Low 6.3

Zipline before 4.8.0 maxViews Limit Bypass via Race Condition

CVE-2026-126935 First seen on SecPulse Nov 12, 07:53

Affected packages

Ecosystem	Package	Affected → Fixed	Fixed
diced	dicedzipline	< 4.8.0→ 4.8.0	4.8.0

Original description The description as published by the source.

Zipline before 4.8.0 contains a race condition vulnerability in src/server/routes/raw/[id].ts that allows remote attackers to bypass file maxViews limits through non-atomic view counting. Attackers holding a file link can send parallel requests that read the same pre-increment count, viewing view-limited or delete-on-max-views files beyond their limit.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

advisory github.com
advisory github.com
advisory vulncheck.com
advisory nvd.nist.gov
advisory github.com
patch github.com
web github.com
web github.com

Key facts

CVSS v3: Low 3.7; CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4: Medium 6.3; CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Published: Nov 12, 2026
First seen on SecPulse: Nov 12, 07:53
GHSA: GHSA-7xv9-wr46-j578
CWE: CWE-367

NVD GitHub Advisory

Tags(click for explanation)

CWE

CWE-367

All

Diced Zipline

Detection sources

OSV.dev (Open Source Vulnerabilities)11:47
NIST National Vulnerability Database06:36
GitHub Security Advisories (Global)Nov 12, 09:33
CVE.org (CVE Program・cvelistV5)Nov 12, 07:53