Supply Chain · Watch Friday · 21 August 2026 End-of-day synthesis 4 watches · 24 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — A late-evening dump of four unrelated critical RCEs — JSONata, Xinference, Phalcon, and GeoTools — landed alongside a fresh npm backdoor campaign and a newly-KEV'd Zimbra pre-auth command injection.

The day opened with three straight batches of access-control and permission bugs — Winter CMS, Wagtail, django CMS, and a second wave of Laravel Backpack CRUD disclosures — that mostly warrant a patch sweep rather than individual urgency.

Then GitHub's evening advisory run landed four unrelated critical RCEs within about ninety minutes of each other: three independent JSONata sandbox-escape bugs that all reach child_process.execSync, an unsafe eval() on LLM tool-call output in Xinference that's unauthenticated RCE in default deployments, a Phalcon Volt template-compiler SSTI, and an unauthenticated SQL injection in GeoTools against PostGIS layers. Layer on Trend Micro's discovery of 14 trojanized npm packages dropping an AI-assisted Linux backdoor (RedC2 4.0) and a new CISA KEV entry for an unauthenticated Zimbra SMTP command-injection bug due 2026-08-24, and this is the busiest critical-severity window of the week — even though none of the four RCEs share a root cause or a vendor.

The bright spot: every one of the four RCE-class GHSAs shipped with a real fix in the same advisory, no half-measures or mitigation-only entries. Operational priority for the night: if you run JSONata, Xinference, Phalcon with Volt, or GeoTools against PostGIS, patch before end of shift — all four are reachable in common deployment shapes, not edge cases.

18:00 ET · First Watch

Critical · The Hacker News · active campaign · npm (Trend Micro/TrendAI) ·added 18:00 ET

14 trojanized npm packages drop AI-assisted RedC2 4.0 Linux backdoor

Trend Micro's TrendAI unit found 14 npm packages posing as calendar and streak-tracking utilities that work as advertised while quietly dropping a bundled Linux ELF binary — chmod +x, then launched as a detached background process — that unpacks into RedC2 4.0, an AI-assisted command-and-control implant. Functional-but-backdoored is harder to catch than dependency confusion or typosquatting: npm audit and static scanners miss a working package with a hidden postinstall dropper. Audit postinstall/lifecycle scripts across your lockfiles for binary downloads, and check build and CI hosts for unexpected detached processes spawned during npm install in the last week.

Critical · CISA KEV · critical · Zimbra Collaboration Suite (ZCS) ·added 18:00 ET

Zimbra Collaboration Suite: newly-KEV'd unauthenticated OS command injection via crafted SMTP

CISA added CVE-2026-73570 to KEV today: an unauthenticated attacker can send a specially crafted SMTP request to Zimbra Collaboration Suite and execute arbitrary OS commands as the Zimbra user — no auth, mail-transport-facing. Zimbra has a track record of mass exploitation within days of KEV entries, so treat this as an active-scanning target starting now, not eventually. Patch by the 2026-08-24 due date; if you can't, restrict SMTP submission to trusted relays at the network layer.

Critical · GHSA · critical · JSONata (3-advisory batch) ·added 18:00 ET

JSONata: three independent sandbox-escape bugs let crafted expressions reach child_process.execSync

Three separate JSONata sandbox-escape bugs landed together — a bypassable hasOwnProperty check in environment.lookup, a missing hasOwnProperty check in the lookup function, and an overwritable $clone that allows prototype mutation via destructured lambdas — and all three published PoCs converge on the same endpoint: reach __proto__.constructor and call process.getBuiltinModule('child_process').execSync(). Any service that evaluates user-supplied JSONata expressions (a common pattern for JSON transform/query APIs) has remote code execution regardless of which of the three an attacker uses. Update to jsonata 2.2.1 or 1.8.8 — all three are fixed in the same release, so there's no reason to patch one and skip the others.

Critical · GHSA · critical · Xinference ·added 18:00 ET

Xinference: unsafe eval() on LLM tool-call output is unauthenticated RCE in default deployments

Xinference parses Llama3 tool-call output from the model with Python's eval(), and because that output is downstream of attacker-controlled prompts sent to the chat completion API, a crafted prompt can make the model emit a Python expression that gets evaluated server-side. Default Xinference deployments ship without authentication, so this is unauthenticated RCE via the public /v1/chat/completions endpoint — the same shape as the Langflow and Ray-Project RCEs already in KEV, and another reminder that model output is untrusted input the moment it touches eval() or exec(). Patch immediately; if you can't, put authentication in front of Xinference's API regardless.

Critical · GHSA · critical · Phalcon ·added 18:00 ET

Phalcon: Volt template compiler's join filter allows compile-time PHP code injection (SSTI to RCE)

Phalcon's Volt template compiler builds the PHP for the join filter by string-concatenating the raw, unescaped template-literal argument straight into the generated join('…') call — an attacker who influences a Volt template's join arguments can break out of that call and inject arbitrary PHP, which Phalcon then writes to a cache file and require()s at render time. Classic SSTI-to-RCE; the risk scales with how much of your Volt templates are built from user-influenced strings (translated content, CMS-editable templates), so don't assume it's admin-only without checking. Patch, then grep your Volt templates for join filters fed by anything other than a hardcoded literal.

Critical · GHSA · critical · GeoTools ·added 18:00 ET

GeoTools: unauthenticated SQL injection in jsonArrayContains against PostGIS layers

GeoTools' jsonArrayContains OGC filter function writes its value argument straight into generated SQL with no escaping when running against a PostGIS DataStore (PostGIS 12+), and OGC filter endpoints on a GeoServer/GeoTools WFS service are often unauthenticated by design — so this is SQL injection with no auth required. There's no mitigation short of the patch; GeoTools' own advisory recommends limiting the PostGIS connection pool's rights as the only fallback. Update to GeoTools 35.1/34.4/33.5, and if you run GeoServer, confirm which release line it bundles.

High · GHSA · high · kin-openapi (2-advisory batch) ·added 18:00 ET

kin-openapi: two unauthenticated DoS bugs in openapi3filter — multi-GB allocation and a nil-pointer panic

Two independent DoS bugs in Go's kin-openapi request validator: a deepObject-style query-parameter decoder allocates one array slot per attacker-supplied index before schema validation ever runs, so a 24-byte request (?param[items][50000000]=x) forces multi-gigabyte heap allocation, and separately a nil-pointer dereference in ConvertErrors crashes the handler goroutine on a malformed multipart/form-data field. Both are single-request and unauthenticated, and hit any service that validates requests against an OpenAPI spec with kin-openapi — which is a lot of Go API gateways. Update, and if you can't patch immediately, put a request-size/complexity limit in front of anything using openapi3filter.

High · GHSA · high · Hydra ·added 18:00 ET

Hydra: hydra.utils.instantiate() executes arbitrary code from untrusted config

Hydra's instantiate() resolves and calls Python objects named in config, so an attacker who controls _target_ and its arguments in a config file, CLI override, or model-metadata blob gets arbitrary code execution wherever that config reaches instantiate(). Hydra itself isn't a network service, so exploitability depends entirely on whether your application feeds untrusted config into instantiate() — a real risk for ML pipelines that load config from uploaded model cards or user-submitted experiment configs. Treat any instantiate() call as equivalent to eval() if the config source isn't fully trusted.

High · GHSA · high · YOURLS ·added 18:00 ET

YOURLS: stored XSS in referrer statistics chart via crafted Referer header

An unauthenticated attacker can send a crafted Referer header to any existing short URL, and when an admin or stats-viewer later opens that link's statistics page, the stored referrer domain is embedded into Google Charts JavaScript without string escaping — stored XSS that requires zero interaction beyond one HTTP request from the attacker. Reachable in default private installations whenever an authenticated user checks stats, which for most YOURLS deployments is routine admin behavior. Patch, and until then, don't assume private-instance stats pages are safe to click through.

High · GHSA · high · Atlantis ·added 18:00 ET

Atlantis: workspace path traversal allows out-of-bounds directory deletion/creation

Atlantis 0.19.8 through 0.45.0 doesn't consistently validate user-controlled workspace values before building local filesystem paths, so a crafted workspace name with traversal segments can make Atlantis create, use, or delete directories outside the intended per-PR workspace — with the privileges of the Atlantis process, before Terraform even rejects the invalid name. If you run Atlantis for Terraform PR automation, this is an untrusted-PR-author attack surface: a malicious or compromised contributor can potentially clobber files on the Atlantis host via a crafted PR. Update to 0.45.0 and review who can open PRs against Atlantis-managed repos.

High · GHSA · high · Keystone ·added 18:00 ET

Keystone: graphql.maxTake bound bypassed by passing a negative take

Keystone's graphql.maxTake setting — meant to bound how many records a GraphQL query can return — can be bypassed by supplying a negative take value, letting a query return more results than the developer intended. Any project relying on maxTake as a resource-exhaustion or data-exposure control is affected; it's the kind of bug that looks cosmetic until someone uses it to page through a dataset the API was supposed to cap. Update to @keystone-6/core 6.5.3, or clamp take server-side if you can't patch yet.

High · GHSA · high · Defuddle ·added 18:00 ET

Defuddle: XSS via unescaped attribute interpolation in site extractors

Defuddle's site-extractor component injects attacker-controlled attribute values into output HTML without escaping, so a crafted page — or content on a domain a matching extractor targets — executes arbitrary script when Defuddle processes it, no external compromise needed beyond serving the malicious page. If you use Defuddle to extract/clean readable content from arbitrary URLs (a common pattern for read-it-later or summarization pipelines), treat its output as untrusted HTML, not sanitized text. Update to 0.19.1.

High · GHSA · high · Unleash (3-advisory batch) ·added 18:00 ET

Unleash: unauthenticated single-request DoS, plus a process-wide HTML-escaping override and an addon SSRF

Three separate Unleash bugs: an unauthenticated POST with deeply-nested JSON to any OpenAPI-validated endpoint (including the anonymous /edge/validate and /edge/issue-token) crashes the entire server via a JSON.stringify stack overflow in the validation-error formatter; a feature-event formatter globally overrides Mustache.escape and disables HTML escaping process-wide, letting an unrestricted username inject links into Slack/Teams notifications; and the addon/integration webhook URL is dialed server-side with no internal-address filtering, so a configured webhook can be pointed at internal services or cloud metadata and exfiltrate request headers. The DoS is the most urgent — one request takes down the whole server — patch that first, then review addon webhook configuration for SSRF exposure.

Medium · GHSA · medium · Mailpit (2-advisory batch) ·added 18:00 ET

Mailpit: WebSocket origin-check bypass regression, plus SMTP size limit enforced too late

Two Mailpit bugs: the cross-site WebSocket hijacking fix from CVE-2026-22689 regressed because Go's ServeMux routes on the percent-decoded path while the origin check tested the raw URI, so requesting /%61pi/events reaches the WebSocket handler with no origin control at all (affects 1.29.0–1.30.5); separately, the SMTP DATA reader buffers a complete line before enforcing MaxMessageSize, so one oversized line forces memory allocation before the expected 552 rejection. If you patched the original WebSocket hijacking CVE, confirm you're past 1.30.5 — that fix alone doesn't hold.

Medium · GHSA · medium · Grav ·added 18:00 ET

Grav: Twig sandbox's addJs/addCss allowlist lets page editors inject script, escalating to super-admin

Grav 2.0 renders editor-authored Twig in page content behind a sandbox, but the shipped sandbox policy allowlists addcss/addjs on Grav's Assets class — the sandbox checks that the call is permitted, not what it does, so a user with only page-edit rights can register an arbitrary script asset that the theme emits into the document head, reaching anyone who views the page including a super-admin. This is a privilege-escalation path from page-editor to super-admin, not just XSS — treat page-edit as more privileged than the role model implies until patched.

12:00 ET · Forenoon Watch

Critical · CISA KEV · critical · TrueConf Server ·added 12:00 ET

TrueConf Server: newly-KEV'd missing-authentication bug completes the pre-auth RCE chain with yesterday's code-injection CVE

CISA added CVE-2026-72529 to KEV today, the missing-authentication half of the TrueConf Server pair alongside yesterday's CVE-2026-72530 code-injection add — together an unauthenticated attacker on port 4307/TCP skips auth and breaks out of the isolated environment to execute code on the host. Both trace to the same ICS-CERT advisory; if you run TrueConf Server, treat this as one incident, not two. Patch both CVEs now — the auth-bypass half is due 2026-08-23.

High · GHSA · high · netty-incubator-codec-ohttp (4-advisory batch) ·added 12:00 ET

netty-incubator-codec-ohttp: four more DoS/leak disclosures in the OHTTP codec — parser can be looped, memory leaked, or crashed

Four more high-severity bugs land in Netty's incubator OHTTP (Oblivious HTTP) codec on top of yesterday's HPKE private-key-exposure disclosure: an unauthenticated CPU-exhaustion DoS from an infinite loop in field-section decoding, a second infinite-loop variant at the known-length field-section boundary, missing length limits on variable-length fields, and a native direct-memory leak on AEAD decryption failure that also drives gateway DoS. It's still an incubator module — confirm it's actually wired into a production OHTTP relay/gateway before treating this as urgent, but if it is, all four are unauthenticated remote DoS. Pin past the fixed release rather than just patching the HPKE issue and calling it done.

High · GHSA · high · Laravel Backpack CRUD (3-advisory batch, wave 3) ·added 12:00 ET

Laravel Backpack CRUD: third wave of disclosures — Update/Delete/Reorder bypass tenant scoping, plus an account-takeover password bug

A third round of Backpack CRUD advisories, on top of yesterday's command-injection fix and this morning's five-advisory batch: CRUD's Update, Delete, and Reorder operations bypass the same query-scope enforcement (`addBaseClause`) that list/read respect, so any authenticated user who knows a record's primary key can modify or delete rows outside their tenant — a write-path IDOR, not just a read one. Separately, `HasUploadFields::uploadMultipleFilesToDisk` deletes attacker-supplied paths from `clear_<attr>[]` without checking they belong to the record, and `MyAccountController` mass-assigns the request body on account-info updates, letting an authenticated user set their own password field without the normal old-password check. If you run Backpack CRUD with tenant scoping via `addBaseClause`, patch this before the earlier read-only IDOR — this one is read-write.

06:00 ET · Morning Watch

Medium · GHSA · medium · Winter CMS (9-advisory batch) ·added 06:00 ET

Winter CMS: nine more backend disclosures — dual LFI paths, XSS, CSRF, and an import/export permission bypass

Nine more Winter CMS backend bugs surfaced in the same disclosure round as yesterday's Twig sandbox-escape: two local-file-inclusion paths (via `=include` in JS asset compilation, via `@import` in LESS stylesheet compilation), stored and reflected XSS, a CSRF gap in AJAX handler dispatch, an IDOR on upload-widget metadata, and an import/export permission bypass. All require authenticated backend access, but the volume in one round argues for a full patch sweep rather than triaging each CVE separately. Update to the current release and re-test authz on the customizable-stylesheet and import/export widgets specifically.

Medium · GHSA · medium · Wagtail (9-advisory batch) ·added 06:00 ET

Wagtail: nine more access-control gaps across Pages, Documents, Images, and translation APIs

Nine more Wagtail disclosures repeat one shape across surfaces: Pages admin, Documents/Images, snippet-copy, and translation API endpoints that don't fully enforce collection- or permission-level restrictions, letting an authenticated user reach content outside their assigned scope. A DoS via unbounded filter specs in image preview and a low-severity SHA1 document-identification issue round out the batch. If you run Wagtail with collection-based permissions, audit the documents/images and translation APIs — yesterday's single high-severity XSS fix didn't close out this disclosure round.

Medium · GHSA · medium · django CMS (5-advisory batch) ·added 06:00 ET

django CMS: five access-control bugs — page Duplicate action reads any page cross-tenant

First django CMS coverage on the watch: five disclosures, four of which share the same root cause — clipboard-copy, page-Duplicate, and structure-endpoint actions don't fully re-check page-view permission, so a low-privileged or cross-tenant user can read page content they shouldn't reach. A stored XSS in edit-mode plugin-exception rendering rounds out the batch. Worth a permission-model review if you run django CMS multi-tenant; the Duplicate-action bug is the most exploitable of the five.

Medium · GHSA · medium · Laravel Backpack CRUD (5-advisory batch, part 2) ·added 06:00 ET

Laravel Backpack CRUD: five more disclosures — unrestricted upload extension lets shell.php reach the webserver

Five more Laravel Backpack CRUD bugs extend yesterday's four-advisory batch (pre-auth command injection, cross-tenant IDOR, arbitrary file deletion, password-change bypass): the standout is HasUploadFields preserving attacker-supplied file extensions on public-disk uploads, so a `shell.php` upload lands directly on the webserver despite GHSA's medium rating — treat it as a file-upload RCE path. The rest are a cross-tenant relation-reparenting IDOR, an SVG-with-script upload via SingleBase64Image, an email change without password confirmation, and a stored XSS in the color column. If you patched yesterday's command injection, pull the full release — this batch shipped alongside it.

Medium · GHSA · medium · Fleet (2-advisory batch) ·added 06:00 ET

Fleet: unauthenticated iOS binary download plus an ORDER BY injection on activity endpoints

Two more Fleet disclosures alongside yesterday's Okta SQL-injection bug: in-house iOS app binaries are downloadable without authentication via predictable URLs, and activity-list endpoints accept unsanitized ORDER BY column names. Neither matches yesterday's database-compromise severity, but if you distribute internal iOS builds through Fleet, the predictable-URL exposure means anyone who guesses the pattern gets your binary.

Medium · GHSA · medium · gettext-converter ·added 06:00 ET

gettext-converter: prototype pollution in js2i18next() via crafted translation keys

gettext-converter's js2i18next() function is vulnerable to prototype pollution through crafted translation keys — an i18n/build-tooling package, so exposure depends on whether translation strings ever come from untrusted input, such as user-submitted locale content or third-party translation contributions. Low likelihood for most build pipelines, but audit before accepting external translation PRs into a build that runs this converter.