CVE-2026-5160
Aliases:GHSA-c97m-vxhj-p7j6GO-2026-5320DEBIAN-CVE-2026-5160CGA-24m5-h5qc-hp6qCGA-29qw-8g92-wjvmCGA-2fjf-jc95-q85qCGA-2rpx-qmcr-xgqvCGA-3f48-5p2f-jh7pCGA-3vf2-c3jw-c9vvCGA-3xm8-m2v8-pv4pCGA-44r2-6mxg-j4g2CGA-4gv6-hfmw-gj2jCGA-4gx7-p68r-28q5CGA-4xxq-gghp-jxrpCGA-5cmx-w3fx-r982CGA-5mfq-rg33-4cgfCGA-5pgg-rh36-jc26CGA-5q3x-r4pw-56m8CGA-5xj2-4cx5-5fg9CGA-6554-h8j5-r8c3CGA-66p6-gm68-m9xxCGA-74xp-vqgq-7v4vCGA-759p-q2vw-f7qrCGA-78rh-pjj4-cxrhCGA-79wf-p3jg-qw8mCGA-7f2q-j6q2-w768CGA-879h-ww8v-c7p2CGA-8r5r-p729-597xCGA-8x5h-8746-3x4vCGA-93w7-whww-jgwpCGA-95qj-mh32-v8r2CGA-9c5m-54mh-5rmjCGA-9fhm-9mv7-2vcjCGA-9m45-x5h5-xfqhCGA-9vgh-c6fq-6wrcCGA-c222-vqp2-rwmjCGA-c3gm-hw7w-6v6mCGA-cf2v-cg5c-468pCGA-cv78-pxq3-jfg6CGA-f478-m6rj-vwhpCGA-f5f4-mjrr-x62rCGA-fh2x-x72x-qhg4CGA-gh79-p83m-3ph3CGA-gj6q-c27c-f94qCGA-gpj3-jmh4-4953CGA-h3px-hjgj-8h67CGA-h4fh-f8fw-wgmpCGA-h535-8xhg-xqqfCGA-h72c-vmf6-gw3mCGA-h8w4-gchv-62rcCGA-hm9p-fx5f-4pgmCGA-j358-8m5m-2586CGA-j4jj-r4vr-g786CGA-jrvf-q8hw-48vpCGA-mp37-6jg2-pf5fCGA-mq42-wfxm-3q9wCGA-mr9g-xg39-6323CGA-mwmc-m5hp-33x6CGA-mxgv-4fmw-hhh5CGA-pgvr-mw9h-pgmhCGA-ph26-c4qv-rjxjCGA-phh3-p95p-995hCGA-prrc-9wg7-5486CGA-prv7-j526-2vx5CGA-pvxf-hx7r-fw64CGA-2254-hqv8-r744CGA-23f6-qp22-xc7wCGA-23pc-q5fj-x4v4CGA-24gp-vw29-3f7xCGA-2528-m326-3qfrCGA-253p-pqjc-q4f9CGA-256r-jch8-x3jjCGA-265x-75mw-64xqCGA-26xx-5cfr-7jc2CGA-2795-c2p4-27j5CGA-27rv-4rrm-7hqfCGA-286w-f9q6-pvr5CGA-28vh-44jf-7g4pCGA-2fjw-89fq-xx67CGA-2fm3-r3h4-rcm9CGA-2gqm-4cch-g2ccCGA-2h59-wmg7-f97gCGA-2hc4-r4f5-wwf5CGA-2j5r-9q5g-5rq4CGA-2j5x-458p-325vCGA-2j8p-93fv-p39qCGA-2jrh-7m34-9523CGA-2m4m-q9jx-3xrhCGA-2mf4-p5qw-3j63CGA-2pgc-8hqf-x9rwCGA-2r43-8m32-2f99CGA-2rc3-97r8-8wpvCGA-2v5m-g3p4-7g35CGA-2vmq-24vp-vmq6CGA-2w36-cw29-p273CGA-2wg3-jcc6-48qpCGA-3363-p8hq-mc96CGA-34qh-fq2q-g37vCGA-35hv-cg7m-643xCGA-35mg-63cc-c478CGA-35v8-xfwm-cp69CGA-35vh-624m-4p9rCGA-37gj-2hvf-22jqCGA-37p4-cfwh-xccrCGA-37pp-72c9-5q7gCGA-37qp-pm8m-cccvCGA-37vx-5g7c-7gw9CGA-383q-783c-8hm5CGA-38x4-247x-2rjmCGA-397r-wm2m-3pxpCGA-39qx-v8gm-3q57CGA-3c89-653m-v2r4CGA-3c9q-hcj4-c2v3CGA-3cwq-q7gw-vfvqCGA-3fv3-m976-pp8wCGA-3gxh-7p9p-wwcgCGA-3hj2-686q-99x3CGA-3j6h-h52x-pcvjCGA-3jj5-qq3x-xvg8CGA-3jrm-mgg8-24jhCGA-3m5j-9vjh-q8crCGA-3p27-gfr9-rrj7CGA-3p7w-rvw8-h2qqCGA-3pqq-j35r-fcmjCGA-3qj9-3x2w-q93cCGA-3r87-q4cr-3h74CGA-3r93-xx23-j4xmCGA-3x49-c2h3-3w6wCGA-3x6m-r7rc-x9c5CGA-3xc4-jw78-v8p3CGA-42jr-f7qg-x8cmCGA-437q-h55m-2hvrCGA-439v-v9qq-w4mjCGA-43jj-jj9r-78wmCGA-43qj-v7h6-wgjgCGA-44cq-2qqh-mwpjCGA-45g7-89g5-x7j4CGA-478r-g5jw-vch9CGA-47fw-7c4q-qc44CGA-47mf-5rh5-f8jwCGA-47xg-wq43-mfhgCGA-48ch-f7cm-m55rCGA-48wp-hx59-qhh8CGA-4952-88p4-5jmhCGA-4c8c-3jv7-pxvfCGA-4c8f-pcx3-v24qCGA-4cfr-r664-8g22CGA-4f62-jgm5-2fjpCGA-4fp4-hq54-q5f4CGA-4g5p-pgvx-jp48CGA-4gcv-qhjw-7j5wCGA-4gg9-6rm6-xmvhCGA-4hh5-v5gp-gh3gCGA-4jh4-pgr9-fc94CGA-4jww-w653-x7jgCGA-4mgw-qc2p-wf3gCGA-4mqx-mwm8-45v8CGA-4p57-pvx4-m8pwCGA-4qf5-jvp9-3gfqCGA-4qj4-554x-q7mcCGA-4qj8-cqhp-xcf5CGA-4rvh-qgvj-rm7wCGA-4v4c-4wwv-4v7hCGA-4vx9-hjcj-fmvmCGA-4w48-66mv-2m87CGA-4wvc-6rr2-8v6cCGA-4xpv-rr45-4wqgCGA-4xrm-gq56-fc95CGA-52wq-8m2h-c6c7CGA-53rq-j556-xg28CGA-544f-qm92-jwgpCGA-55p8-5mxc-gpr2CGA-5666-prcc-jf53CGA-5684-hw9v-q9v7CGA-56m7-23w4-8fcjCGA-575p-6mcj-79vmCGA-57x4-qx3g-p3vxCGA-5844-vm3q-h3w8CGA-59f9-v3p6-48h4CGA-59hx-qg3g-cffhCGA-5c5w-6r67-w5j4CGA-5f35-jmp7-hqrqCGA-5fjc-4rp8-wqhcCGA-5fqj-2pxx-xc4hCGA-5hff-r5g4-9fjhCGA-5hgc-w54m-x2jxCGA-5jr7-7hqr-mc92CGA-5mfp-2pc2-933mCGA-5p69-c958-pwq6CGA-5pc5-jfw5-fff5CGA-5pcp-25gx-hj6cCGA-5pq6-465m-gj83CGA-5qqm-947r-ppwhCGA-5w5w-9hqr-h77vCGA-5w64-wjvj-wfg6CGA-5wfp-f64m-fq9vCGA-5xcc-g73p-9cx5CGA-5xgf-29fv-g9q8CGA-5xxj-mwg2-cc5rCGA-62fc-rhqh-hw36CGA-62p6-7j79-vccgCGA-6325-pmw9-f9ggCGA-642r-c325-q5xmCGA-645v-2jgr-32gmCGA-646w-23wm-7pwqCGA-64hw-pq6g-hp7jCGA-659c-mgwp-jpw5CGA-65h6-5chx-cprqCGA-65rh-w578-gqrgCGA-6655-772f-994qCGA-67mp-9mx6-77xwCGA-6837-74q2-g2mrCGA-6884-264w-rr3xCGA-6893-3jwm-f36fCGA-689m-gmj6-j4h5CGA-68hq-8w64-2cw7CGA-68v6-mpvq-fqv6CGA-68ww-m89x-px6pCGA-6948-q24m-xcm8CGA-69h6-223q-x8p3CGA-69j8-6r3p-9wffCGA-69vj-3524-xwxhCGA-6cv4-fq9r-4h38CGA-6cwm-m8v9-658gCGA-6f5m-pjm9-cg7gCGA-6g4j-8w7j-4789CGA-6g8j-9766-cqmpCGA-6ggh-r9v9-jhphCGA-6gmj-6phg-pp4cCGA-6h4h-pmx7-vvmgCGA-6h5r-8xc8-86jmCGA-6hhr-jphq-w2m2CGA-6j52-f5pm-54c3CGA-6j97-6wph-3jgxCGA-6jjf-v9fq-pvq6CGA-6mxc-whjm-ccwvCGA-6p95-gph5-5g77CGA-6pq2-43q8-3f5qCGA-6pvc-rm75-2mq4CGA-6q6c-j368-phcvCGA-6qqh-3jxp-xcmcCGA-6r8p-7w7x-vx28CGA-6r99-8x26-cr9vCGA-6v2r-58hf-vgxhCGA-6v5f-r68x-cq6pCGA-6vhg-c2vj-2j58CGA-6vxj-2g2f-8x94CGA-6wh5-5w5g-pfp9CGA-6wh9-w5fp-56mrCGA-6wvw-5499-62jjCGA-6xmj-mxg8-g5grCGA-6xpj-gwfh-4x47CGA-7232-gcf6-48ccCGA-72v4-5qv7-vw9fCGA-732v-gvwm-3vwjCGA-7386-pvj4-4r7pCGA-73hj-7jw2-g8h3CGA-73pj-q6mx-vrm7CGA-748v-85wf-7fm4CGA-74cm-pmr8-g8c2CGA-75mm-fg32-fjxjCGA-75rr-5m9f-29jcCGA-77fv-prf5-x5c9CGA-78x5-3hf7-m254CGA-7cjh-wh36-x52cCGA-7f24-g7vh-vjf8CGA-7fjf-8849-j486CGA-7fjq-rhmr-gphcCGA-7fmv-xx68-7qcgCGA-7gj3-h3pw-xjf3CGA-7gwx-738w-qp6gCGA-7hhq-jj75-g7vxCGA-7jj5-jv7p-cfxpCGA-7jv3-h4wf-mqp2CGA-7rj2-6hw6-r58fCGA-7rp7-xg55-cccwCGA-7rwh-4r36-wf9xCGA-7vgh-wxr6-pcxqCGA-7w4c-9x76-2rjpCGA-7x85-ghgg-w3m9CGA-7xhr-xqh6-j226CGA-822p-qm42-4v2xCGA-825m-xx49-523xCGA-83xq-g8mj-627rCGA-85m8-q38h-wghcCGA-85mg-6ppr-qh88CGA-85p6-2cr5-qp77CGA-85xh-82q4-fh47CGA-87rf-g9mc-rwr3CGA-87rm-4rqm-7pw6CGA-87ww-xh45-8g4fCGA-885h-prjj-pm7jCGA-8c7m-f44r-37g3CGA-8cqf-wcw6-4wp8CGA-8fj6-8r47-h34rCGA-8fjx-2qrg-v2v3CGA-8fv4-6wpm-7mqgCGA-8h23-4fqj-q3w3CGA-8hw6-qxxv-g3r8CGA-8j76-285c-pq8wCGA-8jx9-8xhv-j22rCGA-8q96-4fxv-w6cjCGA-8rxf-pqpx-gjw4CGA-8v9x-p47r-8wg7CGA-8vgm-6h4c-3vpqCGA-8vpp-74f8-p5ggCGA-8w3p-875r-74chCGA-8wg3-23fh-c6vqCGA-8wq6-hpxm-m4x9CGA-8x75-mc2f-x272CGA-922x-7ghx-x7v6CGA-92f6-hfxm-2m89CGA-92gw-52mj-jvw2CGA-92qp-g23g-j67qCGA-92vh-jx47-7xwvCGA-92x3-483g-6xqrCGA-935r-gw3m-rxw6CGA-93jp-76ff-32qpCGA-9499-p5cx-g974CGA-94pc-3xch-qjf6CGA-95v6-c85m-q3gfCGA-96h5-vm67-c3qqCGA-972h-v6mf-ff67CGA-9774-j6cg-7538CGA-98wx-2c63-v45xCGA-98xw-3qpr-2rpgCGA-995c-5f9m-mjpfCGA-9974-6vcj-x9wrCGA-9c28-x2v7-fh4pCGA-9c2j-r533-vf7mCGA-9c9m-x3vq-vvmrCGA-9cmw-2vch-w2qpCGA-9f9w-f852-7437CGA-9fwv-h698-q89gCGA-9g7c-hfj6-4fmqCGA-9gp9-wvjm-54qjCGA-9hq9-fxf8-6jp8CGA-9jcw-3wg9-hpr2CGA-9jq8-mffp-72c7CGA-9jv8-vjvp-h6g2CGA-9pwq-xgg8-m592CGA-9q49-9gpp-c8wfCGA-9q4g-642j-vfqqCGA-9r83-gfj8-qf63CGA-9v3q-2h6f-vx45CGA-9vfg-86gw-xj5qCGA-9wf8-xmr2-4vg5CGA-9wm9-95qx-4c6cCGA-c33p-5fhg-5hwpCGA-c34v-m5x5-4q7gCGA-c35j-75cx-775hCGA-c4q8-8xqr-xqqxCGA-c5ff-x5v8-g3pcCGA-c5r7-9pjx-hvmgCGA-c5x3-v36v-773vCGA-c6x2-vjgj-mw58CGA-c84v-6chg-6hwqCGA-c8h5-467h-jg3cCGA-c9x4-7rfj-5jjwCGA-cf2w-fh2c-2pvwCGA-cf6f-pfmq-4j98CGA-cf8j-fwj6-mwhvCGA-cfx2-gcfv-8mp6CGA-cgxq-wj33-3w94CGA-ch5q-c77x-v3x4CGA-ch87-fccv-r536CGA-ch9r-7pcm-vp6pCGA-chmm-gw3p-qqq6CGA-cj35-9pf2-p898CGA-cjc5-jv5c-qcghCGA-cjwf-h4rw-pqx4CGA-cp27-4pxm-jxpjCGA-cp96-fg25-w4x2CGA-cq37-4c2g-4454CGA-cq4w-mr8g-q262CGA-cqcp-8wv9-5wp6CGA-cqqq-fgvr-3x26CGA-cr45-wfqx-8hrvCGA-crc5-rq85-95xcCGA-crjm-c8gv-68h5CGA-crr8-88wf-3pw9CGA-cv67-xgp7-wv5rCGA-cv84-m66w-v6w3CGA-cv9x-gw6p-7fp8CGA-cvc5-vq9q-8f26CGA-cwhp-4v89-2hcgCGA-cwph-9phx-gm99CGA-cwqp-37hq-p7p3CGA-cx54-9pm3-xq92CGA-cxp7-8p9p-cfq3CGA-f235-m7gf-jrc4CGA-f25j-7w4j-jf97CGA-f2ff-9vh9-32prCGA-f2pw-qhp2-c3pgCGA-f2rx-vv9j-6q78CGA-f3gm-jxmf-32r6CGA-f3xg-q7c6-p7p5CGA-f4vf-35x8-5j9qCGA-f53c-jh2m-p462CGA-f56j-q928-9g9qCGA-f5p9-89pg-h8h8CGA-f6r5-qfj6-3p43CGA-f6vq-wh66-6xfgCGA-f73c-fxcj-c89xCGA-f7hc-6j8f-263rCGA-f7qm-f24r-vh65CGA-f7qv-q74x-qfrhCGA-f8c7-8hmp-mqgxCGA-f8qq-jx99-c56gCGA-f97q-6x67-xv5qCGA-f9p3-75r9-xpmhCGA-fc23-qm22-4626CGA-fccp-8c6j-m3pjCGA-fg9c-63r3-9qwvCGA-fjpc-4xg8-g7hrCGA-fm9p-fh6v-hq2mCGA-fpp7-fg46-qq2xCGA-fq2v-77p6-qq85CGA-fq87-xp8w-hgpjCGA-fqjf-72jc-2x2mCGA-fqp5-gm2j-6w43CGA-fr5v-75hf-98chCGA-frf4-rvrf-v8whCGA-frqh-36v6-448hCGA-frwv-23cg-jw8gCGA-fv97-7vfj-5pj8CGA-fvr7-5wf2-gjmvCGA-fvrm-3r2x-7wgcCGA-fw7j-7245-2f5jCGA-fw9g-xhc6-x45cCGA-fwwj-4g7q-9fxfCGA-fxj4-v65m-3xw2CGA-fxmg-294r-gh7xCGA-g2m4-w73w-5j6vCGA-g2qx-p6g5-7rq4CGA-g2r5-xjj8-mrh9CGA-g45c-wf4p-wfrpCGA-g45q-pxpc-w247CGA-g46q-2c92-54m5CGA-g494-3wh8-cwhrCGA-g5cq-5p4v-4x48CGA-g679-cjm3-jfxcCGA-g77j-5h8f-fqqjCGA-g7r2-p98f-mvx8CGA-g944-h782-6cf3CGA-g9m5-c5xg-v35fCGA-gfjg-rf3h-2g52CGA-gfqg-6hw7-7gm8CGA-gfrp-qpw4-4g95CGA-gg3w-8hp8-7gj4CGA-gg8x-hx53-hg4mCGA-ghf5-387w-cv8pCGA-ghm2-h6vp-jr43CGA-ghq2-4q4h-hp9gCGA-gjwx-37mr-r5cwCGA-gmf3-95vq-8g4qCGA-gp2p-vvc2-fj6pCGA-gq39-r22x-fw37CGA-gq3c-5xg2-wfhhCGA-gr3j-g5rw-vjj7CGA-grgc-mfwf-fpphCGA-grv6-vphf-xxx2CGA-gvc4-5rch-px6xCGA-gx4j-fv4h-q3c6CGA-gx5p-9j62-69cfCGA-gxgq-fpxc-h3x4CGA-h299-vh37-w2g8CGA-h2fv-2583-rgmrCGA-h2qm-q795-fmqxCGA-h344-wggf-3v8qCGA-h37x-pv66-hf43CGA-h3c2-h258-c4x5CGA-h3mp-7c9h-4h4jCGA-h5fg-j4p8-hh4rCGA-h5jx-rh3c-vq74CGA-h72q-mc2c-g3h2CGA-h7jr-j3mx-27jrCGA-h7pp-vq38-gpwxCGA-h7xp-rq5c-g6crCGA-h97h-vvxj-h38cCGA-h9wr-hmf4-vh6xCGA-hcf9-xq9p-6w9mCGA-hcfm-9f8w-9w66CGA-hcvg-wxwf-g58cCGA-hf7h-7wjw-8xjfCGA-hgv4-5484-4xvqCGA-hhjq-f85v-r7rqCGA-hhvm-vhpm-9hrgCGA-hhwj-r4qc-qjq2CGA-hj82-qvm4-6975CGA-hjvm-697p-jf9qCGA-hmxj-9f77-jpgqCGA-hqp4-m329-6fpqCGA-hqp6-mrjg-8jrcCGA-hqpc-jvcq-gw69CGA-hr8j-73jv-pm2jCGA-hrpg-h386-cc2vCGA-hvff-x6cp-77cjCGA-hw8r-hqwp-m67mCGA-hxp7-qhfv-fcf8CGA-hxrv-2ppm-f2vmCGA-j2gr-g7g4-429qCGA-j2mv-vg8g-56h5CGA-j2vh-p7h7-28mgCGA-j357-5vm6-3rvqCGA-j3vx-2h88-cq2rCGA-j48j-55v3-hj3wCGA-j58m-vh2g-68gwCGA-j5gv-3mqg-fm9cCGA-j5j6-gmfm-6gmcCGA-j69h-h7c6-53mcCGA-j6j8-7mgc-h6ffCGA-j6m6-87mm-2jcxCGA-j6vx-j9rc-226mCGA-j74m-x6g8-g83rCGA-j8px-xp98-m39rCGA-j9jg-7hfq-64pqCGA-j9vc-jx9g-58w8CGA-jc39-39g2-rmjjCGA-jfmc-qf55-x87vCGA-jhfm-whw3-4qg9CGA-jhvr-5hp7-rg2vCGA-jj4v-2c37-x9g8CGA-jmg5-p3mg-5p2xCGA-jmxw-xp88-c2hqCGA-jp8p-xxpc-4vh9CGA-jp98-cc48-wr84CGA-jpw7-mqmx-vh9xCGA-jrv5-2j7m-q49hCGA-jvc3-8hf5-8j3mCGA-jw69-w43w-96wxCGA-jx88-cw96-92h4CGA-jxj8-34fr-h639CGA-m37p-jf8w-r2p6CGA-m3c3-fpgv-3gm8CGA-m3c4-42j6-x39cCGA-m5c3-3pf5-rq4jCGA-m5h8-96m8-mpm5CGA-m72f-w5x3-gmvmCGA-m7gx-7x8m-7x39CGA-m7wf-hw22-cf28CGA-m7xm-w5g8-p843CGA-m8jv-w276-vjm3CGA-m92q-q75q-2rf2CGA-m9gq-c442-rpvvCGA-mc5h-3x75-58hgCGA-mfpf-53p3-3q49CGA-mg7p-86fv-3f79CGA-mg9w-6w3g-54rxCGA-mghr-m697-jcx6CGA-mgjp-f8h4-fjvjCGA-mgpc-488p-8w2mCGA-mh76-jf5w-4h4fCGA-mh8c-r4cq-9578CGA-mhr7-x4f6-89c9CGA-mhw3-cppf-8h99CGA-mhw3-f86j-hh38CGA-mj29-cpxw-4hgvCGA-mj54-3pc8-h359CGA-mj75-h6x2-7q4rCGA-mmc5-7pgf-7ggcCGA-mpww-6g5q-j8vqCGA-mq8c-6h35-r527CGA-mr4r-rwfx-grfqCGA-mr5c-5qhx-p4w7CGA-mr5f-m5j5-fq8xCGA-mr78-98j6-pm9wCGA-mv23-m36m-4cw3CGA-mv2r-7gvh-c875CGA-mv8r-55xr-wvhqCGA-mvrr-v26r-537pCGA-mvrx-325q-r558CGA-mvv6-2mh5-q7prCGA-mvvf-pfrv-gqj2CGA-mx5g-x5vc-q2vwCGA-mxgp-7m2v-55cmCGA-mxqj-3642-69v3CGA-p245-c76g-hjc7CGA-p2vq-2gfc-77c3CGA-p2wj-8hhm-cj94CGA-p2wr-xh8c-vppqCGA-p3pm-xx59-x53hCGA-p4rr-c4c7-xxrvCGA-p6x7-353q-gwjjCGA-p92p-c366-vhq8CGA-p9hj-54mv-3cg7CGA-p9xp-fh45-48r6CGA-pcmv-cx65-23p8CGA-pcv8-ppxp-wq6pCGA-pcxq-rj28-mx8qCGA-pfpg-x559-mg2mCGA-pg9c-h4px-5p2wCGA-pgg2-9pqh-9p5xCGA-pghr-p5v7-vmqqCGA-pgjx-6rcw-25x5CGA-ph6p-9xxh-8j28CGA-pj67-8r55-vvg7CGA-pj8j-3p9x-c9rrCGA-pjr8-mff4-wphcCGA-pm94-xj2w-vjqqCGA-pmq5-pf4x-4g2gCGA-pp8p-h8mj-qr7cCGA-ppj5-c555-pr25CGA-ppvf-x5j2-p7c3CGA-pq2m-jfpf-q2jhCGA-pq35-jx5r-jh9xCGA-pq8c-gm93-8mjcCGA-pq8g-3r8g-4gcpCGA-pqf9-8qfv-rxrvCGA-pqfq-v548-m67wCGA-prw2-3qjh-83pgCGA-pwh3-97j9-h4rvCGA-pwjx-4m53-7xf9CGA-pwvp-rp35-x54cCGA-pwx9-56q4-gcjcCGA-px29-2pvv-7fjgCGA-pxch-4gwg-46mxCGA-pxmq-hr2j-4h3qCGA-pxv9-9hq8-j94pCGA-pxxw-3qp7-52rmCGA-q2pj-3434-c6h9CGA-q44g-fxw7-rqq5CGA-q4p4-9hq8-cprjCGA-q4wc-hgw3-vhc2CGA-q56v-h552-qv9pCGA-q5xh-cj7p-r84fCGA-q69p-7x2c-rghxCGA-q6cm-h4j3-33qrCGA-q6hh-g2f2-4g59CGA-q72h-99cg-wr32CGA-q7h6-994x-v5hcCGA-q83p-mpgv-vh8jCGA-q8fq-mwx6-48hfCGA-q8w8-g2cr-2c6pCGA-q998-539p-4h52CGA-q9pg-625w-242gCGA-qc6r-h48x-gj5wCGA-qc9c-fqqq-h2m4CGA-qcgg-r9f4-8vpfCGA-qcr9-hw2j-4w76CGA-qfg7-3jvf-284rCGA-qfjh-8qc6-3g8hCGA-qfrf-fghf-fwg3CGA-qg8c-9v2p-r5j2CGA-qhwm-9rf2-3fxhCGA-qj3f-wvpv-cgf8CGA-qj9r-cjh9-rj9mCGA-qjmf-8f46-cqcrCGA-qjv9-xqgm-5jvgCGA-qm7x-9wf2-hw5fCGA-qp37-8p7p-3vvrCGA-qp7q-qm63-xw6qCGA-qqjx-7cv8-q63jCGA-qr62-ghq5-5jgqCGA-qr9f-vpj7-ffgxCGA-qv23-r6q5-qqhxCGA-qvrc-rgpj-3796CGA-qvxj-wgf7-grrjCGA-qw63-6fjp-m4jgCGA-qw6g-mv7f-3qh8CGA-qwjv-w7g2-pjwwCGA-qx65-rr9q-4h5fCGA-r445-6pjw-6pcjCGA-r476-fw7m-83c6CGA-r4f8-747w-cr97CGA-r585-69p3-79w2CGA-r5fw-q7g8-gc2qCGA-r6m7-8475-4g62CGA-r6v7-4crj-39wqCGA-r739-h4pg-cmvcCGA-r7j7-5rq8-6cm2CGA-r8q5-4qgm-x956CGA-r8wx-wp3w-hvw9CGA-r8xx-cm7x-48qvCGA-r99j-g5p2-58g5CGA-r9wj-wx94-3qq3CGA-rc6j-p5wq-wjggCGA-rf32-hf2w-ccvfCGA-rf8m-jfqf-f88vCGA-rfqg-hwg4-xgwjCGA-rhcv-8qhj-m674CGA-rhqw-6chv-5xpxCGA-rhrw-m2vq-q8qfCGA-rhw2-3hww-3jwjCGA-rjrm-h83x-wr7wCGA-rmg2-cxh5-xjp2CGA-rrjm-97qj-9mx9CGA-rv39-m8pv-878fCGA-rwc7-cq73-frg3CGA-rwh3-3rv6-835qCGA-rwvc-8r4j-6hwrCGA-rx9r-gchf-cc8fCGA-rxcc-r452-cmgqCGA-v279-67jj-5f8wCGA-v27w-6hm8-323mCGA-v28f-g27v-7998CGA-v2gx-8hq7-4v93CGA-v2wp-g5p4-w239CGA-v428-8x9g-mcq4CGA-v4f2-xwr4-vgf6CGA-v4fw-c3p3-3w6jCGA-v4m3-6j69-xhrfCGA-v4p9-9gv8-m5qmCGA-v543-gpw6-p9h3CGA-v564-65xh-vr8cCGA-v5j8-9r8x-r47wCGA-v652-9g38-x8ghCGA-v65p-6hh2-j27hCGA-v6h6-p5vr-69jfCGA-v6pq-36pv-q9hhCGA-v779-cf7f-q266CGA-v8gp-r4w6-7c5mCGA-v8jw-h2m9-8h7jCGA-v922-f5hv-3vrjCGA-vcmm-ff2v-chccCGA-vf2m-wrx7-26m2CGA-vf37-q7mw-wm25CGA-vf79-vc4v-7w32CGA-vfwq-w28r-rfvjCGA-vg3m-5856-c63wCGA-vgfw-8gv6-j22pCGA-vgmw-7hgc-c377CGA-vgw7-5jpf-4rqcCGA-vjwg-3wj9-jwccCGA-vmf8-4f3w-mvjfCGA-vp26-5xxm-q769CGA-vp75-4m6r-jhwcCGA-vpf5-vgg6-92gmCGA-vpj9-q6pc-jm6jCGA-vpx6-hw4f-xw3pCGA-vq5m-4j27-rc73CGA-vqxv-5x7r-vvrfCGA-vqxx-rjx7-x33gCGA-vv85-qqpx-hf88CGA-vvhp-pp98-744wCGA-vvmm-5jfm-mxx9CGA-vvw7-7p57-m8wqCGA-vvxg-6vv3-3j5wCGA-vx26-rxqc-5wc9CGA-vxh7-p7q8-22mpCGA-vxp6-g5g2-mc83CGA-vxxv-crrv-vccfCGA-w226-v7x7-x9rmCGA-w262-f6h7-xxvmCGA-w26f-32j9-f586CGA-w29j-gfh3-7cj9CGA-w357-hg4c-7245CGA-w37p-3vp8-cw2vCGA-w38x-799p-qwhvCGA-w3vq-cr73-xpf3CGA-w5f5-p755-73cvCGA-w65c-5w9p-jpxmCGA-w6mf-xgx2-2q8cCGA-w749-49w2-q4pjCGA-w82w-rvpv-3jmvCGA-w9fw-82p9-3h7xCGA-w9j6-c5pf-pgrgCGA-w9r3-x6q9-xfqpCGA-w9v2-qqx9-w4j3CGA-wc7m-rfg2-95f9CGA-wf8v-q2x5-q48vCGA-wh9p-gw59-mw92CGA-whff-vmjj-433mCGA-wm2g-rvxg-9xvfCGA-wm8q-47wx-47ppCGA-wmxm-m4rh-v6qmCGA-wp84-5x97-jqfhCGA-wpj9-7x4c-jrq4CGA-wq4p-vr7p-3wcvCGA-wqwg-26mc-r3rpCGA-wr6j-q27m-8jq9CGA-wr8g-hv2w-72qmCGA-wrj5-qwpq-7j2jCGA-wvfh-qghp-5gq9CGA-wvhm-qr8q-8f3rCGA-wvm5-x5vw-w8qqCGA-wwh2-cwm8-gx5mCGA-wwrf-9v9w-wj2wCGA-www6-p88x-v2q2CGA-wwxw-w68v-3m6vCGA-wxcm-px9f-4fmgCGA-wxxg-x7jf-r4f4CGA-x2f9-f5vm-545hCGA-x2j5-vcxr-rwr5CGA-x2m3-v7qv-7mhmCGA-x2pg-6xfh-pj4rCGA-x3f4-2rm9-jq5gCGA-x3qq-9c56-hjg3CGA-x4gv-jvhx-987rCGA-x4pj-38c7-7gvjCGA-x5hg-x82w-wgw8CGA-x5mc-r9c7-2m7qCGA-x62m-xx85-7qfrCGA-x678-qxvj-489vCGA-x69q-cvq3-pf3qCGA-x7vg-jhjv-4pwrCGA-x8c7-97jm-grcqCGA-x8gg-7x59-q2cfCGA-x9j3-r8r8-75cpCGA-xc6f-vf44-5p6pCGA-xcwj-c574-8mv4CGA-xfqx-49w4-j6f6CGA-xfv7-cpj8-3vr2CGA-xfxh-fpx5-86h7CGA-xgqc-hw7w-cjx6CGA-xgrv-qpxr-qhfpCGA-xh3c-xr2c-2qr9CGA-xh65-67mx-r744CGA-xhjh-7vcp-8r75CGA-xhw7-v275-573qCGA-xmh8-8p6g-r54jCGA-xmxc-65w6-653gCGA-xpr9-h8f2-wp2rCGA-xpv9-wh7h-qqhpCGA-xq6h-8p29-2qg5CGA-xqcq-qp27-53f7CGA-xqcw-v27g-3j4hCGA-xqpc-jf44-v32fCGA-xr63-mfr8-mw2wCGA-xrf6-3xpr-hp2pCGA-xrh3-r2jj-64rwCGA-xv5p-6g35-7c8vCGA-xw37-vq5j-wx3qCGA-xw65-722v-868jCGA-xw8p-vxj8-6qv7CGA-xwxx-2cx7-5xjxCGA-xx22-h7x8-895jCGA-xxrf-fq3m-6hwqCGA-4r77-mhjf-3p9gCGA-gxp3-cxhj-c334CGA-qc2m-59m7-4j7q
Advisory lineage Upstream: 0 Downstream: 6
Analyzed
Published: 15 Apr 2026, 05:00
Last modified:15 Apr 2026, 18:07
Vulnerability Summary
Overall Risk (default)
low
24/100 CVSS Score
6.1 MEDIUM
v3.1 (nvd)
EPSS Score
0.29% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
15 Apr 2026, 05:00
Published
Vulnerability first disclosed
15 Apr 2026, 18:07
Last Modified
Vulnerability information updated
Description
Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting (XSS) due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check (IsDangerousURL) before resolving HTML entities. This allows an attacker to bypass protocol filtering by encoding dangerous schemes using HTML5 named character references. For example, a payload such as javascript:alert(1) is not recognized as dangerous during validation, leading to arbitrary script execution in the context of applications that render the URL.
CVSS Metrics
- v4.0•MEDIUM•Score: 5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
- v4.0•MEDIUM•Score: 5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- v3.1•MEDIUM•Score: 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS Trends
Current EPSS score: 0.29%• Percentile: 21%
Techniques & Countermeasures
- CWE-79•Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Affected Systems
- chainguard•chainctl
< 0.2.321-r1
- chainguard•chainctl-fips
< 0.2.321-r1
- chainguard•crossplane-2.3-crank
< 2.3.3-r35
- chainguard•crossplane-aws-glacier-fips
< 2.6.0-r2
- chainguard•crossplane-aws-monolith
< 2.6.0-r3
- chainguard•crossplane-aws-monolith-fips
< 2.6.0-r4
- chainguard•crossplane-aws-xray-fips
< 2.6.0-r3
- chainguard•crossplane-fips-2.3-crank
< 2.3.3-r8
- chainguard•crossplane-provider-aws-accessanalyzer
< 2.6.0-r4
- chainguard•crossplane-provider-aws-accessanalyzer-fips
< 2.6.0-r4
- chainguard•crossplane-provider-aws-account
< 2.6.0-r4
- chainguard•crossplane-provider-aws-account-fips
< 2.6.0-r4
- chainguard•crossplane-provider-aws-acm
< 2.6.0-r5
- chainguard•crossplane-provider-aws-acm-fips
< 2.6.0-r6
- chainguard•crossplane-provider-aws-acmpca
< 2.6.0-r4
- chainguard•crossplane-provider-aws-acmpca-fips
< 2.6.0-r4
- chainguard•crossplane-provider-aws-amp
< 2.6.0-r4
- chainguard•crossplane-provider-aws-amp-fips
< 2.6.0-r5
- chainguard•crossplane-provider-aws-apigateway
< 2.6.0-r4
- chainguard•crossplane-provider-aws-apigatewayv2
< 2.6.0-r3
- chainguard•crossplane-provider-aws-apigatewayv2-fips
< 2.6.0-r4
- chainguard•crossplane-provider-aws-appautoscaling
< 2.6.0-r3
- chainguard•crossplane-provider-aws-appautoscaling-fips
< 2.6.0-r4
- chainguard•crossplane-provider-aws-appconfig
< 2.6.0-r3
- chainguard•crossplane-provider-aws-appconfig-fips
< 2.6.0-r5
- chainguard•crossplane-provider-aws-appflow
< 2.6.0-r5
- chainguard•crossplane-provider-aws-appflow-fips
< 2.6.0-r8
- chainguard•crossplane-provider-aws-appintegrations
< 2.6.0-r4
- chainguard•crossplane-provider-aws-appintegrations-fips
< 2.6.0-r4
- chainguard•crossplane-provider-aws-applicationinsights
< 2.6.0-r5
- chainguard•crossplane-provider-aws-applicationinsights-fips
< 2.6.0-r4
- chainguard•crossplane-provider-aws-appmesh
< 2.6.0-r3
- chainguard•crossplane-provider-aws-appmesh-fips
< 2.6.0-r3
- chainguard•crossplane-provider-aws-apprunner
< 2.6.0-r4
- chainguard•crossplane-provider-aws-apprunner-fips
< 2.6.0-r4
- chainguard•crossplane-provider-aws-appstream
< 2.6.0-r4
- chainguard•crossplane-provider-aws-appstream-fips
< 2.6.0-r3
- chainguard•crossplane-provider-aws-appsync
< 2.6.0-r3
- chainguard•crossplane-provider-aws-appsync-fips
< 2.6.0-r2
- chainguard•crossplane-provider-aws-athena
< 2.6.0-r6
- chainguard•crossplane-provider-aws-athena-fips
< 2.6.0-r7
- chainguard•crossplane-provider-aws-autoscaling
< 2.6.0-r6
- chainguard•crossplane-provider-aws-autoscaling-fips
< 2.6.0-r5
- chainguard•crossplane-provider-aws-autoscalingplans
< 2.6.0-r2
- chainguard•crossplane-provider-aws-autoscalingplans-fips
< 2.6.0-r4
- chainguard•crossplane-provider-aws-backup
< 2.6.0-r7
- chainguard•crossplane-provider-aws-backup-fips
< 2.6.0-r5
- chainguard•crossplane-provider-aws-batch
< 2.6.0-r4
- chainguard•crossplane-provider-aws-bedrock
< 2.6.0-r3
- chainguard•crossplane-provider-aws-bedrock-fips
< 2.6.0-r4
Showing first 50 affected entries in server-rendered view.
References (7)
- https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMYUINGOLDMARKRENDERERHTML-15838406
- https://github.com/yuin/goldmark/commit/cb46bbc4eca29d55aa9721e04ad207c23ccc44f9
- https://nvd.nist.gov/vuln/detail/CVE-2026-5160
- https://github.com/yuin/goldmark
- https://github.com/advisories/GHSA-c97m-vxhj-p7j6
- https://security-tracker.debian.org/tracker/CVE-2026-5160
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5160.json