Publish Advisories

GHSA-2g88-7qc8-9vxv
GHSA-hx22-9fx3-xg77

Author: advisory-database[bot]

advisories/unreviewed/2026/06/GHSA-2g88-7qc8-9vxv/GHSA-2g88-7qc8-9vxv.json

@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2g88-7qc8-9vxv",
+  "modified": "2026-06-14T12:30:26Z",
+  "published": "2026-06-14T12:30:26Z",
+  "aliases": [
+    "CVE-2026-11527"
+  ],
+  "details": "Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument in _make_filehandle.\n\nConfig::IniFiles::_make_filehandle opens a filename argument with Perl's 2-arg open(), so a filename that begins or ends with a pipe (\"| cmd\", \"cmd |\") or begins with a redirect (\"> path\", \">> path\") is run as a command or redirect rather than opened as a file. The helper is the open path behind the documented -file argument: new(-file => $thing) reaches it through ReadConfig. An in-memory scalar reference (-file => \\$text) does not open a path and is unaffected.\n\nAny caller that forwards untrusted input to the -file argument can run an arbitrary command or truncate a file under the process UID.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11527"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/shlomif/perl-Config-IniFiles/commit/3e48f9627fbba4dae5de35be1f735cdeb7e47fb8.patch"
+    },
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/release/SHLOMIF/Config-IniFiles-3.001000/changes"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-73"
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2026-06-14T12:16:23Z"
+  }
+}

advisories/unreviewed/2026/06/GHSA-hx22-9fx3-xg77/GHSA-hx22-9fx3-xg77.json

@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-hx22-9fx3-xg77",
+  "modified": "2026-06-14T12:30:26Z",
+  "published": "2026-06-14T12:30:26Z",
+  "aliases": [
+    "CVE-2026-11526"
+  ],
+  "details": "GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle.\n\nGD::Image::_make_filehandle opens a filename argument with Perl's 2-arg open(), so a filename that begins or ends with a pipe (\"| cmd\", \"cmd |\") or begins with a redirect (\"> path\", \">> path\") is run as a command or redirect rather than opened as a file. _make_filehandle is the single open path behind every filename-accepting constructor (new, newFromPng, newFromJpeg, and the rest); the in-memory *Data variants do not open a path and are unaffected.\n\nAny caller that forwards untrusted input to one of these constructors as a pathname can run an arbitrary command or truncate a file under the process UID.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11526"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/lstein/Perl-GD/commit/67b163713c6c78dfeb693da0978ae934e5cd8210.patch"
+    },
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/release/RURBAN/GD-2.86/changes"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-73"
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2026-06-14T12:16:22Z"
+  }
+}