CVE-2026-48596

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48596", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-05-22T09:36:56.834Z", "datePublished": "2026-06-02T19:09:31.615Z", "dateUpdated": "2026-09-24T20:53:10.649Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Tesla.Multipart'"], "packageName": "tesla", "packageURL": "pkg:hex/tesla", "product": "tesla", "programFiles": ["lib/tesla/multipart.ex"], "programRoutines": [{"name": "'Elixir.Tesla.Multipart':add_content_type_param/2"}, {"name": "'Elixir.Tesla.Multipart':headers/1"}], "repo": "https://github.com/elixir-tesla/tesla", "vendor": "elixir-tesla", "versions": [{"lessThan": "1.18.3", "status": "affected", "version": "0.8.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Tesla.Multipart'"], "packageName": "elixir-tesla/tesla", "packageURL": "pkg:github/elixir-tesla/tesla", "product": "tesla", "programFiles": ["lib/tesla/multipart.ex"], "programRoutines": [{"name": "'Elixir.Tesla.Multipart':add_content_type_param/2"}, {"name": "'Elixir.Tesla.Multipart':headers/1"}], "repo": "https://github.com/elixir-tesla/tesla", "vendor": "elixir-tesla", "versions": [{"lessThan": "23601edac5d22ba9407b427967b5bdbda201aec2", "status": "affected", "version": "6ebfdb9abe9c6f119408045b933d82462decd351", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The application must pass untrusted input into <code>Tesla.Multipart.add_content_type_param/2</code>.</p>"}, {"base64": false, "type": "text/markdown", "value": "The application must pass untrusted input into `Tesla.Multipart.add_content_type_param/2`."}], "value": "The application must pass untrusted input into Tesla.Multipart.add_content_type_param/2."}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.18.3", "versionStartIncluding": "0.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Yordis Prieto"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}], "datePublic": "2026-06-02T19:09:31.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via <code>Tesla.Multipart.add_content_type_param/2</code>.</p>\n<p><code>Tesla.Multipart.add_content_type_param/2</code> appends caller-supplied strings to the multipart <code>content_type_params</code> list without validating for CR (<code>\\r</code>) or LF (<code>\\n</code>) characters. <code>Tesla.Multipart.headers/1</code> then joins these params verbatim with <code>\"; \"</code> to construct the outgoing <code>Content-Type</code> header value. A param containing <code>\\r\\n</code> splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into <code>add_content_type_param/2</code> is affected.</p>\n<p>This issue affects tesla: from 0.8.0 before 1.18.3.</p>"}, {"base64": false, "type": "text/markdown", "value": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via `Tesla.Multipart.add_content_type_param/2`.\n\n`Tesla.Multipart.add_content_type_param/2` appends caller-supplied strings to the multipart `content_type_params` list without validating for CR (`\\r`) or LF (`\\n`) characters. `Tesla.Multipart.headers/1` then joins these params verbatim with `\"; \"` to construct the outgoing `Content-Type` header value. A param containing `\\r\\n` splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into `add_content_type_param/2` is affected.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3."}], "value": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\\r) or LF (\\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with \"; \" to construct the outgoing Content-Type header value. A param containing \\r\\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3."}], "impacts": [{"capecId": "CAPEC-105", "descriptions": [{"lang": "en", "value": "CAPEC-105 HTTP Request Splitting"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "baseScore": 2.1, "baseSeverity": "LOW", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-113", "description": "CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-09-24T20:53:10.649Z"}, "references": [{"tags": ["vendor-advisory", "related"], "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"}, {"name": "EEF CNA record for CVE-2026-48596", "tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-48596.html"}, {"name": "OSV record EEF-CVE-2026-48596", "tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48596"}, {"name": "Introducing commit 6ebfdb9 in elixir-tesla/tesla", "tags": ["related"], "url": "https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351"}, {"name": "Fix commit 23601ed in elixir-tesla/tesla", "tags": ["patch"], "url": "https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2"}], "source": {"discovery": "EXTERNAL"}, "title": "CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injection", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Validate content-type parameter strings before passing them to <code>Tesla.Multipart.add_content_type_param/2</code>, rejecting any value that contains <code>\\r</code> or <code>\\n</code>.</p>"}, {"base64": false, "type": "text/markdown", "value": "Validate content-type parameter strings before passing them to `Tesla.Multipart.add_content_type_param/2`, rejecting any value that contains `\\r` or `\\n`."}], "value": "Validate content-type parameter strings before passing them to Tesla.Multipart.add_content_type_param/2, rejecting any value that contains \\r or \\n."}]}, "adp": [{"references": [{"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-03T13:01:48.568462Z", "id": "CVE-2026-48596", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-03T13:01:52.596Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48596", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-03T13:01:48.568462Z"}}}], "references": [{"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-03T13:01:27.414Z"}}], "cna": {"title": "CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injection", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Yordis Prieto"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}], "impacts": [{"capecId": "CAPEC-105", "descriptions": [{"lang": "en", "value": "CAPEC-105 HTTP Request Splitting"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"], "repo": "https://github.com/elixir-tesla/tesla", "vendor": "elixir-tesla", "modules": ["'Elixir.Tesla.Multipart'"], "product": "tesla", "versions": [{"status": "affected", "version": "0.8.0", "lessThan": "1.18.3", "versionType": "semver"}], "packageURL": "pkg:hex/tesla", "packageName": "tesla", "programFiles": ["lib/tesla/multipart.ex"], "collectionURL": "https://repo.hex.pm", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Tesla.Multipart':add_content_type_param/2"}, {"name": "'Elixir.Tesla.Multipart':headers/1"}]}, {"cpes": ["cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"], "repo": "https://github.com/elixir-tesla/tesla", "vendor": "elixir-tesla", "modules": ["'Elixir.Tesla.Multipart'"], "product": "tesla", "versions": [{"status": "affected", "version": "6ebfdb9abe9c6f119408045b933d82462decd351", "lessThan": "23601edac5d22ba9407b427967b5bdbda201aec2", "versionType": "git"}], "packageURL": "pkg:github/elixir-tesla/tesla", "packageName": "elixir-tesla/tesla", "programFiles": ["lib/tesla/multipart.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Tesla.Multipart':add_content_type_param/2"}, {"name": "'Elixir.Tesla.Multipart':headers/1"}]}], "datePublic": "2026-06-02T19:09:31.000Z", "references": [{"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w", "tags": ["vendor-advisory", "related"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-48596.html", "name": "EEF CNA record for CVE-2026-48596", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48596", "name": "OSV record EEF-CVE-2026-48596", "tags": ["related"]}, {"url": "https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351", "name": "Introducing commit 6ebfdb9 in elixir-tesla/tesla", "tags": ["related"]}, {"url": "https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2", "name": "Fix commit 23601ed in elixir-tesla/tesla", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "Validate content-type parameter strings before passing them to Tesla.Multipart.add_content_type_param/2, rejecting any value that contains \\r or \\n.", "supportingMedia": [{"type": "text/html", "value": "<p>Validate content-type parameter strings before passing them to <code>Tesla.Multipart.add_content_type_param/2</code>, rejecting any value that contains <code>\\r</code> or <code>\\n</code>.</p>", "base64": false}, {"type": "text/markdown", "value": "Validate content-type parameter strings before passing them to `Tesla.Multipart.add_content_type_param/2`, rejecting any value that contains `\\r` or `\\n`.", "base64": false}]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\\r) or LF (\\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with \"; \" to construct the outgoing Content-Type header value. A param containing \\r\\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3.", "supportingMedia": [{"type": "text/html", "value": "<p>Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via <code>Tesla.Multipart.add_content_type_param/2</code>.</p>\n<p><code>Tesla.Multipart.add_content_type_param/2</code> appends caller-supplied strings to the multipart <code>content_type_params</code> list without validating for CR (<code>\\r</code>) or LF (<code>\\n</code>) characters. <code>Tesla.Multipart.headers/1</code> then joins these params verbatim with <code>\"; \"</code> to construct the outgoing <code>Content-Type</code> header value. A param containing <code>\\r\\n</code> splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into <code>add_content_type_param/2</code> is affected.</p>\n<p>This issue affects tesla: from 0.8.0 before 1.18.3.</p>", "base64": false}, {"type": "text/markdown", "value": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via `Tesla.Multipart.add_content_type_param/2`.\n\n`Tesla.Multipart.add_content_type_param/2` appends caller-supplied strings to the multipart `content_type_params` list without validating for CR (`\\r`) or LF (`\\n`) characters. `Tesla.Multipart.headers/1` then joins these params verbatim with `\"; \"` to construct the outgoing `Content-Type` header value. A param containing `\\r\\n` splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into `add_content_type_param/2` is affected.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-113", "description": "CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')"}]}], "configurations": [{"lang": "en", "value": "The application must pass untrusted input into Tesla.Multipart.add_content_type_param/2.", "supportingMedia": [{"type": "text/html", "value": "<p>The application must pass untrusted input into <code>Tesla.Multipart.add_content_type_param/2</code>.</p>", "base64": false}, {"type": "text/markdown", "value": "The application must pass untrusted input into `Tesla.Multipart.add_content_type_param/2`.", "base64": false}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.18.3", "versionStartIncluding": "0.8.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-09-24T20:53:10.649Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48596", "state": "PUBLISHED", "dateUpdated": "2026-09-24T20:53:10.649Z", "dateReserved": "2026-05-22T09:36:56.834Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-06-02T19:09:31.615Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Tesla.Multipart'"], "packageName": "tesla", "packageURL": "pkg:hex/tesla", "product": "tesla", "programFiles": ["lib/tesla/multipart.ex"], "programRoutines": [{"name": "'Elixir.Tesla.Multipart':add_content_type_param/2"}, {"name": "'Elixir.Tesla.Multipart':headers/1"}], "repo": "https://github.com/elixir-tesla/tesla", "vendor": "elixir-tesla", "versions": [{"lessThan": "1.18.3", "status": "affected", "version": "0.8.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Tesla.Multipart'"], "packageName": "elixir-tesla/tesla", "packageURL": "pkg:github/elixir-tesla/tesla", "product": "tesla", "programFiles": ["lib/tesla/multipart.ex"], "programRoutines": [{"name": "'Elixir.Tesla.Multipart':add_content_type_param/2"}, {"name": "'Elixir.Tesla.Multipart':headers/1"}], "repo": "https://github.com/elixir-tesla/tesla", "vendor": "elixir-tesla", "versions": [{"lessThan": "23601edac5d22ba9407b427967b5bdbda201aec2", "status": "affected", "version": "6ebfdb9abe9c6f119408045b933d82462decd351", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*", "matchCriteriaId": "876BFB6A-2010-4450-9EA4-F4AF4B78F93F", "versionEndExcluding": "1.18.3", "versionStartIncluding": "0.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\\r) or LF (\\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with \"; \" to construct the outgoing Content-Type header value. A param containing \\r\\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3."}, {"lang": "es", "value": "La vulnerabilidad de Neutralizaci\u00f3n Inadecuada de Secuencias CRLF en Encabezados HTTP ('Divisi\u00f3n de Solicitud/Respuesta HTTP') en elixir-tesla tesla permite la inyecci\u00f3n de encabezados HTTP a trav\u00e9s de Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 a\u00f1ade cadenas proporcionadas por el llamador a la lista multipart content_type_params sin validar los caracteres CR (\\r) o LF (\\n). Tesla.Multipart.headers/1 luego une estos par\u00e1metros textualmente con '; ' para construir el valor del encabezado Content-Type saliente. Un par\u00e1metro que contiene \\r\\n divide la l\u00ednea del encabezado, permitiendo que se inyecten encabezados arbitrarios en la solicitud HTTP saliente. Cualquier aplicaci\u00f3n que reenv\u00ede entrada no confiable (como un charset o una cadena de par\u00e1metro proporcionados por el usuario) a add_content_type_param/2 se ve afectada.\n\nEste problema afecta a tesla: desde 0.8.0 antes de 1.18.3."}], "id": "CVE-2026-48596", "lastModified": "2026-09-24T21:17:13.370", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48596", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-03T13:01:48.568462Z", "version": "2.0.3"}}]}, "published": "2026-06-02T20:16:38.557", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Third Party Advisory"], "url": "https://cna.erlef.org/cves/CVE-2026-48596.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Broken Link"], "url": "https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Third Party Advisory"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48596"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-113"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.8.0,1.18.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "tesla", "source": "cna", "vendor": "elixir-tesla"}, "product": "tesla", "vendor": "elixir-tesla"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6ebfdb9abe9c6f119408045b933d82462decd351,23601edac5d22ba9407b427967b5bdbda201aec2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "tesla", "source": "cna", "vendor": "elixir-tesla"}, "product": "tesla", "vendor": "elixir-tesla"}], "created": "2026-06-03T04:30:05.943088+00:00", "updated": "2026-06-03T10:54:56.988711+00:00", "vendors": ["elixir-tesla", "elixir-tesla$PRODUCT$tesla"]}