Bilerden

**Name of the Vulnerable Software and Affected Versions** protobufjs versions prior to 7.6.5 protobufjs versions prior to 8.6.6 **Description** protobufjs compiles protobuf definitions into JavaScript functions. The software parses option names by advancing through schema tokens until an = token is reached without verifying the end of the input. Consequently, a specially crafted .proto schema that opens an option declaration and ends prematurely can cause the `parse()`, `Root.load()`, or `Root.loadSync()` functions to loop indefinitely. **Recommendations** Update protobufjs to version 7.6.5 or later. Update protobufjs to version 8.6.6 or later.

**Name of the Vulnerable Software and Affected Versions** axios versions prior to 0.33.0 axios versions prior to 1.18.0 **Description** axios is susceptible to read-side prototype pollution gadgets that can alter request construction if `Object.prototype` has been polluted by another vulnerability or dependency. In bodyless method aliases such as `axios.get()`, `axios.delete()`, `axios.head()`, and `axios.options()`, the software reads inherited `data` via `(config || {}).data` before config normalization. This allows an attacker to inject a controlled request body into requests that were not intended to have one, potentially corrupting request semantics on the receiving service. Additionally, low-level paths are affected when exported adapters or helpers (such as `lib/adapters/http.js` and `unsafe/helpers/resolveConfig.js`) are called directly with plain configurations. In these instances, the software may inherit polluted `proxy` values, routing requests through an attacker-controlled proxy, or polluted `paramsSerializer` values, allowing attacker-controlled URL serialization. These low-level issues do not occur during normal high-level axios calls in versions 1.15.2 and later. **Recommendations** Update axios to version 0.33.0 or later. Update axios to version 1.18.0 or later. As a temporary mitigation, explicitly pass `data: undefined` when using bodyless method aliases in environments where prototype pollution is a concern. Avoid processing untrusted input with libraries or code paths capable of polluting `Object.prototype`.

**Name of the Vulnerable Software and Affected Versions** Nokogiri versions prior to 1.19.4 **Description** In the JRuby implementation, the `NONET` parse option—enabled by default for `Nokogiri::XML::Schema`—was not correctly enforced. This allows a schema parsed with default options to fetch external resources over the network, which could lead to Server-Side Request Forgery (SSRF) or XML External Entity (XXE) attacks. SSRF is a technique where an attacker induces a server to make requests to an unintended location, and XXE is an attack that interferes with an application's processing of XML input. **Recommendations** Update to version 1.19.4.

**Name of the Vulnerable Software and Affected Versions** CarrierWave versions prior to 2.2.7 CarrierWave versions prior to 3.1.3 **Description** CarrierWave is a framework used to upload files from Ruby applications. The `content type denylist` check fails to escape regex metacharacters in string entries, causing the denylist to silently fail when matching the content types it is intended to block. In the `denylisted content type()` function, denylist entries are interpolated directly into a regular expression without using `Regexp.quote` or anchoring. For example, an entry like `image/svg+xml` is treated as a pattern where the `+` character is interpreted as a quantifier rather than a literal character, preventing it from matching the actual MIME type. Other content types containing regex metacharacters, such as `application/xhtml+xml`, are similarly affected. This allows an attacker to upload files, such as SVG files containing arbitrary JavaScript, which can lead to stored Cross-Site Scripting (XSS) if the application serves the file inline from its own origin. **Recommendations** Update to version 2.2.7 for users on the 2.x branch. Update to version 3.1.3 for users on the 3.x branch. As a temporary workaround, restrict the use of the `content type denylist` feature until the software is updated.