Devnoscope

Several issue routes of the REST API do not verify if a repository is archived. While the web interface prevents changes to issues and pull requests in archived repositories, an authorized user can bypass these restrictions via the API to edit, close, or delete issues, modify labels and deadlines, manage tracked time and stopwatches, add reactions, change issue blocks, and pin issues. This allows the alteration of data that is intended to be frozen by the archiving process.

A sandbox escape issue exists in the extension script engine of alf.io, an open source ticket reservation system. An authenticated administrator can execute arbitrary operating system commands on the server. The system uses a sandboxed Rhino environment to execute restricted JavaScript; however, the use of an unguarded injected Java object `returnClass` combined with an incomplete AST (Abstract Syntax Tree) blocklist allows the sandbox to be bypassed via Java reflection. This flaw can be triggered through the Extensions API.

An access control flaw exists in the container registry and Composer package handling. The issue allows unauthenticated remote attackers to pull private container images and view private or internal Composer package source links. This occurs because the system fails to properly enforce the private flag and lacks sufficient permission checks when rendering or serving package source metadata. An attacker can exploit this by querying Composer package endpoints or sending standard anonymous Docker/OCI pull requests to the registry API. This flaw persisted for nearly four years and potentially affects over 30,000 deployments worldwide, including approximately 4,000 production systems on major cloud platforms. Exposure of this data can lead to the disclosure of sensitive information, such as source code, secrets, and internal infrastructure details.