Red Hat Security Advisory: Red Hat Developer Hub 1.10.2 release.

CVE-2026-6322 — fast-uri: fast-uri: URI authority bypass due to improper delimiter handling CVE-2026-6734 — undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing CVE-2026-9277 — shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators CVE-2026-9673 — json-2-csv: json-2-csv: CSV Injection vulnerability allows arbitrary code execution via preventCsvInjection bypass. CVE-2026-9697 — undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy CVE-2026-12143 — form-data: form-data: Form field override via CRLF injection CVE-2026-12151 — undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames CVE-2026-24781 — vm2: vm2: Arbitrary code execution via sandbox breakout through inspect function CVE-2026-27136 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-39820 — net/mail: golang: Go net/mail: Denial of Service via crafted email inputs CVE-2026-42338 — ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42499 — net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-44486 — axios: Axios: Information disclosure of proxy credentials via HTTP redirects CVE-2026-44487 — axios: Axios: Information disclosure of proxy credentials via redirect flows CVE-2026-44488 — axios: Axios: Denial of Service due to unenforced request and response size limits CVE-2026-44492 — axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization CVE-2026-44494 — axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution CVE-2026-44495 — axios: Axios: Information disclosure due to prototype pollution vulnerability CVE-2026-44496 — axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name CVE-2026-45736 — ws: ws: Uninitialized memory disclosure via websocket.close() with TypedArray CVE-2026-47131 — vm2: vm2: Arbitrary code execution via sandbox escape vulnerability CVE-2026-47135 — vm2: vm2: Sandbox escape allows arbitrary code execution on the host system CVE-2026-47137 — vm2: vm2: Sandbox escape leading to arbitrary code execution via security bypass CVE-2026-47139 — vm2: vm2: Sandbox escape via internal HTTP built-ins leading to network restriction bypass CVE-2026-47140 — vm2: vm2: Arbitrary code execution due to incomplete sandbox restrictions CVE-2026-47141 — vm2: vm2: NodeVM observability builtins leak host process and HTTP request data CVE-2026-47208 — vm2: vm2: Sandbox Breakout Using Promise Species CVE-2026-47210 — vm2: vm2: Arbitrary code execution via sandbox escape when executing untrusted code with async support. CVE-2026-48779 — ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments