Bikini

**Name of the Vulnerable Software and Affected Versions** Ladybird (affected versions not specified) **Description** A memory-safety flaw exists in the WebAssembly ESM-integration module loader. When a JavaScript function is imported into a WebAssembly module via the ESM path, `WebAssemblyModule.cpp` passes a stack-local `Wasm::FunctionType` by reference to `create host function()`. The host callback captures this reference, which becomes dangling once the ESM link-loop iteration ends and the `FunctionType` is destroyed. This allows the host callback to return an empty result vector for a statically non-empty result, causing the destination register to retain an attacker-influenced value. This value is then consumed by the WASM-GC `array.set` handler, which performs a null check and bit-casts the reference low bits to an `ArrayInstance` pointer, leading to an arbitrary write. A web page can exploit this chain to achieve code execution within the WebContent process. This issue is reachable from HTML content without requiring instrumentation or source modification. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NodeBB (affected versions not specified) **Description** NodeBB fails to bind the claimed author of an inbound ActivityPub object to the authenticated remote actor. While the inbound middleware verifies the HTTP-signature actor and the origin of the `object.id`, it does not validate that the `attributedTo` parameter corresponds to the sender. Because the `actors.assert()` function silently ignores numeric identifiers, a remote actor can set `attributedTo` to a numeric value, such as `1`, causing the system to attribute the post or private message to a local user ID, including the administrator account. This allows a remote attacker to forge posts and direct messages attributed to arbitrary local users. This issue requires the ActivityPub/federation feature to be enabled. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Disable the ActivityPub/federation feature to minimize the risk of exploitation.