Cruzryan

**Name of the Vulnerable Software and Affected Versions** simple-git versions prior to 4.0.0 **Description** The default `blockUnsafeOperationsPlugin` compares parsed option names with literal dangerous option spellings, but Git accepts unambiguous long-option abbreviations. This allows attacker-influenced push arguments, such as abbreviated forms of `--receive-pack` or `--exec`, to bypass the `detectVulnerableFlags` function. Consequently, Git may invoke an attacker-selected command when these arguments are passed to a local or file remote, or an attacker-influenced receive-pack target. **Recommendations** Update to version 4.0.0.

**Name of the Vulnerable Software and Affected Versions** ip-address versions 10.2.0 through 10.5.0 **Description** The `Address6.isPrivate` classifier in `src/ipv6.ts` fails to recognize the NAT64 local-use range `64:ff9b:1::/48`. Consequently, the `isPrivate()`, `isLoopback()`, and `isLinkLocal()` functions return `false` for addresses within this range, causing internal IPv4 destinations encoded via a local-use NAT64 prefix to be incorrectly identified as global addresses. This can lead to a trust-boundary bypass in applications using these checks to prevent Server-Side Request Forgery (SSRF), an attack where a user-supplied address tricks a server into making requests to internal destinations, such as loopback services or cloud metadata endpoints. Exploitation requires the server network to use an operator-selected NAT64 prefix within the local-use range. **Recommendations** Update ip-address to version 10.5.1. As a temporary workaround, manually test if a host is within the NAT64 local-use range by using `isHostInSubnet()` with the `64:ff9b:1::/48` subnet.

**Name of the Vulnerable Software and Affected Versions** stream-json versions prior to 3.6.0 **Description** The Assembler component materializes object properties using plain assignment. When an input key is named ` proto `, it invokes the inherited setter, leading to the replacement of the parsed object prototype instead of creating an own data property. This can allow applications that rely on inherited values for authorization or feature decisions to consume attacker-controlled properties. Additionally, a null prototype may disrupt code expecting standard Object.prototype methods. While the global Object.prototype is not polluted, the issue occurs when parsing untrusted JSON. **Recommendations** Update to version 3.6.0.