EUVD-2026-45429
GHSA-v4ff-75cq-5r9g
Severity by source
CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-only access (AV:A), high complexity to induce exceptional condition (AC:H), low privileges required (PR:L), limited integrity impact only, no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was detected in hunvreus devpush up to 0.4.6. Affected by this issue is the function reset_storage of the file app/workers/tasks/storage.py of the component Storage Reset Failure Handler. The manipulation results in improper check or handling of exceptional conditions. A high complexity level is associated with this attack. The exploitation is known to be difficult. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Improper exception handling in devpush's storage reset worker exposes a limited integrity-impact flaw for adjacent network attackers with low-privilege access. The reset_storage function in app/workers/tasks/storage.py fails to correctly check or handle exceptional conditions (CWE-703), meaning that under specific error scenarios, the storage reset process may enter an inconsistent or exploitable state. With a CVSS 4.0 score of 2.1, no public exploit code identified, and no active exploitation confirmed, this represents a low-priority finding that nonetheless warrants a vendor patch given the unresponsive upstream maintainer.
Technical ContextAI
devpush (CPE: cpe:2.3:a:hunvreus:devpush:*:*:*:*:*:*:*:*) is a small open-source project maintained by hunvreus on GitHub. The affected component is the Storage Reset Failure Handler, specifically the reset_storage function located in app/workers/tasks/storage.py. The root cause is CWE-703 (Improper Check or Handling of Exceptional Conditions), a class of defects where software does not adequately guard against conditions such as runtime exceptions, null states, or unexpected return values - leading to undefined or insecure program behavior when those conditions arise. In this case, when the storage reset operation encounters an exceptional condition, the handler does not properly recover or fail safely, potentially allowing a caller to influence program state in unintended ways. The CVSS 4.0 adjacent-network vector (AV:A) indicates the attack surface is constrained to the local network segment rather than being internet-reachable.
RemediationAI
No vendor-released patch has been identified at time of analysis; the maintainer had not responded to the disclosure at https://github.com/hunvreus/devpush/issues/69. Organizations running devpush should consider replacing or wrapping the reset_storage function with proper exception handling as a compensating control - specifically, ensuring all code paths in the failure handler return gracefully or raise controlled errors rather than propagating unhandled exceptions. Additionally, restricting access to the adjacent network segment where devpush workers operate (e.g., via firewall rules or VLAN segmentation) limits the attack vector from AV:A to effectively unreachable for external threat actors. Monitoring for anomalous storage reset task failures in worker logs can serve as a detection mechanism. Users should watch https://github.com/hunvreus/devpush/ and https://vuldb.com/cve/CVE-2026-16218 for patch availability.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today