CVE-2026-48158

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48158", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-20T23:12:43.031Z", "datePublished": "2026-08-10T15:56:59.027Z", "dateUpdated": "2026-08-11T01:56:01.248Z"}, "containers": {"cna": {"title": "use-context-selector was vulnerable to malicious code execution via compromised commits", "problemTypes": [{"descriptions": [{"cweId": "CWE-506", "lang": "en", "description": "CWE-506: Embedded Malicious Code", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/dai-shi/use-context-selector/security/advisories/GHSA-7h6v-mwq6-jhm8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/dai-shi/use-context-selector/security/advisories/GHSA-7h6v-mwq6-jhm8"}], "affected": [{"vendor": "dai-shi", "product": "use-context-selector", "versions": [{"version": ">= 9d8481a513b7b0d1c0941b220c69b25de748641b, <= 6f2dae054ca014068bdbbb4db96006424d674124", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-10T15:56:59.027Z"}, "descriptions": [{"lang": "en", "value": "use-context-selector is a React useContextSelector hook in userland Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34, the default branch contained malicious commits 9d8481a513b7b0d1c0941b220c69b25de748641b through 6f2dae054ca014068bdbbb4db96006424d674124 that executed remote attacker-controlled code on developer machines during\n`npm install`. The commits were removed by force-push, but local clones, forks, and direct-SHA URLs may still contain them, and `npm install` against an affected checkout will still execute the code today. The package was not published to npm. `src/install.js` was added and wired into the `postinstall` script. It fetched a JavaScript payload from an attacker-controlled HTTPS endpoint (configurable via an environment variable), disabled TLS verification, and evaluated the response as code with `require` available. Execution was deliberately skipped on CI and cloud/serverless environments, targeting developer workstations. The second-stage payload was attacker-hosted and cannot be reconstructed. Assume full compromise of anything reachable from a Node process with the user's permissions. Those who ran `npm install` against an affected checkout on a developer machine on or after 2026-05-18 15:57:18 should treat the machine as compromised, rotate every credential the machine could reach, audit account activity** since 2026-05-18 15:57:18, and clean local clones."}], "source": {"advisory": "GHSA-7h6v-mwq6-jhm8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-11T01:55:43.542457Z", "id": "CVE-2026-48158", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T01:56:01.248Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48158", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-11T01:55:43.542457Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T01:55:49.143Z"}}], "cna": {"title": "use-context-selector was vulnerable to malicious code execution via compromised commits", "source": {"advisory": "GHSA-7h6v-mwq6-jhm8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "dai-shi", "product": "use-context-selector", "versions": [{"status": "affected", "version": ">= 9d8481a513b7b0d1c0941b220c69b25de748641b, <= 6f2dae054ca014068bdbbb4db96006424d674124"}]}], "references": [{"url": "https://github.com/dai-shi/use-context-selector/security/advisories/GHSA-7h6v-mwq6-jhm8", "name": "https://github.com/dai-shi/use-context-selector/security/advisories/GHSA-7h6v-mwq6-jhm8", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "use-context-selector is a React useContextSelector hook in userland Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34, the default branch contained malicious commits 9d8481a513b7b0d1c0941b220c69b25de748641b through 6f2dae054ca014068bdbbb4db96006424d674124 that executed remote attacker-controlled code on developer machines during\n`npm install`. The commits were removed by force-push, but local clones, forks, and direct-SHA URLs may still contain them, and `npm install` against an affected checkout will still execute the code today. The package was not published to npm. `src/install.js` was added and wired into the `postinstall` script. It fetched a JavaScript payload from an attacker-controlled HTTPS endpoint (configurable via an environment variable), disabled TLS verification, and evaluated the response as code with `require` available. Execution was deliberately skipped on CI and cloud/serverless environments, targeting developer workstations. The second-stage payload was attacker-hosted and cannot be reconstructed. Assume full compromise of anything reachable from a Node process with the user's permissions. Those who ran `npm install` against an affected checkout on a developer machine on or after 2026-05-18 15:57:18 should treat the machine as compromised, rotate every credential the machine could reach, audit account activity** since 2026-05-18 15:57:18, and clean local clones."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-506", "description": "CWE-506: Embedded Malicious Code"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-10T15:56:59.027Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48158", "state": "PUBLISHED", "dateUpdated": "2026-08-11T01:56:01.248Z", "dateReserved": "2026-05-20T23:12:43.031Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-10T15:56:59.027Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "use-context-selector", "vendor": "dai-shi", "versions": [{"status": "affected", "version": ">= 9d8481a513b7b0d1c0941b220c69b25de748641b, <= 6f2dae054ca014068bdbbb4db96006424d674124"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "use-context-selector is a React useContextSelector hook in userland Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34, the default branch contained malicious commits 9d8481a513b7b0d1c0941b220c69b25de748641b through 6f2dae054ca014068bdbbb4db96006424d674124 that executed remote attacker-controlled code on developer machines during\n`npm install`. The commits were removed by force-push, but local clones, forks, and direct-SHA URLs may still contain them, and `npm install` against an affected checkout will still execute the code today. The package was not published to npm. `src/install.js` was added and wired into the `postinstall` script. It fetched a JavaScript payload from an attacker-controlled HTTPS endpoint (configurable via an environment variable), disabled TLS verification, and evaluated the response as code with `require` available. Execution was deliberately skipped on CI and cloud/serverless environments, targeting developer workstations. The second-stage payload was attacker-hosted and cannot be reconstructed. Assume full compromise of anything reachable from a Node process with the user's permissions. Those who ran `npm install` against an affected checkout on a developer machine on or after 2026-05-18 15:57:18 should treat the machine as compromised, rotate every credential the machine could reach, audit account activity** since 2026-05-18 15:57:18, and clean local clones."}, {"lang": "es", "value": "use-context-selector es un hook de React useContextSelector en el espacio de usuario. Entre el 18-05-2026 15:57:18 y el 19-05-2026 15:24:34, la rama predeterminada conten\u00eda commits maliciosos 9d8481a513b7b0d1c0941b220c69b25de748641b hasta 6f2dae054ca014068bdbbb4db96006424d674124 que ejecutaban c\u00f3digo remoto controlado por el atacante en m\u00e1quinas de desarrolladores durante \u2019npm install\u2019. Los commits fueron eliminados mediante un \u2019force-push\u2019, pero los clones locales, las bifurcaciones y las URL de SHA directas a\u00fan pueden contenerlos, y \u2019npm install\u2019 contra una copia afectada a\u00fan ejecutar\u00e1 el c\u00f3digo hoy. El paquete no fue publicado en npm. \u2019src/install.js\u2019 fue a\u00f1adido y conectado al script \u2019postinstall\u2019. Recuper\u00f3 una carga \u00fatil de JavaScript de un punto final HTTPS controlado por el atacante (configurable mediante una variable de entorno), deshabilit\u00f3 la verificaci\u00f3n TLS y evalu\u00f3 la respuesta como c\u00f3digo con \u2019require\u2019 disponible. La ejecuci\u00f3n fue omitida deliberadamente en entornos de CI y de nube/sin servidor, apuntando a estaciones de trabajo de desarrolladores. La carga \u00fatil de segunda etapa fue alojada por el atacante y no puede ser reconstruida. Asuma un compromiso total de cualquier cosa accesible desde un proceso de Node con los permisos del usuario. Aquellos que ejecutaron \u2019npm install\u2019 contra una copia afectada en una m\u00e1quina de desarrollador el o despu\u00e9s del 18-05-2026 15:57:18 deben tratar la m\u00e1quina como comprometida, rotar cada credencial a la que la m\u00e1quina pudo acceder, auditar la actividad de la cuenta desde el 18-05-2026 15:57:18, y limpiar los clones locales."}], "id": "CVE-2026-48158", "lastModified": "2026-10-23T20:10:00.160", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48158", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-11T01:55:43.542457Z", "version": "2.0.3"}}]}, "published": "2026-08-10T16:19:48.117", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/dai-shi/use-context-selector/security/advisories/GHSA-7h6v-mwq6-jhm8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-506"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[9d8481a513b7b0d1c0941b220c69b25de748641b,6f2dae054ca014068bdbbb4db96006424d674124]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "use-context-selector", "source": "cna", "vendor": "dai-shi"}, "product": "use-context-selector", "vendor": "dai-shi"}], "created": "2026-08-10T18:00:03.742690+00:00", "updated": "2026-08-11T14:22:33.672230+00:00", "vendors": ["dai-shi", "dai-shi$PRODUCT$use-context-selector"]}