GCVE-110-BREW-2026-001571

Advisory Published

Vulnetix · Advisory published October 16, 2026

[JS-INSTALL-REMOTE-IMPORT] npm lifecycle hook require()/imports from a remote https URL: the hook fetches attacker-controlled code outside the registry at install time. Benign packages declare dependencies in package.json and load them from the registry; an install hook that loads a remote URL is a download-and-execute bypass.

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious CodeCWE-94Improper Control of Generation of Code ('Code Injection')

Affected Products

Vendor	Product	Versions	Platforms
homebrew	gnupg	2.5.24 (affected)	—

References

advisory

web

Browse GCVE Records

5,487 records in the GCVE database · Updated October 16, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON