https://vulnerability.circl.lu/sightings/feed 2026-08-20T19:42:14.882345+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/e98511ce-1fdb-45e4-ac85-90460d92cc31/export 2026-08-20T19:42:14.893202+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "e98511ce-1fdb-45e4-ac85-90460d92cc31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-HC4M-Q9JH-XW4J", "type": "seen", "source": "https://gist.github.com/alon710/92ad6f547c2ba0c3ac7a937f90c439cc", "content": "# GHSA-HC4M-Q9JH-XW4J: GHSA-hc4m-q9jh-xw4j: Registry Pack Verification Fail-Open Vulnerability in nono-cli\n\n> **CVSS Score:** 6.6\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/GHSA-HC4M-Q9JH-XW4J\n\n## Summary\nThe nono-cli package verification mechanism fails open when both the lockfile entry and local trust bundle are absent. This allows local attackers to execute unverified package profiles and native host session hooks by removing metadata configurations, bypassing cryptographic integrity controls.\n\n## TL;DR\nA fail-open flaw in nono-cli version 0.61.2 and earlier allows unverified packages to execute on the host machine by simply deleting their local metadata and lockfile files.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-636\n- **Attack Vector**: Local (AV:L)\n- **CVSS Severity**: 6.6 Medium\n- **Impact**: High Confidentiality, High Integrity (C:H/I:H)\n- **Exploit Status**: Proof of Concept (PoC)\n- **First Patched Version**: 0.61.3 / v0.62.0\n\n## Affected Systems\n\n- nono-cli\n- nono profile runtime\n- **nono-cli**: <= 0.61.2 (Fixed in: `0.61.3`)\n\n## Mitigation\n\n- Upgrade nono-cli to version 0.61.3 or higher.\n- Deploy File Integrity Monitoring (FIM) over the ~/.config/nono directory.\n- Restrict local configuration write permissions to root or authorized owners only.\n\n**Remediation Steps:**\n1. Identify installed instances of nono-cli and query versions using 'nono --version'.\n2. Update the utility using the cargo package manager or system-specific installation scripts to v0.62.0.\n3. Verify configuration status using 'nono verify' against existing packs.\n4. If lockfiles are missing, execute recovery with 'nono pull --force' to securely reconstruct trust bundles.\n\n## References\n\n- [GitHub Security Advisory GHSA-hc4m-q9jh-xw4j](https://github.com/advisories/GHSA-hc4m-q9jh-xw4j)\n- [always-further/nono Advisory on Github](https://github.com/always-further/nono/security/advisories/GHSA-hc4m-q9jh-xw4j)\n- [Fix Commit db07375](https://github.com/nolabs-ai/nono/commit/db07375031642f089d549b4f7b9abece87e39f87)\n- [Release v0.62.0](https://github.com/nolabs-ai/nono/releases/tag/v0.62.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-HC4M-Q9JH-XW4J) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-28T16:31:30.511355Z"} 2026-07-28T16:31:30.511355+00:00