Podman Container Escape via Env Var Injection

CVE-2026-57231 — Podman versions 1.8.1 through 5.8.4 contain a container-escape vector via environment variable injection. A malicious container image that defines an environment variable with only a key and no value can trick Podman into passing that same-named variable from the host into the container, leaking secrets such as API tokens, cloud credentials, or database passwords. The flaw exploits how Podman parses environment variable definitions in container images — when a key lacks a = separator, the runtime treats the host's environment variable of the same name as the value. This is a design-level ambiguity in the OCI image spec that Podman's implementation mishandles. Users should update to Podman 5.8.4 or later and audit any container images that use bare-key environment variables.

CVE-2026-55677 — The Echo Go web framework (versions prior to 4.15.3 and 5.2.0) suffers from a path-traversal vulnerability caused by a disagreement between the router and the static file handler on URL decoding. The router matches routes against the raw encoded path, preserving %2F as a literal slash, while StaticDirectoryHandler unescapes the path before serving files. An attacker can craft a request like /static/%2e%2e%2fsecret.txt — the router sees /static/%2e%2e%2fsecret.txt and routes to the static handler, which then decodes it to /static/../secret.txt, escaping the intended directory. This enables arbitrary file read on the host filesystem. Applications using Echo's static file serving should upgrade immediately and review any access logs for encoded path traversal attempts.

CVE-2026-56123 — socat versions 1.8.0.0 through 1.8.1.1 contain a heap-based buffer overflow in the SOCKS5 proxy client code. When socat connects through a malicious SOCKS5 proxy server, the DOMAINNAME reply parser suffers from a sign-extension flaw that allows the server to overwrite adjacent heap memory. An attacker who controls a SOCKS5 proxy that a socat client connects to can achieve remote code execution in the context of the socat process. This is particularly dangerous in containerized or microservice environments where socat is used as a network relay. Users should update to the latest socat release and ensure SOCKS5 proxies are trusted endpoints.

CVE-2026-56876 — The npm package extract-zip does not validate symlink targets when extracting archives, enabling arbitrary file write via symlink traversal. A malicious zip file containing a symlink with a relative path like ../../../../etc/passwd will be extracted as-is, allowing an attacker to overwrite files outside the extraction directory. This is a classic zip-symlink vulnerability in a package with over 1 million weekly downloads on npm. Any CI/CD pipeline or build process that uses extract-zip to unpack untrusted archives is vulnerable. Users should switch to a maintained alternative or apply the fix once available.

CVE-2026-57918 — libnfs through version 6.0.2 contains an integer underflow vulnerability in the RPC socket reader. When connecting to a crafted NFS server, the xid field in the PDU header can be manipulated to cause an integer underflow in rpc_read_from_socket, leading to a heap buffer over-read or crash. An attacker controlling an NFS server can trigger a denial of service or potentially leak memory contents from the client. This affects any application using libnfs to mount or access NFS shares, including backup tools and file managers. Users should update to the latest libnfs commit (935b8db or later) and avoid connecting to untrusted NFS servers.

CVE-2026-6658 — Jupyter nbconvert versions up to 7.17.0 are vulnerable to cross-site scripting (XSS) via unsanitized Mermaid diagram output. When a notebook contains a text/vnd.mermaid cell, nbconvert's HTML template renders the Mermaid content without escaping, allowing an attacker to inject arbitrary JavaScript into the exported HTML page. This affects any workflow that converts untrusted notebooks to HTML — for example, automated report generation or notebook-sharing platforms. Users should update nbconvert to the latest version and sanitize notebook inputs before conversion.