rpm package
opensuse/pi-coding-agent&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/pi-coding-agent&distro=openSUSE%20Tumbleweed
Vulnerabilities (6)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-102278 | Hig | 7.5 | < 1.0.0-1.1 | 1.0.0-1.1 | Sep 28, 2026 | The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the na | |
| CVE-2026-102277 | Med | 5.3 | < 1.0.0-1.1 | 1.0.0-1.1 | Sep 28, 2026 | The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing c | |
| CVE-2026-102276 | Hig | 7.5 | < 1.0.2-1.1 | 1.0.2-1.1 | Sep 28, 2026 | The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per br | |
| CVE-2026-84961 | Hig | 7.4 | < 0.87.1-1.1 | 0.87.1-1.1 | Sep 4, 2026 | undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a c | |
| CVE-2026-84947 | Low | 3.7 | < 0.87.1-1.1 | 0.87.1-1.1 | Sep 4, 2026 | undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead si | |
| CVE-2026-84933 | Med | 6.5 | < 0.87.1-1.1 | 0.87.1-1.1 | Sep 4, 2026 | undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example o |
- affected < 1.0.0-1.1fixed 1.0.0-1.1
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the na
- affected < 1.0.0-1.1fixed 1.0.0-1.1
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing c
- affected < 1.0.2-1.1fixed 1.0.2-1.1
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per br
- affected < 0.87.1-1.1fixed 0.87.1-1.1
undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a c
- affected < 0.87.1-1.1fixed 0.87.1-1.1
undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead si
- affected < 0.87.1-1.1fixed 0.87.1-1.1
undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example o