CVE-2026-54511 (GCVE-0-2026-54511)
Vulnerability from cvelistv5
Published
2026-08-26 14:27
Modified
2026-08-27 14:33
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog package's escapeStructuredDataValue() function in packages/syslog/src/syslog.ts does not neutralize C0 control characters from U+0000 through U+001F in structured data values, and formatStructuredData() inserts property keys without validating the RFC 5424 SD-NAME grammar. When includeStructuredData is true, an attacker-controlled newline can terminate an RFC 6587 non-transparent TCP syslog frame and make following bytes appear as a forged RFC 5424 record, while a key containing a closing bracket or other forbidden character can terminate or corrupt the structured-data element. Applications that forward attacker-controlled property values or keys can therefore allow forged records with arbitrary hosts, applications, process identifiers, facilities, or severity levels, undermining downstream collector and SIEM integrity. This issue is fixed in versions 1.3.11, 2.0.14, and 2.1.5.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54511",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T13:55:07.085909Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T14:33:57.212Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "logtape",
"vendor": "dahlia",
"versions": [
{
"status": "affected",
"version": "\u003c 1.3.11"
},
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c 2.0.14"
},
{
"status": "affected",
"version": "\u003e= 2.1.0, \u003c 2.1.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog package\u0027s escapeStructuredDataValue() function in packages/syslog/src/syslog.ts does not neutralize C0 control characters from U+0000 through U+001F in structured data values, and formatStructuredData() inserts property keys without validating the RFC 5424 SD-NAME grammar. When includeStructuredData is true, an attacker-controlled newline can terminate an RFC 6587 non-transparent TCP syslog frame and make following bytes appear as a forged RFC 5424 record, while a key containing a closing bracket or other forbidden character can terminate or corrupt the structured-data element. Applications that forward attacker-controlled property values or keys can therefore allow forged records with arbitrary hosts, applications, process identifiers, facilities, or severity levels, undermining downstream collector and SIEM integrity. This issue is fixed in versions 1.3.11, 2.0.14, and 2.1.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "CWE-93: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-117",
"description": "CWE-117: Improper Output Neutralization for Logs",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:27:27.910Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/dahlia/logtape/security/advisories/GHSA-8h6h-x5pq-56fq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/dahlia/logtape/security/advisories/GHSA-8h6h-x5pq-56fq"
},
{
"name": "https://github.com/dahlia/logtape/commit/7a6e5b9ddf7915edfff78fa129bc17c979b2a623",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/dahlia/logtape/commit/7a6e5b9ddf7915edfff78fa129bc17c979b2a623"
},
{
"name": "https://github.com/dahlia/logtape/releases/tag/1.3.11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/dahlia/logtape/releases/tag/1.3.11"
},
{
"name": "https://github.com/dahlia/logtape/releases/tag/2.0.14",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/dahlia/logtape/releases/tag/2.0.14"
},
{
"name": "https://github.com/dahlia/logtape/releases/tag/2.1.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/dahlia/logtape/releases/tag/2.1.5"
}
],
"source": {
"advisory": "GHSA-8h6h-x5pq-56fq",
"discovery": "UNKNOWN"
},
"title": "@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54511",
"datePublished": "2026-08-26T14:27:27.910Z",
"dateReserved": "2026-06-15T18:01:15.513Z",
"dateUpdated": "2026-08-27T14:33:57.212Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-54511\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-27T13:55:07.085909Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-27T13:55:08.152Z\"}}], \"cna\": {\"title\": \"@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys\", \"source\": {\"advisory\": \"GHSA-8h6h-x5pq-56fq\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"dahlia\", \"product\": \"logtape\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.3.11\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.0.0, \u003c 2.0.14\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.1.0, \u003c 2.1.5\"}]}], \"references\": [{\"url\": \"https://github.com/dahlia/logtape/security/advisories/GHSA-8h6h-x5pq-56fq\", \"name\": \"https://github.com/dahlia/logtape/security/advisories/GHSA-8h6h-x5pq-56fq\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/dahlia/logtape/commit/7a6e5b9ddf7915edfff78fa129bc17c979b2a623\", \"name\": \"https://github.com/dahlia/logtape/commit/7a6e5b9ddf7915edfff78fa129bc17c979b2a623\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/dahlia/logtape/releases/tag/1.3.11\", \"name\": \"https://github.com/dahlia/logtape/releases/tag/1.3.11\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/dahlia/logtape/releases/tag/2.0.14\", \"name\": \"https://github.com/dahlia/logtape/releases/tag/2.0.14\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/dahlia/logtape/releases/tag/2.1.5\", \"name\": \"https://github.com/dahlia/logtape/releases/tag/2.1.5\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog package\u0027s escapeStructuredDataValue() function in packages/syslog/src/syslog.ts does not neutralize C0 control characters from U+0000 through U+001F in structured data values, and formatStructuredData() inserts property keys without validating the RFC 5424 SD-NAME grammar. When includeStructuredData is true, an attacker-controlled newline can terminate an RFC 6587 non-transparent TCP syslog frame and make following bytes appear as a forged RFC 5424 record, while a key containing a closing bracket or other forbidden character can terminate or corrupt the structured-data element. Applications that forward attacker-controlled property values or keys can therefore allow forged records with arbitrary hosts, applications, process identifiers, facilities, or severity levels, undermining downstream collector and SIEM integrity. This issue is fixed in versions 1.3.11, 2.0.14, and 2.1.5.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-93\", \"description\": \"CWE-93: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-117\", \"description\": \"CWE-117: Improper Output Neutralization for Logs\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-26T14:27:27.910Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-54511\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-27T14:33:57.212Z\", \"dateReserved\": \"2026-06-15T18:01:15.513Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-26T14:27:27.910Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…