November 13, 2026
November 13, 2026
On November 13, 2026, GitHub's security advisory list published 41 new advisories, changed 2, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.
- GHSA-mfg3-p6m3-gjgrPyPI · nova · MODERATE · OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints
- GHSA-4j63-6c4x-wfg4PyPI · soupsieve · MODERATE · Soup Sieve: General sibling combinator inside :has() matches untrusted HTML in quadratic time
- GHSA-mmhr-3c5m-f64fPyPI · soupsieve · HIGH · Soup Sieve: Polynomial-time denial of service in the descendant combinator
- GHSA-x585-4vv8-2mh2PyPI · rucio · CRITICAL · Rucio: Unauthenticated administrator impersonation through SSH challenge tokens
- GHSA-v653-r55g-hcmgcrates[.]io · uv · MODERATE · uv has ZIP payload obfuscation through parsing differentials
- GHSA-7g44-g9rc-x53wPyPI · soupsieve · MODERATE · Soup Sieve: Uncontrolled recursion in CSS parser lets nested pseudo-class selectors exhaust the Python call stack
- GHSA-6655-6qjp-jx7xPyPI · soupsieve · HIGH · Soup Sieve: Exponential ReDoS in selector compilation via \9-run in CSS_ESCAPES/IDENTIFIER
- GHSA-mf5v-w3w3-f6cgPyPI · opentelemetry-api · MODERATE · OpenTelemetry Python API: Denial of service through quadratic-time traceparent parsing
- GHSA-cpgf-5mjf-73p7RubyGems · rails-html-sanitizer · MODERATE · rails-html-sanitizer: Possible regular expression denial of service with certain configurations
- GHSA-jv6m-48w5-5rprPyPI · envd · MODERATE · envd: Host file disclosure through requirements path traversal and TOCTOU
- GHSA-h7wh-q2qr-458cRubyGems · rails-html-sanitizer · MODERATE · rails-html-sanitizer: Possible XSS via shared scrubber state in concurrent calls
- GHSA-mjrq-cffv-q4qcnpm · @nuxt/schema · MODERATE · Nuxt dev server serves files from a parent directory with a stray lockfile or workspace file
- GHSA-r3h5-4585-7x3wnpm · @astrojs/node, astro · MODERATE · Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems
- GHSA-mh32-jxcr-mh9fnpm · astro · LOW · Astro: XSS via attribute injection in dynamic tag names
- GHSA-gpwp-5797-mjffNuGet · AutoMapper · HIGH · AutoMapper: Denial of Service via uncontrolled recursion that bypasses MaxDepth
- GHSA-63hm-g96r-2m2qPackagist · laravel/framework · LOW · Laravel: Task Output Injection - Concurrency Process
- GHSA-4fqr-96q8-xrfxRubyGems · sqlite3 · MODERATE · sqlite3-ruby: Possible SQL query truncation when a string is 4 GiB or larger
- GHSA-q7gw-24fr-5p69Go · go[.]opentelemetry[.]io/otel/sdk, go[.]opentelemetry[.]io/otel/sdk/log, go[.]opentelemetry[.]io/otel/trace · MODERATE · opentelemetry-go: AttributeValueLengthLimit is fully bypassed by attribute values composed of valid U+FFFD runes
- GHSA-rrfc-gjm9-cgrjGo · go[.]opentelemetry[.]io/otel/baggage, go[.]opentelemetry[.]io/otel/propagation · MODERATE · OpenTelemetry-Go: Eager W3C baggage-property materialization causes bounded memory-allocation amplification
- GHSA-736f-c93q-9fwxcrates[.]io · russh · LOW · russh try_sign: asynchronous confirmation can sign after agent lock
- GHSA-9264-jvgf-6w2fcrates[.]io · russh · LOW · russh kex_done: Shared-secret callback runs before server host-key verification
- GHSA-6vhm-j9h7-f9ghNuGet · AutoMapper · HIGH · AutoMapper: Uncontrolled Recursion with Constructor Parameters
- GHSA-3v2p-hm54-8qcqnpm · @opentelemetry/instrumentation-http · MODERATE · OpenTelemetry JavaScript: Insertion of Sensitive Information into Log File and Exposure of Sensitive Information to an Unauthorized Actor in @opentelemetry/instrumentation-http
- GHSA-r99w-jh2x-3mg9npm · @nuxt/nitro-server · MODERATE · Nuxt: Incomplete fix for GHSA-9v7c-q64q-vv33: a leading `//` in the request path bypasses `server/middleware` path checks and server route rules on page routes
- GHSA-vvf4-9x63-8xvvPyPI · dnspython · HIGH · dnspython has excessive memory and CPU use
- GHSA-5cjw-f85j-cv6rPyPI · tornado · LOW · Tornado: Open redirect via triple-slash redirect paths
- GHSA-rqw3-x7hx-mm3pnpm · @sveltejs/adapter-node · MODERATE · SvelteKit: `@sveltejs/adapter-node` crashes when proxying certain requests via `fetch`
- GHSA-5wg4-q3ww-283hnpm · @sveltejs/adapter-cloudflare · MODERATE · SvelteKit: Prerendered redirect paths can inject arbitrary rules into the `_redirects` file generated by `@sveltejs/adapter-cloudflare`
- GHSA-jf9x-2fg2-hx4wnpm · @sveltejs/adapter-vercel, @sveltejs/adapter-static · MODERATE · SvelteKit: Prerendered paths are interpreted as regular expressions in Vercel route config generated by @sveltejs/adapter-vercel and @sveltejs/adapter-static
- GHSA-mw6w-2fmv-pvw3npm · @sveltejs/kit · MODERATE · SvelteKit: adapter-node crashes with an unhandled URIError when `reroute` rewrites malformed pathnames
- GHSA-7r4r-6ppg-7ff8PyPI · nltk · HIGH · Duplicate Advisory: Symlink escape in YCOECorpusReader lets a psd/pos directory symlink read files outside the corpus root within the data sandbox
- GHSA-4hvg-fv5c-9936PyPI · nltk · HIGH · Duplicate Advisory: Unbounded CPU consumption in NLTK SteppingRecursiveDescentParser[.]parse() with ambiguous or self-embedding grammars
- GHSA-qg35-44qx-7vrrPyPI · nltk · HIGH · NLTK: Symlink escape in YCOECorpusReader lets a psd/pos directory symlink read files outside the corpus root within the data sandbox
- GHSA-8fx7-8jr8-84rvPyPI · nltk · HIGH · NLTK: Unbounded CPU consumption in SteppingRecursiveDescentParser[.]parse() with ambiguous or self-embedding grammars
- GHSA-rg32-vgf9-927cPyPI · nltk · MODERATE · Duplicate Advisory: Quadratic CPU exhaustion in TreebankWordTokenizer.span_tokenize via list[.]pop(0) in quote-restore loop
- GHSA-ffr9-mgrr-wcvrPyPI · nltk · MODERATE · NLTK: Quadratic CPU exhaustion in TreebankWordTokenizer.span_tokenize via list[.]pop(0) in quote-restore loop
- GHSA-gpwc-27cw-rh9rPyPI · nltk · MODERATE · NLTK: Quadratic CPU exhaustion in LegalitySyllableTokenizer[.]tokenize via unguarded onset reversal loop
- GHSA-g5wx-957h-f4wjPyPI · nltk · MODERATE · Duplicate Advisory: Path Traversal in save_maxent_params / load_maxent_params Allow Arbitrary File READ/WRITE
- GHSA-jh6r-h4rx-2j3wPyPI · nltk · HIGH · Duplicate Advisory: Quadratic-time CPU denial of service in NLTK CCG lexicon parser (fromstring) on wide bracket bodies and operator chains
- GHSA-pp88-jhwj-5qh5Go · github[.]com/filebrowser/filebrowser/v2 · LOW · File Browser: Trailing-slash directory deletion leaves public shares active for recreated paths
- GHSA-qfx6-q44v-9qqwnpm · ag-psd · HIGH · ag-psd can exhaust memory when parsing crafted PSD dimensions
- GHSA-f7j6-hf97-9v99PyPI · nltk · HIGH · Duplicate Advisory: BllipParser passes caller-supplied model paths to the bllipparser C extension with no pathsec check, enabling arbitrary read
- GHSA-fg9w-wfp5-j933PyPI · nltk · MODERATE · NLTK: BllipParser passes caller-supplied model paths to the bllipparser C extension with no pathsec check, enabling arbitrary read