Truffle Hog, Fade In and BSAFE Crypto-C vulnerabilities
Summary: Cisco Talos disclosed three vulnerabilities in Dell BSAFE Crypto-C, two in Fade In screenwriting software, and one in TruffleHog, all patched by their vendors. The Fade In flaws are an out-of-bounds write (CVE-2025-53855) and a use-after-free (CVE-2025-53814) in its XML parser, TruffleHog 3.90.2 has an arbitrary code execution flaw (CVE-2025-41390) triggered by a malicious repository, and the BSAFE issues were folded into CVE-2019-3728, with the product at end of service.
Why it matters: TruffleHog is the tool organizations point at their own repositories to find exposed API keys and passwords, and a specially crafted repository can now execute arbitrary code against it - so the scanner itself becomes an attack path into the environment it was deployed to protect.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2019-3728CVE-2025-41390CVE-2025-53814CVE-2025-53855
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026