Davidcarliez

An issue exists where database Owners can bypass port-specific deny-net rules. This occurs when using JSON Web Key Set (JWKS) URLs that utilize implicit default ports. By configuring a JWT or record access method with a JWKS URL that omits port 80 or 443, an attacker can trigger blind GET requests to internal services that were explicitly denied.

The icon downloader fails to apply the `should block host()` check to the second-stage host when processing favicon URLs parsed from attacker-controlled HTML passed to `get page with referer()`. This allows a remote unauthenticated attacker to use an IP-literal URL in a favicon to bypass host normalization and force the server to reach loopback, private, or internal addresses. This issue occurs on instances where internal icon downloading is enabled and can lead to the exposure of internal responses or reveal internal network reachability through timing, status, and cache behavior.

Authenticated project members can bypass server-side request forgery (SSRF) protections by targeting the non-global 198.18.0.0/15 benchmarking range. This occurs because the `UnsafeIPv4` check omits this specific range, allowing attackers to configure alert-channel webhooks that point to internally routed services. This can be used to perform blind internal probing and limited state-changing POST requests.

An authorization issue allows holders of a public token with session write access to obtain environment-wide S2 stream credentials during session input initialization. These credentials can be used against the storage API to create, append, or trim other session and run streams, which enables the forgery of output or the permanent deletion of records.

An MCP server accessed over HTTP may deliver responses and notifications from one client to another. This occurs when clients share a single stateless transport, `McpServer` instance, or `Server` instance. The issue stems from messages being matched to a connection using only the JSON-RPC `id`. Since SDK clients typically start numbering requests from 0, these identifiers collide during normal operation.

When the HTML backend renders pages in a headless browser using `HTMLBackendOptions(render page=True)`, the `enable local fetch` option is not enforced. The function `HTMLDocumentBackend. get browser request block reason` allows `file:` URLs unconditionally, failing to confine local requests to the source document directory. This allows a crafted HTML file to embed arbitrary local text files (such as `.env` or credential files) into a browser-rendered page image when the `playwright` dependency is installed and the input is provided as a filesystem `Path`. This disclosure is passive, as only content rendered visibly within the page viewport is captured.

The `validate url safety` function in `docling/backend/utils/image resource loader.py` performs a single IPv4 lookup to validate a hostname but subsequently allows the HTTP client to resolve and parse the original URL again. This behavior enables DNS rebinding, mixed public and internal address records, and backslash authority parser disagreement, allowing access to internal services. Additionally, `HTMLBackendOptions(render page=True)` permits HTTP and HTTPS browser requests without validating the resolved destination. Exploitation requires remote fetching to be enabled, and the response content is only exposed if it is decoded as an image or passively rendered in a page screenshot.

An insecure direct object reference occurs in the 'POST' and 'DELETE' '/api/beszel/user-alerts' endpoints. This allows authenticated users to create or delete alerts for systems they are not authorized to access by providing arbitrary system IDs in the request body. This can lead to the disclosure of target system names and metrics through the resulting notifications.

In the 5xx request logging path within `jupyter server/log.py`, the Referer header is copied into a JSON header block without applying the token scrubbing typically used for the request URI. When a request returns an HTTP 500 error and the Referer header contains a URL with a token, that token is written to the server logs in plaintext. An attacker with access to these logs can recover the token to gain the permissions of the affected user.

An issue in the Custom MCP node allows authenticated attackers to achieve remote code execution. By supplying malicious npx package names through the `mcpServerConfig` parameter, an attacker can force the server to invoke npx with attacker-controlled npm packages, leading to arbitrary code execution on the server.

Nezha contains a Host header injection issue in the OAuth2 redirect endpoint. When the optional `dashboard host` setting is empty, the application reflects the attacker-supplied HTTP Host header into the `redirect uri` sent to the identity provider instead of using the configured `install host`. An attacker can induce a victim to start an OAuth2 login using a request with a forged Host header, causing the identity provider to send the victim's authorization code to an attacker-controlled callback URL. This allows the attacker to complete the login or binding flow and take over the account. This issue occurs at the `/api/v1/oauth2/{provider}` endpoint within the `oauth2redirect()` function.

The SFTP server evaluates configured path permissions using a literal string-prefix comparison instead of requiring a path-component boundary. This allows an authenticated low-privilege user scoped to a specific path to access sibling paths that begin with the same characters. For example, a user with access to `/tenants/alice` could potentially access `/tenants/alice-archive` or `/tenants/alice2`. This flaw enables a user to bypass Access Control List (ACL) boundaries to read or overwrite files belonging to other tenants.

The Node HTTP adapter in `lib/adapters/http.js` provides request options that lack a specific `createConnection` value. When a separate prototype pollution flaw is present in the same process, an attacker can place a function on `Object.prototype.createConnection`. Node then resolves and executes this inherited socket factory, enabling the attacker to control the transport endpoint. This allows the attacker to intercept request headers and bodies, including credentials, and provide malicious responses while the URL remains seemingly legitimate.

The software registers administrative node test endpoints that do not require the `Admin.Write` OAuth scope. This allows an OAuth client authorized only with the `Admin.Read` scope to submit attacker-controlled node definitions. This flaw enables blind server-side request forgery (SSRF)—a technique where an attacker forces a server to make requests to an unintended location—internal service probing, and the delivery of signed slave-style requests to arbitrary endpoints. The affected endpoints are 'POST /api/v4/admin/node/test' and 'POST /api/v4/admin/node/test/downloader'.

Server-side request forgery exists in the OpenAPI query import and REST query execution. Authenticated builder-level users can bypass DNS pinning protections using DNS rebinding attacks. This technique involves configuring hostnames that resolve to public addresses during the validation phase but resolve to loopback or private addresses during the actual connection, enabling unauthorized access to blocked internal HTTP services.

An authorization regression exists in the S3 attachment upload endpoint. This issue allows users with BASIC permissions to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The vulnerability occurred because the route permission check was changed from BUILDER to TABLE/WRITE, a permission that BASIC users possess by default. An attacker can specify arbitrary S3 buckets in the request body to generate presigned URLs, enabling unauthorized file uploads to any bucket accessible by the stored IAM credentials.

A server-side request forgery (SSRF) issue exists in the JWKS fetcher. The system validates the URL hostname string against allow-lists but fails to verify the resolved IP addresses. An attacker with the Owner role can configure an access method using an allow-listed hostname that resolves to private or loopback addresses, forcing the server to send GET requests to internal addresses that are otherwise blocked by direct URL access.

Authenticated users can leave stale public shares behind because the software fails to normalize paths before querying the share index in the `DeleteWithPathPrefix()` function. An attacker can delete a shared directory by using a path with a trailing slash and subsequently recreate the directory to expose new contents via the dormant public share URL.

A stored CSS injection exists in the Markdown image `resize()` media action. The `resize()` action within the `Excerpts::processMediaActions()` function writes caller-controlled values directly into the image's `styleAttributes`. A lower-privileged content editor can store a crafted image URL containing semicolon-delimited CSS declarations in the resize parameters. These declarations are rendered into the final `<img style=...>` attribute when a higher-privileged user views the page or preview. This allows for UI redress, overlay, and content-manipulation attacks, such as creating a full-viewport fixed overlay, without requiring JavaScript execution.

An issue exists in the ScopedFs component where the system validates the nearest existing ancestor of a dangling symlink as being within scope and subsequently follows that symlink during file creation. This allows an authenticated user possessing Create and Modify permissions to create files outside of their assigned scope.