Skip to content

Commit 5b6a903

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-52x6-gq3r-vpf4 GHSA-8hv8-536x-4wqp GHSA-8rfp-98v4-mmr6 GHSA-m2v9-299j-rv96
1 parent e1c84b7 commit 5b6a903

4 files changed

Lines changed: 250 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/06/GHSA-52x6-gq3r-vpf4/GHSA-52x6-gq3r-vpf4.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-52x6-gq3r-vpf4",
4+
"modified": "2026-06-16T14:05:41Z",
5+
"published": "2026-06-16T14:05:40Z",
6+
"aliases": [
7+
"CVE-2026-54530"
8+
],
9+
"summary": "pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction",
10+
"details": "### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires extracting the text in layout mode.\n\n### Patches\n\nThis has been fixed in [pypdf==6.13.0](https://github.com/py-pdf/pypdf/releases/tag/6.13.0).\n\n### Workarounds\n\nIf you cannot upgrade yet, consider applying the changes from PR [#3830](https://github.com/py-pdf/pypdf/pull/3830).",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "pypdf"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "6.13.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/py-pdf/pypdf/security/advisories/GHSA-52x6-gq3r-vpf4"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/py-pdf/pypdf/pull/3830"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/py-pdf/pypdf"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/py-pdf/pypdf/releases/tag/6.13.0"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-835"
59+
],
60+
"severity": "MODERATE",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-06-16T14:05:40Z",
63+
"nvd_published_at": null
64+
}
65+
}

‎advisories/github-reviewed/2026/06/GHSA-8hv8-536x-4wqp/GHSA-8hv8-536x-4wqp.json‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8hv8-536x-4wqp",
4+
"modified": "2026-06-16T14:05:06Z",
5+
"published": "2026-06-16T14:05:06Z",
6+
"aliases": [
7+
"CVE-2026-50146"
8+
],
9+
"summary": "Astro: Reflected XSS via unescaped slot name",
10+
"details": "## Summary\n\nWhen a component uses a `client:*` directive, Astro inserts named slot content into a `data-astro-template` attribute without HTML escaping the slot name allowing an attacker to break out of the attribute context and inject arbitrary HTML, resulting in reflected XSS during SSR.\n\nThis is similar to GHSA-wrwg-2hg8-v723 but exploits a different injection point.\n\n## Vulnerable Code\n\n`packages/astro/src/runtime/server/render/component.ts:371:376`\n\n```ts\n// component.ts:371\n`<template data-astro-template${key !== 'default' ? `=\"${key}\"` : ''}>${children[key]}</template>`\n```\n\nI found that key is interpolated directly into the attribute value without proper escaping.\n\n## Proof of Concept\n\nFor the PoC, I set up with a minimal repository with Astro 6.3.1, Node.js: v26.0.0.\n\n**`astro.config.mjs`**\n```js\nimport react from '@astrojs/react';\nimport node from '@astrojs/node';\nimport { defineConfig } from 'astro/config';\nexport default defineConfig({\n output: 'server',\n adapter: node({ mode: 'standalone' }),\n integrations: [react()],\n});\n```\n\n**`src/pages/index.astro`**\n```astro\n---\nimport Wrapper from '../components/Wrapper.jsx';\nconst slotName = Astro.url.searchParams.get('tab') ?? 'default';\n---\n<html><body>\n <Wrapper client:load>\n <div slot={slotName}>content</div>\n </Wrapper>\n</body></html>\n```\n\n**`src/components/Wrapper.jsx`**\n```jsx\nexport default function Wrapper() { return null; }\n```\n\n**Payload:**\n```\nabc\"></template></astro-island><img src=x onerror=confirm(document.domain)><!--\n```\nAccessing this URL will trigger the popup.\n\nhttp://localhost:4321/?tab=abc%22%3E%3C%2Ftemplate%3E%3C%2Fastro-island%3E%3Cimg+src%3Dx+onerror%3Dconfirm(document.domain)%3E%3C!--\n\n\n\n<img width=\"1268\" height=\"592\" alt=\"image\" src=\"https://github.com/user-attachments/assets/675cdc04-4134-4d83-883c-abe16d751ec7\" />\n\n\n\nThis will render in html.\n\n```html\n<template data-astro-template=\"abc\"></template></astro-island>\n<img src=x onerror=confirm(document.domain)><!--\">content</template>\n```\n\n## Fix\n\nI suggest leveraging the existing escape function on the slot name.\n\n```ts\n// component.ts:371\n`<template data-astro-template${key !== 'default' ? `=\"${escapeHTML(String(key))}\"` : ''}>${children[key]}</template>`\n```\n\n---",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "astro"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "6.3.3"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/withastro/astro/security/advisories/GHSA-8hv8-536x-4wqp"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/withastro/astro"
46+
}
47+
],
48+
"database_specific": {
49+
"cwe_ids": [
50+
"CWE-79",
51+
"CWE-80"
52+
],
53+
"severity": "HIGH",
54+
"github_reviewed": true,
55+
"github_reviewed_at": "2026-06-16T14:05:06Z",
56+
"nvd_published_at": null
57+
}
58+
}

‎advisories/github-reviewed/2026/06/GHSA-8rfp-98v4-mmr6/GHSA-8rfp-98v4-mmr6.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8rfp-98v4-mmr6",
4+
"modified": "2026-06-16T14:06:30Z",
5+
"published": "2026-06-16T14:06:29Z",
6+
"aliases": [],
7+
"summary": "Bleach: URI sanitization allows disallowed URI schemes with Unicode > U+00A0 in output",
8+
"details": "### Impact\n\nA possible XSS bypass affects users calling `bleach.clean` with all of:\n\n* `a` in the allowed tags\n* `href` in allowed attributes\n\nThe `bleach.clean` sanitizer outputs URIs containing disallowed scheme patterns that it should be stripping. However, because the inserted Unicode characters make the scheme invalid per RFC 3986, modern browsers do not execute these as javascript: URIs. The practical security impact is limited to:\n\n- Bleach's output contains URI values that violate the caller's protocol allowlist, breaking the sanitizer's contract.\n- If a downstream system performs its own Unicode normalization on bleach's output (stripping invisible characters before rendering), the javascript: scheme could become valid. This is a non-standard processing chain but represents a theoretical secondary risk.\n\nThis is not a direct XSS vulnerability.\n\nPython code example from reporter with Bleach v6.3.0 and Python 3.13:\n\n```\nimport bleach\npayload1 = '<a href=\"javascript\\u200b:alert(document.cookie)\">Click me</a>'\nresult1 = bleach.clean(payload1)\nprint(f\"(ZWSP): {repr(result1)}\")\n```\n\nOutput:\n\n```\n(ZWSP): '<a href=\"javascript\\u200b:alert(document.cookie)\">Click me</a>'\n```\n\n### Patches\n\nUsers should upgrade to Bleach 6.4.0.\n\n### Workarounds\n\nPre-process content removing non-ASCII characters from URI schemes before sanitizing with `bleach.clean`.\n\nA strong[ Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) without unsafe-inline and unsafe-eval[ script-srcs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src) will also help mitigate the risk.\n\n### References\n\n* https://bugzilla.mozilla.org/show_bug.cgi?id=2023812\n* RFC 3986, Section 3.1 (URI Scheme syntax): scheme characters are restricted to ALPHA *( ALPHA / DIGIT / \"+\" / \"-\" / \".\" )\n\n### Reported by \n\nReported by codeant from CodeAnt AI.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "PyPI",
19+
"name": "bleach"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "6.4.0"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 6.3.0"
36+
}
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/mozilla/bleach/security/advisories/GHSA-8rfp-98v4-mmr6"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2023812"
47+
},
48+
{
49+
"type": "PACKAGE",
50+
"url": "https://github.com/mozilla/bleach"
51+
}
52+
],
53+
"database_specific": {
54+
"cwe_ids": [
55+
"CWE-184"
56+
],
57+
"severity": "LOW",
58+
"github_reviewed": true,
59+
"github_reviewed_at": "2026-06-16T14:06:29Z",
60+
"nvd_published_at": null
61+
}
62+
}

‎advisories/github-reviewed/2026/06/GHSA-m2v9-299j-rv96/GHSA-m2v9-299j-rv96.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-m2v9-299j-rv96",
4+
"modified": "2026-06-16T14:05:57Z",
5+
"published": "2026-06-16T14:05:57Z",
6+
"aliases": [
7+
"CVE-2026-54531"
8+
],
9+
"summary": "pypdf: Possible infinite loop when processing outlines/bookmarks in writer",
10+
"details": "### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with outlines into a writer.\n\n### Patches\n\nThis has been fixed in [pypdf==6.13.0](https://github.com/py-pdf/pypdf/releases/tag/6.13.0).\n\n### Workarounds\n\nIf you cannot upgrade yet, consider applying the changes from PR [#3830](https://github.com/py-pdf/pypdf/pull/3830).",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "pypdf"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "6.13.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/py-pdf/pypdf/security/advisories/GHSA-m2v9-299j-rv96"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/py-pdf/pypdf/pull/3830"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/py-pdf/pypdf"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/py-pdf/pypdf/releases/tag/6.13.0"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-835"
59+
],
60+
"severity": "MODERATE",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-06-16T14:05:57Z",
63+
"nvd_published_at": null
64+
}
65+
}

0 commit comments

Comments
 (0)