Monthly
Unicode normalization mishandling in HashiCorp go-slug versions 0.4.0 through 0.18.2 enables a local attacker to circumvent .terraformignore exclusion rules, causing sensitive files to be silently bundled into Terraform slug uploads destined for remote backends. Exploitation requires local filesystem write access to the Terraform working directory and a legitimate operator triggering a slug upload operation - the CVSS vector confirms AV:L/UI:R, narrowing the realistic attack surface to shared workstations, multi-tenant CI/CD environments, or compromised developer machines. Confidentiality impact is rated high (C:H) because excluded files such as credentials, API keys, or Terraform variable files containing secrets may be exposed to remote Terraform Cloud or Enterprise backends; no public exploit has been identified and the vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog.
Setuptools prior to 83.0.0 fails to normalize Unicode filenames before matching them against MANIFEST.in exclusion patterns on macOS APFS and HFS+ filesystems, allowing files with NFD-normalized on-disk names to silently bypass NFC-encoded exclude, global-exclude, recursive-exclude, and prune directives and be packed into Python source distributions. Python package maintainers developing on macOS face a supply chain risk: sensitive files such as credentials, private keys, or environment configs that are correctly listed in MANIFEST.in for exclusion may still appear in tarballs published to PyPI or private registries. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Improper hostname normalization in Node.js TLS server-identity verification (fixed in v26.3.1) lets a TLS peer's hostname be evaluated without proper Unicode/case normalization, so identity checks may match a host they should reject. Rated High by the Node.js team (CVSS 7.7, scope-changed, confidentiality-only), it can cause a client to trust the wrong server and expose data carried over the connection. No public exploit identified at time of analysis; this was disclosed pre-NVD via the nodejs/node June 2026 security release and is not listed in CISA KEV.
Arbitrary DLL loading in SQLite's sqldiff.exe utility on Windows allows attackers to achieve code execution by abusing the Microsoft C runtime's Unicode-to-ANSI Best-Fit character conversion. Specially crafted Unicode characters in command-line arguments can be transformed into ASCII characters that sqldiff then parses as the '-L' option, loading an attacker-supplied DLL. Publicly available exploit research (Blackhat EU 2024 'WorstFit' presentation) demonstrates the technique, though no public exploit identified targeting sqldiff specifically and it is not listed in CISA KEV.
protobufjs versions 7.5.5 and earlier, and 8.0.0-8.0.1 accept overlong UTF-8 byte sequences in the minimal UTF-8 decoder used by non-Node and fallback decoding paths, allowing attackers to bypass byte-level filtering and decode strings containing characters that were not present in the raw protobuf binary input. This integrity issue affects applications that rely on pre-decoding byte validation before using protobuf strings in security-sensitive contexts. Patch versions 7.5.6 and 8.0.2 are available; Node.js Buffer-backed paths are not directly affected.
Denial of service in the Perl module Text::Minify::XS (v0.3.0 up to but excluding v0.7.8) arises because its minify functions mishandle certain malformed UTF-8 byte sequences, corrupting the heap. A remote attacker who can supply crafted text to an application that calls minify (or its alias minify_utf8) can trigger heap corruption and crash the process. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.04%), and the flaw is not in CISA KEV.
The split utility in uutils coreutils corrupts output filenames when processing non-UTF-8 prefix or suffix inputs by converting invalid byte sequences to UTF-8 replacement characters, causing filename mismatches, collisions, and potential data misdirection. Affected versions prior to 0.8.0 on all platforms exhibit this behavior, which deviates from GNU split's byte-preservation semantics. Local authenticated users can trigger the vulnerability through crafted non-UTF-8 input, leading to integrity issues in automated workflows relying on predictable filename generation.
The ln utility in uutils coreutils fails to process source paths containing non-UTF-8 filename bytes when using target-directory forms, rejecting valid filenames that GNU ln handles correctly. This logic error affects automated scripts and system tasks on Unix filesystems where non-UTF-8 filenames are common, causing denial of service for those specific operations. SSVC classifies exploitation as possible (POC available) but not automatable, with partial technical impact.
The comm utility in uutils coreutils silently corrupts binary and non-UTF-8 encoded file output by replacing invalid UTF-8 byte sequences with the Unicode replacement character (U+FFFD), diverging from GNU comm's byte-preserving behavior. This affects any user comparing files with legacy encodings or binary content, resulting in data integrity loss. A proof-of-concept demonstrating the lossy conversion exists, and a patch is available.
Account management inconsistencies in Splunk Enterprise and Splunk Cloud Platform allow users with the high-privilege 'edit_user' capability to create specially crafted usernames containing null bytes or non-UTF-8 percent-encoded bytes. This can lead to improper storage of usernames, resulting in inability to edit or delete affected users. No active exploitation has been identified and the EPSS score is very low (0.04%), indicating minimal real-world risk.
Unicode normalization mishandling in HashiCorp go-slug versions 0.4.0 through 0.18.2 enables a local attacker to circumvent .terraformignore exclusion rules, causing sensitive files to be silently bundled into Terraform slug uploads destined for remote backends. Exploitation requires local filesystem write access to the Terraform working directory and a legitimate operator triggering a slug upload operation - the CVSS vector confirms AV:L/UI:R, narrowing the realistic attack surface to shared workstations, multi-tenant CI/CD environments, or compromised developer machines. Confidentiality impact is rated high (C:H) because excluded files such as credentials, API keys, or Terraform variable files containing secrets may be exposed to remote Terraform Cloud or Enterprise backends; no public exploit has been identified and the vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog.
Setuptools prior to 83.0.0 fails to normalize Unicode filenames before matching them against MANIFEST.in exclusion patterns on macOS APFS and HFS+ filesystems, allowing files with NFD-normalized on-disk names to silently bypass NFC-encoded exclude, global-exclude, recursive-exclude, and prune directives and be packed into Python source distributions. Python package maintainers developing on macOS face a supply chain risk: sensitive files such as credentials, private keys, or environment configs that are correctly listed in MANIFEST.in for exclusion may still appear in tarballs published to PyPI or private registries. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Improper hostname normalization in Node.js TLS server-identity verification (fixed in v26.3.1) lets a TLS peer's hostname be evaluated without proper Unicode/case normalization, so identity checks may match a host they should reject. Rated High by the Node.js team (CVSS 7.7, scope-changed, confidentiality-only), it can cause a client to trust the wrong server and expose data carried over the connection. No public exploit identified at time of analysis; this was disclosed pre-NVD via the nodejs/node June 2026 security release and is not listed in CISA KEV.
Arbitrary DLL loading in SQLite's sqldiff.exe utility on Windows allows attackers to achieve code execution by abusing the Microsoft C runtime's Unicode-to-ANSI Best-Fit character conversion. Specially crafted Unicode characters in command-line arguments can be transformed into ASCII characters that sqldiff then parses as the '-L' option, loading an attacker-supplied DLL. Publicly available exploit research (Blackhat EU 2024 'WorstFit' presentation) demonstrates the technique, though no public exploit identified targeting sqldiff specifically and it is not listed in CISA KEV.
protobufjs versions 7.5.5 and earlier, and 8.0.0-8.0.1 accept overlong UTF-8 byte sequences in the minimal UTF-8 decoder used by non-Node and fallback decoding paths, allowing attackers to bypass byte-level filtering and decode strings containing characters that were not present in the raw protobuf binary input. This integrity issue affects applications that rely on pre-decoding byte validation before using protobuf strings in security-sensitive contexts. Patch versions 7.5.6 and 8.0.2 are available; Node.js Buffer-backed paths are not directly affected.
Denial of service in the Perl module Text::Minify::XS (v0.3.0 up to but excluding v0.7.8) arises because its minify functions mishandle certain malformed UTF-8 byte sequences, corrupting the heap. A remote attacker who can supply crafted text to an application that calls minify (or its alias minify_utf8) can trigger heap corruption and crash the process. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.04%), and the flaw is not in CISA KEV.
The split utility in uutils coreutils corrupts output filenames when processing non-UTF-8 prefix or suffix inputs by converting invalid byte sequences to UTF-8 replacement characters, causing filename mismatches, collisions, and potential data misdirection. Affected versions prior to 0.8.0 on all platforms exhibit this behavior, which deviates from GNU split's byte-preservation semantics. Local authenticated users can trigger the vulnerability through crafted non-UTF-8 input, leading to integrity issues in automated workflows relying on predictable filename generation.
The ln utility in uutils coreutils fails to process source paths containing non-UTF-8 filename bytes when using target-directory forms, rejecting valid filenames that GNU ln handles correctly. This logic error affects automated scripts and system tasks on Unix filesystems where non-UTF-8 filenames are common, causing denial of service for those specific operations. SSVC classifies exploitation as possible (POC available) but not automatable, with partial technical impact.
The comm utility in uutils coreutils silently corrupts binary and non-UTF-8 encoded file output by replacing invalid UTF-8 byte sequences with the Unicode replacement character (U+FFFD), diverging from GNU comm's byte-preserving behavior. This affects any user comparing files with legacy encodings or binary content, resulting in data integrity loss. A proof-of-concept demonstrating the lossy conversion exists, and a patch is available.
Account management inconsistencies in Splunk Enterprise and Splunk Cloud Platform allow users with the high-privilege 'edit_user' capability to create specially crafted usernames containing null bytes or non-UTF-8 percent-encoded bytes. This can lead to improper storage of usernames, resulting in inability to edit or delete affected users. No active exploitation has been identified and the EPSS score is very low (0.04%), indicating minimal real-world risk.