PatchSiren

adamarcanov CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH adamarcanov CVE published 2026-10-14

CVE-2026-110648

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-10-14T14:17:16.381Z and has not been modified since then. The @offactory/compress-fonts package before version 1.1.1 contains an OS command injection vulnerability. This vulnerability allows attackers to execute shell commands by supplying font files with crafted names. The font paths are interpolated [truncated]