Snyk

Broken access control allows a user with organization administrator permissions to delete dashboard snapshots belonging to other organizations hosted on the same instance. Additionally, an attacker can recover a snapshot's secret delete key using only its public share key.

A remote code execution vulnerability has been identified, enabling an attacker to execute arbitrary code within the Code Agent container. Exploiting this issue requires an attacker to have network access to the Code Agent within the deployment environment. External exploitation is unlikely and depends on cluster misconfigurations and/or chaining with another vulnerability. However, internal exploitation could still be possible with a cluster misconfiguration.

The issue is related to Regular Expression Denial of Service (ReDoS) due to the `upgradeWebSocket` function, which contains regexes in the form of `/s*,s*/`, used for splitting the `Connection/Upgrade` header. A specially crafted `Connection/Upgrade` header can be used to significantly slow down a web socket server.

The issue concerns a Denial of Service (DoS) condition that occurs when an attacker sends an HTTP request containing control characters that the `decodeURI()` function cannot parse. This can lead to a service disruption.

The issue arises due to missing input sanitization and the employment of sandboxes to the `req.url` user input that is passed to the server code, leading to Directory Traversal.

The issue arises due to missing input sanitization and the employment of sandboxes to the `req.url` user input that is passed to the server code, leading to Directory Traversal.

The issue arises when an attacker sends an HTTP request that includes control characters, which the `decodeURI()` function is unable to parse, leading to a Denial of Service (DoS). This occurs when the `decodeURI()` function encounters characters it cannot process, resulting in the service becoming unavailable.