Asjidkalam

An OS command injection flaw allows attackers to execute arbitrary commands by injecting shell metacharacters into the source paths, destination path, or the `maxHeap` option. This occurs because the `child process.exec()` function runs these inputs through a shell using the privileges of the Node.js process. Attackers can trigger this by providing file names or options containing double quotes, semicolons, `$()`, or backticks.

fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing proto , constructor or prototype key segments. Attackers can pass [ proto ] or [constructor.prototype] table headers or proto .x dotted keys to parse() to pollute all objects, causing denial of service or authorization bypass.

A use after free issue exists in the Cast component. A remote attacker who has already compromised the renderer process can potentially achieve a sandbox escape by using a specially crafted HTML page. Use after free is a memory corruption flaw that occurs when an application continues to use a pointer after it has been freed.

An uninitialized use in the GamepadAPI allows a remote attacker who has compromised the renderer process to obtain potentially sensitive information from process memory through a crafted HTML page.

A use after free issue in FileSystem allows a remote attacker to potentially perform a sandbox escape by using a crafted HTML page. Use after free is a memory corruption flaw that occurs when an application continues to use a pointer after it has been freed.