Deprrous

Several components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. This occurs in a file-search agent middleware that validates a starting directory but fails to validate the search pattern or the resolved target of matched files, allowing glob patterns and symlinks to access files outside the configured root. Additionally, prompt and chain/agent-configuration loaders resolve path fields without confining them to a trusted base or rejecting symlink targets. Furthermore, path-prefix authorization checks use string prefix comparison without a path-segment boundary, which allows sibling paths sharing the same prefix to be accepted. If these components process path values, search patterns, or workspace contents influenced by an untrusted source, such as an LLM acting on untrusted input, it can lead to the disclosure of files outside the intended boundary.

The ` url to size()` helper function, utilized by `get num tokens from messages` for image token counting, contains a Time-of-Check to Time-of-Use (TOCTOU) flaw. The function validates URLs for Server-Side Request Forgery (SSRF) protection and subsequently fetches them using a separate network operation with independent DNS resolution. This creates a DNS rebinding window where an attacker-controlled hostname can resolve to a public IP during the validation phase and then resolve to a private or localhost IP during the actual fetch operation.

The Select schema plugin fails to sanitize option values before interpolating them into HTML via `innerHTML`. This allows attackers to supply malicious templates with crafted option values containing HTML and JavaScript, leading to arbitrary code execution in the browsers of users who view or interact with the template. The issue occurs in the `ui` renderer within `packages/schemas/src/select/index.ts`, where values from the `options` array in the template JSON are directly inserted into `<option>` elements without escaping special characters. This can be exploited through file uploads, shared templates, or the `updateTemplate()` API.

The SVG schema plugin renders user-supplied SVG content directly to `innerHTML` without proper sanitization. This occurs in the `ui` renderer within the `packages/schemas/src/graphics/svg.ts` file when in viewer mode or form mode with `readOnly` set to `true`. While the `isValidSVG()` function checks for basic SVG tags and well-formedness, it fails to block malicious elements such as `<script>` tags, event handler attributes (e.g., `onload`, `onerror`), `<foreignObject>` elements containing HTML, or `<animate>` elements with `onbegin` handlers. An attacker can exploit this by providing a malicious template or user-controlled data, leading to arbitrary JavaScript execution in the user's browser. This could result in session hijacking, keylogging of form inputs, phishing, or data exfiltration.

fast-xml-parser allows users to process XML from JavaScript objects without relying on C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass that allows numeric character references (&amp;#NNN;, &amp;#xHH;) and standard XML entities to circumvent entity expansion limits (like `maxTotalExpansions` and `maxExpandedLength`) originally implemented to address CVE-2026-26278. This bypass enables a denial of service through XML entity expansion. The root cause is that the `replaceEntitiesValue()` function in `OrderedObjParser.js` only enforces expansion counting on entities defined in DOCTYPE, while the loop handling numeric and standard entities does not perform any counting. An attacker can supply a large number of numeric entity references, such as 1M instances of &#65;, to force significant memory allocation (approximately 147MB) and high CPU usage, potentially crashing the process even with strict limits configured.