Checkmarx Zero Working to Keep the Open Source Ecosystem Safe https://xitter.cf/t.co/3yB6kPHV9B
Joined April 2022
- Tweets435
- Following18
- Followers251
- Likes31
Now, Node.js. The Internet keeps giving us more to patch. 🔧
Yesterday, Node.js dropped a security release addressing 10 vulnerabilities (4 High, 3 Medium, and 3 Low) across the 22.x, 24.x, and 26.x release lines.
Four of these particularly caught our attention:
- CVE-2026-111497: Potential Remote Code Execution through an out-of-bounds write in the Brotli decoder, which can affect applications that process untrusted Brotli-compressed data, directly or through a library.
- CVE-2026-105483 and CVE-2026-106069: Two TLS certificate hostname bypasses related to issues when parsing and resolving IP addresses.
- CVE-2026-105482: A `dns.resolve` issue where hostnames containing null bytes are truncated, potentially affecting what an application validates and what gets resolved.
Six other CVEs were also addressed. You can find the full list and technical details in the official Node.js advisory:
nodejs.org/en/blog/vulnerabi…
And there's more.
Node.js also shipped certificate-related updates in response to the eMudhra CA compromise, which we covered yesterday. If you missed that one, here's our breakdown of what happened and why it matters:
checkmarx.com/zero-post/eigh…
Stay safe by updating Node.js to the patched versions: **22.23.4, 24.22.1, or 26.12.1**.
If you're running an end-of-life release line, it's time to migrate to a supported one.
Blog post coming soon.
#NodeJS #AppSec #CheckmarxZero
A critical compromise of the private keys for eight eMudhra intermediate Certificate Authority (CA) certificates has exposed systems across the Internet to potential impersonation attacks.
The private keys were generated with Weak Cryptographic Entropy, compromising trust in the certificates. Six were intended for TLS and two for code signing, potentially allowing attackers to forge certificates and impersonate websites or services, including against applications relying on outdated or custom certificate trust stores.
Go responded with an URGENT security update, releasing versions 1.27.3 and 1.26.10 to mitigate the issue, tracked as CVE-2026-111943. The fix introduces a deny list that rejects any chain containing one of the blocked keys.
Chrome, Mozilla, Cloudflare, and other major providers have also taken action. But the impact goes beyond browsers and infrastructure providers, reaching the broader software dependency ecosystem, including Python's certifi, Rust's webpki-roots, and many others.
Organizations are strongly advised to follow security recommendations from affected providers, apply available updates, and review certificate trust configurations to ensure compromised intermediates are no longer trusted.
Learn more:
checkmarx.com/zero-post/eigh…
#CheckmarxZero #SupplyChainSecurity #AppSec
Misinformation about #PHP2Shell remediation and mitigation is making the rounds; be careful! Dor Tumarkin covers the issue and provides reliable guidance for remediation.
Critically, note that as Dor says:❗️Any [PHP] version before 8.2 are EOL and no fix is forthcoming – these versions must be migrated to 8.2 or later secure versions.❗️
checkmarx.com/zero-post/php2…
#PHP #PHP2Noise #VulnerabilityManagement #Vulnerability #OpenSource #Cybersecurity
🚨 CVE-2026-112900 and CVE-2026-112403: Two critical-severity vulnerabilities affecting Pillow.
CVE-2026-112900 (versions 2.6.0 through 12.3.0) allows a crafted filename to inject Ghostscript arguments when opening EPS files, potentially leading to command execution.
CVE-2026-112403 (versions through 12.3.0) allows a crafted lossless JPEG processed with thumbnail() to trigger a heap buffer overflow.
PoCs are included in public advisories.
Upgrade to version 13.0.0.
Credits:
- Chanu Kang, CysecLab at KAIST (CVE-2026-112900)
- David Korczynski (CVE-2026-112403), found by Anthropic using Claude, validated by Ada Logics.
More details:
devhub.checkmarx.com/cve-det…
devhub.checkmarx.com/cve-det…
A low-risk (in practice, despite the Medium severity) JupyterLab vulnerability (CVE-2026-102832) is an example of a bug class every developer should recognize: time-of-check to time-of-use (TOCTOU). Credit to rexpository for reporting it, and to MUFFANUJ and krassowski for the fix and coordination.
The flow: you click a button in a Markdown file or notebook, and JupyterLab asks whether to Cancel, Run Once, or Trust. You're deciding about the document you clicked in. But the code applies "Trust" to whichever document is current when you answer. If another document becomes current while the prompt is open, that one gets trusted instead, and the one you were reading stays untrusted. The app is checking for permission for one thing, but using that permission assuming "what's current" won't have changed.
The lesson: when a user approves something, bind the approval to the exact object they saw, not to "whatever is current" later. That's what the fix does. The trust request now carries the document that was clicked, and the command runs only after that same document is marked.
🟢 Should you worry? Not much. It takes a notebook or Markdown file from someone else, a click, a Trust answer, and a second document becoming current at exactly the wrong moment. The advisory itself rates the complexity high and treats this as defense in depth.
If you run JupyterLab: update to 4.5.11 or 4.6.4 (Notebook 7.6.3 and jupyterlite-core 0.8.4 carry the fix too). Until then, choose Run Once instead of Trust.
If you write code with confirm prompts, approval dialogs, or async handlers: check what each one resolves at answer time.
Read the full advisory:
github.com/jupyterlab/jupyte…
#AppSec #SecureCoding #Jupyter
ALT Checkmarx Zero advisory card for CVE-2026-102832, JupyterLab trust prompt, CVSS 4.2 medium, with affected and patched versions for jupyterlab, jupyterlite-core, and notebook.
Python's .pth files have been a thorn in AppSec's side for a while, but PEP-829's .start file specification aims to improve matters.
.pth files are intended to tell Python additional places to search for importable libraries; but they can easily be abused to execute arbitrary code. The .start file specification aims to add some safety compared to .pth files while preserving important backward-compatibility.
It's a good idea, but like npm's disabling of lifecycle scripts, it doesn't stop malware. Attackers can still get their code to run with .start files, and of course they can also move their code into the .py modules themselves.
Bruno Dias discusses the change, its strengths and weaknesses, and some considerations for developers and AppSec teams: checkmarx.com/zero-post/pep-…
#AppSec #Python #PEP829 #Path #OpenSource
‼️ Your AI infrastructure has an attack surface. #LMCache is the latest reminder.
5 recently disclosed CVEs deserve attention. Two stand out:
→ CVE-2026-105192
→ CVE-2026-107204
Both are critical (CVSS 9.8) and can lead to unauthenticated Remote Code Execution (#RCE) when vulnerable services are reachable.
The question isn't just "Which version are we running?"
It's "Which services are exposed, and who can reach them?"
Mitigate now: Keep ZeroMQ bound to localhost or a trusted cluster network, firewall its port, and restrict access to LMCache's HTTP endpoints.
AI infrastructure is production infrastructure. Secure it accordingly.
#CheckmarxZero #AISecurity #CVE
🚨 6 new CVEs were published yesterday affecting different versions of fast-jwt, a popular JWT library used in the Node.js ecosystem.
Severity ranges from Medium to Critical, across different vulnerability classes including algorithm confusion and token expiration issues. The critical one (CVE-2026-107722) is an incomplete fix for an earlier #CVE and may allow attackers to forge tokens and bypass authentication.
👉️ Fixes landed in different releases. Upgrade to fast-jwt 6.3.4 to be covered against all six: CVE-2026-107719, CVE-2026-107720, CVE-2026-107721, CVE-2026-107722, CVE-2026-107723, CVE-2026-107724 ; with *22 being the critical; *20, *23, *24 being High.
#AppSec #npm
🚨 CVE-2026-90970: Critical RCE in GitLab AI Gateway (CVSS 9.9)
A logged-in user with low privileges and Duo Agent Platform access can escape the prompt template sandbox with a crafted flow configuration. That lets them run arbitrary commands on a self-hosted AI Gateway.
Affected versions:
• 18.1.6 through 19.2.3
• 19.3.0 through 19.3.1
• 19.4.0
Fixed versions:
• 19.2.4
• 19.3.2
• 19.4.1
👀 Have you checked the latest #Next.js security release?
7 #vulnerabilities were addressed, including 1 High, 5 Medium, and 1 Low.
The issues range from SSRF in Image Optimization to cache poisoning, unintended information disclosure, and exposure through the development server's MCP endpoint.
Different vulnerabilities, different attack conditions, and potentially very different impacts depending on how Next.js is used.
If you're running an affected version, make sure to update to v16.3.8 or v15.5.27, depending on your release line.
🔗 Official release
buff.ly/NRNiG7q
#CheckmarxZero #AppSec
🚨 #Handlebars, a widely used JS templating library, just released two critical #RCE vulnerabilities. CVE-2026-106445 is a bypass of the prototype-access denial for the Function constructor. An attacker can render a template that reaches Function.prototype when allowProtoMethodsByDefault is enabled, allowing the execution of arbitrary #JS on the server.
CVE-2026-106446 is a bypass of CVE-2026-33937 by evading prior AST validation, permitting JS expressions in unchecked values like Program.blockParams.length. The compiler emits those values as valid JavaScript, leading to server-side RCE.
Be sure to update Handlebars to v4.7.10!
More details: devhub.checkmarx.com/cve-det… devhub.checkmarx.com/cve-det…
The EU CRA (Cyber Resilience Act) provisions have started kicking in, with reporting requirements for incidents and exploited vulnerabilities.
Our teammate Avek brings her compliance expertise to bear to help you understand when these provisions affect you, and what's required of you. She even covers when your organizations' open-source projects are and are not covered.
See the complete rundown at checkmarx.com/zero-post/the-…
#CyberResilienceAct #CRA #EUCyberResilienceAct #Cybersecurity #Compliance #AppSec #ApplicationSecurity #SoftwareSupplyChain #OpenSource #SBOM #VulnerabilityManagement #CyberSecurityCompliance #RegTech #CheckmarxZero #InfoSec
🚨 Critical-severity CVE-2026-94545 affects Next.js 16.2.0 through 16.3.5 when attacker-controlled input is passed to ImageResponse.
Another critical RCE in Next.js, this time through SVG injection during image generation. The underlying flaw resides in Satori, the library used to convert JSX and CSS into SVG before ImageResponse generates the final PNG.
Insufficient escaping allows attacker-controlled values to become SVG markup, leading to code execution during image processing.
Next.js 15 and the Edge implementation of ImageResponse are not affected. Checkmarx SCA already detects affected versions.
👉 Update to Next.js 16.3.6.
More details at Cx Zero:buff.ly/FLhA4Md
We just found an npm supply-chain campaign that's already earned attackers 109 ETH (~€230,933) — and it doesn't use `postinstall` or any other lifecycle script.
The malicious package, indexed-btree, mimics the legitimate sorted-btree library and has hit nearly 2 million weekly downloads. Instead of a preinstall or postinstall hook, the trigger is buried inside a commonly-called method.
Once triggered, it fingerprints the host and exfiltrates data, then talks to an Ethereum smart contract on Sepolia as its C2 channel. On-chain getters/setters instead of a domain makes it significantly more resilient to takedown. A second-stage payload gets unlocked via an on-chain X25519/ECDH key exchange before it self-deletes to cover its tracks.
⏩ What to do: Check your dependencies against the IOC list in the full post (packages, contract address, RPC endpoints, bot tokens) and respond if you have matches.
🧠 If you don't use these specific packages, the bigger takeaway still applies — this confirms our prediction that npm's lifecycle-script crackdown wouldn't stop attackers, just push the trigger from install-time to runtime. Install-script hygiene alone won't catch this class of threat; runtime behavior analysis will.
Full writeup with all IOCs: checkmarx.com/zero-post/npm-…
#AppSec #SupplyChainSecurity #npm #MalwareAnalysis #OpenSourceSecurity
🚨 CVSS 10.0 - CVE-2026-76460 affects Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), regardless of device configuration. An unauthenticated, remote attacker can exploit insufficient authentication controls on an API endpoint to bypass authentication and gain unauthorized access to the web-based management interface. Cisco reports active exploitation.
Affected: ISE/ISE-PIC 3.1, 3.2, 3.3, 3.4, 3.5 (and earlier releases; 3.0 is EoSM).
Fixed: 3.1 Patch 12 | 3.2 Patch 11 | 3.3 Patch 12 | 3.4 Patch 7 | 3.5 Patch 4
sec.cloudapps.cisco.com/secu…
Gitlab just released versions 19.3.2, 19.2.6, 19.1.8 that include security fixes for two critical CVEs:
🚨 CVE-2026-85706: A 10.0 Path Traversal in the repository commits API allowing unauthenticated users to read arbitrary files from Gitlab Server, affecting Community and Enterprise Editions versions from 18.7.
🚨 CVE-2026-87719: A 9.9 Insecure Deserialization allowing authenticated users with Duo Chat access to get Advanced Search instance configurations and sensitive credentials via a crafted GraphQL subscription argument, affecting only Enterprise Edition versions from 18.3.
There are more CVEs being patched in this release, you can read about it here: docs.gitlab.com/releases/pat…
If you're running your own 🦊 Gitlab installation, patch immediately.
Great feature for GitHub, blocking PRs if there are unresolved secrets findings. Too bad it's just if you use their GHAS secrets stuff. Still, if you do -- this is probably worth turning on experimentally.
A thing to watch for during the experiment is alert fatigue; if there are too many FPs, devs will just mark the secrets findings as FP (if they can) and move on. If dev's _can't_ mark an FP, they're going to be really annoyed with you so... proceed with caution.
github.blog/changelog/2026-0…
🚨 CVE-2026-75650 (critical-severity) affects Magento Open Source 2.4.4 through 2.4.9.
Unsanitized input is interpreted as template code, giving unauthenticated attackers remote code execution with no user interaction. Already actively exploited in the wild. Apply the VULN-39341 hotfix via Composer; no version upgrade is available yet.
More details: devhub.checkmarx.com/cve-det…
🚨 Critical-severity CVE-2026-75604 affects Next.js 13.4.x before 15.5.24, 16.0.x before 16.3.3 and some canary versions, running on Windows with Pages Router and App Router configured without Cache Components.
About 9 months after React2Shell, Next.js has patched another critical pre-auth RCE (CVSS 9.0) via a path traversal in the filesystem cache on Windows-hosted servers. PoCs are already circulating. Linux and macOS are not affected.
The same release also fixes a second critical RCE in the Image Optimization API, triggered via a libheif flaw when processing attacker-controlled AVIF images.
👉 Update to 15.5.24, 16.3.3 or 16.4.0-canary.7 now.
More details: buff.ly/LdWZiJF
