Skip to content

Commit 31d1815

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3439-vqgj-2gcf GHSA-3mw5-466q-295q GHSA-4765-v66x-rqx7 GHSA-3439-vqgj-2gcf GHSA-3mw5-466q-295q GHSA-4765-v66x-rqx7
1 parent 303a69c commit 31d1815

6 files changed

Lines changed: 411 additions & 108 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-3439-vqgj-2gcf/GHSA-3439-vqgj-2gcf.json‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3439-vqgj-2gcf",
4+
"modified": "2026-03-31T23:02:57Z",
5+
"published": "2026-03-26T18:31:42Z",
6+
"aliases": [
7+
"CVE-2026-3108"
8+
],
9+
"summary": "Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences",
10+
"details": "Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to sanitize user-controlled post content in the mmctl commands terminal output which allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences that enable screen manipulation, fake prompts, and clipboard hijacking. Mattermost Advisory ID: MMSA-2026-00599.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/mattermost/mattermost/server/v8"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "11.4.0-rc1"
29+
},
30+
{
31+
"fixed": "11.4.1"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Go",
40+
"name": "github.com/mattermost/mattermost/server/v8"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "11.3.0-rc1"
48+
},
49+
{
50+
"fixed": "11.3.2"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "Go",
59+
"name": "github.com/mattermost/mattermost/server/v8"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "11.2.0-rc1"
67+
},
68+
{
69+
"fixed": "11.2.3"
70+
}
71+
]
72+
}
73+
]
74+
},
75+
{
76+
"package": {
77+
"ecosystem": "Go",
78+
"name": "github.com/mattermost/mattermost/server/v8"
79+
},
80+
"ranges": [
81+
{
82+
"type": "ECOSYSTEM",
83+
"events": [
84+
{
85+
"introduced": "10.11.0-rc1"
86+
},
87+
{
88+
"fixed": "10.11.11"
89+
}
90+
]
91+
}
92+
]
93+
},
94+
{
95+
"package": {
96+
"ecosystem": "Go",
97+
"name": "github.com/mattermost/mattermost/server/v8"
98+
},
99+
"ranges": [
100+
{
101+
"type": "ECOSYSTEM",
102+
"events": [
103+
{
104+
"introduced": "8.0.0-20260105080200-d27a2195068d"
105+
},
106+
{
107+
"fixed": "8.0.0-20260217110922-b7d4a1f1f59b"
108+
}
109+
]
110+
}
111+
]
112+
}
113+
],
114+
"references": [
115+
{
116+
"type": "ADVISORY",
117+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3108"
118+
},
119+
{
120+
"type": "PACKAGE",
121+
"url": "https://github.com/mattermost/mattermost"
122+
},
123+
{
124+
"type": "WEB",
125+
"url": "https://mattermost.com/security-updates"
126+
}
127+
],
128+
"database_specific": {
129+
"cwe_ids": [
130+
"CWE-150"
131+
],
132+
"severity": "HIGH",
133+
"github_reviewed": true,
134+
"github_reviewed_at": "2026-03-31T23:02:43Z",
135+
"nvd_published_at": "2026-03-26T17:16:41Z"
136+
}
137+
}

‎advisories/github-reviewed/2026/03/GHSA-3mw5-466q-295q/GHSA-3mw5-466q-295q.json‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3mw5-466q-295q",
4+
"modified": "2026-03-31T23:04:00Z",
5+
"published": "2026-03-26T18:31:42Z",
6+
"aliases": [
7+
"CVE-2026-3112"
8+
],
9+
"summary": "Mattermost allows system administrators to read arbitrary host files via malicious AdvancedLoggingJSON configuration",
10+
"details": "Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to validate Advanced Logging file target paths which allows system administrators to read arbitrary host files via malicious AdvancedLoggingJSON configuration in support packet generation. Mattermost Advisory ID: MMSA-2025-00562.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/mattermost/mattermost/server/v8"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "11.4.0-rc1"
29+
},
30+
{
31+
"fixed": "11.4.1"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Go",
40+
"name": "github.com/mattermost/mattermost/server/v8"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "11.3.0-rc1"
48+
},
49+
{
50+
"fixed": "11.3.2"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "Go",
59+
"name": "github.com/mattermost/mattermost/server/v8"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "11.2.0-rc1"
67+
},
68+
{
69+
"fixed": "11.2.4"
70+
}
71+
]
72+
}
73+
]
74+
},
75+
{
76+
"package": {
77+
"ecosystem": "Go",
78+
"name": "github.com/mattermost/mattermost/server/v8"
79+
},
80+
"ranges": [
81+
{
82+
"type": "ECOSYSTEM",
83+
"events": [
84+
{
85+
"introduced": "10.11.0-rc1"
86+
},
87+
{
88+
"fixed": "10.11.12"
89+
}
90+
]
91+
}
92+
]
93+
},
94+
{
95+
"package": {
96+
"ecosystem": "Go",
97+
"name": "github.com/mattermost/mattermost/server/v8"
98+
},
99+
"ranges": [
100+
{
101+
"type": "ECOSYSTEM",
102+
"events": [
103+
{
104+
"introduced": "8.0.0-20260105080200-d27a2195068d"
105+
},
106+
{
107+
"fixed": "8.0.0-20260217110922-b7d4a1f1f59b"
108+
}
109+
]
110+
}
111+
]
112+
}
113+
],
114+
"references": [
115+
{
116+
"type": "ADVISORY",
117+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3112"
118+
},
119+
{
120+
"type": "PACKAGE",
121+
"url": "https://github.com/mattermost/mattermost"
122+
},
123+
{
124+
"type": "WEB",
125+
"url": "https://mattermost.com/security-updates"
126+
}
127+
],
128+
"database_specific": {
129+
"cwe_ids": [
130+
"CWE-22"
131+
],
132+
"severity": "MODERATE",
133+
"github_reviewed": true,
134+
"github_reviewed_at": "2026-03-31T23:03:59Z",
135+
"nvd_published_at": "2026-03-26T17:16:42Z"
136+
}
137+
}

0 commit comments

Comments
 (0)