Skip to content

Product

redhat/ruff vulnerabilities

39 published CVES affecting redhat/ruff, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
39
Critical
1
High
9
Medium
27
Low
2
Unscored
0
CISA KEV
0

Latest redhat/ruff CVEs

Newest publication first · page 1 of 2

  5. CVE-2026-115908 zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0)

    Published
    HighCVSS 7.4 EPSS 0.43%

    zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir use safe_prepare_path in src/read/zipfile.rs and simplified_components in src/path.rs to validate symbolic link...

  7. CVE-2026-115906 zip: AES Entry HMAC Authentication Bypass on Premature EOF

    Published
    MediumCVSS 6.5 EPSS 0.15%

    zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the...

  8. CVE-2026-115905 zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

    Published
    CriticalCVSS 10.0 EPSS 0.32%

    zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata...

  10. CVE-2026-109345 DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root

    Published
    MediumCVSS 5.1 EPSS 0.25%

    DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style...

  12. CVE-2026-86315 Escargot: Escargot: Out-of-bounds write leads to Denial of Service

    Published
    MediumCVSS 6.2 EPSS 0.17%

    An out-of-bounds write caused by numeric truncation Samsung Open Source Escargot on Linux x86-64 allows an attacker who can supply JavaScript for execution to corrupt native memory and crash the host process via a crafted class definition whose instance initialization entry count...

  13. CVE-2026-85730 smol-toml: Denial of Service via malformed TOML documents

    Published
    HighCVSS 8.2 EPSS 0.52%

    smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 a...

  14. CVE-2026-75838 DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook

    Published
    MediumCVSS 5.1 EPSS 0.39%

    DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even th...

  15. CVE-2026-66010 DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLING

    Published
    MediumCVSS 5.1 EPSS 0.22%

    DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inje...

  16. CVE-2026-65914 DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization

    Published
    MediumCVSS 5.3 EPSS 0.31%

    DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out...

  17. CVE-2026-65913 DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES

    Published
    MediumCVSS 5.1 EPSS 0.32%

    DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept eve...

  18. CVE-2026-65912 DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR

    Published
    MediumCVSS 5.1 EPSS 0.30%

    DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation,...

  19. CVE-2026-65911 DOMPurify before 3.4.0 XSS via ADD_ATTR/ADD_TAGS State Leakage

    Published
    MediumCVSS 5.1 EPSS 0.33%

    In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS...

  20. CVE-2026-65904 DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mode

    Published
    LowCVSS 2.3 EPSS 0.27%

    DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, c...

  21. CVE-2026-65903 DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS

    Published
    MediumCVSS 5.1 EPSS 0.33%

    DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS function, causing them...

  22. CVE-2026-65902 DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags

    Published
    MediumCVSS 5.3 EPSS 0.36%

    DOMPurify before 3.4.7 passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit cfg.ALLOWED_...

  24. CVE-2026-65901 DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName

    Published
    MediumCVSS 5.1 EPSS 0.29%

    DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allo...

  25. CVE-2026-65899 DOMPurify before 3.4.9 Trusted Types Policy State Contamination

    Published
    MediumCVSS 5.1 EPSS 0.41%

    DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output re...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.