Red Hat Security Advisory

RHSA-2025:7626

Red Hat Developer Hub 1.6.0 release.

Released 2025-05-14 · Red Hat rating Important · View on Red Hat →

Fixed in

TI-2024-14290 CVE-2024-21534 · GHSA-pppg-cpfq-h7wr

HIGH 82

All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.09017 Published 2024-10-11 Partial fix · 10.2.0 CWE-94

TI-2025-21187 CVE-2025-29775 · GHSA-x3m8-899r-f7c3

HIGH 81

xml-crypto is an XML digital signature and encryption library for Node.js.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.10141 Published 2025-03-14 Partial fix · 6.0.1, 3.2.1 +1 CWE-347

TI-2025-19705 CVE-2025-26791 · GHSA-vhxf-7vqr-mrjg

MEDIUM 60

DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00605 Published 2025-02-14 Partial fix · 3.2.4 CWE-79

TI-2024-11957 CVE-2024-12905 · GHSA-pq67-2wwv-3xjx

MEDIUM 43

An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal").

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02299 Published 2025-03-27 Partial fix · 1.16.4, 2.1.2 +2 CWE-22