Security Thursdays by yisusvii — 2026-09-10

Table of Contents

🚨 Cybersecurity News of the Week

1. Gitea — RCE via diffpatch git-hook installation (Sep 8)

What happened: On September 8, 2026, Gitea published GHSA-rcr6-4jqh-j84m for CVE-2026-60004. The diffpatch path applies attacker-controlled patches in a shared bare temporary clone. Submitting the same patch twice creates an add/add collision; Git’s three-way fallback can check out an executable hooks/post-index-change under $GIT_DIR, which Git then runs while writing the index — arbitrary commands as the Gitea OS user.

Who is affected: Gitea ≥ 1.17.0 and < 1.27.1. Fixed in 1.27.1 (release notes, blog). Ordinary repository write access is enough. With default open registration, an unauthenticated visitor can register, create a repo, and reach the path — the advisory states open registration is required only for the no-prior-credentials attack path.

Why it matters: Self-hosted forges often hold deploy keys, package credentials, and CI webhooks. RCE as the Gitea service account is a full platform compromise class for many deployments.

Exploitation status: Advisory includes a public PoC (gitea_diffpatch_rce_poc.py). GHSA reference list includes a CISA KEV catalog deep-link; live KEV feed was unreachable here, so catalog membership is not independently verified in this digest. Active exploitation in the wild is not confirmed by sources reviewed.

CVSS: 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) per GHSA.

Defender actions: Upgrade to ≥ 1.27.1 immediately; disable open registration on internet-facing instances if not required; restrict who can create repositories; rotate secrets reachable by the Gitea OS user if the instance was exposed while vulnerable; review audit logs around diffpatch usage.

Primary sources: GHSA-rcr6-4jqh-j84m, v1.27.1 release.

2. Semaphore UI — OS command injection via repository git_url (Sep 8)

What happened: On September 8, 2026, Semaphore UI published GHSA-xp7j-h7jc-4w8p for CVE-2026-73294. Repository git_url is stored without option-injection validation and is passed to git ls-remote without a -- separator. An attacker-controlled value such as --upload-pack=<cmd> is parsed as a git option; git then executes the upload-pack value through a shell. The commit-hash schedule poller runs this in the main Semaphore server process, bypassing remote-runner isolation and exposing the master encryption key and project secrets.

Who is affected: Advisory lists affected builds 2.18.12, 2.18.13, 2.18.16; patched: 2.18.20. Default git_client: cmd_git is enough. Attacker needs Manager or Owner on any project (normal collaborator roles).

Why it matters: Automation UIs are high-value: they hold inventory credentials, Ansible vault material, and often sit with broad network reach. Collaborator-role RCE on the control plane is not a “low-privilege sandbox” issue.

Exploitation: Not confirmed in the wild in sources reviewed; advisory includes a detailed reproduction against v2.18.12.

CVSS: 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) per advisory (notes Scope:Unchanged would be 8.8).

Defender actions: Upgrade to ≥ 2.18.20; inventory Manager/Owner grants; review stored git_url values for option-like strings; rotate Semaphore encryption keys and project secrets if a vulnerable control plane was reachable by untrusted collaborators.

Primary source: GHSA-xp7j-h7jc-4w8p.

3. Next.js and Astro — unauthenticated RCE via image optimization / Windows hosts (Sep 8)

What happened: On September 8, 2026, Vercel published two Critical Next.js advisories fixed on the same trains (15.5.24, 16.3.3):

Separately, Astro published GHSA-26w7-cxv4-gfx2: RCE through AVIF image optimization when untrusted AVIF can reach the default Sharp image service. Fixed in Astro 7.2.8 (requires Sharp 0.35.4). CVSS 3.1 9.8.

Who is affected: Next.js ≥ 13.4 < 15.5.24 and ≥ 16.0 < 16.3.3 for the Windows issue; AVIF image-opt path spans ≥ 10.0.0 up to the same patched floors. Astro < 7.2.8 when attacker-controlled AVIF can be optimized.

Why it matters: Image optimization endpoints are often internet-reachable by design. Framework-default image pipelines inherit native decoder risk (libheif/Sharp) and platform-specific path behavior on Windows.

Exploitation: Not confirmed in the wild in sources reviewed.

Defender actions: Upgrade Next.js and Astro to patched releases; on Windows Next hosts, treat this as urgent with no workaround; ensure Sharp ≥ 0.35.4 where Astro optimizes images; restrict who can submit arbitrary image URLs/files to optimizers.

Primary sources: GHSA-p293-qw3h-jr36, GHSA-2xp9-vwfh-vxw4, GHSA-26w7-cxv4-gfx2.

4. Microsoft MsQuic — unauthenticated network RCE (use-after-free) (Sep 8)

What happened: On September 8, 2026, Microsoft published GHSA-92f5-vc22-8j33 for CVE-2026-62815. Use-after-free in path creation/removal handling: “New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.” An unauthenticated attacker can send crafted packets to execute code. No user interaction required.

Who is affected: NuGet packages Microsoft.Native.Quic.MsQuic.OpenSSL / .Schannel — fixed floors 2.5.10 and 2.4.19 (advisory: affected < 2.5.10, patched 2.5.10, 2.4.19; GHSA package ranges also document ≥ 2.5.3, < 2.5.10 and < 2.4.19).

Why it matters: QUIC stacks terminate on highly exposed UDP listeners (HTTP/3, SMB over QUIC, custom services). Memory-corruption RCE without auth is emergency-class wherever MsQuic is the server-side stack.

Exploitation: Not confirmed in sources reviewed.

CVSS: GHSA lists CVSS 3.1 9.8; advisory page also publishes a CVSS 4.0 vector.

Defender actions: Upgrade MsQuic packages to patched versions; inventory services binding QUIC; apply vendor platform updates if the OS ships MsQuic separately.

Primary source: GHSA-92f5-vc22-8j33.

5. Developer libraries and platform glue — GitPython, Predis, Netty, containerd, SiYuan (Sep 3–9)

Additional high-signal items in-window:

• GitPython CVE-2026-78676 / GHSA-284h-m62q-gf8w (Critical, CVSS 3.1 9.8, Sep 8): multi-line git-config values can be corrupted into live injected directives (e.g. core.hooksPath) on an unrelated GitConfigParser write — prior write-argument guards do not cover the read→rewrite round trip. Fixed ≥ 3.1.59.
• Predis CVE-2026-84372 / GHSA-w6f5-v2h6-g786 (Critical, CVSS 3.1 9.8, Sep 8): pipeline handling on aggregate connections re-parses buffers with explode("\r\n") instead of RESP lengths → Redis command injection (cluster) or reliable DoS (replication). Affected 3.0.0-RC1 through < 3.3.0; fixed 3.3.0. v1/v2 not affected.
• Netty CVE-2026-75595 / GHSA-c4c3-7fpv-j4q5 (Critical, Sep 8): fragmented TLS ClientHello can force fallback to the default SslContext, bypassing per-SNI mTLS selection. Fixed netty-handler 4.1.137.Final / 4.2.17.Final.
• containerd CVE-2026-53495 / GHSA-7jxh-36q5-gcqv (Medium, Sep 9): CRI ExecSync goroutine leak from exec probes/hooks with background children → node-level DoS. Fixed 1.7.35, 2.0.12, 2.2.8, 2.3.5.
• SiYuan SQL cluster (Sep 3): CVE-2026-69084 and siblings (e.g. CVE-2026-69083, CVE-2026-72811) — publish-mode reader/anonymous reachable raw SQL on read-write handles (CVSS 3.1 10.0 class). Fixed floor called out as v3.7.3 (affected ≤ v3.7.2) on the primary advisory; upgrade any internet-published SiYuan instance.

Primary sources: linked GHSAs above; SiYuan GHSA-vh22-h7hf-www7.

🛡️ CVEs That Deserve Attention

CVE-2026-60004 — Gitea diffpatch git-hook RCE

• Product / versions: Gitea ≥ 1.17.0, < 1.27.1; fixed 1.27.1
• Type: Improper control of generation of code / git hook install via patch application (RCE)
• Prereqs: Repo write (or open registration → create repo). diffpatch enabled/reachable as deployed
• CVSS: 3.1 9.8
• KEV / EPSS: KEV not independently verified (feed unreachable); EPSS not retrieved
• Public exploit: Yes (advisory PoC)
• Priority: Emergency for internet-facing or open-registration instances; High for internal forges with broad developer write access
• Advisory: GHSA-rcr6-4jqh-j84m

CVE-2026-73294 — Semaphore UI git_url command injection

• Product / versions: Affected 2.18.12, 2.18.13, 2.18.16; fixed 2.18.20 (consult vendor if you run other trains such as 2.19.x betas referenced in commit notes)
• Type: OS command injection via git argument injection (--upload-pack)
• Prereqs: Authenticated Manager/Owner; default cmd_git client; schedule/repo features in use
• CVSS: 3.1 9.9 (Scope:Changed)
• Priority: Emergency if untrusted users can be Managers; otherwise High
• Advisory: GHSA-xp7j-h7jc-4w8p

CVE-2026-75604 — Next.js Windows unauthenticated RCE

• Product / versions: ≥ 13.4 < 15.5.24, ≥ 16.0 < 16.3.3; fixed 15.5.24, 16.3.3
• Type: RCE on Windows filesystem-hosted servers (Pages/App Router without Cache Component)
• Prereqs: Network reachability to the Next server on Windows; no auth per advisory
• CVSS: 3.1 9.0 (AC:H, Scope:Changed)
• Workaround: None known — upgrade
• Priority: Emergency for Windows production hosts; Monitor/High for Linux-only fleets (still apply the train for the sibling AVIF issue)
• Advisory: GHSA-p293-qw3h-jr36

Next.js / Astro AVIF image-optimization RCE

• Next.js: GHSA-2xp9-vwfh-vxw4 — AVIF optimization via Sharp/libheif; patched 15.5.24 / 16.3.3; AVIF optimization disabled until fix propagates
• Astro: GHSA-26w7-cxv4-gfx2 — fixed 7.2.8 + Sharp 0.35.4; CVSS 3.1 9.8
• Priority: High wherever untrusted images can hit optimizers
• Confirm exact CVE assignment for the Next AVIF GHSA on NVD if you track by CVE ID only — the Windows issue is CVE-2026-75604; treat the AVIF GHSA as first-class regardless of CVE mint timing

CVE-2026-62815 — MsQuic use-after-free RCE

• Product / versions: MsQuic NuGet OpenSSL/Schannel packages; fixed 2.5.10 and 2.4.19
• Type: Use-after-free → unauthenticated network RCE
• CVSS: 3.1 9.8 (CVSS 4.0 also on advisory)
• Priority: High (Emergency if you terminate untrusted QUIC at scale)
• Advisory: GHSA-92f5-vc22-8j33

CVE-2026-78676 — GitPython config rewrite RCE

• Product / versions: GitPython ≤ 3.1.58; fixed 3.1.59
• Type: Config injection via read/corrupt-on-rewrite of multi-line values → hook path control
• Prereqs: Attacker-influenced git config content later rewritten by GitPython
• Priority: High for CI/CD helpers, repo automation, and any service that rewrites git config with GitPython
• Advisory: GHSA-284h-m62q-gf8w

CVE-2026-84372 — Predis pipeline CRLF command injection

• Product / versions: predis/predis ≥ 3.0.0-RC1, < 3.3.0; fixed 3.3.0
• Type: Improper neutralization of CRLF in pipeline re-parse on aggregate connections
• Prereqs: Attacker influence over pipelined key/argument data; cluster or replication aggregate connection
• Priority: High for PHP apps using Predis 3.x pipelines against Redis Cluster
• Advisory: GHSA-w6f5-v2h6-g786

CVE-2026-75595 — Netty SNI / mTLS bypass

• Product / versions: io.netty:netty-handler ≤ 4.1.136.Final → 4.1.137.Final; 4.2.0.Final–4.2.16.Final → 4.2.17.Final
• Type: Fragmented ClientHello → default SslContext fallback
• Priority: High when per-SNI SslContext is the sole mTLS gate; Medium otherwise
• Advisory: GHSA-c4c3-7fpv-j4q5

CVE-2026-69084 — SiYuan publish-mode arbitrary SQL

• Product / versions: ≤ v3.7.2; fixed v3.7.3 (per advisory patched-versions field)
• Type: Unauthenticated/reader-reachable raw SQL on read-write DB handle
• CVSS: 3.1 10.0
• Priority: Emergency if publish mode is internet-exposed; High for any shared publish deployment
• Advisory: GHSA-vh22-h7hf-www7

CVE-2026-53495 — containerd ExecSync node DoS

• Product / versions: Fixed 1.7.35, 2.0.12, 2.2.8, 2.3.5
• Type: Goroutine leak via unbounded I/O drain in CRI ExecSync
• Priority: Medium (availability); raise if hostile workloads can define exec probes/hooks
• Advisory: GHSA-7jxh-36q5-gcqv

🔧 Basic Security Tool of the Week

TruffleHog v3.97.4 — secrets discovery, classification, and validation

What it does: TruffleHog finds leaked credentials in Git history, filesystems, and other sources. It classifies 800+ secret types and can validate whether a candidate still authenticates — separating dead strings from live keys.

Who it is for: Developers, DevOps/SRE, and security engineers cleaning repos before open-sourcing, after incidents, or as a pre-merge/CI gate on authorized codebases.

Why this week: Different category from last week’s OSV-Scanner (SCA). Self-hosted forge and automation RCE stories raise the cost of any secret the service account can read — knowing what is already in git history matters. Latest observed release tag at research time: v3.97.4 (published 2026-09-03). AGPL-3.0 open-source project with active releases.

Install (authorized machine only, pick one):

# macOS
brew install trufflehog

# Docker (pin a tag in real use; example uses documented latest tag pattern)
docker pull trufflesecurity/trufflehog:latest

# Or download a release binary
# https://github.com/trufflesecurity/trufflehog/releases/tag/v3.97.4

Safe basic example — scan only a repository you own or are explicitly authorized to test (local filesystem path):

# Clone or cd into YOUR authorized repo
cd /path/to/your-authorized-repo

# Scan current tree + git history for verified secrets only
trufflehog git file://. --results=verified --fail

Docker equivalent against the maintainers’ public test-keys demo repo (safe learning target):

docker run --rm -it trufflesecurity/trufflehog:latest \
  github --repo https://github.com/trufflesecurity/test_keys

How to read results: Prefer verified findings first — those passed a live check against the provider. Unverified hits need human triage (entropy/format matches, test fixtures, docs). Map each verified secret to owner, rotate it, purge from history if required, and add preventative controls (pre-commit, CI secret scan, push protection).

Limitations: Validation may contact third-party APIs — run only where policy allows egress and only against assets you are authorized to test. Do not point TruffleHog at third-party infrastructure, random orgs, or repos without permission. AGPL licensing may constrain some distribution models. Not a substitute for vault-based secret management or short-lived cloud credentials.

Links: Repository · v3.97.4 release · Product overview

💡 Security Tip of the Day

Today’s tip: On every self-hosted Git forge, set DISABLE_REGISTRATION (or equivalent) to true for internet-facing instances unless you have a documented join workflow — then verify anonymous users cannot create accounts or repositories.

Why it matters: CVE-2026-60004 shows how “anyone can register” converts a write-access RCE into an unauthenticated internet worm path. Registration policy is a control-plane decision, not a UX default to leave on.

How to apply it (≈10 minutes):

1. Identify public Gitea/GitLab/Forgejo/Bitbucket Data Center URLs.
2. Disable open self-registration; require SSO or admin-provisioned accounts.
3. Confirm invite-only or SSO login still works for legitimate users.

Verify: From a private/incognito session with no cookies, the registration endpoint is absent or returns forbidden, and you cannot create a repository without an approved identity.

✅ Security Actions for This Week

1. Emergency: Patch Gitea → ≥ 1.27.1 on all reachable instances; disable open registration; rotate secrets held by the Gitea OS user if exposed while vulnerable.
2. Emergency/High: Upgrade Semaphore UI → ≥ 2.18.20; review Manager/Owner roles and git_url values; rotate control-plane secrets if collaborators were untrusted.
3. High: Upgrade Next.js → 15.5.24 / 16.3.3 (mandatory and immediate on Windows hosts) and Astro → ≥ 7.2.8 with Sharp ≥ 0.35.4.
4. High: Bump MsQuic (2.5.10 / 2.4.19), GitPython (≥ 3.1.59), Predis (≥ 3.3.0), Netty handler (4.1.137 / 4.2.17), containerd fixed trains, and SiYuan ≥ v3.7.3 where those stacks exist.
5. Hygiene: Run TruffleHog (trufflehog git file://. --results=verified --fail) on one authorized repo and rotate any verified findings; apply the registration lock-down tip above.

Sources

• GHSA-rcr6-4jqh-j84m — CVE-2026-60004 Gitea diffpatch RCE
• Gitea v1.27.1 release
• GHSA-xp7j-h7jc-4w8p — CVE-2026-73294 Semaphore UI command injection
• GHSA-p293-qw3h-jr36 — CVE-2026-75604 Next.js Windows RCE
• GHSA-2xp9-vwfh-vxw4 — Next.js AVIF image optimization RCE
• GHSA-26w7-cxv4-gfx2 — Astro AVIF image optimization RCE
• GHSA-92f5-vc22-8j33 — CVE-2026-62815 Microsoft MsQuic RCE
• GHSA-284h-m62q-gf8w — CVE-2026-78676 GitPython config rewrite RCE
• GHSA-w6f5-v2h6-g786 — CVE-2026-84372 Predis pipeline CRLF injection
• GHSA-c4c3-7fpv-j4q5 — CVE-2026-75595 Netty SNI/mTLS bypass
• GHSA-vh22-h7hf-www7 — CVE-2026-69084 SiYuan searchEmbedBlock SQL
• GHSA-fph3-ghq9-vw66 — CVE-2026-69083 SiYuan fullTextSearchAssetContent SQL
• GHSA-q2vg-7qgx-x5fc — CVE-2026-72811 SiYuan backlink/mention SQL
• GHSA-7jxh-36q5-gcqv — CVE-2026-53495 containerd ExecSync DoS
• GHSA-jrc7-96c5-q579 — CVE-2026-85061 MapLibre GL JS sanitizer XSS
• TruffleHog repository
• TruffleHog v3.97.4 release
• NVD — CVE-2026-60004
• NVD — CVE-2026-73294
• NVD — CVE-2026-75604
• NVD — CVE-2026-62815