openSUSE-SU-2026:20919-1
See a problem?- Import Source
- https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:20919-1.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/openSUSE-SU-2026:20919-1
- Upstream
- Related
- Published
- 2026-06-08T10:21:35Z
- Modified
- 2026-06-10T18:24:22Z
- Summary
- Security update for agama-web-ui
- Details
-
This update for agama-web-ui fixes the following issues
- CVE-2025-7339: on-headers: incorrect array handling may lead to HTTP response header manipulation (bsc#1246678).
- CVE-2026-9277: shell-quote: improper escaping of newlines in object .op values by quote() can lead to shell command injection (bsc#1266256).
- CVE-2026-42041: axios: authentication bypass via validateStatus prototype pollution gadget due to suppression of HTTP error (bsc#1264160).
- CVE-2026-42264: axios: prototype pollution read-side gadgets in HTTP adapter can lead to credential injection and request h (bsc#1264802).
Changes for agama-web-ui:
- Update other dependencies reported by "npm audit".
- References
-
- https://bugzilla.suse.com/1246678
- https://bugzilla.suse.com/1264160
- https://bugzilla.suse.com/1264802
- https://bugzilla.suse.com/1266256
- https://www.suse.com/security/cve/CVE-2025-7339
- https://www.suse.com/security/cve/CVE-2026-42041
- https://www.suse.com/security/cve/CVE-2026-42264
- https://www.suse.com/security/cve/CVE-2026-9277