huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2026-47104: libusb: libusb: Denial of Service via malformed USB descriptor
Component: libusb
Severity: Moderate
CWE: CWE-805 (Buffer Access with Incorrect Length Value)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-05-27T13:20:44.432000+00:00

A flaw was found in libusb. This out-of-bounds read vulnerability allows a local attacker, particularly in virtualized environments utilizing USB passthrough, to trigger a denial of service. By providing a malformed USB descriptor, the attacker can cause the software to read beyond its allocated memory, leading to system instability or crashes.

Statement: This Moderate impact vulnerability in libusb allows a local attacker to cause a denial of service. Exploitation requires a virtualized environment with USB passthrough enabled, where a malicious guest can provide a specially crafted USB descriptor to the host, leading to an out-of-bounds read and system instability.

Affected upstream versions: <= v1.0.29
Fixed upstream versions: 1.0.30
Upstream repository: https://github.com/libusb/libusb
Upstream fix commit: 578ab76b4c434f8b204137ab6d7310689c7a9704
CVE-2026-47131: vm2: vm2: Arbitrary code execution via sandbox escape vulnerability
Component: vm2
Severity: Moderate
CWE: CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion'))
CVSS v3: 4.1 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L)
Public date: 2026-06-12T14:14:17.037000+00:00

A flaw was found in vm2, an open-source virtual machine (VM) sandbox for Node.js. A remote attacker can exploit this vulnerability by combining specific Buffer function calls and Node.js's ERR_INVALID_ARG_TYPE error. This allows the attacker to obtain the host's TypeError constructor, leading to an escape from the sandbox. Consequently, this enables attackers to run arbitrary code on the host system.

Statement: The Red Hat Product Security team has rated the impact of this vulnerability as Moderate in Red Hat Developer Hub and Ansible Automation Platform.The affected package is present in both products as a transitive dependency; however, the vulnerable sandbox functionality is not invoked in any production code path. The active sandboxing mechanism used by both products does not rely on this package, and user-supplied input cannot reach the vulnerable code under a standard deployment. Exploitation would require an attacker to independently route arbitrary JavaScript into the sandbox runtime, a condition not present in the default configuration of either product.

Affected upstream versions: < 3.11.4
Fixed upstream versions: v3.11.4
Upstream repository: https://github.com/patriksimek/vm2
Upstream fix commit: 27c525f4615e2b983f122e2bed327d810126f5c8
CVE-2026-47135: vm2: vm2: Sandbox escape allows arbitrary code execution on the host system
Component: vm2
Severity: Moderate
CWE: CWE-1100 (Insufficient Isolation of System-Dependent Functions)
CVSS v3: 8.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N)
Public date: 2026-06-12T14:14:42.022000+00:00

A flaw was found in vm2, an open-source virtual machine (VM) sandbox for Node.js. An attacker within the sandbox could exploit incomplete symbol interception and missing security checks to gain control over the host system. This could allow the attacker to execute arbitrary code outside the sandbox environment, leading to a complete compromise of the host.

Statement: This vulnerability has been rated as Moderate for Red Hat Developer Hub and Red Hat Ansible Automation Platform. The vm2 sandbox exists as a transitive dependency in Red Hat Developer Hub and is only utilized during build time. The sandbox is therefore not exposed on the production code path. Exploitation of this vulnerability requires attackers to write cross-realm symbol keys to host objects which is not possible in the default configuration of Red Hat Developer Hub.

Affected upstream versions: < 3.11.4
Fixed upstream versions: v3.11.4
Upstream repository: https://github.com/patriksimek/vm2
Upstream fix commit: 928aef51898b5c52a05f05a40c4cfeb52e172878
CVE-2026-47137: vm2: vm2: Sandbox escape leading to arbitrary code execution via security bypass
Component: vm2
Severity: Moderate
CWE: CWE-480 (Use of Incorrect Operator)
CVSS v3: 4.1 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L)
Public date: 2026-06-12T14:15:34.795000+00:00

A flaw was found in vm2, an open-source virtual machine (VM) sandbox for Node.js. A remote attacker could bypass a security check designed to prevent the combination of nested environments and disabled module loading. This bypass occurs because a strict equality check for the `require` option can be circumvented by simply omitting the option, leading to an unintended configuration. Successful exploitation of this vulnerability could allow an attacker to escape the sandbox and achieve arbitrary code execution on the host system.

Statement: The Red Hat Product Security team has rated the impact of this vulnerability as Moderate in Red Hat Developer Hub and Ansible Automation Platform.The affected package is present in both products as a transitive dependency; however, the vulnerable sandbox functionality is not invoked in any production code path. The active sandboxing mechanism used by both products does not rely on this package, and user-supplied input cannot reach the vulnerable code under a standard deployment. Exploitation would require an attacker to independently route arbitrary JavaScript into the sandbox runtime, a condition not present in the default configuration of either product.

Affected upstream versions: < 3.11.4
Fixed upstream versions: v3.11.4
Upstream repository: https://github.com/patriksimek/vm2
Upstream fix commit: 01a7552add345d5a6862623884e6b79a85bf0568
CVE-2026-47139: vm2: vm2: Sandbox escape via internal HTTP built-ins leading to network restriction bypass
Component: vm2
Severity: Moderate
CWE: CWE-1100 (Insufficient Isolation of System-Dependent Functions)
CVSS v3: 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)
Public date: 2026-06-12T14:15:44.652000+00:00

A flaw was found in vm2, a Node.js sandbox. This vulnerability allows sandboxed code to bypass network restrictions by utilizing internal HTTP built-ins, such as _http_client and _http_server. An attacker can exploit this to make outbound HTTP requests or open listening HTTP sockets, even when public network modules are explicitly denied. This could lead to unauthorized information disclosure or further compromise of the system.

Statement: This vulnerability has been rated as Moderate for Red Hat Developer Hub and Red Hat Ansible Automation Platform. The vm2 sandbox exists as a transitive dependency in Red Hat Developer Hub and is only utilized during build time. The sandbox is therefore not exposed on the production code path. Exploitation of this vulnerability requires attackers to access internal HTTP built-ins which is not possible in the default configuration of Red Hat Developer Hub.

Affected upstream versions: < 3.11.4
Fixed upstream versions: v3.11.4
Upstream repository: https://github.com/patriksimek/vm2
Upstream fix commit: 436053e30eecbabd487e2fd2959c137ac34e2bb1
CVE-2026-47140: vm2: vm2: Arbitrary code execution due to incomplete sandbox restrictions
Component: vm2
Severity: Moderate
CWE: CWE-184 (Incomplete List of Disallowed Inputs)
CVSS v3: 4.1 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L)
Public date: 2026-06-12T14:16:10.727000+00:00

A flaw was found in vm2, an open-source virtual machine (VM) sandbox for Node.js. This vulnerability allows sandboxed code to bypass intended security restrictions by exploiting missing entries in the denylist for dangerous Node.js built-in functions, specifically `process` and `inspector/promises`. A remote attacker can leverage this to execute arbitrary code in the host process, leading to a complete compromise of the system.

Statement: The Red Hat Product Security team has rated the impact of this vulnerability as Moderate in Red Hat Developer Hub and Ansible Automation Platform.The affected package is present in both products as a transitive dependency; however, the vulnerable sandbox functionality is not invoked in any production code path. The active sandboxing mechanism used by both products does not rely on this package, and user-supplied input cannot reach the vulnerable code under a standard deployment. Exploitation would require an attacker to independently route arbitrary JavaScript into the sandbox runtime, a condition not present in the default configuration of either product.

Affected upstream versions: < 3.11.4
Fixed upstream versions: v3.11.4
Upstream repository: https://github.com/patriksimek/vm2
Upstream fix commit: a1ed47a98d1cc36cb48c0d566d55889688e0b59b
CVE-2026-47141: vm2: vm2: NodeVM observability builtins leak host process and HTTP request data
Component: vm2
Severity: Moderate
CWE: CWE-653 (Improper Isolation or Compartmentalization)
CVSS v3: 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)
Public date: 2026-06-12T14:17:35.970000+00:00

A flaw was found in vm2, an open-source virtual machine (VM) sandbox for Node.js. Prior to version 3.11.4, NodeVM, a component of vm2, improperly exposed certain process-wide observability builtins, such as diagnostics_channel, async_hooks, and perf_hooks. These builtins, which are designed for monitoring and debugging, were not adequately blocked by the dangerous builtin denylist. This oversight allowed sandboxed code to observe sensitive host application data, leading to information disclosure across the vm2 security boundary.

Statement: This vulnerability has been rated as Moderate for Red Hat Developer Hub and Red Hat Ansible Automation Platform. The vm2 sandbox exists as a transitive dependency in Red Hat Developer Hub and is only utilized during build time. The sandbox is therefore not exposed on the production code path. Exploitation of this vulnerability requires attackers to access process-wide observability builtins which is not possible in the default configuration of Red Hat Developer Hub.

Affected upstream versions: < 3.11.4
Fixed upstream versions: v3.11.4
Upstream repository: https://github.com/patriksimek/vm2
Upstream fix commit: e1c48fce05189f48e71efbd32af0754efa4066bb
CVE-2026-47208: vm2: vm2: Sandbox Breakout Using Promise Species
Component: vm2
Severity: Moderate
CVSS v3: 6.6 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L)
Public date: 2026-06-12T14:16:22.726000+00:00

A flaw was found in vm2, an open-source virtual machine (VM) sandbox for Node.js. This vulnerability allows an attacker to escape the sandbox environment by writing malicious code. Successful exploitation can lead to arbitrary code execution on the host system, compromising the integrity and confidentiality of the system.

Statement: Exploitation requires an attacker to supply untrusted malicious code to the vm2 sandbox, which is easily achieved since the component's main purpose is to execute untrusted code.

Escaping the sandbox completely bypasses the intended security boundaries, leading directly to arbitrary code execution on the host system and a full compromise of confidentiality and integrity

Affected upstream versions: < 3.11.4
Fixed upstream versions: v3.11.4
Upstream repository: https://github.com/patriksimek/vm2
Upstream fix commit: a462655009669c3124ee39498121651597529ea8
CVE-2026-47209: vm2: vm2: Integrity bypass via incorrect property assignment leading to potential arbitrary code execution
Component: vm2
Severity: Moderate
CWE: CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes)
CVSS v3: 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N)
Public date: 2026-06-12T14:14:06.455000+00:00

A flaw was found in vm2, an open-source virtual machine (VM) sandbox for Node.js. This vulnerability allows an attacker to bypass security restrictions by writing dangerous cross-realm Symbol keys to host objects. This can lead to a compromise of the integrity of the host system, potentially enabling arbitrary code execution within the Node.js environment. The issue stems from the BaseHandler.set trap in bridge.js, which incorrectly writes to the host target object even when inherited property assignments should create an own property on the receiver.

Statement: This vulnerability has been rated as Moderate for Red Hat Developer Hub and Red Hat Ansible Automation Platform. The vm2 sandbox exists as a transitive dependency in Red Hat Developer Hub and is only utilized during build time. The sandbox is therefore not exposed on the production code path. Exploitation of this vulnerability requires attackers to write cross-realm symbol keys to host objects which is not possible in the default configuration of Red Hat Developer Hub.

Affected upstream versions: < 3.11.4
Fixed upstream versions: v3.11.4
Upstream repository: https://github.com/patriksimek/vm2
Upstream fix commit: 26d0318b5e6555be4b187ba05d6cf378ccecfe22
CVE-2026-47210: vm2: vm2: Arbitrary code execution via sandbox escape when executing untrusted code with async support.
Component: vm2
Severity: Moderate
CWE: CWE-653 (Improper Isolation or Compartmentalization)
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-06-12T14:17:22.653000+00:00

A flaw was found in vm2, an open-source virtual machine (VM) sandbox for Node.js. This sandbox escape vulnerability allows an attacker to execute arbitrary code in the host process. This occurs when untrusted code is executed with asynchronous (async) support on runtimes that expose WebAssembly JavaScript Promise Integration (JSPI). Specifically, a JSPI-backed Promise can bypass expected Promise-species hardening, exposing a host-originated rejection object to attacker-controlled logic and breaking the sandbox boundary.

Statement: The Red Hat Product Security team has rated the impact of this vulnerability as Moderate in Red Hat Developer Hub and Ansible Automation Platform.The affected package is present in both products as a transitive dependency; however, the vulnerable sandbox functionality is not invoked in any production code path. The active sandboxing mechanism used by both products does not rely on this package, and user-supplied input cannot reach the vulnerable code under a standard deployment. Exploitation would require an attacker to independently route arbitrary JavaScript into the sandbox runtime, a condition not present in the default configuration of either product.

Affected upstream versions: < 3.11.4
Fixed upstream versions: v3.11.4
Upstream repository: https://github.com/patriksimek/vm2
Upstream fix commit: 6915fa4d9bcebd47b9a4f39a1adc1aa94ef6ffc6
CVE-2026-47423: dompurify: DOMPurify: Cross-site scripting vulnerability allows information disclosure
Component: dompurify
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N)
Public date: 2026-07-14T19:56:02.057000+00:00

A flaw was found in DOMPurify, a DOM-only cross-site scripting (XSS) sanitizer. Due to the default allowance of `selectedcontent`, a remote attacker could craft a malicious payload that, after initial sanitization, could be re-cloned by browsers, leading to the execution of unsanitized markup. This could result in information disclosure.

Statement: This is a cross-site scripting (XSS) vulnerability in DOMPurify, a sanitizer for HTML, MathML, and SVG. The flaw allows a remote attacker to bypass sanitization by crafting a malicious payload that leverages the default allowance of `selectedcontent`. This can lead to browsers re-cloning the payload and executing unsanitized markup, resulting in information disclosure. User interaction is required for exploitation.

* AC was raised from Low to High because exploitation requires specific browser support for the experimental <selectedcontent> HTML element, which is currently only available in Chromium 148+ and WebKit 625+. Firefox and Safari are not affected, and only the single DOMPurify version 3.4.4 is vulnerable (fixed in 3.4.5), significantly narrowing the attack surface.
* Scope was lowered from Changed to Unchanged because the XSS executes within the same origin as the consuming application with no cross-domain scope change.

No Red Hat product ships dompurify 3.4.4.

Affected upstream versions: >= 3.4.4, < 3.4.5
Fixed upstream versions: 3.4.5
Upstream repository: https://github.com/cure53/DOMPurify
Upstream fix commit: 011b0c78f2a0f57ee54f5fcccb697a46ca6e63ea
CVE-2026-47428: vitest: Vitest: Arbitrary code execution via crafted browser-runner URL
Component: vitest
Severity: Important
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 8.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)
Public date: 2026-07-14T19:30:19.670000+00:00

A flaw was found in Vitest, a testing framework. In Vitest Browser Mode, a remote attacker could craft a specific browser-runner URL that, when visited, would allow the execution of arbitrary JavaScript code within the Vitest server. This vulnerability could also lead to the recovery of the VITEST_API_TOKEN, potentially enabling unauthorized authenticated API calls and further compromise of the system.

Statement: Red Hat has assessed this flaw against its shipping products. The vulnerability requires @vitest/browser (Vitest's opt-in Browser Mode) to be installed and actively enabled; it does not affect the core `vitest` test runner used without Browser Mode. None of Red Hat's shipping products install or execute @vitest/browser, and none configure or enable Browser Mode. Where Vitest is present, it is used strictly as a build/test-time devDependency (core vitest and its non-browser submodules such as expect, runner, snapshot, spy, and utils), not as a shipped runtime component, and several affected streams already ship patched versions (>=4.1.6) or versions below the vulnerable range. Accordingly, while the CVSS score reflects a genuinely severe flaw in Vitest Browser Mode upstream, Red Hat's shipping products are not reachable via this vulnerability.

Affected upstream versions: >= 4.0.17, < 4.1.6, >= 5.0.0-beta.0, < 5.0.0-beta.3
Fixed upstream versions: v4.1.6
Upstream repository: https://github.com/vitest-dev/vitest
Upstream fix commit: 18af98cee1830604d57f6a02bf28f8067cdffc06
CVE-2026-47429: vitest: Vitest: Arbitrary code execution and information disclosure via path traversal
Component: vitest
Severity: Important
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-07-14T19:28:08.688000+00:00

A flaw was found in Vitest, a testing framework. On Windows, the Vitest UI/API server incorrectly handled file serving, which could allow an attacker to read sensitive files outside the project directory. Additionally, exposed API features could be exploited to execute arbitrary scripts, leading to potential system compromise.

Statement: Vitest ships a UI and API server (enabled via the --ui or --api flags, or automatically as part of Browser Mode) that exposes file read, file write, and test-rerun functionality over HTTP. Due to an incorrect path-traversal check in the /__vitest_attachment__ handler and related code paths, a remote attacker who can reach this server can read arbitrary files, and via the write/rerun features can achieve arbitrary code execution. Exploitation requires either exposing the server to a network host (--api.host / api.host config) or running the UI/Browser Mode on Windows.

Red Hat's shipped products use vitest exclusively as a development-time unit test runner (invoked as `vitest run`, `test:unit`, or `--project` in CI/build pipelines). None of the Red Hat products that ship vitest start its UI server, API server, or Browser Mode as part of their build process or shipped runtime. The @vitest/browser package (required for Browser Mode) is not present in any Red Hat product's manifest. As a result, the vulnerable code path is not reachable in any Red Hat product covered by this flaw, and affects are set to NOTAFFECTED / Vulnerable Code not in Execute Path.

Affected upstream versions: < 3.2.5, >= 4.0.0, < 4.1.0
Fixed upstream versions: v4.1.0
Upstream repository: https://github.com/vitest-dev/vitest
Upstream fix commit: 20e00ef7808de6d330c5e2fda530f686e08f1c8d
CVE-2026-47783: memcached: memcached: Username enumeration via timing side channel
Component: memcached
Severity: Important
CWE: CWE-208 (Observable Timing Discrepancy)
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-20T05:43:46.976000+00:00

A flaw was found in memcached. A remote attacker can exploit a timing side channel during Simple Authentication and Security Layer (SASL) password database authentication. This vulnerability allows an attacker to observe subtle timing differences, which could be used to enumerate valid usernames.


Affected upstream versions: <= 1.6.41
Fixed upstream versions: 1.6.42
Upstream repository: https://github.com/memcached/memcached
Upstream fix commit: d13f282b4bce33a9c33b8a1bbf07f12114160fed
CVE-2026-47784: memcached: Memcached: Information disclosure via timing side channel
Component: memcached
Severity: Moderate
CWE: CWE-208 (Observable Timing Discrepancy)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2026-05-20T05:45:37.864000+00:00

A flaw was found in memcached. This vulnerability involves a timing side channel during SASL (Simple Authentication and Security Layer) password database authentication. A remote attacker could potentially exploit the timing differences in the password verification process to infer sensitive password data. This could lead to unauthorized access to the memcached instance.


Affected upstream versions: <= 1.6.41
Fixed upstream versions: 1.6.42
Upstream repository: https://github.com/memcached/memcached
Upstream fix commit: d13f282b4bce33a9c33b8a1bbf07f12114160fed
CVE-2026-4786: python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API
Component: python
Severity: Important
CWE: CWE-88 (Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'))
CVSS v3: 7.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L)
Public date: 2026-04-13T21:52:19.036000+00:00

A flaw was found in the Python webbrowser.open() API. If a specially crafted URL containing "%action" is processed, an attacker could bypass a previous mitigation for CVE-2026-4519. This bypass allows for command injection into the underlying shell, potentially leading to arbitrary code execution.

Statement: This flaw in the Python `webbrowser.open()` API allows for command injection and arbitrary code execution when processing specially crafted URLs containing "%action". This bypasses a previous mitigation for CVE-2026-4519.

Affected upstream versions: 3.14.0a1 < 3.14.5rc1, 3.15.0a1 < 3.15.0b1
Upstream repository: https://github.com/python/cpython
Upstream fix commit: c5767a72838a8dda9d6dc5d3558075b055c56bca
CVE-2026-48779: ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments
Component: ws
Severity: Important
CWE: CWE-1050 (Excessive Platform Resource Consumption within a Loop)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-06-16T21:26:22.537000+00:00

A flaw was found in ws, an open source WebSocket client and server. A remote attacker can exploit this memory exhaustion vulnerability by sending a high volume of exceptionally small fragments and data chunks. This action forces the affected component to allocate and hold structural wrappers that consume excessive memory. Consequently, this leads to process termination and a denial of service (DoS) for the remote peer.

Statement: This is an Important denial of service vulnerability in the `ws` WebSocket library. A remote attacker can exploit this flaw by sending a high volume of small, fragmented data, leading to excessive memory consumption and subsequent process termination. This can result in service disruption for Red Hat products that utilize `ws` for WebSocket communication.

Affected upstream versions: >= 1.1.0, < 5.2.5, >= 6.0.0, < 6.2.4, >= 7.0.0, < 7.5.11, >= 8.0.0, < 8.21.0
Fixed upstream versions: 6.2.4
Upstream repository: https://github.com/websockets/ws
Upstream fix commit: 86d3e8a5fb0246ed373860c5fbb0de88824a27f7