Common Weakness Enumeration
CWE-653
AllowedImproper Isolation or Compartmentalization
Abstraction: Class · Status: Draft
The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.
113 vulnerabilities reference this CWE, most recent first.
GHSA-RR5W-74H2-XQHC
Vulnerability from github – Published: 2026-05-12 15:31 – Updated: 2026-06-30 03:36
VLAI
Details
Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2026-8401"
],
"database_specific": {
"cwe_ids": [
"CWE-653",
"CWE-693"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-12T15:16:20Z",
"severity": "CRITICAL"
},
"details": "Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3.",
"id": "GHSA-rr5w-74h2-xqhc",
"modified": "2026-06-30T03:36:39Z",
"published": "2026-05-12T15:31:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8401"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-51"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-48"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-47"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-45"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8401.json"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476492"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2038679"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-8401"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:27715"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26630"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26629"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26606"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26551"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26539"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26536"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26521"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26493"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26492"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26491"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26270"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26269"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26268"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26174"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:22643"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:22325"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:21382"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:21381"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:21380"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:21378"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RX66-HJ7G-28H7
Vulnerability from github – Published: 2026-04-02 15:31 – Updated: 2026-04-04 05:58
VLAI
Summary
Keycloak: Replay of action tokens via improper handling of single-use entries
Details
A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an attacker to delete arbitrary single-use entries, which can enable the replay of consumed action tokens, such as password reset links. This could lead to unauthorized access or account compromise.
Severity
5.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-services"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "26.5.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-4325"
],
"database_specific": {
"cwe_ids": [
"CWE-653"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-04T05:58:45Z",
"nvd_published_at": "2026-04-02T13:16:26Z",
"severity": "MODERATE"
},
"details": "A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an attacker to delete arbitrary single-use entries, which can enable the replay of consumed action tokens, such as password reset links. This could lead to unauthorized access or account compromise.",
"id": "GHSA-rx66-hj7g-28h7",
"modified": "2026-04-04T05:58:45Z",
"published": "2026-04-02T15:31:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4325"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/issues/47715"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/commit/9046f201125a6fd6be9c116b99d348509d99d4a5"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:6475"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:6476"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:6477"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:6478"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-4325"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448351"
},
{
"type": "PACKAGE",
"url": "https://github.com/keycloak/keycloak"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Keycloak: Replay of action tokens via improper handling of single-use entries"
}
GHSA-V4QX-H7R5-6QC8
Vulnerability from github – Published: 2025-04-29 15:31 – Updated: 2025-11-03 21:33
VLAI
Details
A process isolation vulnerability in Firefox stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended frame, potentially enabling a sandbox escape. This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Firefox ESR < 115.23, Thunderbird < 138, and Thunderbird ESR < 128.10.
Severity
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2025-4083"
],
"database_specific": {
"cwe_ids": [
"CWE-653"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-29T14:15:35Z",
"severity": "CRITICAL"
},
"details": "A process isolation vulnerability in Firefox stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document\u0027s process instead of the intended frame, potentially enabling a sandbox escape. This vulnerability affects Firefox \u003c 138, Firefox ESR \u003c 128.10, Firefox ESR \u003c 115.23, Thunderbird \u003c 138, and Thunderbird ESR \u003c 128.10.",
"id": "GHSA-v4qx-h7r5-6qc8",
"modified": "2025-11-03T21:33:41Z",
"published": "2025-04-29T15:31:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4083"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1958350"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00024.html"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-28"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-29"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-30"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-31"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-32"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-V5QF-VX9F-H34F
Vulnerability from github – Published: 2025-01-23 03:30 – Updated: 2025-01-23 15:31
VLAI
Details
lunasvg v3.0.0 was discovered to contain a segmentation violation via the component composition_source_over.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-57723"
],
"database_specific": {
"cwe_ids": [
"CWE-653"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-23T01:15:27Z",
"severity": "MODERATE"
},
"details": "lunasvg v3.0.0 was discovered to contain a segmentation violation via the component composition_source_over.",
"id": "GHSA-v5qf-vx9f-h34f",
"modified": "2025-01-23T15:31:05Z",
"published": "2025-01-23T03:30:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57723"
},
{
"type": "WEB",
"url": "https://github.com/sammycage/lunasvg/issues/209"
},
{
"type": "WEB",
"url": "https://github.com/keepinggg/poc/blob/main/poc_of_lunasvg_3.1.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-VCFP-63CX-4H59
Vulnerability from github – Published: 2025-01-28 03:31 – Updated: 2025-01-28 03:31
VLAI
Details
NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code obtaining read and write access to host devices. This vulnerability is present only when the NVIDIA Container Toolkit is configured in a nondefault way. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Severity
7.6 (High)
{
"affected": [],
"aliases": [
"CVE-2024-0136"
],
"database_specific": {
"cwe_ids": [
"CWE-653"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-28T03:15:07Z",
"severity": "HIGH"
},
"details": "NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code obtaining read and write access to host devices. This vulnerability is present only when the NVIDIA Container Toolkit is configured in a nondefault way. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.",
"id": "GHSA-vcfp-63cx-4h59",
"modified": "2025-01-28T03:31:14Z",
"published": "2025-01-28T03:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0136"
},
{
"type": "WEB",
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5599"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-VHM6-GP6V-Q659
Vulnerability from github – Published: 2026-06-16 15:33 – Updated: 2026-07-15 12:31
VLAI
Details
Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, and Firefox ESR 115.37.
Severity
9.6 (Critical)
{
"affected": [],
"aliases": [
"CVE-2026-12297"
],
"database_specific": {
"cwe_ids": [
"CWE-119",
"CWE-653"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-16T13:16:29Z",
"severity": "CRITICAL"
},
"details": "Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, and Firefox ESR 115.37.",
"id": "GHSA-vhm6-gp6v-q659",
"modified": "2026-07-15T12:31:49Z",
"published": "2026-06-16T15:33:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12297"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-61"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-60"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-59"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-58"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-57"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12297.json"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489235"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2041610"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-12297"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:39706"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:39428"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:39142"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:39141"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:39011"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:38753"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:38751"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:38750"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:38506"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:37391"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:37210"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36103"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36102"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36101"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36100"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:33445"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:30846"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:29940"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:27734"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:27733"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:27717"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-VVW2-H478-XWR3
Vulnerability from github – Published: 2025-11-04 15:31 – Updated: 2025-11-04 17:05
VLAI
Summary
DSPy does not properly restrict file reads
Details
The overly permissive sandbox configuration in DSPy allows attackers to steal sensitive files in cases when users build an AI agent which consumes user input and uses the “PythonInterpreter” class.
Severity
5.9 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "dspy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.0.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-12695"
],
"database_specific": {
"cwe_ids": [
"CWE-653"
],
"github_reviewed": true,
"github_reviewed_at": "2025-11-04T17:05:45Z",
"nvd_published_at": "2025-11-04T14:15:34Z",
"severity": "MODERATE"
},
"details": "The overly permissive sandbox configuration in DSPy allows attackers to steal sensitive files in cases when users build an AI agent which consumes user input and uses the \u201cPythonInterpreter\u201d class.",
"id": "GHSA-vvw2-h478-xwr3",
"modified": "2025-11-04T17:05:45Z",
"published": "2025-11-04T15:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12695"
},
{
"type": "PACKAGE",
"url": "https://github.com/stanfordnlp/dspy"
},
{
"type": "WEB",
"url": "https://research.jfrog.com/vulnerabilities/dspy-sandbox-escape-arbitrary-file-read-jfsa-2025-001495652"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "DSPy does not properly restrict file reads"
}
GHSA-WR8Q-C73G-M7GP
Vulnerability from github – Published: 2026-04-08 15:31 – Updated: 2026-06-08 19:03
VLAI
Summary
pretix: API leaks check-in data between events of the same organizer
Details
A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-in events belonging to the respective organizer. This allows an API consumer to access information for all other events under the same organizer, even those they should not have access to.
These records contain information on the time and result of every ticket scan as well as the ID of the matched ticket. Example:
{ "id": 123, "successful": true, "error_reason": null, "error_explanation": null, "position": 321, "datetime": "2020-08-23T09:00:00+02:00", "list": 456, "created": "2020-08-23T09:00:00+02:00", "auto_checked_in": false, "gate": null, "device": 1, "device_id": 1, "type": "entry" }
An unauthorized user usually has no way to match these IDs (position) back to individual people.
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pretix"
},
"ranges": [
{
"events": [
{
"introduced": "2026.3.0"
},
{
"fixed": "2026.3.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "pretix"
},
"ranges": [
{
"events": [
{
"introduced": "2026.2.0"
},
{
"fixed": "2026.2.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "pretix"
},
"ranges": [
{
"events": [
{
"introduced": "2025.10.0"
},
{
"fixed": "2026.1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-5600"
],
"database_specific": {
"cwe_ids": [
"CWE-653"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-08T19:23:39Z",
"nvd_published_at": "2026-04-08T13:16:43Z",
"severity": "MODERATE"
},
"details": "A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-in events belonging to the respective organizer. This allows an API consumer to access information for all other events under the same organizer, even those they should not have access to.\n\nThese records contain information on the time and result of every ticket scan as well as the ID of the matched ticket. Example:\n\n{\n \"id\": 123,\n \"successful\": true,\n \"error_reason\": null,\n \"error_explanation\": null,\n \"position\": 321,\n \"datetime\": \"2020-08-23T09:00:00+02:00\",\n \"list\": 456,\n \"created\": \"2020-08-23T09:00:00+02:00\",\n \"auto_checked_in\": false,\n \"gate\": null,\n \"device\": 1,\n \"device_id\": 1,\n \"type\": \"entry\"\n}\n\nAn unauthorized user usually has no way to match these IDs (position) back to individual people.",
"id": "GHSA-wr8q-c73g-m7gp",
"modified": "2026-06-08T19:03:02Z",
"published": "2026-04-08T15:31:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5600"
},
{
"type": "PACKAGE",
"url": "https://github.com/pretix/pretix"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pretix/PYSEC-2026-111.yaml"
},
{
"type": "WEB",
"url": "https://pretix.eu/about/en/blog/20260408-release-2026-3-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H",
"type": "CVSS_V4"
}
],
"summary": "pretix: API leaks check-in data between events of the same organizer"
}
GHSA-WRFH-R93C-GW3F
Vulnerability from github – Published: 2025-06-27 15:31 – Updated: 2025-07-31 18:31
VLAI
Details
On open-vsx.org http://open-vsx.org/ it was possible to run an arbitrary build scripts for auto-published extensions because of missing sandboxing of CI job runs. An attacker who had access to an existing extension could take over the service account of the marketplace. The issue has been fixed on June 24th, 2025 and the vulnerable code present in the publish-extension code repository.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-6705"
],
"database_specific": {
"cwe_ids": [
"CWE-653"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-27T15:15:28Z",
"severity": "HIGH"
},
"details": "On open-vsx.org http://open-vsx.org/ \u00a0it was possible to run an arbitrary build scripts for auto-published extensions because of missing sandboxing of CI job runs. An attacker who had access to an existing extension could take over the service account of the marketplace. The issue has been fixed on June 24th, 2025 and the vulnerable code present in the publish-extension code repository.",
"id": "GHSA-wrfh-r93c-gw3f",
"modified": "2025-07-31T18:31:57Z",
"published": "2025-06-27T15:31:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6705"
},
{
"type": "WEB",
"url": "https://github.com/EclipseFdn/publish-extensions/pull/881"
},
{
"type": "WEB",
"url": "https://open-vsx.org"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-WWJG-89VG-GFHH
Vulnerability from github – Published: 2025-07-09 09:31 – Updated: 2025-07-09 12:31
VLAI
Details
Restricted shell rbash evasion in Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) allows the user vpuser to start a full-feature shell.
A user with vpuser credentials that opens an SSH connection to the device, gets a restricted shell rbash that allows only a small list of allowed commands. This vulnerability enables the user to get a full-featured Linux shell, bypassing the rbash restrictions.
Severity
4.1 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-27027"
],
"database_specific": {
"cwe_ids": [
"CWE-653"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-09T09:15:26Z",
"severity": "MODERATE"
},
"details": "Restricted shell rbash\u00a0evasion in Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) allows the user vpuser\u00a0to start a full-feature shell.\n\n\n\nA user with vpuser\u00a0credentials that opens an SSH connection to the device, gets a restricted shell rbash\u00a0that allows only a small list of allowed commands. This vulnerability enables the user to get a full-featured Linux shell, bypassing the rbash\u00a0restrictions.",
"id": "GHSA-wwjg-89vg-gfhh",
"modified": "2025-07-09T12:31:34Z",
"published": "2025-07-09T09:31:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27027"
},
{
"type": "WEB",
"url": "https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27027"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Architecture and Design
Break up privileges between different modules, objects, or entities. Minimize the interfaces between modules and require strong access control between them.
No CAPEC attack patterns related to this CWE.