RHSA-2026:71113

GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from().

sqlparse is a non-validating SQL parser module for Python.

GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature.

GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbi…

sqlparse is a non-validating SQL parser module for Python.

js-yaml is a JavaScript YAML parser and dumper.

GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard.

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees.

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD.

GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields.

A flaw was found in Red Hat Ansible Automation Platform's automation- controller.

A flaw was found in Red Hat Ansible Automation Platform's automation- controller.

A flaw was found in the Ansible Automation Platform automation-controller.

A flaw was found in Red Hat Ansible Automation Platform's automation- controller.

sqlparse is a non-validating SQL parser module for Python.

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin.

A flaw was found in AWX.

js-yaml is a JavaScript YAML parser and dumper.

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not.

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface.

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

A flaw was found in Red Hat Ansible Automation Platform's automation- controller.

A flaw was found in Red Hat Ansible Automation Platform's automation- controller.

nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure).

A flaw was found in Red Hat Ansible Automation Platform's automation- controller.

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript.

A flaw was found in Ansible Automation Platform's automation-controller.

A flaw was found in the automation-controller input-validation guard sanitize_jinja().

A flaw was found in the Ansible Automation Platform automation-controller.

A flaw was found in the automation-controller API.

An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem.

A flaw was found in the Ansible Automation Platform automation-controller.

A flaw was found in the automation-controller instance install-bundle endpoint.

A flaw was found in Ansible Automation Platform's automation-controller (AWX).

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.

JobJobEventsChildrenSummary view has no model/parent_model.

URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC.

A flaw was found in the Ansible Automation Platform automation-controller.

StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths.

/api/v2/config/ is protected only by IsAuthenticated.

RunAdHocCommand.build_args() appends limit as bare positional (args.append(limit)) instead of using args.extend(['-l', limit]) like RunJob.

LaunchConfigurationBaseSerializer.scm_branch has no validate_scm_branch() leading-dash check, unlike Project/JobTemplate/JobLaunch serializers.

Notification template Jinja AST whitelist only inspects static Getattr nodes.