Security Advisories

high2026-10-22

toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

binarymuse/toml-node · GHSA-h895-cgqg-jf52 · CVE-2026-114142

high2026-10-22

toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

binarymuse/toml-node · GHSA-4qx8-w7c3-pj3p · CVE-2026-114141

high2026-10-22

toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()

binarymuse/toml-node · GHSA-9j65-hcg3-gc64 · CVE-2026-114143

high2026-10-22

toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()

binarymuse/toml-node · GHSA-9qmh-m7c6-f92p · CVE-2026-114144

high2026-10-22

Storybook dev server vulnerable to code injection from the local network

storybookjs/storybook · GHSA-px85-f4q5-jh77 · CVE-2026-114126

medium2026-10-22

Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering

withastro/astro · GHSA-98hj-9722-w3j8 · CVE-2026-114128

low2026-10-22

Astro: Arbitrary CSS injection in Astro View Transitions

withastro/astro · GHSA-mpr7-6m5w-76rw · CVE-2026-114127

high2026-10-22

GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

ardatan/graphql-tools · GHSA-c4qx-w738-7hr3 · CVE-2026-114604

high2026-10-22

GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit

graphql-python/graphql-core · GHSA-r77w-qph3-7vf8 · CVE-2026-75508

high2026-10-22

GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule

graphql-python/graphql-core · GHSA-vj8h-fx38-h3vc · CVE-2026-75507

critical2026-10-22

DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes

cure53/dompurify · GHSA-cg2g-xh64-v4q7

high2026-10-22

DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)

cure53/dompurify · GHSA-mrv2-3pqr-j5jr

low2026-10-22

DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml

cure53/dompurify · GHSA-c6gr-qvv4-5v3f

high2026-10-22

nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc

jupyter/nbconvert · GHSA-pjvx-prjx-h659 · CVE-2026-114140

medium2026-10-22

OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

open-telemetry/opentelemetry-python · GHSA-xcq7-p3pf-p88h · CVE-2026-114603

medium2026-10-22

ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

beaugunderson/ip-address · GHSA-rxp7-6hxx-x8q5 · CVE-2026-111997

high2026-10-22

Black: GitHub Action installs unvalidated required-version from pyproject.toml

psf/black · GHSA-cg8m-r9f2-5wm2 · CVE-2026-114134

high2026-10-22

Django REST framework: TokenProxy.delete() reports success and revokes nothing

encode/django-rest-framework · GHSA-xw6w-gcfp-cf8m · CVE-2026-114137

high2026-10-22

Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation

encode/django-rest-framework · GHSA-33wh-fxxf-88vv · CVE-2026-114138

high2026-10-22

Django REST framework: JSONParser applies an attacker-named codec to the request stream

encode/django-rest-framework · GHSA-3547-9m27-7rxg · CVE-2026-114136