Christ Bouchuen

An out-of-bounds write issue exists in the M421 G-code handler when the software is built with `MESH BED LEVELING` enabled. An attacker can corrupt firmware memory by providing out-of-range X and Y grid indices through a crafted G-code command sent via USB serial, network interface, or a malicious gcode file. This allows a 32-bit float value to be written past the `z values` array bounds, which can lead to the corruption of adjacent firmware variables, resulting in firmware state corruption or denial of service.

A stored cross-site scripting issue exists where authenticated users with the `STANDARD REGISTRY` role can inject malicious scripts. This occurs by submitting a crafted `companyName` value through the branding configuration API endpoint. The flaw is caused by an unsanitized `innerHTML` assignment in the branding service, which allows arbitrary JavaScript to execute in the browser of every authenticated user upon every page load.

An issue in the `/ log` HTTP handler allows unauthenticated network-adjacent attackers to execute arbitrary code on the host system. The handler processes JSON request bodies by passing user-supplied data to the `vm.runInNewContext()` function combined with `eval()`. Because the `vm` module is not a security mechanism, attackers can escape the Node.js sandbox by leveraging a host-context Function reference through `util.format` to access the host process via `this.constructor.constructor`. This allows for full remote code execution on the underlying system. The `/ log` endpoint is particularly susceptible as it does not require the UUID authentication used by other handlers like ` progress` and ` report`.

An authentication bypass exists in the 'GET /api/v1/demo/registered-users' endpoint. This allows unauthenticated attackers to retrieve sensitive user information, including usernames, Hedera DIDs, parent registry DIDs, system roles, and policy role assignments for all registered users in the system.

Name of the Vulnerable Software and Affected Versions Hashgraph Guardian versions through 3.5.0 Description Hashgraph Guardian through version 3.5.0 has an unsandboxed JavaScript execution issue in the Custom Logic policy block worker. Authenticated Standard Registry users can execute arbitrary code by supplying JavaScript expressions directly to the Node.js Function() constructor without isolation. This allows attackers to import native Node.js modules to read arbitrary files from the container filesystem, access process environment variables containing sensitive credentials such as RSA private keys, JWT signing keys, and API tokens, and forge valid authentication tokens for any user, including administrators. Recommendations Update to a version later than 3.5.0.

BrowserStack Runner contains a path traversal issue in the ` default` HTTP handler within `lib/server.js`. This allows unauthenticated network-adjacent attackers to access the HTTP server bound on all interfaces to traverse outside the project root and read arbitrary sensitive files. Notepad++ contains an issue where the installer allows unprivileged users to gain SYSTEM-level privileges due to insecure executable search paths. An attacker could use social engineering or clickjacking to trick users into downloading both the legitimate installer and a malicious executable into the same directory, resulting in the automatic execution of the attack with SYSTEM privileges upon running the installer.