High-severity network-reachable flaw in HPE networking products can let attackers who already hold high-level privileges affect confidentiality, integrity, and availability. The exact affected models, firmware versions, and triggering feature are not described in the available sources; HPE bulletin hpesbnw05162en_us is the authoritative reference. No public exploit identified at time of analysis.
High-privilege attackers can achieve full confidentiality, integrity, and availability impact on affected HPE networking devices over the network, according to the CVSS 3.1 vector (7.2) with PR:H, AC:L, and UI:N. The high-privilege prerequisite excludes unauthenticated and low-privilege actors, but an already-authenticated administrator can reach the flaw without user interaction. No public exploit has been identified at time of analysis, and the exact product, versions, and trigger are not described in the supplied sources; HPE bulletin hpesbnw05162en_us should be consulted for scope.
Privileged network users can compromise the confidentiality, integrity, and availability of affected HPE products through a low-complexity, no-user-interaction flaw rated CVSS 3.1 base 7.2 HIGH. The specific HPE product, affected versions, and triggering feature are not described in the supplied sources; HPE advisory hpesbnw05162en_us is the only reference and must be consulted for scope. No public exploit code or CISA KEV entry is identified in the supplied data, and the PR:H requirement confines realistic exploitation to insiders or attackers using stolen high-privilege credentials.
Unauthenticated network reachability combined with existing high privileges on an affected HPE networking product can be leveraged to fully compromise confidentiality, integrity and availability (CVSS 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The high-privilege prerequisite (PR:H) is the primary limiting factor, so exposure is confined to administrators and to attackers who have already obtained privileged credentials; no user interaction is required and attack complexity is low once that access exists. The dataset is thin - no CVE description, no CWE and no CPE data were supplied, the trigger condition is not described in the available sources, and no public exploit has been identified at time of analysis (no KEV listing, no PoC reference). Priority is 'this_week' per the vuln.today decision label.
An attacker who already holds high administrative privileges on an affected, network-exposed HPE product can achieve high confidentiality, integrity, and availability impact (CVSS 7.2) through a low-complexity path that requires no user interaction. The supplied intelligence contains no CISA KEV confirmation and no public exploit identified at time of analysis, and it does not name the vulnerable component or describe the trigger; HPE bulletin hpesbnw05162en_us must be consulted for the affected product and version.
An authenticated administrator of an HPE networking product can reach a low-complexity, network-exposed flaw and achieve full confidentiality, integrity and availability impact on the affected component, according to an HPE security bulletin (document HPESBNW05162) scored at CVSS 3.1 base 7.2. The vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H confirms the issue is remotely reachable with no user interaction, but the high-privilege prerequisite (PR:H) means only an attacker who already holds an administrative or otherwise privileged account on the device can exploit it, so the realistic exposure is an insider, a compromised administrative credential, or a post-exploitation step, not anonymous internet attack. No public exploit code or proof-of-concept is referenced in the supplied sources, and the specific affected product, version, feature and protocol are not described in the available data.
Administrative users of an HPE networking product can abuse existing high privileges over the network to achieve full confidentiality, integrity, and availability impact under CVE-2026-79956 (CVSS 7.2). The flaw is remotely reachable with low complexity and no user interaction, but the PR:H vector means only attackers who already hold administrative access can exploit it, making insider or post-compromise abuse the realistic path. No public exploit was identified at time of analysis, and the HPE advisory is the primary source because no description or CWE was supplied.
NoSQL injection in MongoDB C# Driver before 3.13.0 lets an authenticated application user redirect LINQ-generated field paths by supplying dictionary keys, field names, or array-filter identifiers that contain dot or dollar characters. This can expose other users' documents, widen update operations beyond intended data, or write malformed fields that leave stored documents unreadable until repaired. The issue is a moderate-priority concern limited to applications that pass attacker-controllable input into field-name positions; no public exploit was identified at time of analysis, and it is fixed in driver 3.13.0.
Server-side request forgery filter bypass in Roundcube Webmail 1.6.14-1.6.19 and 1.7.0-1.7.4 allows an authenticated webmail user (authoritative assessment: PR:L; the supplied CVSS vector lists PR:N) to submit URLs containing NAT64 prefixes 64:ff9b::/96 or 64:ff9b:1::/48, or the unspecified address ::/128, that evade rcube_utils::is_local_url() and reach loopback, link-local, or cloud metadata services. The supplied CVSS score is 7.2 with changed scope and partial confidentiality/integrity impact; real-world impact depends on the server being able to route the NAT64-mapped addresses to live internal services. No public exploit identified at time of analysis.
IMAP command injection in Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows an authenticated remote user to inject CRLF sequences through the _flag parameter of the mail/mark action and execute arbitrary IMAP commands in their mail session. The CVSS 3.1 score is 7.1 (High) with PR:L, and default installations are vulnerable because mail/mark is available to normal logged-in users, so risk centers on compromised accounts, malicious insiders, or credentialed attackers rather than anonymous scanning. Vendor fixes are available in 1.6.20 and 1.7.5; no public exploit identified at time of analysis and no CISA KEV confirmation was provided.
Authentication bypass in Silicon Labs Connect SDK 4.3.1 and earlier, plus Flex SDK 3.7.7 and earlier, allows an attacker positioned within radio range of the device to send a protocol message carrying invalid security settings that the stack fails to verify, causing the message to be processed as though it came from a trusted source. Successful exploitation disrupts network operation (high integrity and availability impact) but cannot recover the Network Key or decrypt traffic, so confidentiality is explicitly unaffected. The trigger is unauthenticated, low complexity, and requires no user interaction, though the attacker must be within adjacent-network/radio range and cannot reach the device over the internet; no public exploit code or active exploitation is identified in the available data, and patch is available from the vendor.
Arbitrary local file read in Mistune's opt-in Include directive (all versions before 3.3.0, with 3.2.0 confirmed) lets an attacker who controls Markdown that an application renders through Markdown.read(path) disclose files readable by the rendering process - the advisory demonstrates reading /etc/passwd - and, when the included non-Markdown file contains markup, smuggle unescaped HTML or script into the rendered page. Exploitation requires two non-default conditions in the host application: the Include directive must be enabled via RSTDirective([Include()]), and the untrusted Markdown must be loaded from disk with Markdown.read(path); passing Markdown as a plain string does not trigger the flaw, and no public exploit is confirmed beyond the PoC reference published in the GHSA advisory. Confidentiality impact is the primary concern (assessed CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N), and the vendor fix is Mistune 3.3.0.
Authenticated clients of the Crawl4AI Docker API server (0.9.0 through 0.9.4) can freeze the entire service, including the /health endpoint, by submitting a catastrophic-backtracking regular expression in a /crawl request body through RegexExtractionStrategy.custom, RegexChunking.patterns, or a schema field of type 'regex' in the JSON extraction strategies. Python's re engine does not release the GIL while matching, so a single crafted pattern combined with an attacker-influenced page blocks the event loop and the crawl deadline cannot interrupt it. Exploitation requires a valid API bearer token and a crawl target whose text triggers the backtracking; a public proof-of-concept request is published in the vendor advisory, no active exploitation has been reported, and the vendor fixed the issue in 0.9.5. The library imported directly is not exposed unless the host application itself feeds untrusted regexes into these strategies.
Integrity-only NoSQL injection in the MongoDB C# Driver update-statement builder allows an authenticated application user with ordinary read-write access to influence update logic, potentially modifying or deleting stored data the application did not intend to change. The flaw is tracked as CSHARP-6168 and affects releases before 3.13.0; exploitation depends on the application passing attacker-influenced values directly into the affected update builder surface, so it is not reachable against a hardened application that does not do so. No public exploit was identified in the provided intelligence at time of analysis, and the primary remediation is upgrading to MongoDB .NET/C# Driver 3.13.0.
Authorization bypass in the Grav Flex Objects plugin 1.4.0 through 1.4.16 lets authenticated, non-super users holding api.access plus either admin.pages or admin.configuration.pages read page source and frontmatter, modify content, and delete pages they are explicitly denied, because the generic /api/v1/flex-objects/pages routes enforce only directory-level admin.pages checks instead of the Pages API's api.pages.read/write and page-level permission rules. Scored 7.1 with an independent assessment of high confidentiality and high integrity impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the flaw is a privilege-escalation problem past intended per-page restrictions rather than an anonymous compromise path - the attacker must already hold a valid restricted admin or editor account, and super-user accounts are unaffected. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a moderate-priority remediation item rather than a drop-everything emergency.
Authorization bypass (CWE-639) in the MarcosCamara01 Ecommerce Template lets any authenticated shopper delete or change the cart and wishlist rows that belong to other accounts on the same installation, because the Drizzle repository calls match rows on the primary key alone and the per-user PostgreSQL row level security policies never take effect for the application's connection. Affected deployments are those using the template's default single-DATABASE_URL setup, where the migration role that creates the tables is also the runtime role, so PostgreSQL does not apply RLS to the table owner; cart_items.id and wishlist.id are sequential bigserial values, making other users' row identifiers enumerable, and the update path returns the modified row including its owning user_id. A valid low-privileged account on the target is required and no user interaction is needed; no public exploit identified at time of analysis, and vendor-side code addressing both the RLS enforcement gap and the missing ownership predicates is available in the referenced commit.
Price substitution in the MarcosCamara01 Ecommerce Template cart and checkout flow lets any authenticated customer pay a cheap Stripe price while ordering a more expensive variant, producing paid orders and order records that do not match. The flaw exists because /api/user/cart stores client-supplied variantId and stripeId independently, and /api/stripe/payment charges the stored stripeId while the checkout.session.completed webhook records the variantId. The vendor commit e6b364cd668f2ba875cfa7f6d55c63e771715df7 removes stripeId from client input and resolves pricing server-side; a public PoC reference exists in the vendor regression test and is not verified as working exploit code, and no CISA KEV active exploitation is reported in the supplied data.
Authenticated restricted TLS clients on Incus can retrieve S3 access and secret keys for storage buckets in the default project, enabling them to read, modify, or delete bucket objects directly through the S3 endpoint. The issue affects Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 when the TLS authorizer is in use; OpenFGA deployments are not affected. No public exploit identified at time of analysis.
Canonical Juju 4.0 through 4.0.15 leaves the model unit-resources download route without an authorization check, so any principal already authenticated to the controller - a unit agent, or a human user holding only 'login' permission with no access to the target model - can request an arbitrary unit in an arbitrary model and read that application's charm resources, including container-registry credentials. The fix in Juju 4.0.16 binds the unit named in the request URL to the authenticated identity, refusing cross-unit and cross-model access. No public exploit code was identified at time of analysis, and the flaw requires a valid controller credential, though one at the lowest privilege tier and against default deployments.
Client-side field-level encryption (CSFLE) in the MongoDB C# / .NET Driver before 3.13.0 can silently fail to encrypt fields that an application designated for protection, so data intended to be ciphertext is stored and returned in cleartext. The flaw sits in the schema-construction component that turns caller-supplied field identifiers into pattern expressions, so it only affects applications that build automatic-encryption schemas through the affected PatternProperty overload; the same defect can also make a rule apply more broadly than intended. Discovery requires no user interaction, and the party reading the unprotected values only needs ordinary authenticated read access to the stored data (PR:L in the assessed vector) - not the encryption keys - though it is not a default configuration and no public exploit was identified at time of analysis; the driver fixes it in 3.13.0.
Denial of service with a limited information-disclosure component affects HPE networking devices, where an attacker positioned on an adjacent network segment can degrade availability severely (A:H) and potentially read a small amount of data (C:L) without authentication (PR:N) or user interaction (UI:N). The 7.1 severity is moderated in practice by the adjacency precondition (AV:A), which confines realistic exposure to insiders, on-path attackers, or hosts on an already-compromised Layer-2 segment rather than arbitrary internet clients. No CVE description was supplied and no public exploit code has been identified at time of analysis, so the specific vulnerable feature, protocol and affected models must be confirmed against HPE bulletin hpesbnw05162en_us.
Adjacent-network attackers can cause high availability impact and minor integrity changes on HPE networking devices through CVE-2026-95710, which carries a CVSS 3.1 base score of 7.1. The vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) means an attacker on the same Layer-2 segment or a logically adjacent network needs no credentials and no user interaction, and the flaw is not reachable from the open internet without first reaching that segment. No public exploit code or CISA KEV entry was identified at time of analysis, and the trigger itself is not described in the available sources.
Information disclosure in HPE networking products (CVSS 7.1) could let an unauthenticated attacker with adjacent-network access expose or affect sensitive data when a legitimate user is induced to perform an action, though a high-complexity precondition limits reliable exploitation. The affected models, firmware branches, and vulnerable feature are not specified in the available data; HPE bulletin hpesbnw05162en_us is the authoritative reference for scope and fixes. No public exploit code is identified at time of analysis, and the assessed vector rates confidentiality, integrity, and availability impact as High.
Presigned S3 upload URLs issued by Incus's built-in in-process S3 server can be abused to read other objects in the same bucket, because the server validates SigV4 signatures only over the headers the client lists in X-Amz-SignedHeaders and never rejects additional unsigned x-amz-* headers (the SigV2 presigned path omits CanonicalizedAmzHeaders entirely). Anyone holding a presigned PUT URL for one key - no bucket credentials required - can attach an unsigned X-Amz-Copy-Source header and have the server copy an arbitrary object in that bucket onto the granted key under the signer's credentials, leaking the source object's ETag and, where the attacker can also read the granted key (for example via a matching presigned download URL), its full contents. Incus 7.0.0 through 7.0.1 and 7.1.0 through 7.4.x are affected when a storage bucket on a local storage pool is served by the built-in S3 server and the bucket listener (core.storage_buckets_address) is enabled, which is not the default; Ceph radosgw buckets are unaffected. Authentication is required in the sense that a valid presigned grant must already be held, and no public exploit code has been identified at time of analysis.
Stored cross-site scripting in the WP Mailster WordPress plugin (all versions through 1.9.1.0) lets an attacker who can place content into the plugin's stored data have script execute in a different security context when a victim loads a page that renders that content. The published score is CVSS 7.1, while the assessed vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, so exploitation requires victim interaction (a page load) and the outcome is scope change with low confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis and there is no CISA KEV entry; the available data lists no fixed plugin version.
Stored cross-site scripting in CodePeople's Contact Form Email WordPress plugin through 1.3.68 lets an attacker persist script payloads through form submission fields or form configuration and execute them when a victim, most plausibly an administrator reviewing submissions in wp-admin, views the stored content. The CVSS vector carries PR:N and UI:R, so the reported path is unauthenticated but requires victim interaction; the independent assessment notes the privilege needed to persist the payload is unconfirmed, and practical risk is lower if authentication is required. No public exploit code or CISA KEV confirmation is provided, and the plugin must be installed and active for exposure.
Cypher injection in Flexible GraphRAG 0.6.0 through 0.8.1 lets attacker-influenced document content reach FalkorDB queries when GRAPH_BACKEND=langchain and GRAPH_DB=falkordb are configured. A crafted ingested document can steer the extraction model into producing malicious entity or relationship values, and the broken _escape() helper fails to neutralize a quote, allowing injected Cypher clauses to modify or delete graph data and, if the calling code surfaces query results to the user or LLM, disclose graph data. The assessed vector is CVSS 3.1 7.1 with AC:H, PR:L and UI:R; the maintainer demonstrated a proof-of-concept against a live FalkorDB instance that deleted every node, and the vendor released 0.8.2 with parameterized queries and backtick stripping.
Stored cross-site scripting in the ACF Extended WordPress plugin, affecting versions through 0.9.2.7, allows script content persisted in plugin-managed fields or forms to execute when a victim later views the page where that input is rendered. CVSS 7.1 reflects network reachability, low complexity, scope change, and required user interaction, with limited confidentiality, integrity, and availability impact; the privilege needed to store the payload is not confirmed in the available sources. No public exploit was identified at time of analysis.
Blind SQL injection in Frappe Framework before 16.33.0 allows any authenticated low-privilege user to submit crafted input to the frappe.desk.doctype.event.event.get_events method and infer sensitive database contents from application behavior. The defect is rated CVSS 7.1 (CVSS 4.0) and assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, meaning exploitation is network-reachable but requires a valid account and no administrator rights. No public exploit identified at time of analysis, and KEV status is not indicated.
Delegated 'Users Admin' accounts in WWBN AVideo before version 29.4.0 can delete, overwrite, or demote full administrator accounts by posting directly to confirmDeleteUser.json.php or userAddNew.json.php with an administrator's user ID, destroying that admin's videos and account in the process. The flaw is a server-side authorization gap: the interface already hides admin-row actions from non-admins, but the endpoints themselves never re-verified that the caller outranks the target, so a crafted request bypasses the cosmetic UI restriction. Exploitation requires an authenticated account holding the Permissions::canAdminUsers() delegated role, so anonymous visitors and ordinary users are not affected; no public exploit code has been identified at time of analysis and no EPSS or CISA KEV signal is present in the available data.
Traefik 2.11.0 through 2.11.57 and 3.0.0 through 3.7.13 can assign an unauthenticated attacker's frontend request to a backend socket that a legitimate user preauthenticated with Authorization: Negotiate (NTLM/Kerberos), letting the attacker read or write with the victim's identity. The root cause is Traefik's globally shared backend connection pool, which does not isolate sockets bound to a particular frontend identity; exploitation requires an active victim socket and favorable pool-reuse timing, so this is a mid-to-high priority issue for deployments fronting connection-bound Negotiate backends rather than a universal emergency. No public exploit code or CISA KEV entry is identified at time of analysis, and fixed releases are 2.11.58 and 3.7.14.
Unauthenticated clients can inherit a victim's NTLM/Negotiate-authenticated backend session in Traefik v3.2.0 through v3.7.13 when the experimental FastProxy connection pool is enabled, because pooled keep-alive backend connections are not pinned to the frontend client that originally authenticated. An attacker who lands on a reused connection after a victim completed a handshake can read that victim's data and perform actions as them on the backend, while the Traefik instance itself is not directly compromised. Exploitation is opportunistic and configuration-dependent: it requires the non-default experimental FastProxy pool, NTLM or Negotiate authentication on the backends, and a timing window in which the attacker is handed the victim's pooled connection; no public exploit code or CISA KEV entry was identified at time of analysis.
Access-control bypass in Traefik v3.7.13's Kubernetes Ingress NGINX provider allows unauthenticated remote attackers to reach ssl-passthrough Ingress backends protected by auth-type, auth-url, or whitelist-source-range annotations when a non-TLS entry point is exposed and the attacker knows the Ingress host. The flaw is configuration-gated-affected deployments must use the Ingress NGINX provider with ssl-passthrough Ingresses and a reachable plain HTTP entry point-and the bypass is silent because nothing is logged. No public exploit code or active exploitation is identified in the provided intelligence; upgrade to v3.7.14.
Incus servers that use multi-project tenancy expose in-flight operations across project boundaries because the GET /1.0/operations/{uuid} handler performs no authorization check, letting any authenticated client - including one holding a TLS certificate restricted to a single project - read operations that belong to other projects. The disclosed data includes the full command line, the process environment (where deployment tooling typically stores database passwords, API tokens and cloud credentials), the operation's websocket fd secrets and resource URLs, and, when an 'incus config trust add' operation happens to be pending, the trust-enrolment token itself, which the reporter demonstrated could be exchanged for an unrestricted certificate and full server admin. Exploitation is constrained: the attacker must already hold a project-restricted certificate and must obtain the 122-bit crypto/rand UUIDv4 of a specific in-flight operation out of band, since Incus discloses no enumeration path to a restricted client. The issue carries no CISA KEV entry or reported active exploitation; the upstream advisory includes a step-by-step reproduction sequence, which is the only published proof of concept.
Authentication bypass in Traefik Proxy 3.7.0 through 3.7.13 allows unauthenticated remote attackers to impersonate mTLS identities by supplying forged Ssl-Client-* headers (notably Ssl-Client-Verify: SUCCESS plus a chosen certificate subject and issuer) to the plaintext HTTP router. Exploitation is gated on a non-default configuration: the Kubernetes Ingress-NGINX provider must be in use, ssl-redirect must be disabled so the HTTP router is reachable, auth-tls-pass-certificate-to-upstream must be enabled so Traefik forwards client-supplied headers, and the upstream backend must trust those headers as proof of mutual-TLS identity. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the advisory (GHSA-mwrr-6hp4-pxr6) covers releases before v3.7.14.
Mutual TLS enforcement in Traefik Proxy can be bypassed, allowing unauthenticated remote clients to reach routers that are configured to require client certificates without presenting one. The flaw affects builds made with the Go 1.27 toolchain, where the request TLS state can be evaluated as nil and the SNI check is consequently skipped; an attacker sends an HTTP/2 request carrying the ':scheme http' pseudo-header over the TLS connection to sidestep certificate validation. Fixed in v2.11.58 and v3.7.14, the issue is exploitable only when an mTLS-protected router actually exists and the binary was compiled with the affected Go version, so default deployments that do not use client-certificate authentication are not exposed; no public exploit code was identified at time of analysis.
Client-certificate authentication bypass in Traefik v3.7.0 through v3.7.13 lets a holder of a certificate issued by one host's client CA reach a different host that requires its own separate client CA, while that host's legitimate clients are locked out. The defect only manifests when the Kubernetes Ingress NGINX provider is enabled and mTLS client authentication (auth-tls-secret) is configured on multiple hosts whose secret names collide once dots are normalized to dashes, causing Traefik to merge the two trust pools; the independent assessment rates this CVSS 3.1 7.4-class impact (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) because exploitability depends on that naming pattern (AT:P). No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation additionally requires the attacker to already hold a valid certificate from the colliding CA.
HPE Networking products are affected by a network-reachable, unauthenticated flaw scored 7.0 (High) under CVSS 3.1, with low confidentiality and integrity impact and high availability impact. High attack complexity means exploitation depends on conditions outside the attacker's direct control, and the supplied sources do not describe the trigger, affected feature, or exact product versions. No public exploit or CISA KEV entry is identified at time of analysis; HPE bulletin hpesbnw05162en_us is the authoritative reference for affected scope and fixes.
TLS client-configuration reuse in Traefik Proxy 2.11.0 through 2.11.57 and 3.0.0 through 3.7.13 allows an unauthenticated client to bypass a backend service's configured root CAs, SNI/server name, and certificate verification. When one backend issues an NTLM or Negotiate (Kerberos) challenge, Traefik stores the resulting round tripper in a client-connection slot that is not keyed by ServersTransport; an attacker who arms that slot can then reach a different service over the same keep-alive connection and inherit the wrong TLS client settings, undermining trust in the downstream backend rather than in Traefik itself. Exploitation is conditional - it requires connection-reuse timing, an NTLM/Kerberos-authenticating backend, and multiple services with divergent ServersTransport TLS settings behind the same proxy - and no public exploit code or active exploitation has been identified at time of analysis; vendor fixes are available in 2.11.58 and 3.7.14.
Authenticated page editors in Grav CMS 2.0.0 through 2.2.4 can abuse flex-*@ frontmatter directives to invoke Flex object methods in another editor's session when that editor opens a crafted page, allowing unauthorized deletion of protected pages. The flaw is an access-control/confused-deputy issue in FlexDirectory::dynamicFlexField() and carries a High CVSS 4.0 score of 7.0, though exploitation requires an existing page-edit account plus a second editor opening the page. No public exploit code or confirmed active exploitation was identified at time of analysis.
Prototype pollution in `@graphql-tools/utils` (npm) versions >= 10.10.1 through 12.0.1 allows an attacker who controls, compromises, or MITMs the upstream GraphQL transport to write attacker-chosen properties onto `Object.prototype` in the consuming Node.js process. The flaw is in the exported `mergeIncrementalResult` helper: its only guard does strict string equality against `__proto__`, `constructor` and `prototype`, so a non-primitive path segment like `["__proto__"]` passes the check and is then coerced by `ToPropertyKey` during bracket access, redirecting the subsequent assignment onto `Object.prototype`. Reproduction was demonstrated dynamically - source-level, against published npm builds (10.10.0 safe, 10.10.1 through 12.0.1 all succeed), and over the network via a crafted multipart `@defer` response that set `Object.prototype.isAdmin = true` and made a consumer-style `opts.isAdmin === true` check return true on a fresh object. A public proof-of-concept reference exists; its status as verified working exploit code beyond the reporter's own reproductions is not independently confirmed, and there is no CISA KEV listing indicating active exploitation. Risk is conditional: only consumers calling the helper on payloads from an upstream they do not control are exposed, and the project's own production code does not call it.
The GitHub Action shipped with psf/black can be induced to install and execute attacker-controlled code when the optional use_pyproject: true input is enabled. Because the action read tool.black.required-version from the checked-out pyproject.toml and passed it to pip without validating it as a plain version specifier, a pull request that rewrites that value into a direct reference (such as a URL to a malicious package or wheel) causes pip to fetch and run that package inside the victim repository's CI workflow. Only repositories that opt into the non-default use_pyproject setting and run the action against pull-request-supplied content are exposed, and unattended execution is most plausible for returning or authorized contributors since GitHub normally gates first-time contributors behind maintainer workflow approval; the complete fix is Black 26.10.1, which now rejects anything other than released version specifiers.