CVE-2026-72904

This vulnerability exposes a two-stage detection gap that standard WAF and IDS signatures will miss. The initial attack surface is json-schema-ref-parser processing $ref keywords embedded in AJV-excluded schema fields (default, const, enum). When dereference fails, the resulting error messages serialize filesystem contents — but the exfiltration channel isn't the error itself. It's the extraction API's error-handling subsystem, which persists stack context and file contents into job results returned to callers. That's the real problem: the API was designed to return processed content, and its error handler was built for debugging convenience — auto-attaching filesystem context to responses. That combination turns a single dereference failure into a reliable exfiltration channel. The CVSS 9.3 scores the file-read, but the extraction worker's network position typically has broader access than the public API — internal service tokens, cloud metadata endpoints, host-level secrets reachable only from that worker. A complete Stage-1 fix (patching json-schema-ref-parser invocation or resolver flags) doesn't defuse the multiplier. Any future dereference error — different resolver, different library, same extraction worker — automatically inherits the same exfiltration surface, because the pipeline's trust model was never changed. The architectural assumption that the extraction worker is a "safe context" for processing untrusted schemas is what needs to break, not just the specific resolver flags. Detection should focus on the error-persistence channel, not the file-read primitive. Check whether your monitoring alerts on extraction jobs returning dereference errors with anomalous content-lengths, or on schemas containing $ref keywords in AJV-excluded fields at submission time. The deeper question: should error handlers that auto-include stack context or file contents in API responses be treated as a privileged operation requiring explicit allowlisting? That's the systemic debt that outlasts this CVE — it's already codified in middleware assumptions, copied error wrappers, or documentation of "how we do error responses." The next developer who needs to debug a different extraction failure will reach for the same convenience, and the channel reopens through architectural debt, not a new vulnerability.

Reviewed through automated stages and approved by a human before publication.