Security Thursdays by yisusvii — 2026-10-08

Table of Contents

🚨 Cybersecurity News of the Week

1. Payload CMS — Form Builder RCE, SQLi, first-register RCE, ACL failures (Oct 6–7)

What happened: Between October 6 and October 7, 2026, Payload published a dense advisory set. The highest-severity item is GHSA-r488-j9vj-wx3q / CVE-2026-105857 — Critical, CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H): @payloadcms/plugin-form-builder < 3.90.0 allowed submissions crafted to execute remote code on the server. Companion issues in the same patch train include:

Who is affected: npm payload and related @payloadcms/* packages on 3.x < 3.90.0 (canary < 4.0.0-canary.34). Form Builder RCE requires the form-builder plugin. MongoDB users are out of scope for the SQLi advisories that name SQL adapters only.

Why it matters: Payload is a common headless CMS/backend for Next.js and Node apps. Unauthenticated Form Builder RCE and open first-register RCE are internet-facing patterns, not niche admin bugs.

Exploitation status: Not confirmed as mass in-the-wild exploitation in sources reviewed. Severity and prerequisites are taken from vendor GHSAs.

Defender actions: Upgrade to v3.90.0 (or canary ≥ 4.0.0-canary.34). Ensure an initial admin user already exists so first-register is closed. Review orderable: true collections and form-builder exposure at the edge.

Primary sources: linked GHSAs; v3.90.0; v3.88.0.

2. Langflow — MCP stdio command injection + Python REPL RCE (Oct 6–7)

What happened: On October 7, 2026, Langflow published GHSA-w794-rj3p-xv45 / CVE-2026-105697 (Critical, CVSS 3.1 9.9, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Before 1.10.3, MCP stdio server configs accepted arbitrary command/args. Pre-1.10.3 execution wrapped them in bash -c "exec …". Any user who can hit MCP server settings or embed MCP Tools in a flow can run OS commands as the Langflow process user when Langflow connects to the “server.” With default LANGFLOW_AUTO_LOGIN=true, GET /api/v1/auto_login issues a token without credentials — so default exposed installs are effectively unauthenticated. Partial allowlisting landed in 1.9.0; the execution sink was fully fixed in 1.10.3 (no shell; shared validation).

Separately, on October 6, GHSA-8qpj-27x8-pwpq / CVE-2026-10561 (Critical, CVSS 3.1 9.9) covered PythonREPLComponent / legacy REPL tool executing unsandboxed Python in-process — fixed core in 1.10.1 (further hardening through 1.12.3 per advisory text).

Who is affected: PyPI langflow ≥ 1.1.2, < 1.10.3 (MCP); REPL < 1.10.1. Also langflow-base / lfx bands on the MCP advisory.

Why it matters: AI flow UIs are being treated like internal notebooks while listening like production APIs. Command-exec sinks plus default auto-login is a predictable compromise path.

Exploitation status: Advisory states the reporter found several internet-facing vulnerable Langflow servers. That is confirmed exposure, not confirmed active exploitation campaigns in the sources reviewed.

Defender actions: Upgrade to v1.10.3 or newer. Disable auto-login. Do not publish Langflow on untrusted networks. On multi-tenant hosts, use package allowlists / interpreter hardening env vars documented in the advisory.

Primary sources: GHSA-w794-rj3p-xv45, GHSA-8qpj-27x8-pwpq, v1.10.3.

3. Flowise — prompt-injection RCE/SSRF and NodeVM/puppeteer escape (Oct 7)

What happened: On October 7, 2026, Flowise advisories for ≤ 3.1.2 (fixed 3.1.3) covered:

• GHSA-w7x8-q2gp-5cgg / CVE-2026-73487 — CSV/Airtable Agent Python validator bypass → dataset exfil, SSRF, and further execution via prompt injection against the unauthenticated prediction API. Advisory text cites CVSS 3.1 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).
• GHSA-9gvv-qjj3-2p6g / CVE-2026-73483 — authenticated NodeVM escape via attacker-controlled puppeteer.launch() executablePath/args reaching host child_process.spawn; 3.0.8–3.1.2 need ALLOW_BUILTIN_DEP=true, earlier versions default-exposed.

Who is affected: npm flowise and flowise-components ≤ 3.1.2. Patched release tag observed: flowise@3.1.3.

Why it matters: Same class as Langflow: agent UIs that eval model output or “sandbox” JS become host RCE when validators are regex blocklists and browser automation is allowlisted into the sandbox.

Exploitation status: Not confirmed mass exploitation in sources reviewed.

Defender actions: Upgrade to ≥ 3.1.3. Require auth on prediction APIs. Disable unused agent nodes. Do not run Flowise containers as root with broad network egress.

Primary sources: linked GHSAs; flowise@3.1.3.

4. Ghost CMS — bookmark-image RCE and theme-translation RCE (Oct 7)

What happened: On October 7, 2026, Ghost published multiple staff-driven RCE/XSS issues. Highest practical risk for self-hosters:

• GHSA-788w-68h3-cvxp / CVE-2026-105642 (High, CVSS 3.1 8.8) — SVG handling in a bundled image library: any staff user including Contributors can create a bookmark card pointing at an attacker site and reach arbitrary command execution on the Ghost server. GHSA range: ≥ 6.56.0, < 6.67.0; fixed v6.67.0. Advisory prose also notes presence through v6.65.0 — use the patched release, not the prose upper bound alone.
• GHSA-jj74-hc2q-xrvm / CVE-2026-105677 (High, CVSS 3.1 7.2, PR:H) — authenticated Administrator RCE via crafted theme translation files; ≥ 6.10.3, < 6.64.0; fixed v6.64.0.

Additional stored XSS paths (embed cards, SVG uploads, oEmbed, local file uploads) share the same upgrade floor narrative — treat 6.67.0 as the practical self-host target this week.

Who is affected: Self-hosted Ghost on the version bands above. Ghost(Pro) customers should follow vendor communications; this digest tracks the open-source package advisories.

Why it matters: Contributor-level RCE via a normal editorial feature (bookmark cards) collapses the usual “only admins install themes” mental model.

Exploitation status: Not confirmed in the wild in sources reviewed.

Defender actions: Upgrade self-hosted Ghost to ≥ 6.67.0. Limit staff roles until patched. Review recently added bookmark cards and theme uploads.

Primary sources: linked GHSAs; v6.67.0, v6.64.0.

5. Backstage, Next.js floors, vm2, proxy-addr, and adjacent libraries (Oct 5–7)

Additional high-signal items from the window:

• Backstage (Oct 7): GHSA-4488-j8vj-vqqv / CVE-2026-106510 — TechDocs markdown_extensions in mkdocs.yml → OS command execution on the docs build host (High 7.7); GHSA-qmw3-745m-w99g / CVE-2026-106558 — improper MkDocs config validation (High 8.8); both patch @backstage/plugin-techdocs-node 1.15.4. GHSA-g2v8-7jhw-pp8p / CVE-2026-106501 — Scaffolder task read can expose internal execution data/credentials (Critical 9.6); floors include scaffolder-backend 4.1.0 (and listed 3.x/4.0.x patches). GHSA-826h-28h9-65hg / CVE-2026-106488 — OIDC email identity assumption when provider allows unverified emails (High 8.1); @backstage/plugin-auth-backend-module-oidc-provider ≥ 0.4.20.
• Next.js (vendor notes Sep 30; GHSA published Oct 7): GHSA-cjq9-62q9-8jv4 / CVE-2026-94483 — Image Optimization SSRF to private IPs via attacker-controlled allow-listed remote URL (images.remotePatterns); npm next ≥ 16.0.0, < 16.3.8 → 16.3.8. CVSS 3.1 6.5; CVSS 4.0 8.3 on the advisory. Not affected if no remotePatterns. Cache-poisoning issues GHSA-4jqv-mc3x-m676 / CVE-2026-94543 and GHSA-mcj8-r9mp-w47p / CVE-2026-94484 hit self-hosted SSG/ISR (Vercel-hosted apps called out as not affected for one advisory); floors 15.5.27 / 16.3.8.
• vm2 (Oct 5–7 cluster; headline Oct 7): GHSA-pq68-rvw4-xp4r / CVE-2026-93605 (Critical 10.0) — DANGEROUS_BUILTINS omits child_process, so builtin:['*'] yields host RCE; fixed v3.12.1. Additional vm2 escapes published Oct 5 (e.g. GHSA-88hf-g992-jg85 / CVE-2026-92955) reinforce: do not use vm2 for untrusted code.
• proxy-addr (Oct 5): GHSA-jqcg-44mw-7w3h / CVE-2026-90711 (Critical 9.1) — IPv4-mapped IPv6 trust subnets with short prefixes (e.g. ::ffff:10.0.0.0/8 instead of /104) compile to “trust everyone,” so client-supplied X-Forwarded-For becomes req.ip; fixed v2.0.8.
• shell-quote (Oct 6): GHSA-pqg4-j6r4-53mv / CVE-2026-102422 (Critical 8.1) — quote() command injection via line terminator after a { comment } token; ≥ 1.8.4, < 1.11.0 → 1.11.0.
• WeasyPrint (Oct 7): GHSA-r543-q48m-4c9j / CVE-2026-106443 (High 8.8) — untrusted EPS/PS reaches Ghostscript via Pillow; RCE when GS has a -dSAFER bypass. Fixed v70.0.
• Quasar (Oct 7): GHSA-pq96-jpmf-w254 / CVE-2026-106102 — SSR getHead() unescaped meta → XSS; Critical 10.0; quasar < 2.22.0 → quasar-v2.22.0.

🛡️ CVEs That Deserve Attention

CVE-2026-105857 — Payload @payloadcms/plugin-form-builder RCE

• Type: Improper control of code generation / prototype issues (CWE-94, CWE-1321 per GHSA).
• Affected: @payloadcms/plugin-form-builder < 3.90.0 (canary < 4.0.0-canary.34).
• Fixed: 3.90.0 / 4.0.0-canary.34.
• CVSS 3.1: 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
• EPSS (GHSA field, observation via advisory record retrieved 2026-10-08): percentage 0.00434, percentile 0.35662.
• CISA KEV: Not verified (catalog unreachable this run).
• Prerequisites: Using the Form Builder plugin; network path to form submission endpoints.
• Priority: Emergency.
• Advisory: GHSA-r488-j9vj-wx3q.

CVE-2026-105697 — Langflow MCP stdio OS command injection

• Type: OS command injection (CWE-78).
• Affected: langflow ≥ 1.1.2, < 1.10.3; langflow-base ≥ 0.1.2, < 0.10.3; lfx < 1.10.3.
• Fixed: 1.10.3 / 0.10.3 / 1.10.3 respectively.
• CVSS 3.1: 9.9.
• EPSS (GHSA): percentage 0.00396, percentile 0.31601.
• Auth: Privileges “Low” on paper; default AUTO_LOGIN can remove real auth on exposed instances.
• Priority: Emergency for internet-facing or multi-tenant Langflow.
• Advisory: GHSA-w794-rj3p-xv45.

CVE-2026-73487 — Flowise CSV/Airtable agent validator bypass

• Type: Insufficient neutralization of model-generated code / SSRF/exfil chain.
• Affected: flowise / flowise-components ≤ 3.1.2.
• Fixed: 3.1.3.
• CVSS: Advisory text 9.3 (vector in advisory body); GHSA API score field was empty at retrieval time — prefer advisory text.
• EPSS (GHSA): percentage 0.00769, percentile 0.53626.
• Priority: Emergency if prediction API is unauthenticated or internet-facing.
• Advisory: GHSA-w7x8-q2gp-5cgg.

CVE-2026-93605 — vm2 NodeVM sandbox escape

• Type: Protection mechanism failure / improper isolation (CWE-693, CWE-913).
• Affected: vm2 ≤ 3.12.0.
• Fixed: 3.12.1 (release; v3.12.2 also present on the release list).
• CVSS 3.1: 10.0 (S:C).
• EPSS (GHSA): percentage 0.00726, percentile 0.52516.
• Prerequisites: Untrusted code in NodeVM with builtin:['*'], subtract patterns, or explicit child_process.
• Priority: Emergency wherever vm2 still sandboxes untrusted plugins; otherwise High inventory-and-remove.
• Advisory: GHSA-pq68-rvw4-xp4r.

CVE-2026-105642 — Ghost bookmark card image RCE

• Type: Code injection via image/SVG processing (CWE-94, CWE-1395).
• Affected: ghost ≥ 6.56.0, < 6.67.0 (GHSA package metadata).
• Fixed: 6.67.0.
• CVSS 3.1: 8.8 (PR:N/UI:R on vector — staff interaction to create bookmark; still low staff privilege).
• EPSS (GHSA): percentage 0.00251, percentile 0.15062.
• Priority: High (Emergency if untrusted Contributors exist on internet-facing self-host).
• Advisory: GHSA-788w-68h3-cvxp.

CVE-2026-90711 — proxy-addr trusted-hop spoofing

• Type: IP trust confusion → authZ/rate-limit bypass.
• Affected: proxy-addr ≥ 1.1.0, < 2.0.8.
• Fixed: 2.0.8.
• CVSS 3.1: 9.1.
• EPSS (GHSA): percentage 0.00332, percentile 0.23628.
• Prerequisites: Trust configuration uses vulnerable IPv4-mapped/short-prefix forms (or similar all-zero leading-bit IPv6 trusts).
• Priority: High (Emergency if IP allowlists gate admin APIs).
• Advisory: GHSA-jqcg-44mw-7w3h.

CVE-2026-94483 — Next.js Image Optimization SSRF

• Type: SSRF (CWE-918).
• Affected: next ≥ 16.0.0, < 16.3.8.
• Fixed: 16.3.8.
• CVSS 3.1: 6.5; CVSS 4.0: 8.3 (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N).
• EPSS (GHSA): percentage 0.00244, percentile 0.14276.
• Original vendor advisory date: 2026-09-30; GitHub Advisory Database published: 2026-10-07. Not presented here as a brand-new Sep 30-only story — included because GHSA packaging/floors and the 16.3.8 release line are the actionable signal for this window and were absent from last week’s next/og-focused digest.
• Priority: High if images.remotePatterns includes hosts you do not fully control DNS for; Monitor if no remote patterns.
• Advisory: GHSA-cjq9-62q9-8jv4.

🔧 Basic Security Tool of the Week

Syft v1.54.1 — SBOM generator for directories, images, and archives

What it does: Syft (Anchore) produces a Software Bill of Materials from container images, filesystems, archives, and more. Output formats include SPDX, CycloneDX, and Syft JSON. It inventories packages so you can prove what you shipped and feed scanners (including last week’s Grype).

Who it is for: Developers, DevOps/SRE, platform, and AppSec engineers who need repeatable dependency inventory after a week dominated by npm/PyPI patch floors (Payload, Ghost, Next, vm2, proxy-addr, Langflow, Flowise).

Why this week: Different category from last week’s Grype (vulnerability matching) and earlier Trivy / Checkov / TruffleHog / OSV-Scanner / gosec. Syft answers “what packages are actually in this artifact?” before you argue about CVE noise. Latest GitHub release tag observed at research time: v1.54.1 (published 2026-10-06 — inside this research window; active maintenance).

Install (authorized machine only, pick one):

# Quick install script (review script before use in production)
curl -sSfL https://get.anchore.io/syft | sh -s -- -b /usr/local/bin

# Homebrew
brew install syft

# Docker (no host install)
docker pull anchore/syft:v1.54.1

Safe basic example — generate SBOMs only for trees/images you own or are authorized to assess:

# SBOM for the current authorized project directory (SPDX JSON)
syft dir:. -o spdx-json=sbom.spdx.json

# SBOM for an authorized local/container image you built
syft your-registry.example/your-app:1.2.3 -o cyclonedx-json=sbom.cdx.json

# Dockerized run against the current authorized repo
docker run --rm -v "$PWD":/work -w /work anchore/syft:v1.54.1 dir:. -o table

# Optional: pipe inventory into Grype on an authorized artifact
# syft dir:. -o json | grype

How to read results: Confirm expected package names/versions for this week’s floors (payload, next, ghost, vm2, proxy-addr, langflow, flowise). Prefer SPDX/CycloneDX in CI artifacts. Diff SBOMs between builds to catch unexpected dependency drift. Then scan the same SBOM with a vuln matcher if needed.

Limitations: Inventory quality depends on detectable package metadata (scratch/distroless, vendored copies, and non-standard install paths can under-report). An SBOM is not a vulnerability verdict and not an exploitability proof. Never point Syft at third-party registries, customer clusters, or hosts without authorization. Pin the Syft version in CI.

Links: Repository · v1.54.1 release · Docs

💡 Security Tip of the Day

Today’s tip: Audit every Express/proxy-addr trust proxy setting for IPv4-mapped IPv6 “short prefix” mistakes (for example ::ffff:10.0.0.0/8); use the correct mapped prefix (/104 for a /8 IPv4 block) or plain IPv4 CIDR, then upgrade proxy-addr to ≥ 2.0.8.

Why it matters: CVE-2026-90711 shows a mis-typed mapped subnet can compile silently into “trust all IPv4,” so clients choose their own X-Forwarded-For and become req.ip. IP allowlists, admin rate limits, geo blocks, and audit trails then lie.

How to apply it (≈10 minutes):

1. Search configs and code: trust proxy, proxy-addr, app.set('trust proxy', ::ffff:.
2. Replace mapped short prefixes with documented correct forms (or IPv4 CIDRs your library accepts).
3. Bump proxy-addr (and parent frameworks that bundle it) to ≥ 2.0.8.
4. From an unauthorized client IP, send a forged X-Forwarded-For: 127.0.0.1 and confirm req.ip stays the real peer, not the forged hop.
5. Add a CI/config test that fails if trust lists contain known-bad prefix lengths.

Verify: Forged forwarded headers no longer satisfy IP allowlists; legitimate traffic behind real proxies still resolves correctly; dependency lockfile shows proxy-addr@≥2.0.8.

✅ Security Actions for This Week

1. Emergency: Patch Payload → ≥ 3.90.0 (Form Builder plugin included); confirm first admin user exists; review public form endpoints.
2. Emergency/High: Upgrade Langflow → ≥ 1.10.3 and Flowise → ≥ 3.1.3; disable auto-login / lock prediction APIs; pull internet-facing agent UIs off the open internet until patched.
3. High: Self-hosted Ghost → ≥ 6.67.0; Backstage TechDocs techdocs-node ≥ 1.15.4, Scaffolder backend patched trains, OIDC module ≥ 0.4.20.
4. High: Lockfile sweep — vm2 ≥ 3.12.1 (or remove), proxy-addr ≥ 2.0.8, shell-quote ≥ 1.11.0, next ≥ 16.3.8 (15.x → 15.5.27), WeasyPrint ≥ 70.0, quasar ≥ 2.22.0 where applicable; finish last week’s next/og / Fastify / axios / PyJWT items if open.
5. Hygiene: Generate an authorized Syft SBOM for one production image or repo and diff it against this week’s package floors; apply the trust-proxy tip.

Sources

• GHSA-r488-j9vj-wx3q — CVE-2026-105857 Payload Form Builder RCE
• GHSA-f7hx-52q9-hcrf — CVE-2026-105859 Payload unauthorized collection update
• GHSA-97rh-rhh2-7vjv — CVE-2026-105858 Payload first-register RCE
• GHSA-pj7x-6wpf-pgvp — CVE-2026-105856 Payload SQLi (SQLite/Postgres adapters)
• GHSA-v49j-62m6-pgrr — CVE-2026-105845 Payload SQLi (filters/joins)
• GHSA-66wr-7vmr-p5jq — CVE-2026-105863 Payload auth token field handling
• Payload v3.90.0 release
• Payload v3.88.0 release
• GHSA-w794-rj3p-xv45 — CVE-2026-105697 Langflow MCP stdio RCE
• GHSA-8qpj-27x8-pwpq — CVE-2026-10561 Langflow Python REPL RCE
• Langflow v1.10.3 release
• GHSA-w7x8-q2gp-5cgg — CVE-2026-73487 Flowise agent validator bypass
• GHSA-9gvv-qjj3-2p6g — CVE-2026-73483 Flowise NodeVM/puppeteer escape
• Flowise flowise@3.1.3 release
• GHSA-788w-68h3-cvxp — CVE-2026-105642 Ghost bookmark image RCE
• GHSA-jj74-hc2q-xrvm — CVE-2026-105677 Ghost theme translation RCE
• Ghost v6.67.0 release
• Ghost v6.64.0 release
• GHSA-4488-j8vj-vqqv — CVE-2026-106510 Backstage TechDocs markdown_extensions RCE
• GHSA-qmw3-745m-w99g — CVE-2026-106558 Backstage TechDocs MkDocs validation
• GHSA-g2v8-7jhw-pp8p — CVE-2026-106501 Backstage Scaffolder sensitive data exposure
• GHSA-826h-28h9-65hg — CVE-2026-106488 Backstage OIDC email identity
• GHSA-cjq9-62q9-8jv4 — CVE-2026-94483 Next.js Image Optimization SSRF
• GHSA-4jqv-mc3x-m676 — CVE-2026-94543 Next.js SSG/ISR cache poisoning
• GHSA-mcj8-r9mp-w47p — CVE-2026-94484 Next.js cross-user cache substitution
• Next.js v16.3.8 release
• Next.js v15.5.27 release
• GHSA-pq68-rvw4-xp4r — CVE-2026-93605 vm2 child_process denylist gap
• vm2 v3.12.1 release
• GHSA-jqcg-44mw-7w3h — CVE-2026-90711 proxy-addr trust subnet spoofing
• proxy-addr v2.0.8 release
• GHSA-pqg4-j6r4-53mv — CVE-2026-102422 shell-quote comment/line-terminator injection
• shell-quote v1.11.0 release
• GHSA-r543-q48m-4c9j — CVE-2026-106443 WeasyPrint EPS/Ghostscript RCE path
• WeasyPrint v70.0 release
• GHSA-pq96-jpmf-w254 — CVE-2026-106102 Quasar SSR meta XSS
• Quasar quasar-v2.22.0 release
• NVD — CVE-2026-105857
• NVD — CVE-2026-105697
• NVD — CVE-2026-93605
• NVD — CVE-2026-105642
• NVD — CVE-2026-90711
• NVD — CVE-2026-94483
• Syft repository
• Syft v1.54.1 release