{"vulnerability": "cve-2026-6743", "sightings": [{"uuid": "2f0b1708-c5e9-4a8e-b165-09454820be32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67430", "type": "published-proof-of-concept", "source": "https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-52jp-gj8w-j6xh", "content": "", "creation_timestamp": "2026-07-30T16:35:25.518956Z"}, {"uuid": "feade581-b2be-4ef2-8950-fd2a58037a56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67431", "type": "published-proof-of-concept", "source": "https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-5p9g-j988-pcwv", "content": "", "creation_timestamp": "2026-07-30T16:35:20.729425Z"}, {"uuid": "1e75c43d-f719-499b-b2c3-b748ba67467c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67432", "type": "published-proof-of-concept", "source": "https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-h669-8m4g-r2hc", "content": "", "creation_timestamp": "2026-07-30T16:35:23.183627Z"}, {"uuid": "54e8d5e9-0bdd-4b9a-8c85-8f983db25211", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67438", "type": "published-proof-of-concept", "source": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-xc5w-4v5w-7x65", "content": "", "creation_timestamp": "2026-07-30T16:35:33.264665Z"}, {"uuid": "043656f1-b716-4442-b3db-014ebddf27e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67437", "type": "published-proof-of-concept", "source": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-xpxj-f2fm-rqch", "content": "", "creation_timestamp": "2026-07-30T16:35:35.834770Z"}, {"uuid": "b344273a-47ab-4723-a02c-69aa6b59ac79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67431", "type": "seen", "source": "https://gist.github.com/Correctover/36ce05054d457c4fb176b23f08f9962b", "content": "# MCP Protocol Security in 2026: Why Patching Isn't Enough \u2014 And What Runtime Verification Solves\n\n> **Author**: Guigui Wang, Correctover  \n> **Date**: August 4, 2026  \n> **Relevance**: AI Agent infrastructure, MCP security, runtime verification standards\n\n---\n\n## TL;DR\n\nThe Model Context Protocol (MCP) has accumulated **at least 5 confirmed CVEs** in 2026 alone \u2014 DNS rebinding, session hijacking, session poisoning, cross-client data leaks, and Origin header bypass. Every single one follows the same pattern: the protocol trusts its environment without verifying it.\n\nI'm the author of **CCS (Correctover Computing Standard)**, the first IETF submission for AI Agent runtime verification (draft-correctover-ccs-00). This blog post shows how CCS's 7-dimensional runtime verification framework would have caught these vulnerabilities **systemically** \u2014 not as individual patches, but as a class of problems.\n\nIf you're running MCP-based AI agent infrastructure, you need to think about runtime verification, not just patching. Here's why.\n\n---\n\n## The MCP Vulnerability Catalog (2026)\n\n### CVE-2026-11624: DNS Rebinding Attack\n**Severity**: High  \n**Affected**: All MCP server implementations prior to v0.25  \n**Root Cause**: Missing `Origin` header validation\n\nAn attacker-controlled domain uses DNS rebinding to redirect a victim's browser to `127.0.0.1`, where a local MCP server is running. Because the server doesn't validate `Origin` headers, it accepts connections from the browser context \u2014 allowing arbitrary tool execution.\n\n**Impact**: Any website a developer visits while running an MCP server locally could weaponize this. File reads, command execution, database access \u2014 all through the agent's tool interface.\n\n### CVE-2026-67431: Session Poisoning (Ruby SDK)\n**CVSS**: 8.3 (High)  \n**Affected**: `mcp` Ruby gem < v0.23.0  \n**Root Cause**: Transport layer doesn't bind sessions to their owners\n\nThe stateful transport implementation failed to bind established sessions to their original owners or connection contexts. Any actor with access to a session ID can execute arbitrary tool calls.\n\n### CVE-2026-52869: Session Hijacking (Python SDK)\n**CVSS**: 7.1 (High)  \n**Affected**: MCP Python SDK < v1.27.2  \n**Root Cause**: JSON-RPC requests routed purely on user-controlled session IDs without ownership validation\n\nA bearer-token-authenticated attacker can hijack and inject JSON-RPC messages into another client's session by supplying their session ID. The transport layer accepts any valid token and routes to the target session.\n\n### CVE-2026-25536: Cross-Client Data Leak (TypeScript SDK)\n**CVSS**: 7.1 (High)  \n**Affected**: `@modelcontextprotocol/sdk` v1.10.0 through v1.25.3  \n**Root Cause**: Race condition in shared server/transport state\n\nWhen a single server or transport instance serves multiple clients, one client's tool results, notifications, and sampling requests can be delivered to another client. The trigger is ordinary concurrent load, not a crafted attack.\n\n### OX Security Findings: STDIO Transport Architecture\nThe MCP STDIO transport spawns a new process for every connection. This architectural choice means:\n- Each connection has its own process boundary (isolation?)\n- But also: each connection can access the full host system\n- No centralized verification of what the spawned process does\n\n---\n\n## The Pattern: Protocol Trust Without Runtime Verification\n\nLook at all five CVEs. They share a fundamental pattern:\n\n> **MCP trusts its environment. It assumes that if you have a valid connection, you're authorized. If you have a session ID, you own it. If you can reach localhost, you're a legitimate client.**\n\nThis is a **design-level assumption**, not a bug. And it's the same assumption that causes every new CVE.\n\nPatching one vulnerability doesn't fix the pattern:\n- Adding Origin validation fixes DNS rebinding but doesn't prevent the next spoofing attack\n- Binding sessions to owners prevents hijacking but doesn't validate what the session does\n- Isolating transport state prevents leaks but doesn't verify tool execution intent\n\nWhat MCP needs is not another patch. It needs **runtime verification** \u2014 continuous, systematic validation of every agent action against its authorization and intent.\n\n---\n\n## How CCS Solves This Systemically\n\nCCS (draft-correctover-ccs-00) is a 7-dimensional runtime verification framework submitted to IETF. Here's how each dimension addresses the MCP vulnerability pattern:\n\n### 1. Structure Verification\n**What it checks**: Is the incoming request structurally valid? Does it conform to the expected schema?\n\n**Catches**: Malformed JSON-RPC, unexpected tool call parameters, requests that don't match the server's capability declaration.\n\n### 2. Schema Verification  \n**What it checks**: Does the request match the declared tool/resource schema?\n\n**Catches**: Cross-client data leaks (responses with wrong schema), session poisoning (requests with wrong parameter types).\n\n### 3. Latency Verification\n**What it checks**: Is the response time within expected bounds?\n\n**Catches**: DNS rebinding attacks (abnormal latency patterns when browser proxies to localhost), replay attacks (timing anomalies).\n\n### 4. Cost Verification\n**What it checks**: Does the operation stay within declared resource bounds?\n\n**Catches**: Resource exhaustion through tool spam, unexpected computational costs from hijacked sessions.\n\n### 5. Identity Verification\n**What it checks**: Is the requesting entity who it claims to be? Is the session bound to the authenticated principal?\n\n**Catches**: Session hijacking (CVE-2026-52869), session poisoning (CVE-2026-67431). CCS binds session identity to the authenticated principal at the transport layer.\n\n### 6. Integrity Verification\n**What it checks**: Has the data been tampered with? Is the response from the expected source?\n\n**Catches**: Cross-client data leaks (CVE-2026-25536), response injection. CCS verifies data integrity at the byte level.\n\n### 7. Security Verification\n**What it checks**: Does the observed behavior match the declared authorization policy?\n\n**Catches**: DNS rebinding (CVE-2026-11624), STDIO process escape. CCS verifies that every tool execution stays within the declared authorization boundary, regardless of the transport mechanism.\n\n### Performance\n- **P50 latency**: ~133\u03bcs (out-of-process) / ~7.5\u03bcs (in-process)\n- **Verification mode**: Continuous, per-action\n- **False positive rate**: 0% across 28 audited projects\n\n---\n\n## The Self-Evolution Problem\n\nHere's what makes this worse: MCP is a **living protocol**. New transports are added. New SDKs are implemented. New tool patterns emerge. Every change introduces new attack surfaces.\n\nStatic patches can't keep up. You need a verification engine that **evolves** with the protocol.\n\nThat's why CCS includes a self-evolving detection engine (MCPFuzz):\n- **Layer 1**: Static analysis of known vulnerability patterns\n- **Layer 2**: Dynamic fuzzing with semantic-aware test generation\n- **Layer 3**: Behavioral analysis that discovers new bypass patterns autonomously\n\nThis isn't a rule engine. It's an agent that continuously learns what \"normal\" MCP behavior looks like and flags deviations. It achieved **0 false positives** across 28 production projects in the agent ecosystem.\n\n---\n\n## What This Means for You\n\n### If you're an MCP server operator:\n- Upgrade to the latest SDK versions (v0.25+ for Python, v0.23.0+ for Ruby, v1.26.0+ for TypeScript)\n- Implement Origin header validation\n- Bind sessions to authenticated principals\n- Isolate transport state per client\n\nBut also: **deploy runtime verification**. The patches fix known CVEs. CCS prevents the next class of vulnerabilities.\n\n### If you're building on MCP:\n- Don't assume the protocol is secure. It's a living standard with fundamental trust assumptions.\n- Add CCS verification to your agent pipeline. 133\u03bcs overhead is negligible compared to the risk.\n- Audit your tool execution policies. What is your agent authorized to do? CCS enforces that at runtime.\n\n### If you're an enterprise deploying AI agents:\n- MCP is the connective tissue between your LLM and your enterprise tools (databases, APIs, file systems).\n- A vulnerability in MCP is a vulnerability in your entire agent infrastructure.\n- Runtime verification is not optional. It's the difference between \"we patched the known CVEs\" and \"we systematically prevent the class of problems.\"\n\n---\n\n## The Standard Matters\n\nCCS is not just my project. It's submitted to IETF (draft-correctover-ccs-00, Submission #167254). This means:\n- It's a community standard, not a vendor lock-in\n- It's transparent, auditable, and open\n- It's designed to be adopted across the ecosystem\n\nThe DOI (10.5281/zenodo.21783723) provides timestamped proof of priority. The ccs-verifier SDK is on PyPI (v0.4.1). The code is open source.\n\nI'm not selling anything. I'm establishing a standard and proving it works. The question is whether the ecosystem adopts it before or after the next major MCP vulnerability makes headlines.\n\n---\n\n## Resources\n\n- **CCS IETF Draft**: https://datatracker.ietf.org/submit/status/167254/\n- **CCS DOI**: https://doi.org/10.5281/zenodo.21783723\n- **ccs-verifier SDK**: https://pypi.org/project/ccs-verifier/\n- **GitHub**: https://github.com/Correctover/ccs-verifier\n- **MCP CVE-2026-11624**: https://cvereports.com/reports/CVE-2026-11624\n- **MCP CVE-2026-52869**: https://cvereports.com/reports/CVE-2026-52869\n\n---\n\n*Guigui Wang is the author of CCS and founder of Correctover. Correctover's mission is to make AI Agent runtime verification a standard practice, not an afterthought.*\n", "creation_timestamp": "2026-08-04T06:51:03.379559Z"}, {"uuid": "3a3029a5-22b8-482a-a349-869f28b822b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67435", "type": "seen", "source": "https://gist.github.com/alon710/d1939c63ece21d1bd9e89d2add282b5b", "content": "# CVE-2026-67435: CVE-2026-67435: Custom Authentication Header Leakage via Cross-Origin Redirects in linuxfabrik-lib\n\n> **CVSS Score:** 6.0\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67435\n\n## Summary\nCVE-2026-67435 is a security vulnerability in the linuxfabrik-lib Python library prior to version 6.0.0. When performing HTTP requests with follow_redirects enabled, custom authentication headers (such as X-Auth-Token or X-Api-Key) are forwarded during cross-origin redirects. A malicious or compromised server can leverage this behavior to capture sensitive monitoring and administrative credentials, leading to potential unauthorized access and Server-Side Request Forgery (SSRF).\n\n## TL;DR\nA vulnerability in linuxfabrik-lib prior to 6.0.0 forwards custom authentication headers (such as X-Auth-Token or X-Api-Key) during cross-origin redirects, allowing remote attackers to exfiltrate administrative credentials.\n\n## Technical Details\n\n- **CWE ID**: CWE-200, CWE-918\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 6.0\n- **EPSS Score**: 0.00286 (Percentile: 20.87%)\n- **Impact**: Credential Exposure\n- **Exploit Status**: None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- linuxfabrik-lib\n- Linuxfabrik Monitoring Plugins\n- **linuxfabrik-lib**: < 6.0.0 (Fixed in: `6.0.0`)\n\n## Mitigation\n\n- Upgrade linuxfabrik-lib to version 6.0.0 or higher.\n- Disable redirect handling by passing follow_redirects=False inside client calls.\n- Restrict network-level egress traffic for monitoring servers to prevent connection handshakes with external untrusted destinations.\n\n**Remediation Steps:**\n1. Identify all deployment instances of linuxfabrik monitoring scripts within local cronjobs, configuration modules, or service orchestrators.\n2. Update dependencies in requirements.txt or dependency lock files to specify linuxfabrik-lib>=6.0.0.\n3. Deploy the updated library package across all monitoring nodes and verify correct processing of monitoring endpoints.\n4. Apply strict firewall configurations restricting HTTP/HTTPS egress traffic from administrative monitoring subnets to verified destination systems.\n\n## References\n\n- [GitHub Security Advisory GHSA-4jc5-g844-4x33](https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-4jc5-g844-4x33)\n- [Fix Commit: Strip custom headers on cross-origin redirects](https://github.com/Linuxfabrik/lib/commit/6573ff9347e541200305d278d2663d2e54e052ff)\n- [linuxfabrik-lib Release v6.0.0](https://github.com/Linuxfabrik/lib/releases/tag/v6.0.0)\n- [NVD Record for CVE-2026-67435](https://nvd.nist.gov/vuln/detail/CVE-2026-67435)\n- [CVE.org Record for CVE-2026-67435](https://www.cve.org/CVERecord?id=CVE-2026-67435)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67435) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T01:31:12.240111Z"}, {"uuid": "1e681153-7a81-4e69-b8e0-2b0870cfa1b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67431", "type": "seen", "source": "https://gist.github.com/alon710/eb7bbb63a594430d7d6ab18e1b915ebd", "content": "# CVE-2026-67431: CVE-2026-67431: Session Poisoning via Improper Access Control in Model Context Protocol Ruby SDK\n\n> **CVSS Score:** 8.3\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67431\n\n## Summary\nAn Improper Access Control vulnerability exists in the Model Context Protocol (MCP) Ruby SDK prior to version 0.23.0. The stateful transport implementation failed to bind established sessions to their original owners or connection contexts, enabling unauthorized actors with access to active session IDs to execute arbitrary tools or alter session state.\n\n## TL;DR\nA lack of session binding in the MCP Ruby SDK allows remote attackers possessing a valid session ID to execute arbitrary tool calls and manipulate session states.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-284\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 8.3\n- **EPSS Score**: 0.00276\n- **Exploit Status**: POC (in official repository tests)\n- **KEV Status**: Not Listed\n- **Impact**: High Integrity, Low Availability\n\n## Affected Systems\n\n- mcp (RubyGems)\n- Model Context Protocol Ruby SDK\n- **mcp**: < 0.23.0 (Fixed in: `0.23.0`)\n\n## Mitigation\n\n- Upgrade the mcp gem to version 0.23.0 or higher.\n- Implement the session_request_validator hook to validate incoming requests against active user authentication states.\n- Limit session idle timeouts and maximum concurrent sessions to reduce exposure.\n\n**Remediation Steps:**\n1. Identify all deployments using the mcp Ruby gem.\n2. Update the Gemfile to require version 0.23.0 or higher: gem 'mcp', '>= 0.23.0'.\n3. Execute bundle update mcp to install the patched version.\n4. Locate instantiate configurations of MCP::Server::Transports::StreamableHTTPTransport and define a custom session_request_validator callback.\n5. Ensure the callback validates that the user environment (cookies, tokens) matches the active session ownership context.\n\n## References\n\n- [https://www.cve.org/CVERecord?id=CVE-2026-67431](https://www.cve.org/CVERecord?id=CVE-2026-67431)\n- [https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-5p9g-j988-pcwv](https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-5p9g-j988-pcwv)\n- [https://github.com/modelcontextprotocol/ruby-sdk/commit/35466605319a34e4c7808712ae9bb1ca1afb2356](https://github.com/modelcontextprotocol/ruby-sdk/commit/35466605319a34e4c7808712ae9bb1ca1afb2356)\n- [https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0](https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0)\n- [https://nvd.nist.gov/vuln/detail/CVE-2026-67431](https://nvd.nist.gov/vuln/detail/CVE-2026-67431)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67431) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T02:31:09.791759Z"}, {"uuid": "759f23b0-771d-4bde-936d-1d00d7b13c82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67432", "type": "seen", "source": "https://gist.github.com/alon710/0adfedd2017833afe3a395108d8a9b0f", "content": "# CVE-2026-67432: CVE-2026-67432: High Severity Denial of Service in Model Context Protocol (MCP) Ruby SDK\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67432\n\n## Summary\nAn uncontrolled memory allocation vulnerability (CWE-770) exists in the Model Context Protocol (MCP) Ruby SDK (the `mcp` gem) prior to version 0.23.0. The SDK's StreamableHTTPTransport and StdioTransport layers fail to impose bounds on incoming payloads. An unauthenticated attacker can exploit these issues by transmitting massive, nested payloads to exhaust worker memory, leading to process termination.\n\n## TL;DR\nThe `mcp` Ruby gem prior to 0.23.0 is vulnerable to unauthenticated, remote denial of service (OOM crash) due to unbounded HTTP body reading, unsafe JSON parsing depth, and unlimited standard input buffering.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.5 (High)\n- **EPSS Score**: 0.00436 (35.87%)\n- **Impact**: Denial of Service (OOM Crash)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Model Context Protocol Ruby SDK (mcp gem)\n- **mcp**: < 0.23.0 (Fixed in: `0.23.0`)\n\n## Mitigation\n\n- Upgrade the mcp gem to 0.23.0 or higher.\n- Configure application firewalls to drop payload sizes over a safe limit (e.g. 4MB).\n- Configure limits programmatically when initializing HTTP and Stdio transports.\n\n**Remediation Steps:**\n1. In Gemfile, replace existing gem declaration with: gem 'mcp', '>= 0.23.0'\n2. Run 'bundle update mcp' to apply the patch.\n3. Validate application starts successfully and transport initializations are supplied with explicit size configurations if custom thresholds are needed.\n\n## References\n\n- [GitHub Advisory GHSA-h669-8m4g-r2hc](https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-h669-8m4g-r2hc)\n- [Security Fix Commit](https://github.com/modelcontextprotocol/ruby-sdk/commit/772e0cb1f9db69312006926eee59a7287ad50166)\n- [v0.23.0 Release Notes](https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0)\n- [CVE Record on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-67432)\n- [NVD Vulnerability Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-67432)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67432) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T03:34:09.041044Z"}, {"uuid": "73b5608c-a2de-465e-9a16-cfba84519c11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67430", "type": "seen", "source": "https://gist.github.com/alon710/2fc91b89bbac8024e4e2b03ecca2ce62", "content": "# CVE-2026-67430: CVE-2026-67430: Denial of Service via Unbounded Session Retention in Model Context Protocol Ruby SDK\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67430\n\n## Summary\nCVE-2026-67430 is a medium-severity Denial of Service (DoS) vulnerability in the Model Context Protocol (MCP) Ruby SDK (packaged as the mcp gem) versions prior to 0.23.0. In stateful deployments using the StreamableHTTPTransport class, client session states are retained in an in-memory hash map. Because the transport implements a nil idle timeout by default, the background scavenger process is suppressed. Remote, unauthenticated attackers can flood the endpoint with initialize requests, rapidly consuming system memory and triggering an Out-of-Memory (OOM) crash.\n\n## TL;DR\nUnauthenticated remote attackers can crash stateful MCP Ruby SDK servers by repeatedly triggering new initialize requests. Because the SDK lacks default session limits and idle timeouts, every connection allocates a persistent context in RAM, leading to memory exhaustion and service crashes.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 5.3\n- **EPSS Score**: 0.00291\n- **EPSS Percentile**: 21.41%\n- **Impact**: Denial of Service (DoS) via memory exhaustion (OOM)\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Model Context Protocol Ruby SDK (mcp gem) running stateful transports\n- **mcp (Ruby SDK)**: >= 0.6.0, < 0.23.0 (Fixed in: `0.23.0`)\n\n## Mitigation\n\n- Upgrade the mcp gem to version 0.23.0 or later.\n- Configure tight session_idle_timeout and max_sessions values on StreamableHTTPTransport initialization.\n- Utilize stateless: true if stateful session management is not required.\n- Deploy a reverse proxy (e.g., Nginx, HAProxy) in front of the application to enforce request and connection rate-limiting.\n\n**Remediation Steps:**\n1. Update your Gemfile to reference mcp version 0.23.0 or later.\n2. Run bundle update mcp to retrieve and apply the security patch.\n3. Optionally, explicitly set session_idle_timeout and max_sessions parameters in your StreamableHTTPTransport.new initializer block.\n4. Restart the Ruby application server to apply the code changes.\n\n## References\n\n- [GHSA-52jp-gj8w-j6xh: Model Context Protocol Ruby SDK Unbounded Session Retention DoS](https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-52jp-gj8w-j6xh)\n- [Core Session Hardening Commit](https://github.com/modelcontextprotocol/ruby-sdk/commit/afb968c468c178c4d3294b423fcce250621692f4)\n- [Release Version 0.23.0 Tag](https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0)\n- [CVE-2026-67430 Record](https://www.cve.org/CVERecord?id=CVE-2026-67430)\n- [NVD Entry for CVE-2026-67430](https://nvd.nist.gov/vuln/detail/CVE-2026-67430)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67430) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T04:31:56.372398Z"}, {"uuid": "a5e5918c-b100-48a0-89aa-e4dfcacd70fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67438", "type": "seen", "source": "https://gist.github.com/alon710/006ebdb624799640fa8e05feb88f3b11", "content": "# CVE-2026-67438: CVE-2026-67438: OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check in OliveTin\n\n> **CVSS Score:** 6.6\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67438\n\n## Summary\nAn OS command injection vulnerability exists in OliveTin versions >= 3000.2.0 and < 3000.17.0. The flaw stems from a validation bypass in the shell safety engine, which fails to recognize custom regular expression arguments as unsafe for actions run in shell execution mode. Furthermore, because these custom regex checks evaluate partial string matches, attackers can append arbitrary shell metacharacters to valid inputs. This allows unauthenticated or low-privilege users who are authorized to run configured actions to inject shell commands and achieve arbitrary remote code execution on the host system.\n\n## TL;DR\nOliveTin versions before 3000.17.0 are vulnerable to OS command injection because the shell argument validator excludes 'regex:' argument types from its safety blocklist. Concurrently, unanchored regex validations allow attackers to bypass checks by placing a valid match at the beginning of their input followed by malicious shell commands.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-78 (OS Command Injection)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 6.6 (Medium)\n- **EPSS Score**: 0.00995\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- OliveTin (Server Deployments)\n- OliveTin Docker Containers\n- OliveTin Systemd Services\n- **OliveTin**: >= 3000.2.0, < 3000.17.0 (Fixed in: `3000.17.0`)\n\n## Mitigation\n\n- Upgrade OliveTin to version 3000.17.0 or later to apply the validation enforcement fixes.\n- Convert existing shell-mode actions to exec-mode actions inside config.yaml to eliminate the shell parsing vector.\n- Ensure all custom regular expressions are strictly bounded with start and end anchors (^ and $) if used in other validated contexts.\n\n**Remediation Steps:**\n1. Review the current OliveTin configuration files (config.yaml) for combinations of 'shell:' and 'type: regex:'.\n2. Replace 'shell:' keys with structured 'exec:' arrays to ensure arguments are handled through secure processes.\n3. Update Docker compose files, Helm charts, or system service binaries to pull OliveTin image/binary version 3000.17.0 or greater.\n4. Restart the OliveTin service and verify configuration logs to ensure no initialization errors occur during loading.\n\n## References\n\n- [GitHub Security Advisory GHSA-xc5w-4v5w-7x65](https://github.com/OliveTin/OliveTin/security/advisories/GHSA-xc5w-4v5w-7x65)\n- [OliveTin Fix Commit 995ff79736f2bccc364448a3ece84087b550b232](https://github.com/OliveTin/OliveTin/commit/995ff79736f2bccc364448a3ece84087b550b232)\n- [NVD CVE-2026-67438 Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-67438)\n- [CVE.org CVE-2026-67438 Record](https://www.cve.org/CVERecord?id=CVE-2026-67438)\n- [OliveTin Shell vs Exec Execution Reference](https://docs.olivetin.app/action_execution/shellvsexec.html)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67438) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T08:32:20.883397Z"}, {"uuid": "7202750f-8639-472b-adb2-545325765359", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67439", "type": "seen", "source": "https://gist.github.com/alon710/4da77a0fb37a106d6065c5dabb250f4c", "content": "# CVE-2026-67439: CVE-2026-67439: Incorrect Authorization Leading to Log Leak in OliveTin\n\n> **CVSS Score:** 4.3\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67439\n\n## Summary\nAn incorrect authorization vulnerability (CWE-863) exists in OliveTin prior to version 3000.17.0. The flaw allows authenticated users who are authorized to execute commands but restricted from viewing logs to bypass this restriction. By utilizing synchronous endpoints, attackers can directly access execution outputs containing sensitive system data, credentials, and environmental configurations.\n\n## TL;DR\nOliveTin failed to validate log-viewing permissions on synchronous execution endpoints, leaking sensitive shell outputs to restricted users.\n\n## Technical Details\n\n- **CWE ID**: CWE-863 (Incorrect Authorization)\n- **Attack Vector**: Network (AV:N)\n- **Privileges Required**: Low (PR:L)\n- **CVSS v3.1 Score**: 4.3 (Medium)\n- **EPSS Score**: 0.00252 (Percentile: 16.75%)\n- **Exploit Status**: None (No public PoC)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- OliveTin Core Server\n- **OliveTin**: >= 3000.7.0, < 3000.17.0 (Fixed in: `3000.17.0`)\n\n## Mitigation\n\n- Restrict 'exec' permissions to only fully trusted administrators.\n- Audit command outputs to verify no sensitive data is written to standard output or standard error.\n- Monitor application log endpoints for anomalous synchronous API calls.\n\n**Remediation Steps:**\n1. Upgrade the OliveTin installation to version 3000.17.0 or higher.\n2. Validate the configurations in /etc/OliveTin/config.yaml for data exposure.\n3. Restart the OliveTin service to apply configuration and binary upgrades.\n\n## References\n\n- [GitHub Security Advisory GHSA-jm28-2wcr-qf3h](https://github.com/OliveTin/OliveTin/security/advisories/GHSA-jm28-2wcr-qf3h)\n- [NVD CVE-2026-67439 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-67439)\n- [CVE.org CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-67439)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67439) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T09:31:22.270843Z"}, {"uuid": "6d46f657-479b-436e-a609-06f193140da1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67437", "type": "seen", "source": "https://gist.github.com/alon710/ebcd683ed5c708ce9306a8ed3912a91a", "content": "# CVE-2026-67437: CVE-2026-67437: Unauthenticated Denial of Service via OAuth2 State Memory Exhaustion in OliveTin\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67437\n\n## Summary\nAn uncontrolled resource consumption vulnerability (CWE-400) in OliveTin allows unauthenticated remote attackers to exhaust server memory and trigger a denial of service (DoS). By repeatedly initiating the OAuth2 login flow without completing it, attackers can force the server to allocate state variables in an unbounded in-memory map. This heap-based resource exhaustion eventually causes the host operating system to terminate the OliveTin process via the Out-Of-Memory (OOM) killer.\n\n## TL;DR\nUnauthenticated remote attackers can exhaust OliveTin server memory and crash the application by flooding the OAuth2 login endpoint, forcing unbounded allocation of state variables in memory.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network\n- **CVSS v3.1**: 7.5\n- **EPSS Score**: 0.00354\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: PoC (Proof-of-Concept)\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- OliveTin\n- **OliveTin**: >= 3000.0.0, < 3000.17.0 (Fixed in: `3000.17.0`)\n\n## Mitigation\n\n- Upgrade to OliveTin 3000.17.0 or later\n- Implement rate-limiting on the /oauth/login route via a reverse proxy (e.g., Nginx)\n- Restrict access to the OliveTin interface using firewall rules or VPNs\n\n**Remediation Steps:**\n1. Identify running versions of OliveTin using asset management or container manifests.\n2. Deploy the 3000.17.0 update across affected environments.\n3. Configure reverse proxies to limit HTTP requests to /oauth/login to prevent resource exhaustion or service unavailability.\n\n## References\n\n- [GHSA-xpxj-f2fm-rqch: OliveTin OAuth2 state memory exhaustion advisory](https://github.com/OliveTin/OliveTin/security/advisories/GHSA-xpxj-f2fm-rqch)\n- [NVD Entry for CVE-2026-67437](https://nvd.nist.gov/vuln/detail/CVE-2026-67437)\n- [CVE.org Record for CVE-2026-67437](https://www.cve.org/CVERecord?id=CVE-2026-67437)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67437) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T10:32:17.501159Z"}, {"uuid": "8474a057-a5af-4b66-81a9-19500c198d1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67434", "type": "seen", "source": "https://gist.github.com/FR-Flo/679ec53500707a38f146869163e2f9cc", "content": "## \ud83d\udd17 Companion release\n\nThis release ships alongside the **Marketplace-client (frontend)** release PR:\n\n- https://github.com/Wishibam/Marketplace-client/pull/4256\n\n- **Misc**\n    - *feat(shipping-method): expose the default return method flag on the API* [\\#7793](https://github.com/Wishibam/Marketplace-api/pull/7793)\n    - *:sparkles: feat: resync a single retailer in the live merchandising indices* [\\#7808](https://github.com/Wishibam/Marketplace-api/pull/7808)\n    - *:bug: fix: resync-retailer scroll rejected by ES8 (size param)* [\\#7820](https://github.com/Wishibam/Marketplace-api/pull/7820)\n    - *feat(mcp): add MCP server walking skeleton with list\\_organizations* [\\#7823](https://github.com/Wishibam/Marketplace-api/pull/7823)\n    - *refactor(mcp): extract logic from ImportAction, RetailerNormalizer and RankProduct* [\\#7824](https://github.com/Wishibam/Marketplace-api/pull/7824)\n    - *:sparkles: feat: compute product scoring on the fly (service + ES)* [\\#7825](https://github.com/Wishibam/Marketplace-api/pull/7825)\n    - *:sparkles: feat: raise the ES pagination window beyond 10k documents* [\\#7826](https://github.com/Wishibam/Marketplace-api/pull/7826)\n    - *feat(merchandising): supporter les tris du listing produit sur POST /merchandising* [\\#7827](https://github.com/Wishibam/Marketplace-api/pull/7827)\n    - *feat(merchandising): actions de masse asynchrones avec lock par organisation* [\\#7828](https://github.com/Wishibam/Marketplace-api/pull/7828)\n \n- **D\u00e9j\u00e0 en production**\n    - *:arrow\\_up: deps: bump php\\_codesniffer to 4.0.4 (CVE-2026-67434)* [\\#7817](https://github.com/Wishibam/Marketplace-api/pull/7817)\n    - *feat: allow max product variation at 380* [\\#7829](https://github.com/Wishibam/Marketplace-api/pull/7829)\n\n## POST MEP\n\n### [PR #7826](https://github.com/Wishibam/Marketplace-api/pull/7826) \u2014 :sparkles: feat: raise the ES pagination window beyond 10k documents\n\n```\n  curl -X PUT \"http://localhost:9200/prod_product_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":200000}}'\n  curl -X PUT \"http://localhost:9200/prod_variation_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":500000}}'\n\n  V\u00e9rifier :\n  curl \"http://localhost:9200/prod_product_*/_settings/index.max_result_window?flat_settings\"\n  curl \"http://localhost:9200/prod_variation_*/_settings/index.max_result_window?flat_settings\"\n```\n", "creation_timestamp": "2026-08-12T08:53:45.016646Z"}, {"uuid": "2bbfd47b-7632-4ea5-bb62-0ac3677de223", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67434", "type": "seen", "source": "https://gist.github.com/jbourdin/74d975e9ddef6fe876c3f76f05bacc25", "content": "- **Trello**\n    - [Helsinki : Portail de retour - Sylius - int\u00e9gration front du portail de retour](https://trello.com/c/mhcc7YaC/2401-helsinki-portail-de-retour-sylius-int%C3%A9gration-front-du-portail-de-retour) **TEMP - EPIC - Droit de r\u00e9tractation**\n        - *feat(helsinki): Add return portal to Helsinki order details* [\\#11757](https://github.com/Wishibam/Ecommerce-sylius/pull/11757)\n    - [\\[Migration\\]\\[A.2\\] D\u00e9mant\u00e8lement Setono Analytics + Tag-Bag](https://trello.com/c/uJN0Gkiz/3856-migrationa2-d%C3%A9mant%C3%A8lement-setono-analytics-tag-bag) **\ud83e\udd16 Testing tech**\n        - *:wrench: chore(migration): internalize setono analytics + tag-bag as src/Component \\[A.2\\]* [\\#11846](https://github.com/Wishibam/Ecommerce-sylius/pull/11846)\n    - [\\[Migration\\]\\[A.4.1\\] Internaliser bitbag/wishlist-plugin dans src/Component/Wishlist](https://trello.com/c/U9dQGx1l/3863-migrationa41-internaliser-bitbag-wishlist-plugin-dans-src-component-wishlist) **\ud83e\udd16 Testing tech**\n        - *:wrench: chore: internalize bitbag/wishlist-plugin \\[A.4.1\\]* [\\#11856](https://github.com/Wishibam/Ecommerce-sylius/pull/11856)\n    - [\\[Migration\\]\\[A.4.2/A.4.3\\] Internaliser bring & deep-link dans src/Component](https://trello.com/c/RsLN5SNT/3864-migrationa42-a43-internaliser-bring-deep-link-dans-src-component) **\ud83e\udd16 Testing tech**\n        - *:wrench: chore: internalize bring & deep-link plugins \\[A.4.2, A.4.3\\]* [\\#11861](https://github.com/Wishibam/Ecommerce-sylius/pull/11861)\n    - [\\[Migration\\]\\[A.5\\] Bumps frontend \u00ab safe \u00bb + suppression des packages morts](https://trello.com/c/vI6k61gt/3873-migrationa5-bumps-frontend-safe-suppression-des-packages-morts) **\ud83e\udd16 Testing tech**\n        - *:wrench: chore: bump safe frontend deps + prune dead packages \\[A.5\\]* [\\#11875](https://github.com/Wishibam/Ecommerce-sylius/pull/11875)\n    - [\\[Migration\\]\\[A.6\\] Pr\u00e9paration Doctrine pour DBAL 3 (monkey-patch migrations)](https://trello.com/c/8mdyVMwg/3880-migrationa6-pr%C3%A9paration-doctrine-pour-dbal-3-monkey-patch-migrations) **\ud83e\udd16 Testing tech**\n        - *:wrench: chore: replace Doctrine migration monkey-patch for DBAL 3 \\[A.6\\]* [\\#11893](https://github.com/Wishibam/Ecommerce-sylius/pull/11893)\n    - [TVO - Express checkout : adresse tronqu\u00e9e \u2014 nom de rue perdu (Apple Pay line1/line2)](https://trello.com/c/dIrl0I1a/3884-tvo-express-checkout-adresse-tronqu%C3%A9e-nom-de-rue-perdu-apple-pay-line1-line2) **\ud83e\udd13 Testing**\n        - *:bug: fix: join express checkout wallet address line1/line2 into street* [\\#11914](https://github.com/Wishibam/Ecommerce-sylius/pull/11914)\n    - [\\[P0\\] Express checkout : re-v\u00e9rifier le montant du PaymentIntent au complete](https://trello.com/c/qJdTR9Jc/3885-p0-express-checkout-re-v%C3%A9rifier-le-montant-du-paymentintent-au-complete) **\ud83d\udc8e In Review**\n        - *:bug: fix: verify express checkout PaymentIntent amount at completion* [\\#11916](https://github.com/Wishibam/Ecommerce-sylius/pull/11916)\n    - [\\[P0\\] Webhook Stripe : rembourser r\u00e9ellement les charges des commandes refus\u00e9es/annul\u00e9es](https://trello.com/c/fyJeMD3L/3886-p0-webhook-stripe-rembourser-r%C3%A9ellement-les-charges-des-commandes-refus%C3%A9es-annul%C3%A9es) **\ud83d\udc8e In Review**\n        - *:bug: fix: refund Stripe charges captured for refused or cancelled orders* [\\#11918](https://github.com/Wishibam/Ecommerce-sylius/pull/11918)\n    - [\\[P1\\] Express checkout : pinner explicitement les wallets autoris\u00e9s (quick win)](https://trello.com/c/tEpmPM9l/3890-p1-express-checkout-pinner-explicitement-les-wallets-autoris%C3%A9s-quick-win) **\ud83e\udd13 Testing**\n        - *:bug: fix: restrict express checkout wallets to an explicit allowlist* [\\#11919](https://github.com/Wishibam/Ecommerce-sylius/pull/11919)\n    - [\\[P0\\] Express checkout : commandes \u00e0 fonds captur\u00e9s supprim\u00e9es par la purge des carts + cha\u00eene d'abort morte](https://trello.com/c/1Wo7zGP5/3887-p0-express-checkout-commandes-%C3%A0-fonds-captur%C3%A9s-supprim%C3%A9es-par-la-purge-des-carts-cha%C3%AEne-dabort-morte) **\ud83d\udc8e In Review**\n        - *:bug: fix: protect express checkout captured-funds carts from the purge* [\\#11920](https://github.com/Wishibam/Ecommerce-sylius/pull/11920)\n    - [\ud83d\udc1b Fix r\u00e9indexation ES bloqu\u00e9e \u2014 \u00ab immense term \u00bb sur attribut trop long (Intersport)](https://trello.com/c/iD6idW0v/3915-%F0%9F%90%9B-fix-r%C3%A9indexation-es-bloqu%C3%A9e-immense-term-sur-attribut-trop-long-intersport) **\ud83e\udd16 Testing tech**\n        - *:bug: fix: r\u00e9indexation ES bloqu\u00e9e par un attribut trop long (immense term)* [\\#11972](https://github.com/Wishibam/Ecommerce-sylius/pull/11972)\n    - [\u26a0\ufe0faction preprod/prod \u26a0\ufe0f \u203c\ufe0f Nouveau Feeds - Faire tourner tous les nouveaux feeds sur toutes les preprods/prods](https://trello.com/c/Kr8UhDAv/3910-%E2%9A%A0%EF%B8%8Faction-preprod-prod-%E2%9A%A0%EF%B8%8F-%EF%B8%8F-nouveau-feeds-faire-tourner-tous-les-nouveaux-feeds-sur-toutes-les-preprods-prods) **\ud83e\udee1 To Do JC**\n        - *:sparkles: feat: drive-to-store feeds parity with legacy Setono* [\\#11979](https://github.com/Wishibam/Ecommerce-sylius/pull/11979)\n    - [Helsinki \u2014 Funnel checkout GA4 vide : \u00e9v\u00e9nements e-commerce manquants/incomplets](https://trello.com/c/j0yQGSFm/3921-helsinki-funnel-checkout-ga4-vide-%C3%A9v%C3%A9nements-e-commerce-manquants-incomplets) **\ud83c\udf44 Ready for testing**\n        - *:bug: fix: \u00e9mettre le funnel checkout GA4 complet* [\\#11980](https://github.com/Wishibam/Ecommerce-sylius/pull/11980)\n        - *:bug: fix: \u00e9mettre add\\_payment\\_info quand l'\u00e9tape de paiement est saut\u00e9e* [\\#12014](https://github.com/Wishibam/Ecommerce-sylius/pull/12014)\n    - [Min-height pages React](https://trello.com/c/Rti8eFXb/3919-min-height-pages-react) **\ud83e\udd13 Testing**\n        - *:bug: fix: add min-height on React pages to prevent footer flash* [\\#11987](https://github.com/Wishibam/Ecommerce-sylius/pull/11987)\n    - [\u26a0\ufe0f action preprod/prod \u26a0\ufe0f \ud83d\uded2 Refonte Checkout #1 \u2014 La page Panier change de garde-robe](https://trello.com/c/qxdtlZxk/3851-%E2%9A%A0%EF%B8%8F-action-preprod-prod-%E2%9A%A0%EF%B8%8F-%F0%9F%9B%92-refonte-checkout-1-la-page-panier-change-de-garde-robe) **\ud83c\udf89 A MEP**\n        - *:bug: fix(tvo): cart page QA feedback round* [\\#11990](https://github.com/Wishibam/Ecommerce-sylius/pull/11990)\n    - [Fix : TypeError trim() null sur les share descriptions de channel (admin)](https://trello.com/c/o47Ek1Fo/3924-fix-typeerror-trim-null-sur-les-share-descriptions-de-channel-admin) **\ud83e\udd16 Testing tech**\n        - *:bug: fix: guard against null share descriptions in channel setter* [\\#11992](https://github.com/Wishibam/Ecommerce-sylius/pull/11992)\n    - [\u26a0\ufe0faction preprod/prod \u26a0\ufe0f \ud83d\udce6\ud83c\udf0d Mondial Relay sans fronti\u00e8res \u2014 points relais UE (v1 TVO)](https://trello.com/c/4X0QYlQ5/3918-%E2%9A%A0%EF%B8%8Faction-preprod-prod-%E2%9A%A0%EF%B8%8F-%F0%9F%93%A6%F0%9F%8C%8D-mondial-relay-sans-fronti%C3%A8res-points-relais-ue-v1-tvo) **\ud83d\udc8e In Review**\n        - *:sparkles: feat(mondial-relay): relay search follows the buyer's country* [\\#11994](https://github.com/Wishibam/Ecommerce-sylius/pull/11994)\n    - [\ud83d\udccd Refonte Checkout \u2014 La suggestion d'adresse qui fait mouche](https://trello.com/c/vF0T1FZU/3860-%F0%9F%93%8D-refonte-checkout-la-suggestion-dadresse-qui-fait-mouche) **\ud83d\ude80 To Do Vincent**\n        - *:bug: fix(tvo): address suggestion QA feedback round* [\\#11995](https://github.com/Wishibam/Ecommerce-sylius/pull/11995)\n    - [\ud83c\udf5e Refonte Checkout \u2014 Des toasts tout chauds pour les messages syst\u00e8me](https://trello.com/c/N70pstGO/3861-%F0%9F%8D%9E-refonte-checkout-des-toasts-tout-chauds-pour-les-messages-syst%C3%A8me) **\ud83c\udf89 A MEP**\n        - *:bug: fix(tvo): checkout toasts QA feedback round* [\\#11996](https://github.com/Wishibam/Ecommerce-sylius/pull/11996)\n    - [TVO- mail order\\_open\\_return\\_withdrawn -remplacement de tag](https://trello.com/c/NK5CnCM2/3883-tvo-mail-orderopenreturnwithdrawn-remplacement-de-tag) **\ud83c\udf89 A MEP**\n        - *\ud83d\udc1b fix: orange \"return in progress\" badge on TVO withdrawal email* [\\#12000](https://github.com/Wishibam/Ecommerce-sylius/pull/12000)\n    - [\u26a0\ufe0f action prod \u26a0\ufe0f \ud83d\ude9a Refonte Checkout #3 \u2014 Le Mode de livraison prend la route](https://trello.com/c/NDSNOimu/3854-%E2%9A%A0%EF%B8%8F-action-prod-%E2%9A%A0%EF%B8%8F-%F0%9F%9A%9A-refonte-checkout-3-le-mode-de-livraison-prend-la-route) **\ud83e\udd13 Testing**\n        - *:sparkles: feat(tvo): React checkout select shipping step (P3)* [\\#12011](https://github.com/Wishibam/Ecommerce-sylius/pull/12011)\n    - [Helsinki - Correction bug d'affichage en finnois en version mobile](https://trello.com/c/f9V6mA6z/3686-helsinki-correction-bug-daffichage-en-finnois-en-version-mobile) **\ud83e\udd13 Testing**\n        - *:bug: fix: reduce Helsinki posts carousel title on mobile* [\\#12017](https://github.com/Wishibam/Ecommerce-sylius/pull/12017)\n \n- **Misc**\n    - *:sparkles: feat: PushDispatcher + adaptateur FCM (push app TVO)* [\\#11917](https://github.com/Wishibam/Ecommerce-sylius/pull/11917)\n    - *style(withdrawal): make the withdrawal button theme-colored and not f\u2026* [\\#11951](https://github.com/Wishibam/Ecommerce-sylius/pull/11951)\n    - *:zap: perf: Batavia PLP \u2014 ES result cache, key batching, menu cache* [\\#11963](https://github.com/Wishibam/Ecommerce-sylius/pull/11963)\n    - *:wrench: chore: outillage pour worktrees parall\u00e8les (front isol\u00e9 par projet)* [\\#11986](https://github.com/Wishibam/Ecommerce-sylius/pull/11986)\n    - *:wrench: chore: bump php\\_codesniffer en 3.13.6 (CVE-2026-67434, CI rouge)* [\\#12008](https://github.com/Wishibam/Ecommerce-sylius/pull/12008)\n    - *:sparkles: feat: push app TVO \u2014 envoi asynchrone + badge (3.A.5 + 3.A.6)* [\\#12022](https://github.com/Wishibam/Ecommerce-sylius/pull/12022)\n    - *:sparkles: feat: badge unreadPushCount de bout en bout (app TVO)* [\\#12025](https://github.com/Wishibam/Ecommerce-sylius/pull/12025)\n    - *:sparkles: feat: compteur badge dans data des push (app TVO)* [\\#12028](https://github.com/Wishibam/Ecommerce-sylius/pull/12028)\n \n- **D\u00e9j\u00e0 en production**\n    - [TVO - Les recommandations produits ne remontent aucun produit sur la fiche produit](https://trello.com/c/lw3SYgNG/3926-tvo-les-recommandations-produits-ne-remontent-aucun-produit-sur-la-fiche-produit) **MEP Ao\u00fbt**\n        - *:bug: fix(search): match the indexed color value in recommendations* [\\#12004](https://github.com/Wishibam/Ecommerce-sylius/pull/12004)\n    - *:bug: fix: render flag emojis as SVG icons, not OS emoji glyphs* [\\#11981](https://github.com/Wishibam/Ecommerce-sylius/pull/11981)\n    - *:bug: fix: apply the flag icon filter to the remaining menu renderings* [\\#11982](https://github.com/Wishibam/Ecommerce-sylius/pull/11982)", "creation_timestamp": "2026-08-12T15:47:31.180589Z"}, {"uuid": "dbbc02de-a2da-44e5-8c76-89667b2a9bbb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67434", "type": "seen", "source": "https://gist.github.com/FR-Flo/cc9f766d0a2a4c8f1efc2b89a9f8b2eb", "content": "## \ud83d\udd17 Companion release\n\nThis release ships alongside the **Marketplace-client (frontend)** release PR:\n\n- https://github.com/Wishibam/Marketplace-client/pull/4256\n\n- **Misc**\n    - *feat(shipping-method): expose the default return method flag on the API* [\\#7793](https://github.com/Wishibam/Marketplace-api/pull/7793)\n    - *:sparkles: feat: resync a single retailer in the live merchandising indices* [\\#7808](https://github.com/Wishibam/Marketplace-api/pull/7808)\n    - *:arrow\\_up: deps: bump php\\_codesniffer to 4.0.4 (CVE-2026-67434)* [\\#7817](https://github.com/Wishibam/Marketplace-api/pull/7817)\n    - *:bug: fix: resync-retailer scroll rejected by ES8 (size param)* [\\#7820](https://github.com/Wishibam/Marketplace-api/pull/7820)\n    - *:sparkles: feat: compute product scoring on the fly (service + ES)* [\\#7825](https://github.com/Wishibam/Marketplace-api/pull/7825)", "creation_timestamp": "2026-08-10T13:47:12.041312Z"}, {"uuid": "957c3300-8dd2-472b-8281-84955b31aab3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67434", "type": "seen", "source": "https://gist.github.com/FR-Flo/89fedcf20bcdcfa83762b99068ffac75", "content": "## \ud83d\udd17 Companion release\n\nThis release ships alongside the **Marketplace-client (frontend)** release PR:\n\n- https://github.com/Wishibam/Marketplace-client/pull/4256\n\n- **Trello**\n    - [MP - Cr\u00e9ation / modification m\u00e9thode de livraison - impossible de save](https://trello.com/c/Ud1DRxgj/2407-mp-cr%C3%A9ation-modification-m%C3%A9thode-de-livraison-impossible-de-save) **\ud83e\udd73Testing**\n        - *:bug: MP Fix Dpd class, file and discriminator name* [\\#7757](https://github.com/Wishibam/Marketplace-api/pull/7757)\n \n- **Misc**\n    - *feat(shipping-method): expose the default return method flag on the API* [\\#7793](https://github.com/Wishibam/Marketplace-api/pull/7793)\n    - *:sparkles: feat: resync a single retailer in the live merchandising indices* [\\#7808](https://github.com/Wishibam/Marketplace-api/pull/7808)\n    - *:bug: fix: resync-retailer scroll rejected by ES8 (size param)* [\\#7820](https://github.com/Wishibam/Marketplace-api/pull/7820)\n    - *feat(mcp): add MCP server walking skeleton with list\\_organizations* [\\#7823](https://github.com/Wishibam/Marketplace-api/pull/7823)\n    - *refactor(mcp): extract logic from ImportAction, RetailerNormalizer and RankProduct* [\\#7824](https://github.com/Wishibam/Marketplace-api/pull/7824)\n    - *:sparkles: feat: compute product scoring on the fly (service + ES)* [\\#7825](https://github.com/Wishibam/Marketplace-api/pull/7825)\n    - *:sparkles: feat: raise the ES pagination window beyond 10k documents* [\\#7826](https://github.com/Wishibam/Marketplace-api/pull/7826)\n    - *feat(merchandising): supporter les tris du listing produit sur POST /merchandising* [\\#7827](https://github.com/Wishibam/Marketplace-api/pull/7827)\n    - *feat(merchandising): actions de masse asynchrones avec lock par organisation* [\\#7828](https://github.com/Wishibam/Marketplace-api/pull/7828)\n    - *feat(product-list): pipeline batch pour les actions de masse des listes produits* [\\#7833](https://github.com/Wishibam/Marketplace-api/pull/7833)\n \n- **D\u00e9j\u00e0 en production**\n    - *:arrow\\_up: deps: bump php\\_codesniffer to 4.0.4 (CVE-2026-67434)* [\\#7817](https://github.com/Wishibam/Marketplace-api/pull/7817)\n    - *feat: allow max product variation at 380* [\\#7829](https://github.com/Wishibam/Marketplace-api/pull/7829)\n\n## POST MEP\n\n### [PR #7826](https://github.com/Wishibam/Marketplace-api/pull/7826) \u2014 :sparkles: feat: raise the ES pagination window beyond 10k documents\n\n```\n  curl -X PUT \"http://localhost:9200/prod_product_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":200000}}'\n  curl -X PUT \"http://localhost:9200/prod_variation_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":500000}}'\n\n  V\u00e9rifier :\n  curl \"http://localhost:9200/prod_product_*/_settings/index.max_result_window?flat_settings\"\n  curl \"http://localhost:9200/prod_variation_*/_settings/index.max_result_window?flat_settings\"\n```\n\n### [PR #7828](https://github.com/Wishibam/Marketplace-api/pull/7828) \u2014 feat(merchandising): actions de masse asynchrones avec lock par organisation\n\n - ansible en prod \u00e7a https://github.com/Wishibam/Infrastructure/pull/467\n", "creation_timestamp": "2026-08-13T08:48:17.856018Z"}, {"uuid": "3b9d311b-1849-42c6-bf72-2e5a90c93bc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67434", "type": "seen", "source": "https://gist.github.com/FR-Flo/a87a156132d4ce3d4d952e21a796220a", "content": "## \ud83d\udd17 Companion release\n\nNo open **Marketplace-client (frontend)** release PR found yet \u2014 it will be linked automatically once it exists.\n\n- https://github.com/Wishibam/Marketplace-client/pulls?q=is%3Apr+is%3Aopen+base%3Amaster+head%3Adevelop\n\n- **Misc**\n    - *:arrow\\_up: deps: bump php\\_codesniffer to 4.0.4 (CVE-2026-67434)* [\\#7817](https://github.com/Wishibam/Marketplace-api/pull/7817)", "creation_timestamp": "2026-08-06T14:00:28.557002Z"}, {"uuid": "dcf5ec43-cd89-48fd-8652-f370ff704b88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67434", "type": "seen", "source": "https://gist.github.com/FR-Flo/ce0e6938e2c8aa7a093b16e80373dccf", "content": "## \ud83d\udd17 Companion release\n\nNo open **Marketplace-client (frontend)** release PR found yet \u2014 it will be linked automatically once it exists.\n\n- https://github.com/Wishibam/Marketplace-client/pulls?q=is%3Apr+is%3Aopen+base%3Amaster+head%3Adevelop\n\n- **Misc**\n    - *:sparkles: feat: resync a single retailer in the live merchandising indices* [\\#7808](https://github.com/Wishibam/Marketplace-api/pull/7808)\n    - *:arrow\\_up: deps: bump php\\_codesniffer to 4.0.4 (CVE-2026-67434)* [\\#7817](https://github.com/Wishibam/Marketplace-api/pull/7817)\n    - *:bug: fix: resync-retailer scroll rejected by ES8 (size param)* [\\#7820](https://github.com/Wishibam/Marketplace-api/pull/7820)", "creation_timestamp": "2026-08-06T14:59:38.220856Z"}, {"uuid": "b46ae999-bd92-40f0-b7d6-0fa476cc3dac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67434", "type": "seen", "source": "https://gist.github.com/FR-Flo/bd6228fc53c3a1b0e8523cf329f96538", "content": "## \ud83d\udd17 Companion release\n\nThis release ships alongside the **Marketplace-client (frontend)** release PR:\n\n- https://github.com/Wishibam/Marketplace-client/pull/4256\n\n- **Misc**\n    - *feat(shipping-method): expose the default return method flag on the API* [\\#7793](https://github.com/Wishibam/Marketplace-api/pull/7793)\n    - *:sparkles: feat: resync a single retailer in the live merchandising indices* [\\#7808](https://github.com/Wishibam/Marketplace-api/pull/7808)\n    - *:arrow\\_up: deps: bump php\\_codesniffer to 4.0.4 (CVE-2026-67434)* [\\#7817](https://github.com/Wishibam/Marketplace-api/pull/7817)\n    - *:bug: fix: resync-retailer scroll rejected by ES8 (size param)* [\\#7820](https://github.com/Wishibam/Marketplace-api/pull/7820)\n    - *:sparkles: feat: compute product scoring on the fly (service + ES)* [\\#7825](https://github.com/Wishibam/Marketplace-api/pull/7825)\n    - *:sparkles: feat: raise the ES pagination window beyond 10k documents* [\\#7826](https://github.com/Wishibam/Marketplace-api/pull/7826)\n    - *feat(merchandising): supporter les tris du listing produit sur POST /merchandising* [\\#7827](https://github.com/Wishibam/Marketplace-api/pull/7827)\n\n## POST MEP\n\n### [PR #7826](https://github.com/Wishibam/Marketplace-api/pull/7826) \u2014 :sparkles: feat: raise the ES pagination window beyond 10k documents\n\n```\n  curl -X PUT \"http://localhost:9200/prod_product_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":200000}}'\n  curl -X PUT \"http://localhost:9200/prod_variation_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":500000}}'\n\n  V\u00e9rifier :\n  curl \"http://localhost:9200/prod_product_*/_settings/index.max_result_window?flat_settings\"\n  curl \"http://localhost:9200/prod_variation_*/_settings/index.max_result_window?flat_settings\"\n```\n", "creation_timestamp": "2026-08-11T07:30:17.901402Z"}, {"uuid": "a90ac36c-1405-44a1-a2c7-87150df85222", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67434", "type": "seen", "source": "https://gist.github.com/jbourdin/1d6a0f235ef31e0e7ba082c24789d628", "content": "- **Trello**\n    - [Helsinki : Portail de retour - Sylius - int\u00e9gration front du portail de retour](https://trello.com/c/mhcc7YaC/2401-helsinki-portail-de-retour-sylius-int%C3%A9gration-front-du-portail-de-retour) **TEMP - EPIC - Droit de r\u00e9tractation**\n        - *feat(helsinki): Add return portal to Helsinki order details* [\\#11757](https://github.com/Wishibam/Ecommerce-sylius/pull/11757)\n    - [\\[Migration\\]\\[A.2\\] D\u00e9mant\u00e8lement Setono Analytics + Tag-Bag](https://trello.com/c/uJN0Gkiz/3856-migrationa2-d%C3%A9mant%C3%A8lement-setono-analytics-tag-bag) **\ud83e\udd16 Testing tech**\n        - *:wrench: chore(migration): internalize setono analytics + tag-bag as src/Component \\[A.2\\]* [\\#11846](https://github.com/Wishibam/Ecommerce-sylius/pull/11846)\n    - [\\[Migration\\]\\[A.4.1\\] Internaliser bitbag/wishlist-plugin dans src/Component/Wishlist](https://trello.com/c/U9dQGx1l/3863-migrationa41-internaliser-bitbag-wishlist-plugin-dans-src-component-wishlist) **\ud83e\udd16 Testing tech**\n        - *:wrench: chore: internalize bitbag/wishlist-plugin \\[A.4.1\\]* [\\#11856](https://github.com/Wishibam/Ecommerce-sylius/pull/11856)\n    - [\\[Migration\\]\\[A.4.2/A.4.3\\] Internaliser bring & deep-link dans src/Component](https://trello.com/c/RsLN5SNT/3864-migrationa42-a43-internaliser-bring-deep-link-dans-src-component) **\ud83e\udd16 Testing tech**\n        - *:wrench: chore: internalize bring & deep-link plugins \\[A.4.2, A.4.3\\]* [\\#11861](https://github.com/Wishibam/Ecommerce-sylius/pull/11861)\n    - [\\[Migration\\]\\[A.5\\] Bumps frontend \u00ab safe \u00bb + suppression des packages morts](https://trello.com/c/vI6k61gt/3873-migrationa5-bumps-frontend-safe-suppression-des-packages-morts) **\ud83e\udd16 Testing tech**\n        - *:wrench: chore: bump safe frontend deps + prune dead packages \\[A.5\\]* [\\#11875](https://github.com/Wishibam/Ecommerce-sylius/pull/11875)\n    - [\\[Migration\\]\\[A.6\\] Pr\u00e9paration Doctrine pour DBAL 3 (monkey-patch migrations)](https://trello.com/c/8mdyVMwg/3880-migrationa6-pr%C3%A9paration-doctrine-pour-dbal-3-monkey-patch-migrations) **\ud83e\udd16 Testing tech**\n        - *:wrench: chore: replace Doctrine migration monkey-patch for DBAL 3 \\[A.6\\]* [\\#11893](https://github.com/Wishibam/Ecommerce-sylius/pull/11893)\n    - [TVO - Express checkout : adresse tronqu\u00e9e \u2014 nom de rue perdu (Apple Pay line1/line2)](https://trello.com/c/dIrl0I1a/3884-tvo-express-checkout-adresse-tronqu%C3%A9e-nom-de-rue-perdu-apple-pay-line1-line2) **\ud83e\udd13 Testing**\n        - *:bug: fix: join express checkout wallet address line1/line2 into street* [\\#11914](https://github.com/Wishibam/Ecommerce-sylius/pull/11914)\n    - [\\[P0\\] Express checkout : re-v\u00e9rifier le montant du PaymentIntent au complete](https://trello.com/c/qJdTR9Jc/3885-p0-express-checkout-re-v%C3%A9rifier-le-montant-du-paymentintent-au-complete) **\ud83d\udc8e In Review**\n        - *:bug: fix: verify express checkout PaymentIntent amount at completion* [\\#11916](https://github.com/Wishibam/Ecommerce-sylius/pull/11916)\n    - [\\[P0\\] Webhook Stripe : rembourser r\u00e9ellement les charges des commandes refus\u00e9es/annul\u00e9es](https://trello.com/c/fyJeMD3L/3886-p0-webhook-stripe-rembourser-r%C3%A9ellement-les-charges-des-commandes-refus%C3%A9es-annul%C3%A9es) **\ud83d\udc8e In Review**\n        - *:bug: fix: refund Stripe charges captured for refused or cancelled orders* [\\#11918](https://github.com/Wishibam/Ecommerce-sylius/pull/11918)\n    - [\\[P1\\] Express checkout : pinner explicitement les wallets autoris\u00e9s (quick win)](https://trello.com/c/tEpmPM9l/3890-p1-express-checkout-pinner-explicitement-les-wallets-autoris%C3%A9s-quick-win) **\ud83e\udd13 Testing**\n        - *:bug: fix: restrict express checkout wallets to an explicit allowlist* [\\#11919](https://github.com/Wishibam/Ecommerce-sylius/pull/11919)\n    - [\\[P0\\] Express checkout : commandes \u00e0 fonds captur\u00e9s supprim\u00e9es par la purge des carts + cha\u00eene d'abort morte](https://trello.com/c/1Wo7zGP5/3887-p0-express-checkout-commandes-%C3%A0-fonds-captur%C3%A9s-supprim%C3%A9es-par-la-purge-des-carts-cha%C3%AEne-dabort-morte) **\ud83d\udc8e In Review**\n        - *:bug: fix: protect express checkout captured-funds carts from the purge* [\\#11920](https://github.com/Wishibam/Ecommerce-sylius/pull/11920)\n    - [\ud83d\udc1b Fix r\u00e9indexation ES bloqu\u00e9e \u2014 \u00ab immense term \u00bb sur attribut trop long (Intersport)](https://trello.com/c/iD6idW0v/3915-%F0%9F%90%9B-fix-r%C3%A9indexation-es-bloqu%C3%A9e-immense-term-sur-attribut-trop-long-intersport) **\ud83e\udd16 Testing tech**\n        - *:bug: fix: r\u00e9indexation ES bloqu\u00e9e par un attribut trop long (immense term)* [\\#11972](https://github.com/Wishibam/Ecommerce-sylius/pull/11972)\n    - [\u26a0\ufe0faction preprod/prod \u26a0\ufe0f \u203c\ufe0f Nouveau Feeds - Faire tourner tous les nouveaux feeds sur toutes les preprods/prods](https://trello.com/c/Kr8UhDAv/3910-%E2%9A%A0%EF%B8%8Faction-preprod-prod-%E2%9A%A0%EF%B8%8F-%EF%B8%8F-nouveau-feeds-faire-tourner-tous-les-nouveaux-feeds-sur-toutes-les-preprods-prods) **\ud83e\udee1 To Do JC**\n        - *:sparkles: feat: drive-to-store feeds parity with legacy Setono* [\\#11979](https://github.com/Wishibam/Ecommerce-sylius/pull/11979)\n    - [Helsinki \u2014 Funnel checkout GA4 vide : \u00e9v\u00e9nements e-commerce manquants/incomplets](https://trello.com/c/j0yQGSFm/3921-helsinki-funnel-checkout-ga4-vide-%C3%A9v%C3%A9nements-e-commerce-manquants-incomplets) **\ud83c\udf44 Ready for testing**\n        - *:bug: fix: \u00e9mettre le funnel checkout GA4 complet* [\\#11980](https://github.com/Wishibam/Ecommerce-sylius/pull/11980)\n        - *:bug: fix: \u00e9mettre add\\_payment\\_info quand l'\u00e9tape de paiement est saut\u00e9e* [\\#12014](https://github.com/Wishibam/Ecommerce-sylius/pull/12014)\n    - [Min-height pages React](https://trello.com/c/Rti8eFXb/3919-min-height-pages-react) **\ud83e\udd13 Testing**\n        - *:bug: fix: add min-height on React pages to prevent footer flash* [\\#11987](https://github.com/Wishibam/Ecommerce-sylius/pull/11987)\n    - [\u26a0\ufe0f action preprod/prod \u26a0\ufe0f \ud83d\uded2 Refonte Checkout #1 \u2014 La page Panier change de garde-robe](https://trello.com/c/qxdtlZxk/3851-%E2%9A%A0%EF%B8%8F-action-preprod-prod-%E2%9A%A0%EF%B8%8F-%F0%9F%9B%92-refonte-checkout-1-la-page-panier-change-de-garde-robe) **\ud83c\udf89 A MEP**\n        - *:bug: fix(tvo): cart page QA feedback round* [\\#11990](https://github.com/Wishibam/Ecommerce-sylius/pull/11990)\n    - [Fix : TypeError trim() null sur les share descriptions de channel (admin)](https://trello.com/c/o47Ek1Fo/3924-fix-typeerror-trim-null-sur-les-share-descriptions-de-channel-admin) **\ud83e\udd16 Testing tech**\n        - *:bug: fix: guard against null share descriptions in channel setter* [\\#11992](https://github.com/Wishibam/Ecommerce-sylius/pull/11992)\n    - [\u26a0\ufe0faction preprod/prod \u26a0\ufe0f \ud83d\udce6\ud83c\udf0d Mondial Relay sans fronti\u00e8res \u2014 points relais UE (v1 TVO)](https://trello.com/c/4X0QYlQ5/3918-%E2%9A%A0%EF%B8%8Faction-preprod-prod-%E2%9A%A0%EF%B8%8F-%F0%9F%93%A6%F0%9F%8C%8D-mondial-relay-sans-fronti%C3%A8res-points-relais-ue-v1-tvo) **\ud83d\udc8e In Review**\n        - *:sparkles: feat(mondial-relay): relay search follows the buyer's country* [\\#11994](https://github.com/Wishibam/Ecommerce-sylius/pull/11994)\n    - [\ud83d\udccd Refonte Checkout \u2014 La suggestion d'adresse qui fait mouche](https://trello.com/c/vF0T1FZU/3860-%F0%9F%93%8D-refonte-checkout-la-suggestion-dadresse-qui-fait-mouche) **\ud83d\ude80 To Do Vincent**\n        - *:bug: fix(tvo): address suggestion QA feedback round* [\\#11995](https://github.com/Wishibam/Ecommerce-sylius/pull/11995)\n    - [\ud83c\udf5e Refonte Checkout \u2014 Des toasts tout chauds pour les messages syst\u00e8me](https://trello.com/c/N70pstGO/3861-%F0%9F%8D%9E-refonte-checkout-des-toasts-tout-chauds-pour-les-messages-syst%C3%A8me) **\ud83c\udf89 A MEP**\n        - *:bug: fix(tvo): checkout toasts QA feedback round* [\\#11996](https://github.com/Wishibam/Ecommerce-sylius/pull/11996)\n    - [TVO- mail order\\_open\\_return\\_withdrawn -remplacement de tag](https://trello.com/c/NK5CnCM2/3883-tvo-mail-orderopenreturnwithdrawn-remplacement-de-tag) **\ud83c\udf89 A MEP**\n        - *\ud83d\udc1b fix: orange \"return in progress\" badge on TVO withdrawal email* [\\#12000](https://github.com/Wishibam/Ecommerce-sylius/pull/12000)\n    - [\u26a0\ufe0f action prod \u26a0\ufe0f \ud83d\ude9a Refonte Checkout #3 \u2014 Le Mode de livraison prend la route](https://trello.com/c/NDSNOimu/3854-%E2%9A%A0%EF%B8%8F-action-prod-%E2%9A%A0%EF%B8%8F-%F0%9F%9A%9A-refonte-checkout-3-le-mode-de-livraison-prend-la-route) **\ud83e\udd13 Testing**\n        - *:sparkles: feat(tvo): React checkout select shipping step (P3)* [\\#12011](https://github.com/Wishibam/Ecommerce-sylius/pull/12011)\n    - [Helsinki - Correction bug d'affichage en finnois en version mobile](https://trello.com/c/f9V6mA6z/3686-helsinki-correction-bug-daffichage-en-finnois-en-version-mobile) **\ud83c\udf44 Ready for testing**\n        - *:bug: fix: reduce Helsinki posts carousel title on mobile* [\\#12017](https://github.com/Wishibam/Ecommerce-sylius/pull/12017)\n \n- **Misc**\n    - *:sparkles: feat: PushDispatcher + adaptateur FCM (push app TVO)* [\\#11917](https://github.com/Wishibam/Ecommerce-sylius/pull/11917)\n    - *style(withdrawal): make the withdrawal button theme-colored and not f\u2026* [\\#11951](https://github.com/Wishibam/Ecommerce-sylius/pull/11951)\n    - *:zap: perf: Batavia PLP \u2014 ES result cache, key batching, menu cache* [\\#11963](https://github.com/Wishibam/Ecommerce-sylius/pull/11963)\n    - *:wrench: chore: outillage pour worktrees parall\u00e8les (front isol\u00e9 par projet)* [\\#11986](https://github.com/Wishibam/Ecommerce-sylius/pull/11986)\n    - *:wrench: chore: bump php\\_codesniffer en 3.13.6 (CVE-2026-67434, CI rouge)* [\\#12008](https://github.com/Wishibam/Ecommerce-sylius/pull/12008)\n \n- **D\u00e9j\u00e0 en production**\n    - [TVO - Les recommandations produits ne remontent aucun produit sur la fiche produit](https://trello.com/c/lw3SYgNG/3926-tvo-les-recommandations-produits-ne-remontent-aucun-produit-sur-la-fiche-produit) **MEP Ao\u00fbt**\n        - *:bug: fix(search): match the indexed color value in recommendations* [\\#12004](https://github.com/Wishibam/Ecommerce-sylius/pull/12004)\n    - *:bug: fix: render flag emojis as SVG icons, not OS emoji glyphs* [\\#11981](https://github.com/Wishibam/Ecommerce-sylius/pull/11981)\n    - *:bug: fix: apply the flag icon filter to the remaining menu renderings* [\\#11982](https://github.com/Wishibam/Ecommerce-sylius/pull/11982)", "creation_timestamp": "2026-08-11T07:59:05.295219Z"}, {"uuid": "5f1ea874-83c3-4280-a387-98bb3206b263", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67434", "type": "seen", "source": "https://gist.github.com/FR-Flo/3ac9b6ced79fe8b0cb1ffae9959c6826", "content": "## \ud83d\udd17 Companion release\n\nThis release ships alongside the **Marketplace-client (frontend)** release PR:\n\n- https://github.com/Wishibam/Marketplace-client/pull/4256\n\n- **Misc**\n    - *feat(shipping-method): expose the default return method flag on the API* [\\#7793](https://github.com/Wishibam/Marketplace-api/pull/7793)\n    - *:sparkles: feat: resync a single retailer in the live merchandising indices* [\\#7808](https://github.com/Wishibam/Marketplace-api/pull/7808)\n    - *:arrow\\_up: deps: bump php\\_codesniffer to 4.0.4 (CVE-2026-67434)* [\\#7817](https://github.com/Wishibam/Marketplace-api/pull/7817)\n    - *:bug: fix: resync-retailer scroll rejected by ES8 (size param)* [\\#7820](https://github.com/Wishibam/Marketplace-api/pull/7820)\n    - *feat(mcp): add MCP server walking skeleton with list\\_organizations* [\\#7823](https://github.com/Wishibam/Marketplace-api/pull/7823)\n    - *refactor(mcp): extract logic from ImportAction, RetailerNormalizer and RankProduct* [\\#7824](https://github.com/Wishibam/Marketplace-api/pull/7824)\n    - *:sparkles: feat: compute product scoring on the fly (service + ES)* [\\#7825](https://github.com/Wishibam/Marketplace-api/pull/7825)\n    - *:sparkles: feat: raise the ES pagination window beyond 10k documents* [\\#7826](https://github.com/Wishibam/Marketplace-api/pull/7826)\n    - *feat(merchandising): supporter les tris du listing produit sur POST /merchandising* [\\#7827](https://github.com/Wishibam/Marketplace-api/pull/7827)\n\n## POST MEP\n\n### [PR #7826](https://github.com/Wishibam/Marketplace-api/pull/7826) \u2014 :sparkles: feat: raise the ES pagination window beyond 10k documents\n\n```\n  curl -X PUT \"http://localhost:9200/prod_product_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":200000}}'\n  curl -X PUT \"http://localhost:9200/prod_variation_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":500000}}'\n\n  V\u00e9rifier :\n  curl \"http://localhost:9200/prod_product_*/_settings/index.max_result_window?flat_settings\"\n  curl \"http://localhost:9200/prod_variation_*/_settings/index.max_result_window?flat_settings\"\n```\n", "creation_timestamp": "2026-08-11T14:13:54.294919Z"}, {"uuid": "dbfecc2c-9634-40c1-8d9c-20957e9bf063", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67434", "type": "seen", "source": "https://gist.github.com/jbourdin/e3a2a4307f53e7c762a33892eb7c8952", "content": "- **Trello**\n    - [Helsinki : Portail de retour - Sylius - int\u00e9gration front du portail de retour](https://trello.com/c/mhcc7YaC/2401-helsinki-portail-de-retour-sylius-int%C3%A9gration-front-du-portail-de-retour) **TEMP - EPIC - Droit de r\u00e9tractation**\n        - *feat(helsinki): Add return portal to Helsinki order details* [\\#11757](https://github.com/Wishibam/Ecommerce-sylius/pull/11757)\n    - [\\[Migration\\]\\[A.2\\] D\u00e9mant\u00e8lement Setono Analytics + Tag-Bag](https://trello.com/c/uJN0Gkiz/3856-migrationa2-d%C3%A9mant%C3%A8lement-setono-analytics-tag-bag) **\ud83e\udd16 Testing tech**\n        - *:wrench: chore(migration): internalize setono analytics + tag-bag as src/Component \\[A.2\\]* [\\#11846](https://github.com/Wishibam/Ecommerce-sylius/pull/11846)\n    - [\\[Migration\\]\\[A.4.1\\] Internaliser bitbag/wishlist-plugin dans src/Component/Wishlist](https://trello.com/c/U9dQGx1l/3863-migrationa41-internaliser-bitbag-wishlist-plugin-dans-src-component-wishlist) **\ud83e\udd16 Testing tech**\n        - *:wrench: chore: internalize bitbag/wishlist-plugin \\[A.4.1\\]* [\\#11856](https://github.com/Wishibam/Ecommerce-sylius/pull/11856)\n    - [\\[Migration\\]\\[A.4.2/A.4.3\\] Internaliser bring & deep-link dans src/Component](https://trello.com/c/RsLN5SNT/3864-migrationa42-a43-internaliser-bring-deep-link-dans-src-component) **\ud83e\udd16 Testing tech**\n        - *:wrench: chore: internalize bring & deep-link plugins \\[A.4.2, A.4.3\\]* [\\#11861](https://github.com/Wishibam/Ecommerce-sylius/pull/11861)\n    - [\\[Migration\\]\\[A.5\\] Bumps frontend \u00ab safe \u00bb + suppression des packages morts](https://trello.com/c/vI6k61gt/3873-migrationa5-bumps-frontend-safe-suppression-des-packages-morts) **\ud83e\udd16 Testing tech**\n        - *:wrench: chore: bump safe frontend deps + prune dead packages \\[A.5\\]* [\\#11875](https://github.com/Wishibam/Ecommerce-sylius/pull/11875)\n    - [\\[Migration\\]\\[A.6\\] Pr\u00e9paration Doctrine pour DBAL 3 (monkey-patch migrations)](https://trello.com/c/8mdyVMwg/3880-migrationa6-pr%C3%A9paration-doctrine-pour-dbal-3-monkey-patch-migrations) **\ud83e\udd16 Testing tech**\n        - *:wrench: chore: replace Doctrine migration monkey-patch for DBAL 3 \\[A.6\\]* [\\#11893](https://github.com/Wishibam/Ecommerce-sylius/pull/11893)\n    - [TVO - Express checkout : adresse tronqu\u00e9e \u2014 nom de rue perdu (Apple Pay line1/line2)](https://trello.com/c/dIrl0I1a/3884-tvo-express-checkout-adresse-tronqu%C3%A9e-nom-de-rue-perdu-apple-pay-line1-line2) **\ud83e\udd13 Testing**\n        - *:bug: fix: join express checkout wallet address line1/line2 into street* [\\#11914](https://github.com/Wishibam/Ecommerce-sylius/pull/11914)\n    - [\\[P0\\] Express checkout : re-v\u00e9rifier le montant du PaymentIntent au complete](https://trello.com/c/qJdTR9Jc/3885-p0-express-checkout-re-v%C3%A9rifier-le-montant-du-paymentintent-au-complete) **\ud83d\udc8e In Review**\n        - *:bug: fix: verify express checkout PaymentIntent amount at completion* [\\#11916](https://github.com/Wishibam/Ecommerce-sylius/pull/11916)\n    - [\\[P0\\] Webhook Stripe : rembourser r\u00e9ellement les charges des commandes refus\u00e9es/annul\u00e9es](https://trello.com/c/fyJeMD3L/3886-p0-webhook-stripe-rembourser-r%C3%A9ellement-les-charges-des-commandes-refus%C3%A9es-annul%C3%A9es) **\ud83d\udc8e In Review**\n        - *:bug: fix: refund Stripe charges captured for refused or cancelled orders* [\\#11918](https://github.com/Wishibam/Ecommerce-sylius/pull/11918)\n    - [\\[P1\\] Express checkout : pinner explicitement les wallets autoris\u00e9s (quick win)](https://trello.com/c/tEpmPM9l/3890-p1-express-checkout-pinner-explicitement-les-wallets-autoris%C3%A9s-quick-win) **\ud83e\udd13 Testing**\n        - *:bug: fix: restrict express checkout wallets to an explicit allowlist* [\\#11919](https://github.com/Wishibam/Ecommerce-sylius/pull/11919)\n    - [\\[P0\\] Express checkout : commandes \u00e0 fonds captur\u00e9s supprim\u00e9es par la purge des carts + cha\u00eene d'abort morte](https://trello.com/c/1Wo7zGP5/3887-p0-express-checkout-commandes-%C3%A0-fonds-captur%C3%A9s-supprim%C3%A9es-par-la-purge-des-carts-cha%C3%AEne-dabort-morte) **\ud83d\udc8e In Review**\n        - *:bug: fix: protect express checkout captured-funds carts from the purge* [\\#11920](https://github.com/Wishibam/Ecommerce-sylius/pull/11920)\n    - [\ud83d\udc1b Fix r\u00e9indexation ES bloqu\u00e9e \u2014 \u00ab immense term \u00bb sur attribut trop long (Intersport)](https://trello.com/c/iD6idW0v/3915-%F0%9F%90%9B-fix-r%C3%A9indexation-es-bloqu%C3%A9e-immense-term-sur-attribut-trop-long-intersport) **\ud83e\udd16 Testing tech**\n        - *:bug: fix: r\u00e9indexation ES bloqu\u00e9e par un attribut trop long (immense term)* [\\#11972](https://github.com/Wishibam/Ecommerce-sylius/pull/11972)\n    - [\u26a0\ufe0faction preprod/prod \u26a0\ufe0f \u203c\ufe0f Nouveau Feeds - Faire tourner tous les nouveaux feeds sur toutes les preprods/prods](https://trello.com/c/Kr8UhDAv/3910-%E2%9A%A0%EF%B8%8Faction-preprod-prod-%E2%9A%A0%EF%B8%8F-%EF%B8%8F-nouveau-feeds-faire-tourner-tous-les-nouveaux-feeds-sur-toutes-les-preprods-prods) **\ud83e\udee1 To Do JC**\n        - *:sparkles: feat: drive-to-store feeds parity with legacy Setono* [\\#11979](https://github.com/Wishibam/Ecommerce-sylius/pull/11979)\n    - [Helsinki \u2014 Funnel checkout GA4 vide : \u00e9v\u00e9nements e-commerce manquants/incomplets](https://trello.com/c/j0yQGSFm/3921-helsinki-funnel-checkout-ga4-vide-%C3%A9v%C3%A9nements-e-commerce-manquants-incomplets) **\ud83c\udf44 Ready for testing**\n        - *:bug: fix: \u00e9mettre le funnel checkout GA4 complet* [\\#11980](https://github.com/Wishibam/Ecommerce-sylius/pull/11980)\n        - *:bug: fix: \u00e9mettre add\\_payment\\_info quand l'\u00e9tape de paiement est saut\u00e9e* [\\#12014](https://github.com/Wishibam/Ecommerce-sylius/pull/12014)\n    - [Min-height pages React](https://trello.com/c/Rti8eFXb/3919-min-height-pages-react) **\ud83e\udd13 Testing**\n        - *:bug: fix: add min-height on React pages to prevent footer flash* [\\#11987](https://github.com/Wishibam/Ecommerce-sylius/pull/11987)\n    - [\u26a0\ufe0f action preprod/prod \u26a0\ufe0f \ud83d\uded2 Refonte Checkout #1 \u2014 La page Panier change de garde-robe](https://trello.com/c/qxdtlZxk/3851-%E2%9A%A0%EF%B8%8F-action-preprod-prod-%E2%9A%A0%EF%B8%8F-%F0%9F%9B%92-refonte-checkout-1-la-page-panier-change-de-garde-robe) **\ud83c\udf89 A MEP**\n        - *:bug: fix(tvo): cart page QA feedback round* [\\#11990](https://github.com/Wishibam/Ecommerce-sylius/pull/11990)\n    - [Fix : TypeError trim() null sur les share descriptions de channel (admin)](https://trello.com/c/o47Ek1Fo/3924-fix-typeerror-trim-null-sur-les-share-descriptions-de-channel-admin) **\ud83e\udd16 Testing tech**\n        - *:bug: fix: guard against null share descriptions in channel setter* [\\#11992](https://github.com/Wishibam/Ecommerce-sylius/pull/11992)\n    - [\u26a0\ufe0faction preprod/prod \u26a0\ufe0f \ud83d\udce6\ud83c\udf0d Mondial Relay sans fronti\u00e8res \u2014 points relais UE (v1 TVO)](https://trello.com/c/4X0QYlQ5/3918-%E2%9A%A0%EF%B8%8Faction-preprod-prod-%E2%9A%A0%EF%B8%8F-%F0%9F%93%A6%F0%9F%8C%8D-mondial-relay-sans-fronti%C3%A8res-points-relais-ue-v1-tvo) **\ud83d\udc8e In Review**\n        - *:sparkles: feat(mondial-relay): relay search follows the buyer's country* [\\#11994](https://github.com/Wishibam/Ecommerce-sylius/pull/11994)\n    - [\ud83d\udccd Refonte Checkout \u2014 La suggestion d'adresse qui fait mouche](https://trello.com/c/vF0T1FZU/3860-%F0%9F%93%8D-refonte-checkout-la-suggestion-dadresse-qui-fait-mouche) **\ud83d\ude80 To Do Vincent**\n        - *:bug: fix(tvo): address suggestion QA feedback round* [\\#11995](https://github.com/Wishibam/Ecommerce-sylius/pull/11995)\n    - [\ud83c\udf5e Refonte Checkout \u2014 Des toasts tout chauds pour les messages syst\u00e8me](https://trello.com/c/N70pstGO/3861-%F0%9F%8D%9E-refonte-checkout-des-toasts-tout-chauds-pour-les-messages-syst%C3%A8me) **\ud83c\udf89 A MEP**\n        - *:bug: fix(tvo): checkout toasts QA feedback round* [\\#11996](https://github.com/Wishibam/Ecommerce-sylius/pull/11996)\n    - [TVO- mail order\\_open\\_return\\_withdrawn -remplacement de tag](https://trello.com/c/NK5CnCM2/3883-tvo-mail-orderopenreturnwithdrawn-remplacement-de-tag) **\ud83c\udf89 A MEP**\n        - *\ud83d\udc1b fix: orange \"return in progress\" badge on TVO withdrawal email* [\\#12000](https://github.com/Wishibam/Ecommerce-sylius/pull/12000)\n    - [\u26a0\ufe0f action prod \u26a0\ufe0f \ud83d\ude9a Refonte Checkout #3 \u2014 Le Mode de livraison prend la route](https://trello.com/c/NDSNOimu/3854-%E2%9A%A0%EF%B8%8F-action-prod-%E2%9A%A0%EF%B8%8F-%F0%9F%9A%9A-refonte-checkout-3-le-mode-de-livraison-prend-la-route) **\ud83e\udd13 Testing**\n        - *:sparkles: feat(tvo): React checkout select shipping step (P3)* [\\#12011](https://github.com/Wishibam/Ecommerce-sylius/pull/12011)\n    - [Helsinki - Correction bug d'affichage en finnois en version mobile](https://trello.com/c/f9V6mA6z/3686-helsinki-correction-bug-daffichage-en-finnois-en-version-mobile) **\ud83e\udd13 Testing**\n        - *:bug: fix: reduce Helsinki posts carousel title on mobile* [\\#12017](https://github.com/Wishibam/Ecommerce-sylius/pull/12017)\n    - [\ud83c\udfbd \\[IS\\] Footer : \u00ab Notre accompagnement \u00bb devient \u00ab Nos services \u00bb et raccroche son lien](https://trello.com/c/H2X0XtqH/3932-%F0%9F%8E%BD-is-footer-notre-accompagnement-devient-nos-services-et-raccroche-son-lien) **\ud83e\udd13 Testing**\n        - *:sparkles: feat: rename the Intersport footer column to \u00ab Nos services \u00bb and unlink its title* [\\#12026](https://github.com/Wishibam/Ecommerce-sylius/pull/12026)\n    - [\u2615\ufe0f \\[Batavia\\] Frais de retour : \u20ac3,25 \u2192 \u20ac3,95 (et on passe le texte en traduction)](https://trello.com/c/P4vec3cz/3934-%E2%98%95%EF%B8%8F-batavia-frais-de-retour-%E2%82%AC325-%E2%86%92-%E2%82%AC395-et-on-passe-le-texte-en-traduction) **\ud83e\udd13 Testing**\n        - *:bug: fix: Batavia return cost 3,95 and move the line to a translation* [\\#12034](https://github.com/Wishibam/Ecommerce-sylius/pull/12034)\n \n- **Misc**\n    - *:sparkles: feat: PushDispatcher + adaptateur FCM (push app TVO)* [\\#11917](https://github.com/Wishibam/Ecommerce-sylius/pull/11917)\n    - *style(withdrawal): make the withdrawal button theme-colored and not f\u2026* [\\#11951](https://github.com/Wishibam/Ecommerce-sylius/pull/11951)\n    - *:zap: perf: Batavia PLP \u2014 ES result cache, key batching, menu cache* [\\#11963](https://github.com/Wishibam/Ecommerce-sylius/pull/11963)\n    - *:wrench: chore: outillage pour worktrees parall\u00e8les (front isol\u00e9 par projet)* [\\#11986](https://github.com/Wishibam/Ecommerce-sylius/pull/11986)\n    - *:wrench: chore: bump php\\_codesniffer en 3.13.6 (CVE-2026-67434, CI rouge)* [\\#12008](https://github.com/Wishibam/Ecommerce-sylius/pull/12008)\n    - *:sparkles: feat: push app TVO \u2014 envoi asynchrone + badge (3.A.5 + 3.A.6)* [\\#12022](https://github.com/Wishibam/Ecommerce-sylius/pull/12022)\n    - *:sparkles: feat: badge unreadPushCount de bout en bout (app TVO)* [\\#12025](https://github.com/Wishibam/Ecommerce-sylius/pull/12025)\n    - *:sparkles: feat: compteur badge dans data des push (app TVO)* [\\#12028](https://github.com/Wishibam/Ecommerce-sylius/pull/12028)\n \n- **D\u00e9j\u00e0 en production**\n    - [TVO - Les recommandations produits ne remontent aucun produit sur la fiche produit](https://trello.com/c/lw3SYgNG/3926-tvo-les-recommandations-produits-ne-remontent-aucun-produit-sur-la-fiche-produit) **MEP Ao\u00fbt**\n        - *:bug: fix(search): match the indexed color value in recommendations* [\\#12004](https://github.com/Wishibam/Ecommerce-sylius/pull/12004)\n    - *:bug: fix: render flag emojis as SVG icons, not OS emoji glyphs* [\\#11981](https://github.com/Wishibam/Ecommerce-sylius/pull/11981)\n    - *:bug: fix: apply the flag icon filter to the remaining menu renderings* [\\#11982](https://github.com/Wishibam/Ecommerce-sylius/pull/11982)", "creation_timestamp": "2026-08-13T16:17:32.138873Z"}, {"uuid": "e40705c2-14ae-4c30-ae1f-6af35e0b7e54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67434", "type": "seen", "source": "https://gist.github.com/alon710/a294e95161c29ae2353666d3ed774930", "content": "# CVE-2026-67434: CVE-2026-67434: OS Command Injection via Malicious Filenames in PHP_CodeSniffer Blame Reports\n\n> **CVSS Score:** 7.3\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67434\n\n## Summary\nA critical OS command injection vulnerability exists in PHP_CodeSniffer's VCS blame report modules (Gitblame, Hgblame, Svnblame). Due to inadequate escaping of filenames passed to shell execution wrappers like popen(), an attacker who commits a file with a maliciously crafted name can execute arbitrary commands when the victim generates a blame report.\n\n## TL;DR\nUnauthenticated OS command injection in PHP_CodeSniffer VCS reports due to unescaped filename concatenation in popen() calls.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-78\n- **Attack Vector**: Local\n- **CVSS Score**: 7.3\n- **EPSS Score**: Not established\n- **Impact**: Arbitrary Code Execution\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- PHP_CodeSniffer\n- **PHP_CodeSniffer**: < 3.13.6 (Fixed in: `3.13.6`)\n- **PHP_CodeSniffer**: >= 4.0.0, < 4.0.2 (Fixed in: `4.0.2`)\n\n## Mitigation\n\n- Upgrade to PHP_CodeSniffer 3.13.6 or 4.0.2 to safely escape arguments.\n- Avoid executing PHP_CodeSniffer with blame reports enabled (--report=Gitblame, --report=Hgblame, --report=Svnblame) on untrusted repositories.\n- Implement pre-commit or pre-scan sanitization checks in CI pipelines to validate filenames against command metacharacters.\n\n**Remediation Steps:**\n1. Run 'composer update squizlabs/php_codesniffer' in your dependency manifest.\n2. Ensure version constraint resolutions point to 3.13.6+ or 4.0.2+.\n3. Audit CI build definitions and remove VCS blame reporting flags until software is patched.\n4. Configure pipeline scanners to block filenames containing characters like '$', '`', ';', and '|'.\n\n## References\n\n- [CVE-2026-67434 Record](https://www.cve.org/CVERecord?id=CVE-2026-67434)\n- [GitHub Security Advisory GHSA-hmqg-cxww-wqhq](https://github.com/PHPCSStandards/PHP_CodeSniffer/security/advisories/GHSA-hmqg-cxww-wqhq)\n- [GitHub Pull Request #1473](https://github.com/PHPCSStandards/PHP_CodeSniffer/pull/1473)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67434) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T04:31:19.319540Z"}, {"uuid": "f41d2170-c202-4064-bd7b-3c0673172f9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67434", "type": "seen", "source": "https://gist.github.com/jbourdin/04337c13ed0986eb35ae2dd9fd10e882", "content": "- **Trello**\n    - [Helsinki : Portail de retour - Sylius - int\u00e9gration front du portail de retour](https://trello.com/c/mhcc7YaC/2401-helsinki-portail-de-retour-sylius-int%C3%A9gration-front-du-portail-de-retour) **TEMP - EPIC - Droit de r\u00e9tractation**\n        - *feat(helsinki): Add return portal to Helsinki order details* [\\#11757](https://github.com/Wishibam/Ecommerce-sylius/pull/11757)\n    - [\\[Migration\\]\\[A.2\\] D\u00e9mant\u00e8lement Setono Analytics + Tag-Bag](https://trello.com/c/uJN0Gkiz/3856-migrationa2-d%C3%A9mant%C3%A8lement-setono-analytics-tag-bag) **\ud83e\udd16 Testing tech**\n        - *:wrench: chore(migration): internalize setono analytics + tag-bag as src/Component \\[A.2\\]* [\\#11846](https://github.com/Wishibam/Ecommerce-sylius/pull/11846)\n    - [\\[Migration\\]\\[A.4.1\\] Internaliser bitbag/wishlist-plugin dans src/Component/Wishlist](https://trello.com/c/U9dQGx1l/3863-migrationa41-internaliser-bitbag-wishlist-plugin-dans-src-component-wishlist) **\ud83e\udd16 Testing tech**\n        - *:wrench: chore: internalize bitbag/wishlist-plugin \\[A.4.1\\]* [\\#11856](https://github.com/Wishibam/Ecommerce-sylius/pull/11856)\n    - [\\[Migration\\]\\[A.4.2/A.4.3\\] Internaliser bring & deep-link dans src/Component](https://trello.com/c/RsLN5SNT/3864-migrationa42-a43-internaliser-bring-deep-link-dans-src-component) **\ud83e\udd16 Testing tech**\n        - *:wrench: chore: internalize bring & deep-link plugins \\[A.4.2, A.4.3\\]* [\\#11861](https://github.com/Wishibam/Ecommerce-sylius/pull/11861)\n    - [\\[Migration\\]\\[A.5\\] Bumps frontend \u00ab safe \u00bb + suppression des packages morts](https://trello.com/c/vI6k61gt/3873-migrationa5-bumps-frontend-safe-suppression-des-packages-morts) **\ud83e\udd16 Testing tech**\n        - *:wrench: chore: bump safe frontend deps + prune dead packages \\[A.5\\]* [\\#11875](https://github.com/Wishibam/Ecommerce-sylius/pull/11875)\n    - [\\[Migration\\]\\[A.6\\] Pr\u00e9paration Doctrine pour DBAL 3 (monkey-patch migrations)](https://trello.com/c/8mdyVMwg/3880-migrationa6-pr%C3%A9paration-doctrine-pour-dbal-3-monkey-patch-migrations) **\ud83e\udd16 Testing tech**\n        - *:wrench: chore: replace Doctrine migration monkey-patch for DBAL 3 \\[A.6\\]* [\\#11893](https://github.com/Wishibam/Ecommerce-sylius/pull/11893)\n    - [TVO - Express checkout : adresse tronqu\u00e9e \u2014 nom de rue perdu (Apple Pay line1/line2)](https://trello.com/c/dIrl0I1a/3884-tvo-express-checkout-adresse-tronqu%C3%A9e-nom-de-rue-perdu-apple-pay-line1-line2) **\ud83e\udd13 Testing**\n        - *:bug: fix: join express checkout wallet address line1/line2 into street* [\\#11914](https://github.com/Wishibam/Ecommerce-sylius/pull/11914)\n    - [\\[P0\\] Webhook Stripe : rembourser r\u00e9ellement les charges des commandes refus\u00e9es/annul\u00e9es](https://trello.com/c/fyJeMD3L/3886-p0-webhook-stripe-rembourser-r%C3%A9ellement-les-charges-des-commandes-refus%C3%A9es-annul%C3%A9es) **\ud83d\udc8e In Review**\n        - *:bug: fix: refund Stripe charges captured for refused or cancelled orders* [\\#11918](https://github.com/Wishibam/Ecommerce-sylius/pull/11918)\n    - [\\[P1\\] Express checkout : pinner explicitement les wallets autoris\u00e9s (quick win)](https://trello.com/c/tEpmPM9l/3890-p1-express-checkout-pinner-explicitement-les-wallets-autoris%C3%A9s-quick-win) **\ud83e\udd13 Testing**\n        - *:bug: fix: restrict express checkout wallets to an explicit allowlist* [\\#11919](https://github.com/Wishibam/Ecommerce-sylius/pull/11919)\n    - [\\[P0\\] Express checkout : commandes \u00e0 fonds captur\u00e9s supprim\u00e9es par la purge des carts + cha\u00eene d'abort morte](https://trello.com/c/1Wo7zGP5/3887-p0-express-checkout-commandes-%C3%A0-fonds-captur%C3%A9s-supprim%C3%A9es-par-la-purge-des-carts-cha%C3%AEne-dabort-morte) **\ud83d\udc8e In Review**\n        - *:bug: fix: protect express checkout captured-funds carts from the purge* [\\#11920](https://github.com/Wishibam/Ecommerce-sylius/pull/11920)\n    - [\ud83d\udc1b Fix r\u00e9indexation ES bloqu\u00e9e \u2014 \u00ab immense term \u00bb sur attribut trop long (Intersport)](https://trello.com/c/iD6idW0v/3915-%F0%9F%90%9B-fix-r%C3%A9indexation-es-bloqu%C3%A9e-immense-term-sur-attribut-trop-long-intersport) **\ud83e\udd16 Testing tech**\n        - *:bug: fix: r\u00e9indexation ES bloqu\u00e9e par un attribut trop long (immense term)* [\\#11972](https://github.com/Wishibam/Ecommerce-sylius/pull/11972)\n    - [\u26a0\ufe0faction preprod/prod \u26a0\ufe0f \u203c\ufe0f Nouveau Feeds - Faire tourner tous les nouveaux feeds sur toutes les preprods/prods](https://trello.com/c/Kr8UhDAv/3910-%E2%9A%A0%EF%B8%8Faction-preprod-prod-%E2%9A%A0%EF%B8%8F-%EF%B8%8F-nouveau-feeds-faire-tourner-tous-les-nouveaux-feeds-sur-toutes-les-preprods-prods) **\ud83e\udee1 To Do JC**\n        - *:sparkles: feat: drive-to-store feeds parity with legacy Setono* [\\#11979](https://github.com/Wishibam/Ecommerce-sylius/pull/11979)\n    - [Helsinki \u2014 Funnel checkout GA4 vide : \u00e9v\u00e9nements e-commerce manquants/incomplets](https://trello.com/c/j0yQGSFm/3921-helsinki-funnel-checkout-ga4-vide-%C3%A9v%C3%A9nements-e-commerce-manquants-incomplets) **\ud83c\udf44 Ready for testing**\n        - *:bug: fix: \u00e9mettre le funnel checkout GA4 complet* [\\#11980](https://github.com/Wishibam/Ecommerce-sylius/pull/11980)\n    - [Min-height pages React](https://trello.com/c/Rti8eFXb/3919-min-height-pages-react) **\ud83e\udd13 Testing**\n        - *:bug: fix: add min-height on React pages to prevent footer flash* [\\#11987](https://github.com/Wishibam/Ecommerce-sylius/pull/11987)\n    - [\u26a0\ufe0f action preprod/prod \u26a0\ufe0f \ud83d\uded2 Refonte Checkout #1 \u2014 La page Panier change de garde-robe](https://trello.com/c/qxdtlZxk/3851-%E2%9A%A0%EF%B8%8F-action-preprod-prod-%E2%9A%A0%EF%B8%8F-%F0%9F%9B%92-refonte-checkout-1-la-page-panier-change-de-garde-robe) **\ud83c\udf89 A MEP**\n        - *:bug: fix(tvo): cart page QA feedback round* [\\#11990](https://github.com/Wishibam/Ecommerce-sylius/pull/11990)\n    - [Fix : TypeError trim() null sur les share descriptions de channel (admin)](https://trello.com/c/o47Ek1Fo/3924-fix-typeerror-trim-null-sur-les-share-descriptions-de-channel-admin) **\ud83e\udd16 Testing tech**\n        - *:bug: fix: guard against null share descriptions in channel setter* [\\#11992](https://github.com/Wishibam/Ecommerce-sylius/pull/11992)\n    - [\u26a0\ufe0faction preprod/prod \u26a0\ufe0f \ud83d\udce6\ud83c\udf0d Mondial Relay sans fronti\u00e8res \u2014 points relais UE (v1 TVO)](https://trello.com/c/4X0QYlQ5/3918-%E2%9A%A0%EF%B8%8Faction-preprod-prod-%E2%9A%A0%EF%B8%8F-%F0%9F%93%A6%F0%9F%8C%8D-mondial-relay-sans-fronti%C3%A8res-points-relais-ue-v1-tvo) **\ud83d\udc8e In Review**\n        - *:sparkles: feat(mondial-relay): relay search follows the buyer's country* [\\#11994](https://github.com/Wishibam/Ecommerce-sylius/pull/11994)\n    - [\ud83d\udccd Refonte Checkout \u2014 La suggestion d'adresse qui fait mouche](https://trello.com/c/vF0T1FZU/3860-%F0%9F%93%8D-refonte-checkout-la-suggestion-dadresse-qui-fait-mouche) **\ud83d\ude80 To Do Vincent**\n        - *:bug: fix(tvo): address suggestion QA feedback round* [\\#11995](https://github.com/Wishibam/Ecommerce-sylius/pull/11995)\n    - [\ud83c\udf5e Refonte Checkout \u2014 Des toasts tout chauds pour les messages syst\u00e8me](https://trello.com/c/N70pstGO/3861-%F0%9F%8D%9E-refonte-checkout-des-toasts-tout-chauds-pour-les-messages-syst%C3%A8me) **\ud83c\udf89 A MEP**\n        - *:bug: fix(tvo): checkout toasts QA feedback round* [\\#11996](https://github.com/Wishibam/Ecommerce-sylius/pull/11996)\n    - [TVO- mail order\\_open\\_return\\_withdrawn -remplacement de tag](https://trello.com/c/NK5CnCM2/3883-tvo-mail-orderopenreturnwithdrawn-remplacement-de-tag) **\ud83c\udf89 A MEP**\n        - *\ud83d\udc1b fix: orange \"return in progress\" badge on TVO withdrawal email* [\\#12000](https://github.com/Wishibam/Ecommerce-sylius/pull/12000)\n    - [\u26a0\ufe0f action prod \u26a0\ufe0f \ud83d\ude9a Refonte Checkout #3 \u2014 Le Mode de livraison prend la route](https://trello.com/c/NDSNOimu/3854-%E2%9A%A0%EF%B8%8F-action-prod-%E2%9A%A0%EF%B8%8F-%F0%9F%9A%9A-refonte-checkout-3-le-mode-de-livraison-prend-la-route) **\ud83e\udd13 Testing**\n        - *:sparkles: feat(tvo): React checkout select shipping step (P3)* [\\#12011](https://github.com/Wishibam/Ecommerce-sylius/pull/12011)\n \n- **Misc**\n    - *:sparkles: feat: PushDispatcher + adaptateur FCM (push app TVO)* [\\#11917](https://github.com/Wishibam/Ecommerce-sylius/pull/11917)\n    - *style(withdrawal): make the withdrawal button theme-colored and not f\u2026* [\\#11951](https://github.com/Wishibam/Ecommerce-sylius/pull/11951)\n    - *:zap: perf: Batavia PLP \u2014 ES result cache, key batching, menu cache* [\\#11963](https://github.com/Wishibam/Ecommerce-sylius/pull/11963)\n    - *:wrench: chore: outillage pour worktrees parall\u00e8les (front isol\u00e9 par projet)* [\\#11986](https://github.com/Wishibam/Ecommerce-sylius/pull/11986)\n    - *:wrench: chore: bump php\\_codesniffer en 3.13.6 (CVE-2026-67434, CI rouge)* [\\#12008](https://github.com/Wishibam/Ecommerce-sylius/pull/12008)\n \n- **D\u00e9j\u00e0 en production**\n    - [TVO - Les recommandations produits ne remontent aucun produit sur la fiche produit](https://trello.com/c/lw3SYgNG/3926-tvo-les-recommandations-produits-ne-remontent-aucun-produit-sur-la-fiche-produit) **MEP Ao\u00fbt**\n        - *:bug: fix(search): match the indexed color value in recommendations* [\\#12004](https://github.com/Wishibam/Ecommerce-sylius/pull/12004)\n    - *:bug: fix: render flag emojis as SVG icons, not OS emoji glyphs* [\\#11981](https://github.com/Wishibam/Ecommerce-sylius/pull/11981)\n    - *:bug: fix: apply the flag icon filter to the remaining menu renderings* [\\#11982](https://github.com/Wishibam/Ecommerce-sylius/pull/11982)", "creation_timestamp": "2026-08-07T15:50:54.562361Z"}, {"uuid": "9746b8e2-00d5-4334-9d74-8cbb586586f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67434", "type": "seen", "source": "https://gist.github.com/jbourdin/d5d5ade20f80dca4ef2a3034a9c1ff3e", "content": "- **Trello**\n    - [Helsinki : Portail de retour - Sylius - int\u00e9gration front du portail de retour](https://trello.com/c/mhcc7YaC/2401-helsinki-portail-de-retour-sylius-int%C3%A9gration-front-du-portail-de-retour) **TEMP - EPIC - Droit de r\u00e9tractation**\n        - *feat(helsinki): Add return portal to Helsinki order details* [\\#11757](https://github.com/Wishibam/Ecommerce-sylius/pull/11757)\n    - [\\[Migration\\]\\[A.2\\] D\u00e9mant\u00e8lement Setono Analytics + Tag-Bag](https://trello.com/c/uJN0Gkiz/3856-migrationa2-d%C3%A9mant%C3%A8lement-setono-analytics-tag-bag) **\ud83e\udd16 Testing tech**\n        - *:wrench: chore(migration): internalize setono analytics + tag-bag as src/Component \\[A.2\\]* [\\#11846](https://github.com/Wishibam/Ecommerce-sylius/pull/11846)\n    - [\\[Migration\\]\\[A.4.1\\] Internaliser bitbag/wishlist-plugin dans src/Component/Wishlist](https://trello.com/c/U9dQGx1l/3863-migrationa41-internaliser-bitbag-wishlist-plugin-dans-src-component-wishlist) **\ud83e\udd16 Testing tech**\n        - *:wrench: chore: internalize bitbag/wishlist-plugin \\[A.4.1\\]* [\\#11856](https://github.com/Wishibam/Ecommerce-sylius/pull/11856)\n    - [\\[Migration\\]\\[A.4.2/A.4.3\\] Internaliser bring & deep-link dans src/Component](https://trello.com/c/RsLN5SNT/3864-migrationa42-a43-internaliser-bring-deep-link-dans-src-component) **\ud83e\udd16 Testing tech**\n        - *:wrench: chore: internalize bring & deep-link plugins \\[A.4.2, A.4.3\\]* [\\#11861](https://github.com/Wishibam/Ecommerce-sylius/pull/11861)\n    - [\\[Migration\\]\\[A.5\\] Bumps frontend \u00ab safe \u00bb + suppression des packages morts](https://trello.com/c/vI6k61gt/3873-migrationa5-bumps-frontend-safe-suppression-des-packages-morts) **\ud83e\udd16 Testing tech**\n        - *:wrench: chore: bump safe frontend deps + prune dead packages \\[A.5\\]* [\\#11875](https://github.com/Wishibam/Ecommerce-sylius/pull/11875)\n    - [\\[Migration\\]\\[A.6\\] Pr\u00e9paration Doctrine pour DBAL 3 (monkey-patch migrations)](https://trello.com/c/8mdyVMwg/3880-migrationa6-pr%C3%A9paration-doctrine-pour-dbal-3-monkey-patch-migrations) **\ud83e\udd16 Testing tech**\n        - *:wrench: chore: replace Doctrine migration monkey-patch for DBAL 3 \\[A.6\\]* [\\#11893](https://github.com/Wishibam/Ecommerce-sylius/pull/11893)\n    - [TVO - Express checkout : adresse tronqu\u00e9e \u2014 nom de rue perdu (Apple Pay line1/line2)](https://trello.com/c/dIrl0I1a/3884-tvo-express-checkout-adresse-tronqu%C3%A9e-nom-de-rue-perdu-apple-pay-line1-line2) **\ud83e\udd13 Testing**\n        - *:bug: fix: join express checkout wallet address line1/line2 into street* [\\#11914](https://github.com/Wishibam/Ecommerce-sylius/pull/11914)\n    - [\\[P0\\] Express checkout : re-v\u00e9rifier le montant du PaymentIntent au complete](https://trello.com/c/qJdTR9Jc/3885-p0-express-checkout-re-v%C3%A9rifier-le-montant-du-paymentintent-au-complete) **\ud83d\udc8e In Review**\n        - *:bug: fix: verify express checkout PaymentIntent amount at completion* [\\#11916](https://github.com/Wishibam/Ecommerce-sylius/pull/11916)\n    - [\\[P0\\] Webhook Stripe : rembourser r\u00e9ellement les charges des commandes refus\u00e9es/annul\u00e9es](https://trello.com/c/fyJeMD3L/3886-p0-webhook-stripe-rembourser-r%C3%A9ellement-les-charges-des-commandes-refus%C3%A9es-annul%C3%A9es) **\ud83d\udc8e In Review**\n        - *:bug: fix: refund Stripe charges captured for refused or cancelled orders* [\\#11918](https://github.com/Wishibam/Ecommerce-sylius/pull/11918)\n    - [\\[P1\\] Express checkout : pinner explicitement les wallets autoris\u00e9s (quick win)](https://trello.com/c/tEpmPM9l/3890-p1-express-checkout-pinner-explicitement-les-wallets-autoris%C3%A9s-quick-win) **\ud83e\udd13 Testing**\n        - *:bug: fix: restrict express checkout wallets to an explicit allowlist* [\\#11919](https://github.com/Wishibam/Ecommerce-sylius/pull/11919)\n    - [\\[P0\\] Express checkout : commandes \u00e0 fonds captur\u00e9s supprim\u00e9es par la purge des carts + cha\u00eene d'abort morte](https://trello.com/c/1Wo7zGP5/3887-p0-express-checkout-commandes-%C3%A0-fonds-captur%C3%A9s-supprim%C3%A9es-par-la-purge-des-carts-cha%C3%AEne-dabort-morte) **\ud83d\udc8e In Review**\n        - *:bug: fix: protect express checkout captured-funds carts from the purge* [\\#11920](https://github.com/Wishibam/Ecommerce-sylius/pull/11920)\n    - [\ud83d\udc1b Fix r\u00e9indexation ES bloqu\u00e9e \u2014 \u00ab immense term \u00bb sur attribut trop long (Intersport)](https://trello.com/c/iD6idW0v/3915-%F0%9F%90%9B-fix-r%C3%A9indexation-es-bloqu%C3%A9e-immense-term-sur-attribut-trop-long-intersport) **\ud83e\udd16 Testing tech**\n        - *:bug: fix: r\u00e9indexation ES bloqu\u00e9e par un attribut trop long (immense term)* [\\#11972](https://github.com/Wishibam/Ecommerce-sylius/pull/11972)\n    - [\u26a0\ufe0faction preprod/prod \u26a0\ufe0f \u203c\ufe0f Nouveau Feeds - Faire tourner tous les nouveaux feeds sur toutes les preprods/prods](https://trello.com/c/Kr8UhDAv/3910-%E2%9A%A0%EF%B8%8Faction-preprod-prod-%E2%9A%A0%EF%B8%8F-%EF%B8%8F-nouveau-feeds-faire-tourner-tous-les-nouveaux-feeds-sur-toutes-les-preprods-prods) **\ud83e\udee1 To Do JC**\n        - *:sparkles: feat: drive-to-store feeds parity with legacy Setono* [\\#11979](https://github.com/Wishibam/Ecommerce-sylius/pull/11979)\n    - [Helsinki \u2014 Funnel checkout GA4 vide : \u00e9v\u00e9nements e-commerce manquants/incomplets](https://trello.com/c/j0yQGSFm/3921-helsinki-funnel-checkout-ga4-vide-%C3%A9v%C3%A9nements-e-commerce-manquants-incomplets) **\ud83c\udf44 Ready for testing**\n        - *:bug: fix: \u00e9mettre le funnel checkout GA4 complet* [\\#11980](https://github.com/Wishibam/Ecommerce-sylius/pull/11980)\n    - [Min-height pages React](https://trello.com/c/Rti8eFXb/3919-min-height-pages-react) **\ud83e\udd13 Testing**\n        - *:bug: fix: add min-height on React pages to prevent footer flash* [\\#11987](https://github.com/Wishibam/Ecommerce-sylius/pull/11987)\n    - [\u26a0\ufe0f action preprod/prod \u26a0\ufe0f \ud83d\uded2 Refonte Checkout #1 \u2014 La page Panier change de garde-robe](https://trello.com/c/qxdtlZxk/3851-%E2%9A%A0%EF%B8%8F-action-preprod-prod-%E2%9A%A0%EF%B8%8F-%F0%9F%9B%92-refonte-checkout-1-la-page-panier-change-de-garde-robe) **\ud83c\udf89 A MEP**\n        - *:bug: fix(tvo): cart page QA feedback round* [\\#11990](https://github.com/Wishibam/Ecommerce-sylius/pull/11990)\n    - [Fix : TypeError trim() null sur les share descriptions de channel (admin)](https://trello.com/c/o47Ek1Fo/3924-fix-typeerror-trim-null-sur-les-share-descriptions-de-channel-admin) **\ud83e\udd16 Testing tech**\n        - *:bug: fix: guard against null share descriptions in channel setter* [\\#11992](https://github.com/Wishibam/Ecommerce-sylius/pull/11992)\n    - [\u26a0\ufe0faction preprod/prod \u26a0\ufe0f \ud83d\udce6\ud83c\udf0d Mondial Relay sans fronti\u00e8res \u2014 points relais UE (v1 TVO)](https://trello.com/c/4X0QYlQ5/3918-%E2%9A%A0%EF%B8%8Faction-preprod-prod-%E2%9A%A0%EF%B8%8F-%F0%9F%93%A6%F0%9F%8C%8D-mondial-relay-sans-fronti%C3%A8res-points-relais-ue-v1-tvo) **\ud83d\udc8e In Review**\n        - *:sparkles: feat(mondial-relay): relay search follows the buyer's country* [\\#11994](https://github.com/Wishibam/Ecommerce-sylius/pull/11994)\n    - [\ud83d\udccd Refonte Checkout \u2014 La suggestion d'adresse qui fait mouche](https://trello.com/c/vF0T1FZU/3860-%F0%9F%93%8D-refonte-checkout-la-suggestion-dadresse-qui-fait-mouche) **\ud83d\ude80 To Do Vincent**\n        - *:bug: fix(tvo): address suggestion QA feedback round* [\\#11995](https://github.com/Wishibam/Ecommerce-sylius/pull/11995)\n    - [\ud83c\udf5e Refonte Checkout \u2014 Des toasts tout chauds pour les messages syst\u00e8me](https://trello.com/c/N70pstGO/3861-%F0%9F%8D%9E-refonte-checkout-des-toasts-tout-chauds-pour-les-messages-syst%C3%A8me) **\ud83c\udf89 A MEP**\n        - *:bug: fix(tvo): checkout toasts QA feedback round* [\\#11996](https://github.com/Wishibam/Ecommerce-sylius/pull/11996)\n    - [TVO- mail order\\_open\\_return\\_withdrawn -remplacement de tag](https://trello.com/c/NK5CnCM2/3883-tvo-mail-orderopenreturnwithdrawn-remplacement-de-tag) **\ud83c\udf89 A MEP**\n        - *\ud83d\udc1b fix: orange \"return in progress\" badge on TVO withdrawal email* [\\#12000](https://github.com/Wishibam/Ecommerce-sylius/pull/12000)\n    - [\u26a0\ufe0f action prod \u26a0\ufe0f \ud83d\ude9a Refonte Checkout #3 \u2014 Le Mode de livraison prend la route](https://trello.com/c/NDSNOimu/3854-%E2%9A%A0%EF%B8%8F-action-prod-%E2%9A%A0%EF%B8%8F-%F0%9F%9A%9A-refonte-checkout-3-le-mode-de-livraison-prend-la-route) **\ud83e\udd13 Testing**\n        - *:sparkles: feat(tvo): React checkout select shipping step (P3)* [\\#12011](https://github.com/Wishibam/Ecommerce-sylius/pull/12011)\n \n- **Misc**\n    - *:sparkles: feat: PushDispatcher + adaptateur FCM (push app TVO)* [\\#11917](https://github.com/Wishibam/Ecommerce-sylius/pull/11917)\n    - *style(withdrawal): make the withdrawal button theme-colored and not f\u2026* [\\#11951](https://github.com/Wishibam/Ecommerce-sylius/pull/11951)\n    - *:zap: perf: Batavia PLP \u2014 ES result cache, key batching, menu cache* [\\#11963](https://github.com/Wishibam/Ecommerce-sylius/pull/11963)\n    - *:wrench: chore: outillage pour worktrees parall\u00e8les (front isol\u00e9 par projet)* [\\#11986](https://github.com/Wishibam/Ecommerce-sylius/pull/11986)\n    - *:wrench: chore: bump php\\_codesniffer en 3.13.6 (CVE-2026-67434, CI rouge)* [\\#12008](https://github.com/Wishibam/Ecommerce-sylius/pull/12008)\n \n- **D\u00e9j\u00e0 en production**\n    - [TVO - Les recommandations produits ne remontent aucun produit sur la fiche produit](https://trello.com/c/lw3SYgNG/3926-tvo-les-recommandations-produits-ne-remontent-aucun-produit-sur-la-fiche-produit) **MEP Ao\u00fbt**\n        - *:bug: fix(search): match the indexed color value in recommendations* [\\#12004](https://github.com/Wishibam/Ecommerce-sylius/pull/12004)\n    - *:bug: fix: render flag emojis as SVG icons, not OS emoji glyphs* [\\#11981](https://github.com/Wishibam/Ecommerce-sylius/pull/11981)\n    - *:bug: fix: apply the flag icon filter to the remaining menu renderings* [\\#11982](https://github.com/Wishibam/Ecommerce-sylius/pull/11982)", "creation_timestamp": "2026-08-07T16:25:47.248675Z"}, {"uuid": "cd52882b-6d39-4b4a-8357-eb20d4f5d862", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67430", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrssmrex5o2o", "content": "CVE-2026-67430 - MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood\nCVE ID : CVE-2026-67430\n \n Published : July 29, 2026, 8:17 p.m. | 26\u00a0minutes ago\n \n Description : MCP Ruby SDK is the official Ruby SDK for Model...", "creation_timestamp": "2026-07-29T20:53:24.809615Z"}, {"uuid": "6dc00b17-3154-431f-85e8-4bc507db6fa0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67432", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrsstprxqw2i", "content": "CVE-2026-67432 - MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport\nCVE ID : CVE-2026-67432\n \n Published : July 29, 2026, 8:17 p.m. | 26\u00a0minutes ago\n \n Description : MCP Ruby SDK is the official Ruby SDK for Model Con...", "creation_timestamp": "2026-07-29T20:57:17.805537Z"}, {"uuid": "c60987b8-8c52-479d-848c-f47e04a61477", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67432", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrsszcbcnl22", "content": "\ud83d\udfe0 CVE-2026-67432 - High (7.5)\n\nMCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0....\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-67432/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-29T21:00:25.446900Z"}, {"uuid": "68aa17b4-a49e-4a17-9cc1-71d022a61c0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67435", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrstx5hkw522", "content": "CVE-2026-67435 - linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect\nCVE ID : CVE-2026-67435\n \n Published : July 29, 2026, 8:17 p.m. | 26\u00a0minutes ago\n \n Description : linuxfabrik-lib provides Python modules for database access, caching, shell ex...", "creation_timestamp": "2026-07-29T21:17:06.620102Z"}, {"uuid": "706fbabc-bd15-4add-9819-b116f1bc6170", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67431", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrsu6t2mfx2q", "content": "CVE-2026-67431 - MCP Ruby SDK: Ruby SSE Session Poisoning\nCVE ID : CVE-2026-67431\n \n Published : July 29, 2026, 8:17 p.m. | 26\u00a0minutes ago\n \n Description : MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Trans...", "creation_timestamp": "2026-07-29T21:21:23.968372Z"}, {"uuid": "6aa958df-0233-4912-8039-67241f96ea29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67437", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrswdykg4k2w", "content": "\ud83d\udfe0 CVE-2026-67437 - High (7.5)\n\nOliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-67437/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-29T22:00:05.117140Z"}]}