NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐘
🐘 Packagist
Not in CISA KEV
CRITICAL severity

Access of Resource Using Incompatible Type ('Type Confusion') in yourls/yourlsGHSA-vf23-f26f-mjj9

CRITICALFix: YOURLS/YOURLS#2542

GHSA-vf23-f26f-mjj9 is a critical-severity (CVSS 9.8) CWE-843 vulnerability in yourls/yourls. 4 public exploit or proof-of-concept references are indexed, so weaponization risk is real. A fix is available for yourls/yourls — see the affected versions and patch details below.

Also known asCVE-2019-14537
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
4 known
Exploitation data as of Nov 11, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
6.1%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs94th percentile — riskier than 94% of all scored CVEsHighest risk
3.50%8.20%12.9%17.6%15.0%6.1%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

1 pkg affected
🐘yourls/yourls

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Impact

YOURLS through 1.7.3 is affected by a type juggling vulnerability in the API component that can result in login bypass.

Patches

https://github.com/YOURLS/YOURLS/releases/tag/1.7.4 https://github.com/YOURLS/YOURLS/pull/2542

References

For more information

If you have any questions or comments about this advisory:

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistyourls/yourlsall versions1.7.4composer require yourls/yourls:^1.7.4

Affected Products

1 product · 1 configurations
Application
yourlsyourls
≤ 1.7.3
range
Exploits & PoCs
4

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

YOURLS through 1.7.3 is affected by a type juggling vulnerability in the…

github.comNVDAug 2020

Report on security-garage.com

security-garage.comNVDAug 2020

Report on github.com

github.comGithubAug 2019

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for yourls/yourls, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update yourls/yourls to 1.7.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-vf23-f26f-mjj9 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact YOURLS through 1.7.3 is affected by a type juggling vulnerability in the API component that can result in login bypass. ### Patches https://github.com/YOURLS/YOURLS/releases/tag/1.7.4 https://github.com/YOURLS/YOURLS/pull/2542 ### References * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14537 * https://github.com/Wocanilo/CVE-2019-14537 ### For more information If you have any questions or comments about this advisory: * Open an issue in [YOURLS repository](https://github.com/YOURLS/YOURLS)
O3 Security · Impact-Aware SCA

Is GHSA-vf23-f26f-mjj9 in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
Access of Resource Using Incompatible Type ('Type…