rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-39701 WordPress ShopWP plugin <= 5.2.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in Andrew ShopWP wpshopify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopWP: from n/a through <= 5.2.4.
Problem types: cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: Andrew
product: ShopWP
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Nabil Irawan | Patchstack Bug Bounty Program
Published: 2026-04-08T08:30:46.861Z
CVE-2026-39702 WordPress Animation Addons for Elementor plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wealcoder Animation Addons for Elementor animation-addons-for-elementor allows DOM-Based XSS.This issue affects Animation Addons for Elementor: from n/a through <= 2.6.1.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Wealcoder
product: Animation Addons for Elementor
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Abu Hurayra | Patchstack Bug Bounty Program
Published: 2026-04-08T08:30:47.029Z
CVE-2026-39703 WordPress WPBITS Addons For Elementor Page Builder plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpbits WPBITS Addons For Elementor Page Builder wpbits-addons-for-elementor allows Stored XSS.This issue affects WPBITS Addons For Elementor Page Builder: from n/a through <= 1.8.1.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: wpbits
product: WPBITS Addons For Elementor Page Builder
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Abu Hurayra | Patchstack Bug Bounty Program
Published: 2026-04-08T08:30:47.201Z
CVE-2026-39704 WordPress Precious Metals Automated Product Pricing – Pro plugin <= 4.0.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in nfusionsolutions Precious Metals Automated Product Pricing – Pro precious-metals-automated-product-pricing-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Precious Metals Automated Product Pricing – Pro: from n/a through <= 4.0.5.
Problem types: cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: nfusionsolutions
product: Precious Metals Automated Product Pricing – Pro
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Nabil Irawan | Patchstack Bug Bounty Program
Published: 2026-04-08T08:30:47.383Z
CVE-2026-39705 WordPress MIPL WC Multisite Sync plugin <= 1.4.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in Mulika Team MIPL WC Multisite Sync mipl-wc-multisite-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MIPL WC Multisite Sync: from n/a through <= 1.4.4.
Problem types: cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: Mulika Team
product: MIPL WC Multisite Sync
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Legion Hunter | Patchstack Bug Bounty Program
Published: 2026-04-08T08:30:47.550Z
CVE-2026-39706 WordPress Make My Trivia plugin <= 1.1.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Netro Systems Make My Trivia trivialy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Make My Trivia: from n/a through <= 1.1.0.
Problem types: cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: Netro Systems
product: Make My Trivia
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Nabil Irawan | Patchstack Bug Bounty Program
Published: 2026-04-08T08:30:47.730Z
CVE-2026-39707 WordPress Accept PayPal Payments using Contact Form 7 plugin <= 4.0.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in ZealousWeb Accept PayPal Payments using Contact Form 7 contact-form-7-paypal-extension allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accept PayPal Payments using Contact Form 7: from n/a through <= 4.0.4.
Problem types: cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: ZealousWeb
product: Accept PayPal Payments using Contact Form 7
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Nabil Irawan | Patchstack Bug Bounty Program
Published: 2026-04-08T08:30:47.904Z
CVE-2026-39708 WordPress UiCore Elements plugin <= 1.3.14 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uicore UiCore Elements uicore-elements allows Stored XSS.This issue affects UiCore Elements: from n/a through <= 1.3.14.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: uicore
product: UiCore Elements
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Abu Hurayra | Patchstack Bug Bounty Program
Published: 2026-04-08T08:30:48.106Z
CVE-2026-39709 WordPress The Tribal plugin <= 1.3.4 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in thetechtribe The Tribal the-tech-tribe allows Retrieve Embedded Sensitive Data.This issue affects The Tribal: from n/a through <= 1.3.4.
Problem types: cwe_id: CWE-201
description: Insertion of Sensitive Information Into Sent Data
Affected products: vendor: thetechtribe
product: The Tribal
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Nabil Irawan | Patchstack Bug Bounty Program
Published: 2026-04-08T08:30:48.380Z
CVE-2026-39710 WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Cross Site Request Forgery.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: stmcan
product: RT-Theme 18 | Extensions
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Bonds | Patchstack Bug Bounty Program
Published: 2026-04-08T08:30:48.574Z
CVE-2026-39711 WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Retrieve Embedded Sensitive Data.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.
Problem types: cwe_id: CWE-201
description: Insertion of Sensitive Information Into Sent Data
Affected products: vendor: stmcan
product: RT-Theme 18 | Extensions
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Bonds | Patchstack Bug Bounty Program
Published: 2026-04-08T08:30:48.755Z
CVE-2026-39712 WordPress tagDiv Composer plugin <= 5.4.3 - Arbitrary Shortcode Execution vulnerability
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in tagDiv tagDiv Composer td-composer allows Code Injection.This issue affects tagDiv Composer: from n/a through <= 5.4.3.
Problem types: cwe_id: CWE-80
description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: tagDiv
product: tagDiv Composer
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Bonds | Patchstack Bug Bounty Program
Published: 2026-04-08T08:30:48.938Z
CVE-2026-39713 WordPress Mailercloud – Integrate webforms and synchronize website contacts plugin <= 1.0.7 - Broken Access Control vulnerability
Missing Authorization vulnerability in mailercloud Mailercloud – Integrate webforms and synchronize website contacts mailercloud-integrate-webforms-synchronize-contacts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mailercloud – Integrate webforms and synchronize website contacts: from n/a through <= 1.0.7.
Problem types: cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: mailercloud
product: Mailercloud – Integrate webforms and synchronize website contacts
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Nabil Irawan | Patchstack Bug Bounty Program
Published: 2026-04-08T08:30:49.120Z
CVE-2026-39714 WordPress G5Plus April theme <= 6.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in G5Theme G5Plus April g5plus-april allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects G5Plus April: from n/a through <= 6.8.
Problem types: cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: G5Theme
product: G5Plus April
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Phat RiO | Patchstack Bug Bounty Program
Published: 2026-04-08T08:30:49.299Z
CVE-2026-39715 WordPress AnyTrack Affiliate Link Manager plugin <= 1.5.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in AnyTrack AnyTrack Affiliate Link Manager anytrack-affiliate-link-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyTrack Affiliate Link Manager: from n/a through <= 1.5.5.
Problem types: cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: AnyTrack
product: AnyTrack Affiliate Link Manager
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Nabil Irawan | Patchstack Bug Bounty Program
Published: 2026-04-08T08:30:49.638Z
CVE-2026-39716 WordPress Flipmart theme <= 2.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in CKThemes Flipmart flipmart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flipmart: from n/a through <= 2.8.
Problem types: cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: CKThemes
product: Flipmart
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: João Pedro S Alcântara (Kinorth) | Patchstack Bug Bounty Program
Published: 2026-04-08T08:30:49.850Z
CVE-2026-39803 HTTP/1 chunked body reader ignores length cap in bandit
Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion.

The chunked clause of 'Elixir.Bandit.HTTP1.Socket':read_data/2 in lib/bandit/http1/socket.ex ignores the caller-supplied :length option when reading HTTP/1 chunked request bodies. Instead of capping the accumulated body at the configured limit (e.g. Plug.Parsers' default 8 MB), do_read_chunked_data!/5 buffers every received chunk into an iolist unconditionally and materializes the entire body as a single binary. The function always returns {:ok, body, ...}, so callers cannot interpose a 413 response.

Because Plug.Parsers runs before routing and authentication in the standard Phoenix endpoint, an unauthenticated attacker needs no valid route or credentials. Sending a single Transfer-Encoding: chunked POST request with an arbitrarily large body to any path causes the BEAM process to exhaust available memory and be terminated by the OS OOM killer.

The content-length path in the same function correctly enforces the limit and is not affected.

This issue affects bandit: from 1.4.0 before 1.11.1.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: mtrudel
product: bandit
cpes: cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*
default_status: unaffected
vendor: mtrudel
product: bandit
cpes: cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*
default_status: unaffected
Credits: lang: en
value: Peter Ullrich
lang: en
value: Mat Trudel
lang: en
value: Jonatan Männchen / EEF
Published: 2026-05-13T13:36:09.648Z
CVE-2026-39804 WebSocket permessage-deflate inflate has no output-size cap in bandit
Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion when WebSocket permessage-deflate compression is enabled.

'Elixir.Bandit.WebSocket.PerMessageDeflate':inflate/2 in lib/bandit/websocket/permessage_deflate.ex calls :zlib.inflate/2 with no output-size cap, then materializes the entire decompressed payload as a single binary via IO.iodata_to_binary/1. The websocket_options.max_frame_size option only bounds the on-the-wire (compressed) frame size, not the decompressed output. A high-ratio compressed frame (e.g. uniform data at ~1024:1 ratio) can stay well under any wire-size limit while forcing GiB-scale heap allocations in the connection process before any application code runs.

An unauthenticated attacker who can open a WebSocket connection can send a single such frame to exhaust the BEAM node's memory and trigger an OOM kill.

This vulnerability requires both Bandit's server-level websocket_options.compress and the per-upgrade compress: true option passed to WebSockAdapter.upgrade/4 to be enabled. Stock Phoenix and LiveView applications are not affected as they default to compress: false.

This issue affects bandit: from 0.5.9 before 1.11.0.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: mtrudel
product: bandit
cpes: cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*
default_status: unaffected
vendor: mtrudel
product: bandit
cpes: cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*
default_status: unaffected
Credits: lang: en
value: Peter Ullrich
lang: en
value: Mat Trudel
lang: en
value: Jonatan Männchen / EEF
Published: 2026-05-01T20:34:24.604Z
CVE-2026-39805 CL.CL HTTP request smuggling via duplicate Content-Length in bandit
Inconsistent Interpretation of HTTP Requests vulnerability in mtrudel bandit allows HTTP request smuggling via duplicate Content-Length headers.

'Elixir.Bandit.Headers':get_content_length/1 in lib/bandit/headers.ex uses List.keyfind/3, which returns only the first matching header. When a request contains two Content-Length headers with different values, Bandit silently accepts it, uses the first value to read the body, and dispatches the remaining bytes as a second pipelined request on the same keep-alive connection. RFC 9112 §6.3 requires recipients to treat this as an unrecoverable framing error.

When Bandit sits behind a proxy that picks the last Content-Length value and forwards the request rather than rejecting it, an unauthenticated attacker can smuggle requests past edge WAF rules, path-based ACLs, rate limiting, and audit logging.

This issue affects bandit: before 1.11.0.
Problem types: cwe_id: CWE-444
description: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products: vendor: mtrudel
product: bandit
cpes: cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*
default_status: unaffected
vendor: mtrudel
product: bandit
cpes: cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*
default_status: unaffected
Credits: lang: en
value: Peter Ullrich
lang: en
value: Mat Trudel
lang: en
value: Jonatan Männchen / EEF
Published: 2026-05-01T20:34:29.400Z
CVE-2026-39806 HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel bandit allows unauthenticated remote denial of service via worker process exhaustion.

'Elixir.Bandit.HTTP1.Socket':do_read_chunked_data!/5 in lib/bandit/http1/socket.ex terminates only when the last-chunk line 0\r\n is followed immediately by the empty trailer line \r\n. RFC 9112 §7.1.2 permits zero or more trailer fields between them. When trailers are present, none of the match clauses fit: the catch-all arm computes a negative to_read, calls read_available!/2, receives <<>> on timeout, and tail-recurses with unchanged state. The worker process is pinned for the lifetime of the TCP connection.

A handful of concurrent connections sending RFC-conformant chunked requests with trailer fields is sufficient to exhaust the Bandit worker pool and render the server unresponsive to all further traffic. No authentication, special headers, or large payload is required. Proxies such as NGINX and HAProxy legitimately forward trailer-bearing requests, so servers behind such proxies may be affected without any malicious client involvement.

This issue affects bandit: from 1.6.1 before 1.11.1.
Problem types: cwe_id: CWE-835
description: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products: vendor: mtrudel
product: bandit
cpes: cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*
default_status: unaffected
vendor: mtrudel
product: bandit
cpes: cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*
default_status: unaffected
Credits: lang: en
value: Peter Ullrich
lang: en
value: Mat Trudel
lang: en
value: Jonatan Männchen / EEF
Published: 2026-05-13T13:36:17.806Z
CVE-2026-39807 Client-supplied URI scheme trusted without transport verification in bandit
Reliance on Untrusted Inputs in a Security Decision vulnerability in mtrudel bandit allows unauthenticated transport-state spoofing on plaintext HTTP connections.

'Elixir.Bandit.Pipeline':determine_scheme/2 in lib/bandit/pipeline.ex returns the client-supplied URI scheme verbatim, ignoring the transport's secure? flag. HTTP/1.1 absolute-form request targets (e.g. GET https://victim/path HTTP/1.1) and the HTTP/2 :scheme pseudo-header are both attacker-controlled strings that flow through this function. Over a plaintext TCP connection, a client can declare https and Bandit will set conn.scheme = :https even though no TLS was negotiated.

Downstream Plug consumers that branch on conn.scheme are silently misled: Plug.SSL's already-secure branch skips its HTTP→HTTPS redirect, cookies emitted with secure: true are sent over plaintext, audit logs record requests as having arrived over HTTPS, and CSRF/SameSite gating may make incorrect decisions.

This issue affects bandit: from 1.0.0 before 1.11.0.
Problem types: cwe_id: CWE-807
description: CWE-807 Reliance on Untrusted Inputs in a Security Decision
Affected products: vendor: mtrudel
product: bandit
cpes: cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*
default_status: unaffected
vendor: mtrudel
product: bandit
cpes: cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*
default_status: unaffected
Credits: lang: en
value: Peter Ullrich
lang: en
value: Mat Trudel
lang: en
value: Jonatan Männchen / EEF
Published: 2026-05-01T20:34:22.832Z