# Security changelog 1.5.1

Vulnerabilities fixed since version 1.5.0.

Fixed: 16

| Vulnerability | Severity | Package (previous version) | Platform | Summary |
|---|---|---|---|---|
| [CVE-2026-106446](https://nvd.nist.gov/vuln/detail/CVE-2026-106446) | 9.8 | npm/handlebars@4.7.9 | arm64, x64 | Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937) |
| [CVE-2026-106445](https://nvd.nist.gov/vuln/detail/CVE-2026-106445) | 9.2 | npm/handlebars@4.7.9 | arm64, x64 | Handlebars: JavaScript Injection via Own Property Check Bypass |
| [GHSA-wq5f-xc86-pv6w](https://osv.dev/vulnerability/GHSA-wq5f-xc86-pv6w) | 8.9 | npm/sharp@0.35.4 | arm64 | sharp : Vulnerability in librsvg dependency CVE-2026-96889 |
| [CVE-2026-102275](https://nvd.nist.gov/vuln/detail/CVE-2026-102275) | 8.2 | PyPI/pyjwt@2.14.0 | x64 | PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion |
| [CVE-2026-35189](https://nvd.nist.gov/vuln/detail/CVE-2026-35189), [CVE-2026-35191](https://nvd.nist.gov/vuln/detail/CVE-2026-35191), [CVE-2026-54872](https://nvd.nist.gov/vuln/detail/CVE-2026-54872), [CVE-2026-54875](https://nvd.nist.gov/vuln/detail/CVE-2026-54875), [CVE-2026-72897](https://nvd.nist.gov/vuln/detail/CVE-2026-72897), [CVE-2026-75804](https://nvd.nist.gov/vuln/detail/CVE-2026-75804), [CVE-2026-75805](https://nvd.nist.gov/vuln/detail/CVE-2026-75805), [CVE-2026-75806](https://nvd.nist.gov/vuln/detail/CVE-2026-75806), [CVE-2026-77696](https://nvd.nist.gov/vuln/detail/CVE-2026-77696), [CVE-2026-84782](https://nvd.nist.gov/vuln/detail/CVE-2026-84782), [CVE-2026-84784](https://nvd.nist.gov/vuln/detail/CVE-2026-84784) | 8.2 | Ubuntu:26.04:LTS/openssl@3.5.5-1ubuntu3.5 | arm64, x64 | openssl vulnerabilities |
| [CVE-2026-96512](https://nvd.nist.gov/vuln/detail/CVE-2026-96512) | 7.8 | Ubuntu:26.04:LTS/sudo@1.9.17p2-1ubuntu3.1 | arm64, x64 | sudo vulnerability |
| [CVE-2026-102276](https://nvd.nist.gov/vuln/detail/CVE-2026-102276) | 7.5 | npm/brace-expansion@1.1.18 | arm64, x64 | brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion |
| [CVE-2026-102278](https://nvd.nist.gov/vuln/detail/CVE-2026-102278) | 7.5 | npm/brace-expansion@1.1.18 | arm64, x64 | brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion |
| [CVE-2026-104850](https://nvd.nist.gov/vuln/detail/CVE-2026-104850) | 7.5 | npm/@modelcontextprotocol/sdk@1.30.0 | arm64, x64 | MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server |
| [CVE-2026-42772](https://nvd.nist.gov/vuln/detail/CVE-2026-42772), [CVE-2026-54873](https://nvd.nist.gov/vuln/detail/CVE-2026-54873) | 7.5 | Ubuntu:26.04:LTS/openssl@3.5.5-1ubuntu3.5 | arm64, x64 | openssl vulnerabilities |
| [CVE-2026-49265](https://nvd.nist.gov/vuln/detail/CVE-2026-49265) | 6.8 | PyPI/oauthlib@3.3.1 | arm64, x64 | Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208) |
| [CVE-2026-102598](https://nvd.nist.gov/vuln/detail/CVE-2026-102598) | 6.3 | PyPI/werkzeug@3.1.8 | arm64, x64 | Werkzeug safe_join() allows Windows special device names |
| [CVE-2026-49264](https://nvd.nist.gov/vuln/detail/CVE-2026-49264) | 6.1 | PyPI/oauthlib@3.3.1 | arm64, x64 | Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation |
| [CVE-2026-101918](https://nvd.nist.gov/vuln/detail/CVE-2026-101918) | 5.3 | PyPI/pyjwt@2.14.0 | x64 | PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False) |
| [CVE-2026-102277](https://nvd.nist.gov/vuln/detail/CVE-2026-102277) | 5.3 | npm/brace-expansion@1.1.18 | arm64, x64 | brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service |
| [CVE-2026-106444](https://nvd.nist.gov/vuln/detail/CVE-2026-106444) | 4.7 | npm/handlebars@4.7.9 | arm64, x64 | Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates |