Bilerden

protobufjs compiles protobuf definitions into JavaScript functions. The software parses option names by advancing through schema tokens until an = token is reached without verifying the end of the input. Consequently, a specially crafted .proto schema that opens an option declaration and ends prematurely can cause the `parse()`, `Root.load()`, or `Root.loadSync()` functions to loop indefinitely.

axios is susceptible to read-side prototype pollution gadgets that can alter request construction if `Object.prototype` has been polluted by another vulnerability or dependency. In bodyless method aliases such as `axios.get()`, `axios.delete()`, `axios.head()`, and `axios.options()`, the software reads inherited `data` via `(config || {}).data` before config normalization. This allows an attacker to inject a controlled request body into requests that were not intended to have one, potentially corrupting request semantics on the receiving service. Additionally, low-level paths are affected when exported adapters or helpers (such as `lib/adapters/http.js` and `unsafe/helpers/resolveConfig.js`) are called directly with plain configurations. In these instances, the software may inherit polluted `proxy` values, routing requests through an attacker-controlled proxy, or polluted `paramsSerializer` values, allowing attacker-controlled URL serialization. These low-level issues do not occur during normal high-level axios calls in versions 1.15.2 and later.

In the JRuby implementation, the `NONET` parse option—enabled by default for `Nokogiri::XML::Schema`—was not correctly enforced. This allows a schema parsed with default options to fetch external resources over the network, which could lead to Server-Side Request Forgery (SSRF) or XML External Entity (XXE) attacks. SSRF is a technique where an attacker induces a server to make requests to an unintended location, and XXE is an attack that interferes with an application's processing of XML input.

CarrierWave is a framework used to upload files from Ruby applications. The `content type denylist` check fails to escape regex metacharacters in string entries, causing the denylist to silently fail when matching the content types it is intended to block. In the `denylisted content type()` function, denylist entries are interpolated directly into a regular expression without using `Regexp.quote` or anchoring. For example, an entry like `image/svg+xml` is treated as a pattern where the `+` character is interpreted as a quantifier rather than a literal character, preventing it from matching the actual MIME type. Other content types containing regex metacharacters, such as `application/xhtml+xml`, are similarly affected. This allows an attacker to upload files, such as SVG files containing arbitrary JavaScript, which can lead to stored Cross-Site Scripting (XSS) if the application serves the file inline from its own origin.