Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-55415

  CVE-2026-55415: datamodel-code-generator Code Injection via x-python-import and customTypePath

  A malicious OpenAPI or JSON Schema file can embed arbitrary Python code into generated model files, which then executes automatically the moment anyone imports those models.

• highCVE-2026-54690

  CVE-2026-54690: datamodel-code-generator SSRF via JSON Schema $ref HTTP URL

  A malicious JSON Schema or OpenAPI document can smuggle an HTTP $ref that silently fetches any internal URL, including cloud metadata endpoints, and leaks the response into generated Python source…

• highCVE-2026-55390

  CVE-2026-55390: datamodel-code-generator XSD schemaLocation Path Traversal

  When generating Python models from an attacker-supplied XML Schema file, datamodel-code-generator follows xs:include and xs:import schemaLocation paths without checking boundaries, letting an…

• highCVE-2026-32203

  CVE-2026-32203: System.Security.Cryptography.Xml EncryptedXml Stack Overflow via Deeply Nested XML

  Sending an XML document with more than 64 levels of nested EncryptedData elements to any .NET application that decrypts XML will crash the process with a stack overflow, taking the service down.

• highCVE-2026-50570

  CVE-2026-50570: Fission Incomplete Capability Denylist Allows CAP_SYS_TIME Privilege Escalation

  Fission's admission webhook and executor merge layer only blocked six Linux capabilities by name, so a tenant could add CAP_SYS_TIME to a Function or Environment pod and corrupt the shared node wall…

• highCVE-2026-54635

  CVE-2026-54635: pytonapi Webhook Custom Path Authentication Bypass

  pytonapi's webhook dispatcher skips bearer-token verification entirely when a handler is registered with a custom path, letting any unauthenticated attacker fire victim-defined business logic with…

• highCVE-2026-54632

  CVE-2026-54632: SIPSorcery Remote DoS via Malformed UDP Packet on RTP/ICE Socket

  Sending a single tiny malformed UDP packet to the RTP/ICE port of a SIPSorcery media session can crash that session remotely, with no authentication required.

• highCVE-2026-54603

  CVE-2026-54603: oauth2 Protocol-Relative Redirect Bearer Token Leak

  The Ruby oauth2 gem blindly follows redirects whose Location header starts with //, letting an attacker-controlled server steal your OAuth bearer token by hijacking the redirect destination.

• highCVE-2026-54609

  CVE-2026-54609: QTINeon NeonRelay Unauthenticated Amplification via Unbounded RECONNECT_REQUEST Forwarding

  An unauthenticated attacker can flood a QTINeon relay with RECONNECT_REQUEST packets from spoofed source addresses, causing the relay to forward each one to the hidden host with no cap or…

• criticalCVE-2026-54588

  CVE-2026-54588: Poweradmin Host Header Injection in OIDC / SAML / Logout Redirect

  Poweradmin trusts the attacker-controlled Host request header when building OAuth 2.0 redirect URIs, letting anyone hijack an admin's authorization code and take over the account without credentials.

• highCVE-2026-54605

  CVE-2026-54605: oauth gem Cross-Origin Token Redirect SSRF and Signed-Request Disclosure

  The Ruby oauth gem blindly follows cross-origin redirects during OAuth 1.0 token exchanges, letting a malicious provider send the app's signed credentials (consumer key, signature, nonce, timestamp)…

• highCVE-2026-54593

  CVE-2026-54593: Pterodactyl Panel Improper JWT Scope Allows Unauthorized File Upload

  A subuser with only console access on a Pterodactyl game server can reuse a websocket or file-download JWT to upload arbitrary files, bypassing the file.create permission check entirely.