Supply Chain · Watch Friday · 07 August 2026 Live · last refresh 06:00 ET · Morning Watch 1 watches · 5 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

06:00 ET · Morning Watch

High · GHSA · league/commonmark ·added 06:00 ET

league/commonmark ships four quadratic-complexity DoS advisories in one batch

GHSA disclosed four separate O(N²) denial-of-service bugs in league/commonmark 2.x (three reaching back to 1.5.0): colliding heading slugs, duplicate footnote definitions, adjacent inline attribute blocks, and a core UTF-8 position-translation rescan that needs no extension at all — each turns a few KB of crafted Markdown into seconds of CPU or hundreds of MB of memory. The three extension-gated bugs (HeadingPermalink, Footnote, Attributes) are opt-in; the core parsing bug is not, so any endpoint that converts untrusted Markdown is exposed by default. Upgrade to 2.9.0, which fixes all four in one release.

High · GHSA · js-yaml ·added 06:00 ET

JS-YAML's !!omap quadratic-DoS fix from 5.x was never backported to the still-maintained 3.x/4.x lines

js-yaml's `!!omap` resolver enforces key uniqueness with a linear scan per element, making a plain `yaml.load()` call on untrusted input O(n²) — no custom schema required, since `!!omap` sits in the default schema. This is the identical weakness already fixed in the 5.x line under CVE-2026-59870 (GHSA-724g-mxrg-4qvm); that fix was never ported back to 3.x or 4.x, which most projects still pin. Upgrade to js-yaml 3.15.1 or 4.3.1 if you're not already on 5.x.

High · GHSA · Nx ·added 06:00 ET

Nx self-hosted remote cache extracts tar archives with no path constraint — arbitrary file write from a malicious or MITM'd cache server

Nx's self-hosted HTTP remote cache, plus the @nx/s3-cache, gcs-cache, azure-cache, and shared-fs-cache packages, extract downloaded cache artifacts without constraining the write path, so a malicious or on-path cache server can return a crafted tar archive that writes outside the cache directory — escalatable to RCE. Nx's default local cache and Nx Cloud are unaffected; only workspaces pointed at `NX_SELF_HOSTED_REMOTE_CACHE_SERVER` or a self-hosted cache package are exposed. Upgrade to nx 22.7.7 / 23.0.2, and migrate off the already-deprecated @nx/*-cache packages (CVE-2025-36852) rather than wait on a patch that isn't coming.

High · GHSA · Statamic ·added 06:00 ET

Statamic OAuth login trusts unverified provider emails — unauthenticated account takeover up to super admin

When Statamic's OAuth login is enabled against a provider that doesn't guarantee verified email addresses, an unauthenticated attacker can sign in as any existing user — including a super admin — by matching on email alone, no password needed. Exposure requires OAuth explicitly enabled against such a provider, but the blast radius on a hit is full account takeover with zero credentials. Upgrade to 5.74.1 / 6.24.0, or restrict OAuth to email-verifying providers until you can.

Context · The Hacker News ·added 06:00 ET

TeamPCP's supply-chain campaign traces back to internet-facing Redis compromises dating to 2020

New analysis links TeamPCP — the threat actor currently active in software supply-chain compromise — to Redis-targeting infrastructure attacks going back to 2020, tied together by overlapping domains, malware deployment paths, and staging infrastructure. Today's supply-chain actors often spend years on unglamorous infrastructure compromise before pivoting upstream; treat exposed Redis instances as a long-tail feeder for future campaigns, not just today's problem.