GHSA-5ppf-9rv7-cmpqCritical
Update components download and execute code without proper authenticity verification, relying on...
🔗 CVE IDs covered (1)
📋 Description
Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.
🔗 References (4)
- https://nvd.nist.gov/vuln/detail/CVE-2026-118462
- https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical
- https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html
- https://github.com/advisories/GHSA-5ppf-9rv7-cmpq