SB2026110337 - Fedora 46 update for python-robotframework
Published: November 3, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Incomplete List of Disallowed Inputs (CVE-ID: CVE-2026-106445)
CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary JavaScript on the server.
The vulnerability exists due to an own-property check that bypasses the prototype-access deny list in the lookupProperty function when rendering attacker-controlled templates. A remote attacker can access the Function constructor through the own constructor property of Function.prototype and invoke it with attacker-controlled code to execute arbitrary JavaScript on the server.
Exploitation requires allowProtoMethodsByDefault to be set to true and an accessible function in the template context.
2) Type Confusion (CVE-ID: CVE-2026-106446)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary JavaScript code.
The vulnerability exists due to type confusion in the AST validation and code generation used by Handlebars.compile() and Handlebars.precompile() when processing untrusted pre-parsed AST objects. A remote attacker can submit a specially crafted AST object containing values that are written unchecked into generated JavaScript to execute arbitrary JavaScript code.
Applications that only pass template strings are not affected. The Program.blockParams.length vector works with default compile options and does not require the referenced block helper to exist.
Remediation
Install update from vendor's website.