Rhoai Odh-Mod-Arch-Gen-Ai-Rhel9 vulnerabilities

CVE-2026-41139 [HIGH] CWE-94 mathjs: math.js: Arbitrary code execution via expression parser mathjs: math.js: Arbitrary code execution via expression parser A flaw was found in math.js, an extensive math library for JavaScript and Node.js. This vulnerability allows an attacker to execute arbitrary JavaScript code by exploiting the expression parser. This could lead to a complete compromise of the system where math.js is used. Package: grafana-infinity-datasource-npm (Cryostat 4) - Not affected

CVE-2026-6321 [HIGH] CWE-22 fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies A flaw was found in fast-uri. A remote attacker could exploit this vulnerability by providing a specially crafted Uniform Resource Locator (URL) containing percent-encoded path separators and dot segments. Due to incorrect processing, fast-uri would decode these elements before proper normalization, le

CVE-2026-42044 [CRITICAL] CWE-915 axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as a Prototype Pollution "Gadget" attack, allows a remote attacker to subtly alter JSON API responses. By manipulating a specific function, an attacker can selectively modify data within these responses. This could lead to sign

CVE-2026-42043 [CRITICAL] CWE-918 axios: Axios: NO_PROXY bypass via crafted URL axios: Axios: NO_PROXY bypass via crafted URL A flaw was found in Axios, a promise-based HTTP client. An attacker who can control the destination address of an Axios request can exploit this vulnerability. By using specific internal network addresses (within the 127.0.0.0/8 range, excluding 127.0.0.1), the attacker can completely bypass the NO_PROXY protection, potentially leading to unauthorized access or informati

CVE-2026-41680 [HIGH] CWE-835 marked: Marked: Denial of Service via specific input sequence marked: Marked: Denial of Service via specific input sequence A flaw was found in marked, a markdown parser and compiler. An unauthenticated attacker can exploit this Denial of Service (DoS) vulnerability by providing a specific 3-byte input sequence (a tab, a vertical tab, and a newline). This input triggers an infinite recursion loop during parsing, leading to unbounded memory allocation and causing th

CVE-2026-41907 [HIGH] CWE-787 uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality A flaw was found in uuid. The library's versions v3, v5, and v6 do not adequately check the size of external memory buffers provided by applications. This oversight allows the library to write data beyond the designated buffer limits without signaling an error. Such out-of-bounds writes can

CVE-2026-42033 [HIGH] CWE-915 axios: Axios: HTTP Transport Hijacking via Prototype Pollution axios: Axios: HTTP Transport Hijacking via Prototype Pollution A flaw was found in Axios, an HTTP client library. This vulnerability allows an attacker to exploit a prototype pollution issue if another part of the application has already polluted the Object.prototype. By doing so, the attacker can intercept and modify JSON responses or take control of the HTTP communication. This could lead to unauthori

CVE-2026-40897 [HIGH] CWE-917 mathjs: Math.js: Arbitrary code execution via expression parser mathjs: Math.js: Arbitrary code execution via expression parser A flaw was found in mathjs, an extensive math library for JavaScript and Node.js. This vulnerability allows a remote attacker to execute arbitrary JavaScript code by evaluating malicious expressions through the mathjs expression parser. This can lead to a complete compromise of the affected application. Package: rhdh/rhdh-hub-rhel9 (Red H

CVE-2026-42035 [HIGH] CWE-915 axios: Axios: Arbitrary HTTP header injection via prototype pollution axios: Axios: Arbitrary HTTP header injection via prototype pollution A flaw was found in Axios, a software library for making network requests. A remote attacker can exploit a prototype pollution vulnerability to inject arbitrary HTTP headers into outgoing requests. This occurs when the application's core object definitions are manipulated, causing Axios to misinterpret data and include attacker

CVE-2026-42037 [MEDIUM] CWE-93 axios: Node.js: Axios: Information disclosure via CRLF injection in multipart Content-Type header axios: Node.js: Axios: Information disclosure via CRLF injection in multipart Content-Type header A flaw was found in Axios, an HTTP client for Node.js. A remote attacker, by controlling the type property of a file-like object, could inject arbitrary MIME part headers into multipart form data. This vulnerability arises from insufficient sanitization of carriage return

CVE-2026-42038 [MEDIUM] CWE-1220 axios: Axios: Information disclosure due to `no_proxy` bypass axios: Axios: Information disclosure due to `no_proxy` bypass A flaw was found in Axios, a software library used for making web requests. This vulnerability allows an attacker to bypass the `no_proxy` configuration, which is designed to prevent certain internal network requests from being sent through an external proxy. Specifically, when `no_proxy=localhost` is set, requests intended for local system

CVE-2026-42042 [MEDIUM] CWE-1025 axios: Axios: XSRF token bypass leading to information disclosure axios: Axios: XSRF token bypass leading to information disclosure A flaw was found in Axios, a promise-based HTTP client. A remote attacker can exploit this vulnerability by manipulating the `withXSRFToken` configuration property to a truthy non-boolean value. This bypasses the same-origin check, causing Cross-Site Request Forgery (XSRF) tokens to be sent to attacker-controlled cross-origin server

CVE-2026-42036 [MEDIUM] CWE-770 axios: Axios: Denial of Service via unbounded stream consumption when 'responseType: 'stream'' is used axios: Axios: Denial of Service via unbounded stream consumption when 'responseType: 'stream'' is used A flaw was found in Axios. When 'responseType: 'stream'' is used, Axios returns the response stream without enforcing the 'maxContentLength' limit. This allows a remote attacker to bypass configured response-size limits, leading to unbounded downstream consumpt

CVE-2026-42041 [MEDIUM] CWE-915 axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling A flaw was found in Axios, a promise-based HTTP client. This vulnerability, a Prototype Pollution "Gadget" attack, allows an attacker to manipulate the `Object.prototype.validateStatus` property. By polluting this property, all HTTP error responses (such as 401, 403, or 500) are silently treate

CVE-2026-42034 [MEDIUM] CWE-770 axios: Axios: Denial of Service via oversized streamed uploads bypassing body limits axios: Axios: Denial of Service via oversized streamed uploads bypassing body limits A flaw was found in Axios. A remote attacker can exploit this vulnerability by sending oversized streamed uploads. This occurs when the `maxRedirects` setting is configured to 0, which bypasses the `maxBodyLength` limit for stream request bodies. Consequently, the system will process the full ove

CVE-2026-42039 [MEDIUM] CWE-770 axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data A flaw was found in Axios, a promise-based HTTP client for browsers and Node.js. This vulnerability occurs because the `toFormData` function recursively processes nested objects without a depth limit. A remote attacker can exploit this by sendin

CVE-2026-41238 [MEDIUM] CWE-915 DOMPurify: DOMPurify: Cross-Site Scripting bypass via prototype pollution DOMPurify: DOMPurify: Cross-Site Scripting bypass via prototype pollution A flaw was found in DOMPurify, a software library used to clean potentially malicious code from web content, preventing Cross-Site Scripting (XSS) attacks. A remote attacker could exploit a vulnerability related to 'prototype pollution' to bypass DOMPurify's security checks. This allows the attacker to inject harmful

CVE-2026-41239 [MEDIUM] CWE-1289 DOMPurify: Vue 2: DOMPurify: Cross-site scripting due to incomplete sanitization of template expressions DOMPurify: Vue 2: DOMPurify: Cross-site scripting due to incomplete sanitization of template expressions A flaw was found in DOMPurify. A remote attacker could exploit this cross-site scripting (XSS) vulnerability when DOMPurify is configured to return a Document Object Model (DOM) or DOM fragment. The SAFE_FOR_TEMPLATES feature, intended to strip template ex

CVE-2026-41240 [MEDIUM] CWE-79 DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization A flaw was found in DOMPurify, a DOM-only cross-site scripting sanitizer. A remote attacker could exploit an inconsistency in how forbidden tags and attributes are handled when function-based tag additions are used. This allows malicious HTML, MathML, or SVG elements to bypass sanitization and execute

CVE-2026-41988 [LOW] CWE-787 uuid: uuid: Unexpected data writes when using external output buffers with specific UUID versions uuid: uuid: Unexpected data writes when using external output buffers with specific UUID versions A flaw was found in uuid. When external output buffers are used with UUID versions 3, 5, or 6, an attacker with local access may be able to cause unexpected data writes. This vulnerability could lead to low impact data integrity issues. UUID version 4 is not affected. Pack