Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2022-46295

  CVE-2022-46295: Open Babel MSI Parser Stack Buffer Overflow

  A crafted MSI chemistry file can overflow a fixed-size stack array in Open Babel's MSI parser, letting an attacker write arbitrary data past the end of the buffer and potentially execute code.

• highCVE-2026-46487

  CVE-2026-46487: GeoNetwork Elasticsearch Search ACL Bypass via Missing Query Field

  An unauthenticated attacker can retrieve restricted metadata records from GeoNetwork by sending a search request that omits the query field, causing the access-control filter injection to be skipped…

• highCVE-2025-10997

  CVE-2025-10997: Open Babel Heap Buffer Overflow in ChemKin Parser

  A crafted ChemKin reaction file can corrupt heap memory in Open Babel's species-lookup code, crashing any application that parses untrusted chemistry files.

• highCVE-2022-37331

  CVE-2022-37331: Open Babel Gaussian Output Parser Stack Buffer Overflow

  A crafted Gaussian output file can overflow a fixed-size stack buffer in Open Babel's orientation block parser, letting an attacker write arbitrary data onto the stack and potentially execute code.

• highCVE-2022-42885

  CVE-2022-42885: Open Babel GRO Parser Uninitialized Pointer Dereference

  A crafted GROMACS .gro file can make Open Babel dereference an uninitialized residue pointer while parsing atom records, crashing the process and potentially enabling arbitrary code execution.

• highCVE-2025-10996

  CVE-2025-10996: Open Babel SMILES Parser Heap Buffer Overflow

  Open Babel's SMILES parser reads past the end of a heap buffer when given a crafted molecule string, which can crash or corrupt memory in any application that converts chemistry file formats.

• high

  Kahi Supervisor Privilege Drop and Socket Permission Issues

  Kahi's process supervisor silently failed to apply configured user credentials to child processes, left supplementary groups intact after dropping privileges, and exposed FastCGI Unix sockets to all…

• highCVE-2026-49473

  CVE-2026-49473: @cedar-policy/authorization-for-expressjs Authorization Bypass via Query String

  A query string appended to a request URL tricks the Cedar middleware into evaluating a less restrictive authorization policy while Express routes the request to a more privileged endpoint, letting…

• high

  Fission MessageQueueTrigger Secret Exfiltration and PodSpec Injection

  Any Kubernetes tenant who can create a Fission MessageQueueTrigger can read any Secret in the namespace and run an arbitrary container image under any service account, far beyond their intended RBAC…

• highCVE-2026-49821

  CVE-2026-49821: Fission Package Cross-Namespace Confused Deputy RCE and SA Token Exfiltration

  A Fission user in one Kubernetes namespace could trick the build controller into running their code inside another tenant's builder pod and leaking that namespace's service-account token, giving the…

• highCVE-2026-49822

  CVE-2026-49822: Fission KubernetesWatchTrigger Cross-Namespace Event Leakage

  A low-privilege Fission tenant could spy on Pods, Services, and Jobs in any Kubernetes namespace, or even the entire cluster, by creating a watch trigger that pointed its spec.namespace at a…

• highCVE-2026-49823

  CVE-2026-49823: Fission Cross-Namespace Package Read via Unvalidated PackageRef

  A low-privilege Fission function author in one Kubernetes namespace could read the source code and embedded secrets of any Package in any other namespace by setting a single field the admission…