diff --git a/advisories/github-reviewed/2026/06/GHSA-c8q4-9h32-2ww8/GHSA-c8q4-9h32-2ww8.json b/advisories/github-reviewed/2026/06/GHSA-c8q4-9h32-2ww8/GHSA-c8q4-9h32-2ww8.json index 4d451b1d5d4f4..69192671e4370 100644 --- a/advisories/github-reviewed/2026/06/GHSA-c8q4-9h32-2ww8/GHSA-c8q4-9h32-2ww8.json +++ b/advisories/github-reviewed/2026/06/GHSA-c8q4-9h32-2ww8/GHSA-c8q4-9h32-2ww8.json @@ -1,12 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-c8q4-9h32-2ww8", - "modified": "2026-06-22T20:43:37Z", + "modified": "2026-06-22T20:43:39Z", "published": "2026-06-22T20:43:37Z", "aliases": [ "CVE-2026-44795" ], - "summary": "Spinnaker has uon-safe yaml deserialization, allowing RCE when using specific types", + "summary": "Spinnaker has unsafe yaml deserialization, allowing RCE when using specific types", "details": "### Impact\nThere's an unsafe YAML processing vulnerability that bypasses safe deserialization. This impacts users when when performing:\n* CloudFormation deployments\n* CloudFoundry Baking\n\nThe usage of a non-safe constructor use allows arbitrary loading of Java classes leading to RCE.\n\n### Patches\n 2025.3.3, 2026.0.3 and 2025.4.4.\n\n### Workarounds\nDisable the CloudFormation system and cloudfoundry baking operations.\n\n### Resources\nJoin Spinnaker on Slack for more information!", "severity": [ {