Eclipssec

An issue exists where authenticated users can manipulate the read-only `external id` field via the team create and update endpoints. This mass assignment allows attackers to mark a team they create or manage as externally managed, which prevents the removal of team members and causes users authenticated via Single Sign-On (SSO) to be removed from the team during their next login.

A stored cross-site scripting issue exists in the `html.clean()` function. The problem occurs when iframes are rebuilt from `data-se-iframe-holder-attrs` JSON without properly filtering the `srcdoc` or uppercase `SRC` keys. This allows attackers to inject malicious HTML via paste, `html.set`, or `html.insert` operations, leading to script execution in the host page origin when a user loads or pastes the affected content.

An authentication bypass exists during the staff invite acceptance process. This issue allows users to specify any email address when creating their account, enabling attackers to use leaked invite tokens with email addresses they control. Additionally, legitimate recipients may register using unintended email providers.

A path traversal issue exists in the Btrfs storage driver within the `unpackVolume()` function. An authenticated user with instance creation privileges can delete or replace arbitrary files and directories on the host filesystem with root privileges. This is achieved by providing a crafted `subvolumes[].path` entry in the `backup/optimized header.yaml` file during a Btrfs optimized backup import.

Compliance-trestle is subject to server-side template injection, which can lead to remote code execution. This occurs because the `MDCleanInclude` and `MDSectionInclude` Jinja2 tags re-parse untrusted Markdown content as template source code using a non-sandboxed `jinja2.Environment`. An attacker who controls content rendered by the tool, such as a crafted workspace Markdown file, a third-party SSP document, or a YAML lookup-table value, can inject a Jinja2 expression to traverse Python object internals and execute arbitrary operating system commands within the context of the process.