CLEANSTART-2026-IK37838: brace-expansion library generates arbitrary strings containing a common prefix and suffix

Q: What does an attacker need to exploit this issue?

The supplied CVSS vector indicates network access is sufficient, with low attack complexity. It requires no privileges and no user interaction.

Q: What is the expected security impact?

The reported impact is high availability impact. No confidentiality or integrity impact is indicated by the supplied CVSS vector.

Q: Can I identify affected installations from the available information?

No affected version range, fixed version, or detection method is provided. The available data does not support determining whether a specific installation is affected.

Published Nov 5, 2026

Updated

Security vulnerability affects the npm package. The brace-expansion library generates arbitrary strings containing a common prefix and suffix.

Affected Software

1 affected componentFixes available

cleanstart/npm<10.9.2-r2

10.9.2-r2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/npm to a version that resolves this vulnerability.
Fixed in 10.9.2-r2

Event History

Nov 5, 2026

Advisory Published

via OSV·06:31 AM

Data Sourced

via OSV·06:31 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-69152

Frequently Asked Questions

What does an attacker need to exploit this issue?

The supplied CVSS vector indicates network access is sufficient, with low attack complexity. It requires no privileges and no user interaction.

What is the expected security impact?

The reported impact is high availability impact. No confidentiality or integrity impact is indicated by the supplied CVSS vector.

Can I identify affected installations from the available information?

No affected version range, fixed version, or detection method is provided. The available data does not support determining whether a specific installation is affected.

CLEANSTART-2026-IK37838: brace-expansion library generates arbitrary strings containing a common prefix and suffix

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the expected security impact?

Can I identify affected installations from the available information?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the expected security impact?

Can I identify affected installations from the available information?