Developer Tools & Supply Chain
psd-tools Security Update Addresses 1 Vulnerability
09/22/2026
psd-tools can exhaust worker memory from attacker-controlled PSD dimensions before validation. Update deployed Python workers to 1.17.4 and retain memory controls; file-byte limits and exception handling alone do not contain the allocation.
Open VSX 1.2.0 Blocks Marketplace Cache Poisoning
09/21/2026
Open VSX cache poisoning requires trusted attacker-controlled forwarded-host data and an unpopulated cache entry. Check the deployed server or container version and those conditions, then apply the supported update containing the 1.2.0 fix.
nvm 0.40.8 Blocks Malicious .nvmrc Path Traversal
09/20/2026
A malicious repository-controlled .nvmrc can make vulnerable nvm read outside its alias directory and disclose local files. Update the active nvm installation and review developer, CI and shell-hook workflows that process untrusted repositories.