Publish Advisories

GHSA-hggm-x7r9-mm7v
GHSA-vv3x-j2x5-36jc
GHSA-ccgf-5rwj-j3hv
GHSA-q56x-g2fj-4rj6
GHSA-27w2-87xv-37c6
GHSA-3278-c88v-xrh4
GHSA-37w4-hwhx-4rc4
GHSA-5vpg-rj7q-qpw2
GHSA-9q9q-324x-93r2
GHSA-g2wm-735q-3f56
GHSA-hv23-4qp7-8c8r
GHSA-qj6w-v29q-4rgx
GHSA-rf5q-vwxw-gmrf
GHSA-xh5j-727m-w6gg

Author: advisory-database[bot]

advisories/github-reviewed/2026/03/GHSA-hggm-x7r9-mm7v/GHSA-hggm-x7r9-mm7v.json

@@ -1,14 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-hggm-x7r9-mm7v",
-  "modified": "2026-03-30T13:29:48Z",
+  "modified": "2026-06-08T20:14:00Z",
   "published": "2026-03-26T18:31:41Z",
   "aliases": [
     "CVE-2026-32846"
   ],
   "summary": "OpenClaw is vulnerable to Path Traversal through path validation bypass",
   "details": "OpenClaw through 2026.3.23 (fixed in commit 4797bbc) contains a path traversal vulnerability in media parsing that allows attackers to read arbitrary files by bypassing path validation in the isLikelyLocalPath() and isValidMedia() functions. Attackers can exploit incomplete validation and the allowBareFilename bypass to reference files outside the intended application sandbox, resulting in disclosure of sensitive information including system files, environment files, and SSH keys.",
   "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    },
     {
       "type": "CVSS_V4",
       "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"

advisories/github-reviewed/2026/03/GHSA-vv3x-j2x5-36jc/GHSA-vv3x-j2x5-36jc.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-vv3x-j2x5-36jc",
-  "modified": "2026-03-20T21:24:44Z",
+  "modified": "2026-06-08T20:15:12Z",
   "published": "2026-03-18T20:07:24Z",
   "aliases": [
     "CVE-2026-33080"
   ],
   "summary": "Filament Unvalidated Range and Values summarizer values can be used for XSS",
-  "details": "Two Filament Table summarizers (`Range`, `Values`) render raw database values without escaping HTML. If there is a lack of validation for the data in the columns that use these summarizers, an attacker could plant malicious HTML / JavaScript and achieve stored XSS that executes for users who view the table with those summarizers.",
+  "details": "Two Table summarizers (`Range`, `Values`) render raw database values without escaping HTML. If there is a lack of validation for the data in the columns that use these summarizers, an attacker could plant malicious HTML / JavaScript and achieve stored XSS that executes for users who view the table with those summarizers.",
   "severity": [
     {
       "type": "CVSS_V3",

advisories/github-reviewed/2026/04/GHSA-ccgf-5rwj-j3hv/GHSA-ccgf-5rwj-j3hv.json

@@ -1,14 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-ccgf-5rwj-j3hv",
-  "modified": "2026-05-20T18:08:00Z",
+  "modified": "2026-06-08T20:16:33Z",
   "published": "2026-04-02T23:21:23Z",
   "aliases": [
     "CVE-2026-47099"
   ],
   "summary": "TeleJSON: DOM XSS via unsanitised constructor name in `new Function()`",
   "details": "## Summary\n \ntelejson versions prior to 6.0.0 (released 2022) are vulnerable to DOM-based Cross-Site Scripting (XSS) through unsafe deserialisation. Attacker-controlled input from the `_constructor-name_` property in parsed JSON is passed directly to `new Function()` without sanitisation, allowing arbitrary JavaScript execution.\n \n## Affected versions\n \n| Package  | Affected  | Fixed    |\n|----------|-----------|----------|\n| telejson | < 6.0.0   | >= 6.0.0 |\n \n \n## Details\n \ntelejson's `parse()` function uses a custom reviver to reconstruct JavaScript objects from serialised JSON. When processing objects with a `_constructor-name_` property, the reviver passes the constructor name directly to `new Function()` to recreate the object's prototype.\n \nIn versions prior to 6.0.0, this constructor name is not sanitised. An attacker who can deliver a crafted JSON payload to `telejson.parse()` (for example, via `postMessage` in applications that use telejson for cross-frame communication) can inject arbitrary JavaScript into the `new Function()` call.\n \n**Vulnerable code** ([`src/index.ts`, lines 293-299 at v5.3.3](https://github.com/storybookjs/telejson/blob/v5.3.3/src/index.ts#L293-L299)):\n \n```ts\nif (isObject<ValueContainer>(value) && value['_constructor-name_']) {\n  const name = value['_constructor-name_'];\n  if (name !== 'Object') {\n    const Fn = new Function(`return function ${name}(){}`)();\n    Object.setPrototypeOf(value, new Fn());\n  }\n```\n \n**Fixed code** ([`src/index.ts`, lines 340-346 at v6.0.0](https://github.com/storybookjs/telejson/blob/v6.0.0/src/index.ts#L340-L346)):\n \n```ts\nif (isObject<ValueContainer>(value) && value['_constructor-name_'] && options.allowFunction) {\n  const name = value['_constructor-name_'];\n  if (name !== 'Object') {\n    const Fn = new Function(`return function ${name.replace(/[\\W_]+/g, '')}(){}`)();\n    Object.setPrototypeOf(value, new Fn());\n  }\n```\n \nThe fix introduces two mitigations: a character allowlist via regex that strips non-word characters before they reach `new Function()`, and gating the entire code path behind the `allowFunction` option.\n \n## Impact\n \nAn attacker can execute arbitrary JavaScript in the context of the application using the vulnerable telejson version. Depending on the application, this could enable session hijacking, credential theft, or arbitrary DOM manipulation.\n \n## Remediation\n \nUpgrade to telejson >= 6.0.0.",
   "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    },
     {
       "type": "CVSS_V4",
       "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
@@ -40,9 +44,21 @@
       "type": "WEB",
       "url": "https://github.com/storybookjs/telejson/security/advisories/GHSA-ccgf-5rwj-j3hv"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47099"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Niccolo10/Security-Advisories/blob/main/CVE-2026-47099/cve-2026-47099.md"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/storybookjs/telejson"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.vulncheck.com/advisories/telejson-dom-based-xss-via-parse-function"
     }
   ],
   "database_specific": {
@@ -52,6 +68,6 @@
     "severity": "LOW",
     "github_reviewed": true,
     "github_reviewed_at": "2026-04-02T23:21:23Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2026-05-20T20:16:41Z"
   }
 }