Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
cleanstart/npm and cleanstart/langfuse may produce unexpected strings
published 28 days ago
Summary
The brace‑expansion component used in cleanstart/npm and cleanstart/langfuse can build any text that shares a chosen beginning and ending. This could let an attacker insert unintended data or trick the program into processing malicious input. Apply the vendor’s recommended update or patch to stop the unsafe string generation.
What to do
- Update cleanstart npm to version 12.0.2-r2.
- Update cleanstart langfuse to version 3.225.9-r4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | npm |
< 12.0.2-r2 Fix: upgrade to 12.0.2-r2
|
| CleanStart | cleanstart | langfuse |
< 3.225.9-r4 Fix: upgrade to 3.225.9-r4
|
Original advisory text
brace-expansion library generates arbitrary strings containing a common prefix and suffix
CVE-2026-102277 affects multiple packages. The brace-expansion library generates arbitrary strings containing a common prefix and suffix. See references for individual vulnerability details.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published8 Oct 2026
Updated8 Oct 2026
First seen8 Oct 2026
Sources
CLEANSTART-2026-ME50166 · OSV
Track software like this
Free during beta