OPENSUSE-SU-2026:20919-1

Advisory lineage Upstream: 4 Downstream: 0
Published: 08 Jun 2026, 10:21
Last modified:10 Jun 2026, 18:24

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

08 Jun 2026, 10:21
Published
Vulnerability first disclosed
10 Jun 2026, 18:24
Last Modified
Vulnerability information updated

Description

Security update for agama-web-ui This update for agama-web-ui fixes the following issues - CVE-2025-7339: on-headers: incorrect array handling may lead to HTTP response header manipulation (bsc#1246678). - CVE-2026-9277: shell-quote: improper escaping of newlines in object .op values by quote() can lead to shell command injection (bsc#1266256). - CVE-2026-42041: axios: authentication bypass via validateStatus prototype pollution gadget due to suppression of HTTP error (bsc#1264160). - CVE-2026-42264: axios: prototype pollution read-side gadgets in HTTP adapter can lead to credential injection and request h (bsc#1264802). Changes for agama-web-ui: - Update other dependencies reported by "npm audit".

Affected Systems

  • opensuse•agama-web-ui&distro=openSUSE Leap 16.0

    < 17+612.d8bf69336-160000.11.1

References (8)