Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-56654

  CVE-2026-56654: Gitea Privilege Escalation via Access Token Scope Bypass

  A flaw in Gitea's API lets an attacker use any restricted Personal Access Token to mint a new fully-privileged token, bypassing the password-only guard without ever knowing the account password.

• highCVE-2026-59892

  CVE-2026-59892: @opentelemetry/propagator-jaeger Denial of Service via Malformed Header

  A single HTTP request with a broken percent-encoded value in a Jaeger trace header crashes any Node.js service that uses JaegerPropagator as its active propagator, taking the whole process down.

• high

  svgo removeScripts Plugin XSS Bypass via Namespace Prefix and Case-Insensitive URI

  SVGO's script-removal plugin could be bypassed by using a namespace-prefixed script tag like <svg:script> or a mixed-case JavaScript URI like JavaScript:, leaving executable code in the optimized SVG.

• high

  GitPython unsafe clone option gate bypass via joined short options

  GitPython 3.1.50 lets attackers run arbitrary commands during git clone by passing a joined short option like -u/path/to/helper, which slips past the unsafe-option gate that only checks the plain -u…

• high

  GitPython: OS Command Injection via git long-option prefix abbreviation bypass

  GitPython's blocklist for dangerous git options like --upload-pack can be bypassed by passing an abbreviated form of the option name as a Python keyword argument, letting an attacker run arbitrary…

• highCVE-2026-59884

  CVE-2026-59884: pyasn1 BER Decoder Denial of Service via Unbounded Long-Form Tag IDs

  pyasn1's BER/CER/DER decoder accumulates tag ID bytes in an unbounded loop, letting an attacker feed a megabyte of crafted input that consumes minutes of CPU and crashes Python 3.11+ with an…

• highCVE-2026-59885

  CVE-2026-59885: pyasn1 Quadratic Complexity OID Decoding Denial of Service

  pyasn1's BER/CER/DER decoder builds OID and RELATIVE-OID values using repeated tuple copies, letting an attacker send a small crafted message that consumes seconds of CPU per decode call and hangs…

• highCVE-2026-59886

  CVE-2026-59886: pyasn1 Uncontrolled Resource Consumption in Real Float Conversion

  A tiny ASN.1 REAL value carrying a huge base-10 exponent can freeze or crash any Python process that decodes untrusted ASN.1 data and then prints, logs, or compares the result.

• highCVE-2026-57894

  CVE-2026-57894: Gitea Repository Migration SSRF via Git HTTP Redirect

  A low-privileged Gitea user can supply a migration URL that redirects the server's git clone to a blocked internal endpoint, bypassing the URL allow/block list and exfiltrating private Git…

• highCVE-2026-59880

  CVE-2026-59880: immutable Hash-Collision Algorithmic Complexity DoS

  Crafting many object keys that share the same 32-bit hash forces Immutable.Map and Immutable.Set into O(n²) behavior, letting an attacker stall a Node.js server with a small, precomputed payload.

• highCVE-2026-13676

  CVE-2026-13676: fast-uri IDN Host Confusion via Failed Canonicalization

  fast-uri silently fails to convert Unicode hostnames to their ASCII equivalents, letting attackers bypass hostname-based security checks by using Unicode dot variants that Node's own URL parser…

• highCVE-2026-13760

  CVE-2026-13760: aws-cdk-lib OS Command Injection via nodeModules Version Strings in Docker Bundling

  A malicious or compromised npm package version string in package.json can execute arbitrary shell commands on any developer or CI machine that runs AWS CDK's Docker-based Lambda bundling.