Arjun Jain

An algorithmic complexity issue allows unauthenticated remote attackers to cause excessive CPU consumption. By crafting deeply nested multipart email messages where boundary lines share long prefixes with open boundaries, attackers can block the Node.js event loop for several seconds per message. This occurs within the `processLine()` function, where the parsing cost scales based on the nesting depth (up to the default `maxNestingDepth` of 256) and the shared prefix length.

A duplicate-entry validation bypass exists where attackers can evade the `readEntries()` check by using canonically equivalent entry names, such as './hello.txt' and 'hello.txt'. This allows the creation of ZIP archives where `getEntry()` or `readAsText()` validates benign content, but `extractAllTo()` writes malicious content to the same path, bypassing integrity checks.

An issue exists where attackers can execute arbitrary JavaScript by embedding a custom `!js` YAML tag. During document parsing, the construct callback unconditionally calls the `eval()` function on attacker-supplied string values. Applications parsing untrusted YAML input using this library are exposed to full Node.js runtime authority, which includes the ability to access environment variables, read and write to the filesystem, access the network, and execute subprocesses. There is no safe-mode alternative or opt-out mechanism available.

Improper access control exists within the admin controllers located under `Espace admin/controleur/`. Unauthenticated attackers can bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. This occurs because the PHP `header()` redirect function is not followed by an `exit` or `die` call, allowing subsequent code and database operations to execute regardless of the session state. Attackers can trigger destructive administrative actions, such as record deletion, by targeting controller endpoints using the `supp` GET parameter.

Atals-Livre contains a SQL injection flaw that allows attackers to manipulate database queries. This occurs when unsanitized input is passed through a GET parameter to the `supp()` deletion helper function. Attackers can inject malicious SQL syntax to perform unauthorized database operations, such as extracting or deleting data.