CVE-2026-14611

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-14611", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-07-03T14:09:19.785Z", "datePublished": "2026-07-03T21:00:10.362Z", "dateUpdated": "2026-07-06T15:06:01.675Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-03T21:00:10.362Z"}, "title": "DeepMyst Mysti Per-Project Auto-Memory MemoryManager.ts initProjectMemory exposure of resource", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-668", "lang": "en", "description": "Exposure of Resource"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-200", "lang": "en", "description": "Information Disclosure"}]}], "affected": [{"vendor": "DeepMyst", "product": "Mysti", "versions": [{"version": "0.1", "status": "affected"}, {"version": "0.2", "status": "affected"}, {"version": "0.3", "status": "affected"}, {"version": "0.4.0", "status": "affected"}, {"version": "0.4.0", "status": "unaffected"}], "cpes": ["cpe:2.3:a:deepmyst:mysti:*:*:*:*:*:*:*:*"], "modules": ["Per-Project Auto-Memory Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in DeepMyst Mysti up to 0.4.0. The affected element is the function initProjectMemory of the file src/managers/MemoryManager.ts of the component Per-Project Auto-Memory Handler. Such manipulation of the argument workspacePath leads to exposure of resource. The attack may be performed from remote. Upgrading to version 0.4.0 is sufficient to fix this issue. The name of the patch is 6d709229b5199f6769fb3cf763e5122dcc43c079. It is advisable to upgrade the affected component."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:OF/RC:C"}}], "timeline": [{"time": "2026-07-03T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-07-03T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-07-03T16:14:24.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Dem00000 (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/376119", "name": "VDB-376119 | DeepMyst Mysti Per-Project Auto-Memory MemoryManager.ts initProjectMemory exposure of resource", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/376119/cti", "name": "VDB-376119 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-14611", "name": "CVE-2026-14611 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/844651", "name": "Submit #844651 | DeepMyst Mysti 0.4.0 Information Exposure / Improper Isolation", "tags": ["third-party-advisory"]}, {"url": "https://github.com/DeepMyst/Mysti/issues/46", "tags": ["issue-tracking"]}, {"url": "https://github.com/DeepMyst/Mysti/pull/49", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/DeepMyst/Mysti/commit/6d709229b5199f6769fb3cf763e5122dcc43c079", "tags": ["patch"]}, {"url": "https://github.com/DeepMyst/Mysti/", "tags": ["product"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-06T15:05:54.831783Z", "id": "CVE-2026-14611", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T15:06:01.675Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-14611", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-06T15:05:54.831783Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T15:05:57.979Z"}}], "cna": {"tags": ["x_open-source"], "title": "DeepMyst Mysti Per-Project Auto-Memory MemoryManager.ts initProjectMemory exposure of resource", "credits": [{"lang": "en", "type": "reporter", "value": "Dem00000 (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:deepmyst:mysti:*:*:*:*:*:*:*:*"], "vendor": "DeepMyst", "modules": ["Per-Project Auto-Memory Handler"], "product": "Mysti", "versions": [{"status": "affected", "version": "0.1"}, {"status": "affected", "version": "0.2"}, {"status": "affected", "version": "0.3"}, {"status": "affected", "version": "0.4.0"}, {"status": "unaffected", "version": "0.4.0"}]}], "timeline": [{"lang": "en", "time": "2026-07-03T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-07-03T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-07-03T16:14:24.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/376119", "name": "VDB-376119 | DeepMyst Mysti Per-Project Auto-Memory MemoryManager.ts initProjectMemory exposure of resource", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/376119/cti", "name": "VDB-376119 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-14611", "name": "CVE-2026-14611 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/844651", "name": "Submit #844651 | DeepMyst Mysti 0.4.0 Information Exposure / Improper Isolation", "tags": ["third-party-advisory"]}, {"url": "https://github.com/DeepMyst/Mysti/issues/46", "tags": ["issue-tracking"]}, {"url": "https://github.com/DeepMyst/Mysti/pull/49", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/DeepMyst/Mysti/commit/6d709229b5199f6769fb3cf763e5122dcc43c079", "tags": ["patch"]}, {"url": "https://github.com/DeepMyst/Mysti/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in DeepMyst Mysti up to 0.4.0. The affected element is the function initProjectMemory of the file src/managers/MemoryManager.ts of the component Per-Project Auto-Memory Handler. Such manipulation of the argument workspacePath leads to exposure of resource. The attack may be performed from remote. Upgrading to version 0.4.0 is sufficient to fix this issue. The name of the patch is 6d709229b5199f6769fb3cf763e5122dcc43c079. It is advisable to upgrade the affected component."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-668", "description": "Exposure of Resource"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "Information Disclosure"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-03T21:00:10.362Z"}}}, "cveMetadata": {"cveId": "CVE-2026-14611", "state": "PUBLISHED", "dateUpdated": "2026-07-06T15:06:01.675Z", "dateReserved": "2026-07-03T14:09:19.785Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-07-03T21:00:10.362Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:deepmyst:mysti:*:*:*:*:*:*:*:*"], "modules": ["Per-Project Auto-Memory Handler"], "product": "Mysti", "vendor": "DeepMyst", "versions": [{"status": "affected", "version": "0.1"}, {"status": "affected", "version": "0.2"}, {"status": "affected", "version": "0.3"}, {"status": "affected", "version": "0.4.0"}, {"status": "unaffected", "version": "0.4.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in DeepMyst Mysti up to 0.4.0. The affected element is the function initProjectMemory of the file src/managers/MemoryManager.ts of the component Per-Project Auto-Memory Handler. Such manipulation of the argument workspacePath leads to exposure of resource. The attack may be performed from remote. Upgrading to version 0.4.0 is sufficient to fix this issue. The name of the patch is 6d709229b5199f6769fb3cf763e5122dcc43c079. It is advisable to upgrade the affected component."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad en DeepMyst Mysti hasta la versi\u00f3n 0.4.0. El elemento afectado es la funci\u00f3n initProjectMemory del archivo src/managers/MemoryManager.ts del componente Per-Project Auto-Memory Gestor. Dicha manipulaci\u00f3n del argumento workspacePath conduce a la exposici\u00f3n de recurso. El ataque puede realizarse de forma remota. Actualizar a la versi\u00f3n 0.4.0 es suficiente para solucionar este problema. El nombre del parche es 6d709229b5199f6769fb3cf763e5122dcc43c079. Es aconsejable actualizar el componente afectado."}], "id": "CVE-2026-14611", "lastModified": "2026-10-25T15:10:00.147", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-14611", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-06T15:05:54.831783Z", "version": "2.0.3"}}]}, "published": "2026-07-03T21:16:56.270", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/DeepMyst/Mysti/"}, {"source": "cna@vuldb.com", "url": "https://github.com/DeepMyst/Mysti/commit/6d709229b5199f6769fb3cf763e5122dcc43c079"}, {"source": "cna@vuldb.com", "url": "https://github.com/DeepMyst/Mysti/issues/46"}, {"source": "cna@vuldb.com", "url": "https://github.com/DeepMyst/Mysti/pull/49"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-14611"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/844651"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/376119"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/376119/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-668"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.4.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "0.4.0"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Mysti", "source": "cna", "vendor": "DeepMyst"}, "product": "mysti", "vendor": "deepmyst"}], "created": "2026-07-03T23:15:04.107194+00:00", "updated": "2026-08-01T20:00:07.331657+00:00", "vendors": ["deepmyst", "deepmyst$PRODUCT$mysti"]}