Red Hat Security Advisory: Red Hat Developer Hub 1.9.6 release.

CVE-2026-9277 — shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators CVE-2026-9673 — json-2-csv: json-2-csv: CSV Injection vulnerability allows arbitrary code execution via preventCsvInjection bypass. CVE-2026-27145 — crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries CVE-2026-33811 — net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-39820 — net/mail: golang: Go net/mail: Denial of Service via crafted email inputs CVE-2026-42033 — axios: Axios: HTTP Transport Hijacking via Prototype Pollution CVE-2026-42035 — axios: Axios: Arbitrary HTTP header injection via prototype pollution CVE-2026-42039 — axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data CVE-2026-42041 — axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling CVE-2026-42043 — axios: Axios: NO_PROXY bypass via crafted URL CVE-2026-42044 — axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget CVE-2026-42338 — ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42499 — net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-44486 — axios: Axios: Information disclosure of proxy credentials via HTTP redirects CVE-2026-44487 — axios: Axios: Information disclosure of proxy credentials via redirect flows CVE-2026-44488 — axios: Axios: Denial of Service due to unenforced request and response size limits CVE-2026-44492 — axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization CVE-2026-44494 — axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution CVE-2026-44495 — axios: Axios: Information disclosure due to prototype pollution vulnerability CVE-2026-44496 — axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name CVE-2026-44724 — systeminformation: systeminformation: Command injection via NetworkManager connection profile name CVE-2026-45736 — ws: ws: Uninitialized memory disclosure via websocket.close() with TypedArray CVE-2026-47131 — vm2: vm2: Arbitrary code execution via sandbox escape vulnerability CVE-2026-47135 — vm2: vm2: Sandbox escape allows arbitrary code execution on the host system CVE-2026-47137 — vm2: vm2: Sandbox escape leading to arbitrary code execution via security bypass CVE-2026-47139 — vm2: vm2: Sandbox escape via internal HTTP built-ins leading to network restriction bypass CVE-2026-47140 — vm2: vm2: Arbitrary code execution due to incomplete sandbox restrictions CVE-2026-47141 — vm2: vm2: NodeVM observability builtins leak host process and HTTP request data CVE-2026-47208 — vm2: vm2: Sandbox Breakout Using Promise Species CVE-2026-47209 — vm2: vm2: Integrity bypass via incorrect property assignment leading to potential arbitrary code execution CVE-2026-48779 — ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments