Classif1Ed_Mick

**Name of the Vulnerable Software and Affected Versions** node-poppler versions 9.1.2 and 10.0.1 **Description** An argument injection flaw exists in the Argument Injection Handler component within the `src/index.js` file. A remote attacker can trigger this issue by manipulating the `file path` argument used in the following functions: `pdfInfo()`, `pdfToText()`, `pdfToCairo()`, `pdfToPpm()`, `pdfImages()`, `pdfToHtml()`, `pdfToPs()`, `pdfFonts()`, `pdfDetach()`, `pdfAttach()`, `pdfSeparate()`, and `pdfUnite()`. **Recommendations** Apply patch db6e3f79d3beb20601be7e59669c39811ae3c330 for version 9.1.2. Apply patch db6e3f79d3beb20601be7e59669c39811ae3c330 for version 10.0.1.

**Name of the Vulnerable Software and Affected Versions** peerigon unzip-crx versions prior to 0.2.1 peerigon unzip-crx-3 versions prior to 0.2.1 **Description** A path traversal flaw exists in the Archive Extraction component within the `unzip()` function of the `dist/index.js` file. A local attacker can manipulate the `destination` argument to access or overwrite files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables such as file paths. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** cleverbrush framework and deep versions prior to 4.4.1 **Description** Prototype Pollution occurs in the `deepExtend()` function within the `libs/deep/src/deepExtend.ts` file. This issue allows for the improperly controlled modification of object prototype attributes, which can be exploited remotely. **Recommendations** Upgrade to version 4.4.1.

**Name of the Vulnerable Software and Affected Versions** zackees transcribe-anything versions prior to 4.1.1 **Description** A flaw in the Yt-dlp Download component allows remote os command injection. The issue occurs within the `ytdlp download()` function located in the `src/transcribe anything/ytldp download.py` file when the `url` argument is manipulated. OS command injection is a vulnerability that allows an attacker to execute arbitrary operating system commands on the server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the `url` argument in the `ytdlp download()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** mcp-ffmpeg-helper versions 0.1.0 through 0.2.1 **Description** An OS command injection issue exists within the Tool Handler component, specifically in the `handleToolCall()` function located in the `src/tools/handlers.ts` file. This occurs when the `format` argument is manipulated, allowing for the execution of arbitrary operating system commands. Local access is required to exploit this flaw. **Recommendations** As a temporary workaround, restrict the use of the `handleToolCall()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.