Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:21602-1

Опубликовано: 18 авг. 2026
Источник: suse-cvrf

Описание

Security update for python-pytest-html

This update for python-pytest-html fixes the following issues:

Changes in python-pytest-html:

  • Revendor browserslist to fix the following:
    • CVE-2026-73088: unguarded for...in loop over untrusted JSON keys in normalizeStats() function leads to prototype pollution and uncaught exceptions (bsc#1275374)
    • CVE-2026-73089: unbounded in-memory caching of query pairs in browserslist() can lead to DoS via memory exhaustion through a high volume of distinct queries (bsc#1275437)

Список пакетов

openSUSE Leap 16.0
python313-pytest-html-4.1.1-bp160.5.1

Ссылки

Описание

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.

Затронутые продукты
openSUSE Leap 16.0:python313-pytest-html-4.1.1-bp160.5.1
Ссылки

Описание

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.

Затронутые продукты
openSUSE Leap 16.0:python313-pytest-html-4.1.1-bp160.5.1
Ссылки
Уязвимость openSUSE-SU-2026:21602-1