apk package
chainguard/py3.11-captum
pkg:apk/chainguard/py3.11-captum
Vulnerabilities (34)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-53486 | imp | 8.1 | < 0.9.0-r1 | 0.9.0-r1 | Jul 14, 2026 | decompress: @xhmikosr/decompress: Decompress: Arbitrary file read/write via crafted archive extraction | |
| CVE-2026-11525 | low | 3.7 | < 0.9.0-r1 | 0.9.0-r1 | Jun 17, 2026 | undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header | |
| CVE-2026-6733 | low | 3.7 | < 0.9.0-r1 | 0.9.0-r1 | Jun 17, 2026 | undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. | |
| CVE-2026-9678 | mod | 5.9 | < 0.9.0-r1 | 0.9.0-r1 | Jun 17, 2026 | undici: Undici: Information disclosure due to improper cache-control header parsing | |
| CVE-2026-9679 | mod | 5.9 | < 0.9.0-r1 | 0.9.0-r1 | Jun 17, 2026 | undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding | |
| CVE-2026-9697 | imp | 7.4 | < 0.9.0-r1 | 0.9.0-r1 | Jun 17, 2026 | undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy | |
| CVE-2026-6734 | imp | 7.5 | < 0.9.0-r1 | 0.9.0-r1 | Jun 17, 2026 | undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing | |
| CVE-2026-12151 | imp | 7.5 | < 0.9.0-r1 | 0.9.0-r1 | Jun 17, 2026 | undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames | |
| CVE-2026-53655 | — | < 0.9.0-r1 | 0.9.0-r1 | Jun 15, 2026 | ### Summary `tar` (node-tar) applies a PAX extended header's `size=` record (and other PAX overrides) to the **next header entry of any type**, including intermediary metadata headers such as a GNU long-name (`L`) or long-link (`K`) entry. Per POSIX pax, a PAX extended header (` | ||
| CVE-2026-53550 | — | < 0.9.0-r1 | 0.9.0-r1 | Jun 15, 2026 | ### Summary A crafted YAML document can trigger algorithmic CPU exhaustion in `js-yaml` merge-key processing (`<<`) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event | ||
| CVE-2026-49356 | low | — | < 0.9.0-r1 | 0.9.0-r1 | Jun 15, 2026 | ## Impact Using `@babel/core` to compile maliciously crafted code can allow ab attacker to read any source map from the system that is running Babel, if these conditions are _all_ true: - the attacker controls the input source code - the attacker can read the output source code | |
| CVE-2026-9277 | Hig | 8.1 | < 0.9.0-r1 | 0.9.0-r1 | May 22, 2026 | shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line te | |
| CVE-2026-8723 | Med | 5.3 | < 0.9.0-r1 | 0.9.0-r1 | May 17, 2026 | ### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`). | |
| CVE-2026-44665 | Med | 6.1 | < 0.9.0-r1 | 0.9.0-r1 | May 13, 2026 | fast-xml-builder builds XML from JSON. Prior to 1.1.7, when an input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes. This gives the room for an attacker to insert unwanted attributes to the XML/HTML. | |
| CVE-2026-41650 | Med | 6.1 | < 0.9.0-r1 | 0.9.0-r1 | May 7, 2026 | fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "-->" sequence in comment content or the "]]>" sequence in CDATA sections when building XML from JavaScript objects. This | |
| CVE-2026-41907 | Hig | 7.5 | < 0.9.0-r1 | 0.9.0-r1 | Apr 24, 2026 | uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fi | |
| CVE-2026-41305 | Med | 6.1 | < 0.9.0-r1 | 0.9.0-r1 | Apr 24, 2026 | PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for em | |
| CVE-2026-4800 | Hig | 8.1 | < 0.9.0-r1 | 0.9.0-r1 | Mar 31, 2026 | Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. When an a | |
| CVE-2026-33750 | Med | 6.5 | < 0.9.0-r1 | 0.9.0-r1 | Mar 27, 2026 | The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process | |
| CVE-2026-4867 | Hig | 7.5 | < 0.9.0-r1 | 0.9.0-r1 | Mar 26, 2026 | Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in path-to-regexp@0.1.12 only prevents ambigu |
- affected < 0.9.0-r1fixed 0.9.0-r1
decompress: @xhmikosr/decompress: Decompress: Arbitrary file read/write via crafted archive extraction
- affected < 0.9.0-r1fixed 0.9.0-r1
undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header
- affected < 0.9.0-r1fixed 0.9.0-r1
undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery.
- affected < 0.9.0-r1fixed 0.9.0-r1
undici: Undici: Information disclosure due to improper cache-control header parsing
- affected < 0.9.0-r1fixed 0.9.0-r1
undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding
- affected < 0.9.0-r1fixed 0.9.0-r1
undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy
- affected < 0.9.0-r1fixed 0.9.0-r1
undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing
- affected < 0.9.0-r1fixed 0.9.0-r1
undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames
- CVE-2026-53655Jun 15, 2026affected < 0.9.0-r1fixed 0.9.0-r1
### Summary `tar` (node-tar) applies a PAX extended header's `size=` record (and other PAX overrides) to the **next header entry of any type**, including intermediary metadata headers such as a GNU long-name (`L`) or long-link (`K`) entry. Per POSIX pax, a PAX extended header (`
- CVE-2026-53550Jun 15, 2026affected < 0.9.0-r1fixed 0.9.0-r1
### Summary A crafted YAML document can trigger algorithmic CPU exhaustion in `js-yaml` merge-key processing (`<<`) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event
- affected < 0.9.0-r1fixed 0.9.0-r1
## Impact Using `@babel/core` to compile maliciously crafted code can allow ab attacker to read any source map from the system that is running Babel, if these conditions are _all_ true: - the attacker controls the input source code - the attacker can read the output source code
- affected < 0.9.0-r1fixed 0.9.0-r1
shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line te
- affected < 0.9.0-r1fixed 0.9.0-r1
### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`).
- affected < 0.9.0-r1fixed 0.9.0-r1
fast-xml-builder builds XML from JSON. Prior to 1.1.7, when an input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes. This gives the room for an attacker to insert unwanted attributes to the XML/HTML.
- affected < 0.9.0-r1fixed 0.9.0-r1
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "-->" sequence in comment content or the "]]>" sequence in CDATA sections when building XML from JavaScript objects. This
- affected < 0.9.0-r1fixed 0.9.0-r1
uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fi
- affected < 0.9.0-r1fixed 0.9.0-r1
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for em
- affected < 0.9.0-r1fixed 0.9.0-r1
Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. When an a
- affected < 0.9.0-r1fixed 0.9.0-r1
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process
- affected < 0.9.0-r1fixed 0.9.0-r1
Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in path-to-regexp@0.1.12 only prevents ambigu
Page 1 of 2