webhookd: Unrestricted HTTP Header to Shell Variable Injection

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-59157 · Microsoft / collected KEV context

EUVD-2026-78685

GHSA-v25g-mvwr-f5fp

GO-2026-6451

cve-program · CVE-2026-59157

• https://github.com/ncarlier/webhookd/security/advisories/GHSA-v25g-mvwr-f5fp
• https://github.com/ncarlier/webhookd/pull/121
• https://github.com/ncarlier/webhookd/commit/5ac66677bf7224191f1dfc51a875b09187d10beb
• https://github.com/ncarlier/webhookd/releases/tag/v1.22.0

euvd · EUVD-2026-78685

• https://github.com/ncarlier/webhookd/security/advisories/GHSA-v25g-mvwr-f5fp
• https://github.com/ncarlier/webhookd/pull/121
• https://github.com/ncarlier/webhookd/commit/5ac66677bf7224191f1dfc51a875b09187d10beb
• https://github.com/ncarlier/webhookd/releases/tag/v1.22.0

nvd · CVE-2026-59157

• https://github.com/ncarlier/webhookd/commit/5ac66677bf7224191f1dfc51a875b09187d10beb
• https://github.com/ncarlier/webhookd/pull/121
• https://github.com/ncarlier/webhookd/releases/tag/v1.22.0
• https://github.com/ncarlier/webhookd/security/advisories/GHSA-v25g-mvwr-f5fp

osv · GHSA-v25g-mvwr-f5fp

• https://github.com/ncarlier/webhookd/security/advisories/GHSA-v25g-mvwr-f5fp
• https://github.com/ncarlier/webhookd
• https://github.com/ncarlier/webhookd/releases/tag/v1.22.0

osv · GO-2026-6451

• https://github.com/ncarlier/webhookd/security/advisories/GHSA-v25g-mvwr-f5fp
• https://github.com/ncarlier/webhookd/releases/tag/v1.22.0

No related operational record is retained in the current change model.