Adel Assakaf

A flaw was found in the keycloak-services component of Keycloak, which provides the core authentication and authorization logic for the identity provider. The issue occurs when a user initiates a login after visiting the password reset page, causing the system to skip mandatory security checks for Proof Key for Code Exchange (PKCE). This could allow an attacker who intercepts a login code to gain unauthorized access to the user's account without needing the required security verifier.

A flaw was found in Podman. An attacker can trigger a Denial of Service (DoS) by supplying a container image containing crafted metadata labels. Podman's auto-update mechanism improperly trusts these image labels to determine which system services to restart. If a user runs the malicious container and auto-update processes it, arbitrary system services are restarted with the user's privileges, potentially allowing an attacker to shut down the host system when Podman runs with administrative privileges.

An issue exists in the theme resource endpoint where the server does not validate theme names before using them as keys for an on-disk gzip cache. An unauthenticated attacker can send numerous requests containing unique, fabricated theme names, resulting in persistent disk space exhaustion. This condition persists after server restarts and leads to service disruptions.

When using the `nvm use --save` and `nvm install --save` (or `-w`) commands, the software writes the resolved version to the `.nvmrc` file using `tee`, which follows symbolic links. If a repository contains a `.nvmrc` file that is a symbolic link to a path outside the repository, the `--save` operation can truncate any file the user has permission to write—such as shell startup files or `~/.ssh/authorized keys`—and replace its contents with the version string. This can also create the target of a dangling link. Because the symbolic link itself remains unchanged, the action does not appear in `git status`. This issue results in data loss rather than code execution, as the attacker cannot control the content being written.

An issue exists where `nvm ls-remote` and other commands that refresh remote LTS aliases store the version column of the mirror's `index.tab` in `$NVM DIR/alias/lts/` without validation. The `nvm normalize lts()` function later evaluates any suffix of an `lts/-N` value inside shell arithmetic `$((N+1))`. In bash and zsh, this arithmetic evaluation expands command substitutions in array subscripts, allowing a stored value like `lts/-10*path[$(cmd)1]` to execute `cmd` as the user. This occurs when the alias is resolved by local commands such as `nvm ls`, `nvm alias`, `nvm use --lts`, and `nvm which lts/`, or in every new shell if the `default` alias is set to `lts/*`. This can also be triggered via a project `.nvmrc` file. Exploitation requires the use of a hostile mirror, which could be achieved through a compromised mirror or CDN, a network man-in-the-middle attack on an `http://` mirror, or a maliciously configured `NVM NODEJS ORG MIRROR` variable.