Target

• nodejs/node

Summary

• Improper enforcement in the Node.js Permission Model that can over-grant filesystem access across radix-tree prefix boundaries.
• Under --permission, an attacker granted access to one path could abuse boundary handling to read from or write to paths outside the intended filesystem allowlist.
• Affected: Node.js main, 22.x, 24.x, 26.x.

References

• CVE: https://hackerone.com/hacktivity/cve_discovery?id=CVE-2026-58043

Target

• nvm-sh/nvm

Summary

• Path traversal vulnerability caused by insufficient validation of mirror-supplied LTS codenames.
• A malicious or compromised Node.js mirror could write outside $NVM_DIR/alias/lts and overwrite shell startup files such as ~/.bashrc, ~/.zshrc, or ~/.profile, potentially leading to command execution when the shell starts.

References

• Advisory: https://github.com/nvm-sh/nvm/security/advisories/GHSA-4ghp-wxpw-rhpg
• CVE: https://www.cve.org/CVERecord?id=CVE-2026-15921

Status

• Coordinated disclosure (technical details will be published after the embargo).

Target

• nvm-sh/nvm

Summary

• Command injection caused by insufficient validation of environment variables during wget invocation.

References

• Advisory: https://github.com/nvm-sh/nvm/security/advisories/GHSA-4fc5-r4vr-8rp7
• CVE: https://www.cve.org/CVERecord?id=CVE-2026-1665

Target

• pnpm/pnpm

Summary

• Command injection through environment variable substitution, potentially leading to arbitrary code execution in CI/CD and build environments.

References

• Advisory: https://github.com/advisories/GHSA-2phv-j68v-wwqx

Target

• django/django

Summary

• Super-linear processing of repeated HTTP headers in the ASGI request path, enabling a potential denial-of-service attack.

References

• Advisory: https://github.com/advisories/GHSA-33mw-q7rj-mjwj