Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-58419

  CVE-2026-58419: Gitea Notification API Private Issue Metadata Leak After Access Revocation

  A revoked Gitea user can still read private issue and pull request titles, URLs, and live activity through old notification threads, even after losing all repository access.

• highCVE-2026-58422

  CVE-2026-58422: Gitea OAuth2 Callback Improper Access Control Silently Re-enables Disabled Accounts

  A disabled Gitea user can silently reactivate their own account just by signing in through any linked OAuth2 provider, bypassing an administrator's explicit disable action.

• highCVE-2026-20779

  CVE-2026-20779: Gitea TOTP Passcode Capture-Replay via Basic-Auth and TOCTOU Race

  Gitea's two-factor authentication can be bypassed by replaying a captured one-time password: the Basic-Auth API surface never marked a passcode as used, and the web login handler had a race that let…

• high

  sharp: Inherited libvips Vulnerabilities in GIF, TIFF, and VIPS Loaders (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591)

  Versions of the sharp Node.js image library before 0.35.0 bundle a vulnerable libvips that can be crashed or exploited by a crafted GIF, TIFF, or VIPS file, putting any app that processes untrusted…

• high

  jackson-core Async Parser maxNumberLength Bypass via Chunked Digit Accumulation (Incomplete Fix)

  Jackson's non-blocking JSON parser ignores the configured maxNumberLength limit while receiving digit bytes in chunks, letting an attacker exhaust JVM heap memory by streaming a single oversized…

• high

  gRPC-Go: xDS RBAC Authorization Bypass, HTTP/2 Rapid Reset DoS, and NOT-Rule Panic

  Three bugs in gRPC-Go's xDS RBAC engine and HTTP/2 transport let attackers bypass access controls, crash the server with a crafted policy, or exhaust CPU with a stream-reset flood.

• high

  GitPython: Environment-Variable Exfiltration via Repo.clone_from() URL

  GitPython expands shell environment variables inside attacker-supplied clone URLs before passing them to git, letting an untrusted URL silently leak server secrets like AWS keys or GitHub tokens…

• high

  fast-xml-parser: Repeated DOCTYPE Declarations Reset Entity Expansion Limits

  Attackers can smuggle multiple DOCTYPE declarations into a single XML document to repeatedly reset fast-xml-parser's entity-expansion counters, bypassing all configured DoS limits and crashing…

• highCVE-2026-24451

  CVE-2026-24451: Gitea Fork Sync Information Disclosure via merge-upstream

  A Gitea fork owner can keep pulling commits from a parent repository even after the parent is switched to private, exposing content the fork owner is no longer authorized to see.

• highCVE-2026-27775

  CVE-2026-27775: Gitea Pre-Receive Hook Authorization Bypass via Cached Branch Permission

  A flaw in Gitea's git push handler lets an attacker who has maintainer-edit access to a single branch silently overwrite any other branch in the same repository by batching both refs in one push.

• high

  GitPython Command Injection and Arbitrary File Overwrite via Unguarded Git Options

  GitPython 3.1.50 and earlier let callers pass dangerous Git options directly into several API methods with no safety check, enabling arbitrary command execution via Repo.archive() and…

• highCVE-2026-58436

  CVE-2026-58436: Gitea Locale Middleware ReDoS via Accept-Language Underscore Bypass

  Any unauthenticated attacker can send a single oversized Accept-Language header full of underscore separators to pin a Gitea server CPU for roughly two seconds per request, making a small flood…