THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-8h6h-x5pq-56fq (high) — @logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys

[GHSA] GHSA-8h6h-x5pq-56fq (high) — @logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys

medgithub_advisoriesPublished 2026-08-26

GHSA-8h6h-x5pq-56fq Severity: high CVE: CVE-2026-54511

@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys

`@logtape/syslog` contains two related output-encoding bugs in the structured data formatting code. Both only affect deployments with `includeStructuredData: true`, which is non-default.

## 1. Unescaped C0 control characters in structured dat

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-54511cve

Original source: https://github.com/advisories/GHSA-8h6h-x5pq-56fq