Alimony

**Name of the Vulnerable Software and Affected Versions** fastify versions 5.8.3 through 5.12.0 **Description** An issue exists in the handling of forwarded-header reads used to derive request host, protocol, hostname, ip, and ips values. When the `trustProxy` setting is configured with a numeric hop-count value, the system fails to properly validate the connecting address. This allows an attacker who can reach the origin directly, bypassing the front-facing proxy, to spoof forwarded request fields. This can lead to host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie and CSRF-origin bypass, as well as host-based routing and cache poisoning. **Recommendations** Update to version 5.12.1. Migrate to an IP, CIDR, or custom-function `trustProxy` value that validates the connecting address. Ensure the origin is only reachable through the trusted proxy chain.

**Name of the Vulnerable Software and Affected Versions** Grav versions prior to 2.0.15 **Description** Stored cross-site scripting occurs during the rendering of audio and video media via the `sourceParsedownElement()` function. The issue arises because the media URL fragment is concatenated without being escaped into rawHtml source elements, which allows attackers to inject arbitrary HTML and JavaScript that executes within the sessions of users viewing the content. **Recommendations** Update Grav to version 2.0.15 or later.

**Name of the Vulnerable Software and Affected Versions** Scriban versions 3.0.0 through 7.2.5 **Description** A denial of service issue exists in the `ScriptRange.Multiply` operator. When the left operand is a lazy sequence, the `LoopLimit` is bypassed, allowing attackers to provide templates with array multiplication on lazy sequences. This can result in billions of uncharged iterations, which pins CPU cores and exhausts garbage collection resources, even if `LoopLimit` is configured to 1. **Recommendations** Update Scriban to a version later than 7.2.5.

**Name of the Vulnerable Software and Affected Versions** Shescape versions prior to 2.1.15 Shescape versions 3.0.0 through 3.0.1 **Description** On Unix systems where the shell is explicitly configured to "sh" or true and `/bin/sh` points to BusyBox, the software fails to properly escape tilde (~) characters in assignment contexts. An attacker providing untrusted input to the `escape()` and `escapeAll()` APIs in an assignment prefixed to a command can inject a tilde payload. This can lead to the disclosure of the user's home directory location or alter the directory where a command operates. **Recommendations** Update Shescape to version 2.1.15 or later. Update Shescape to version 3.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** @fastify/static versions prior to 10.1.3 **Description** An incomplete fix for a route guard bypass allows an unauthenticated attacker to access files protected by a route-based guard. The static file handler failed to canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and delegation to the send layer. By using a non-canonical path form, an attacker can bypass the guarded route to disclose the contents of protected files. This issue specifically affects applications that protect a subtree of the static root with a route-based guard, whereas those using the `allowedPath` option remain unaffected. **Recommendations** Update @fastify/static to version 10.1.3.

**Name of the Vulnerable Software and Affected Versions** GitPython versions prior to 3.1.55 **Description** Improper handling of URL expansion in `Remote.create()` and `Submodule.add()` allows for the exfiltration of secrets. Attackers can provide URLs containing environment variable tokens that are expanded into the `.git/config` and `.gitmodules` files. These secrets are then transmitted to attacker-controlled hosts during fetch or pull operations. **Recommendations** Update GitPython to version 3.1.55 or later.

**Name of the Vulnerable Software and Affected Versions** Nextcloud versions prior to 5.2.6 **Description** Nextcloud is an open source content collaboration platform. A missing permissions check allows users to request and read form submissions belonging to other users. **Recommendations** Update to version 5.2.6.