsanitized filenames directly to shell commands when generating Gitblame, Hgblame, or Svnblame reports, letting an attacker run arbitrary OS commands by naming a file with…
- high
Craft CMS Improper Authorization: Arbitrary Password Reset via Element Save
A flaw in Craft CMS lets any logged-in user silently reset their own password, and lets users with 'Edit users' permission reset any other user's password, including admins, without needing elevated…
- high
CVE-2026-59870: js-yaml Quadratic CPU Denial of Service via !!omap
Parsing a large YAML ordered-map (!!omap) document with js-yaml 4.x blocks the Node.js event loop for seconds, letting any attacker stall your server with a single HTTP request.
- high
league/commonmark Footnote Extension Quadratic Complexity DoS
Sending a small Markdown document with repeated footnote references and duplicate footnote definitions causes the parser to build an N-squared number of backref nodes, crashing PHP workers with…
- high
league/commonmark Denial of Service via Colliding Heading Slugs
Sending a Markdown document full of identical or punctuation-only headings forces the slug normalizer into O(K²) work, letting an unauthenticated attacker hang a PHP server with a small payload.