Labs
Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.
- highCVE-2026-54691
CVE-2026-54691: datamodel-code-generator SSRF via --url
datamodel-code-generator fetches any URL you give it with no IP validation and redirect-following on, letting attackers trick it into hitting internal services or cloud metadata endpoints and leaking…
- highCVE-2026-54654
CVE-2026-54654: datamodel-code-generator Code Injection via Carriage Return in --extra-template-data comment
A carriage return character embedded in the comment field of an --extra-template-data file causes datamodel-code-generator to write executable Python code into generated model files, giving an…
- highCVE-2026-54650
CVE-2026-54650: openhole-server Path Traversal via Percent-Encoded URL Segments
openhole-server forwarded URL-decoded paths to tunneled local services, letting unauthenticated attackers read files outside the web root by percent-encoding dot-segments that Go's router would…
- criticalCVE-2026-64863
CVE-2026-64863: goshs WebDAV MOVE Bypasses --no-delete
When goshs is run with --no-delete, the WebDAV MOVE verb is never checked against that flag, so any WebDAV client can still delete or overwrite existing files by renaming them.
- highCVE-2026-54638
CVE-2026-54638: gotd/td Pre-Auth Denial of Service via Unbounded Memory Allocation
A remote, unauthenticated attacker can crash a gotd/td server by sending a tiny crafted MTProto packet that tricks the library into allocating gigabytes of memory before it checks whether the data is…
- criticalCVE-2026-54658
CVE-2026-54658: @hypequery/clickhouse SQL Injection via Backslash Escape Bypass
A flaw in the query builder's value-escaping logic lets an attacker supply a trailing backslash to break out of a quoted SQL string and run arbitrary ClickHouse SQL.
- highCVE-2026-54655
CVE-2026-54655: datamodel-code-generator Code Injection via x-python-type
A malicious JSON Schema field using the x-python-type extension can embed arbitrary Python code into generated model files, which then executes silently the moment a developer imports the output.
- highCVE-2026-55391
CVE-2026-55391: datamodel-code-generator SSRF Protection Bypass via DNS Rebinding
datamodel-code-generator validates a URL's resolved IP once before fetching, but lets httpx re-resolve the hostname independently, so an attacker-controlled DNS record that flips from a public IP to…
- highCVE-2026-54653
CVE-2026-54653: datamodel-code-generator Code Injection via default_factory Schema Field
An attacker who controls a JSON Schema, OpenAPI, or YAML file can plant arbitrary Python code inside the generated models, which then runs automatically when the output file is imported.
- criticalCVE-2026-62325
CVE-2026-62325: goshs SFTP Authentication Bypass via Empty Password
Starting goshs v2.1.3 with a password-less basic-auth flag and SFTP enabled lets any attacker connect to the SFTP service without supplying credentials, because the password handler is never…
- highCVE-2026-54719
CVE-2026-54719: goshs .goshs ACL Bypass via ?bulk Zip-Download Route
An unauthenticated attacker can read any file protected by a per-folder .goshs ACL in goshs by fetching it through the ?bulk zip-download route, which skips authorization entirely.
- highCVE-2026-55389
CVE-2026-55389: datamodel-code-generator Arbitrary File Read via JSON-Schema $ref
An attacker who supplies a crafted JSON Schema can read any file on the server by using a file:// or ../ reference inside a $ref field, bypassing the --no-allow-remote-refs security control entirely.