Eqstlab

**Name of the Vulnerable Software and Affected Versions** @fastify/http-proxy versions prior to 11.6.2 **Description** An unauthenticated network attacker can exploit a path traversal issue where proxied HTTP request paths are not validated for backslash-based dot-segments before being forwarded to the upstream server. The plain HTTP request handler bypasses the destination validation used by WebSocket paths, and the underlying `reply-from` library only rejects forward-slash traversal. This allows requests containing backslash dot-segments to escape the boundaries defined by the `prefix` and `rewritePrefix` options, enabling access to internal upstream paths and the disclosure of hidden endpoints. **Recommendations** Upgrade to @fastify/http-proxy version 11.6.2 or later.

**Name of the Vulnerable Software and Affected Versions** oidcc versions 3.2.0-beta.1 through 3.8.9 **Description** Improper verification of cryptographic signatures allows an unauthenticated attacker to impersonate any user. The issue occurs when the software accepts a JSON Web Encryption (JWE) wrapping unsigned claims as fully validated, failing to require a nested signature as mandated by OpenID Connect Core 1.0 and JARM processing rules. This allows an attacker with the relying party's public encryption key to create tokens with arbitrary `sub`, `iss`, and `aud` values without the provider's signing key. The flaw exists in the `verify decrypted token/4` function within `oidcc jwt util`, where decrypted payloads that are not signed JWS are parsed as plaintext claims. Subsequently, the `int validate jwt/4` function in `oidcc token` returns success based on the JOSE structure type rather than signature verification. Additionally, the `validate jarm/3` function in `oidcc token` is reachable via the browser front channel. This is only exploitable if the OpenID Provider advertises ID token or authorization response encryption and the relying party has an encryption key configured. **Recommendations** Update oidcc to version 3.9.0 or later.

**Name of the Vulnerable Software and Affected Versions** mcp-shell versions prior to 0.6.0 **Description** An OS Command Injection issue exists in the `shell exec` MCP tool. The software implements a secure mode that restricts command execution to an allowlist of executables defined in `security.yaml`, which by default includes `/usr/bin/git`. However, the security validator in `security.go` fails to block the `!` character in the `containsShellMetacharacters()` and `containsDangerousShellConstructs()` functions. An attacker can exploit this by providing a command argument such as `/usr/bin/git -c alias.pwn=!<arbitrary-command>`, which leverages Git's ability to create shell aliases to execute arbitrary OS commands as the `mcp-shell` process user. In default Docker deployments, this is exploitable without additional authentication beyond MCP connectivity. **Recommendations** Update mcp-shell to version 0.6.0. As a temporary workaround, remove `/usr/bin/git` from the `allowed executables` list in `security.yaml` or restrict access to the `shell exec` tool.

**Name of the Vulnerable Software and Affected Versions** mcp-shell versions prior to 0.6.0 **Description** An OS command injection issue exists in the `shell exec` MCP tool. The software implements a secure mode that restricts command execution to an allowlist defined in `security.yaml`. However, the default Docker configuration includes `/bin/bash` in the `allowed executables` list. The validation logic in `security.go` only verifies the first token of the command and fails to reject the shell command-mode flag `-c`. An attacker can bypass the allowlist by providing a command such as `/bin/bash -c <arbitrary-command>` to the `shell exec` tool. This input passes validation and is executed via `exec.CommandContext` in `executor.go`, allowing arbitrary OS command execution inside the container as the `mcpuser` user. This bypass requires no authentication or configuration changes. **Recommendations** Update mcp-shell to version 0.6.0. As a temporary mitigation, remove `/bin/bash` from the `allowed executables` list in the `security.yaml` configuration file.

**Name of the Vulnerable Software and Affected Versions** hbs versions 2.1.0 through 4.2.1 **Description** The `registerAsyncHelper` API in the hbs Express view engine bypasses the automatic HTML escaping of Handlebars. During the first render pass, an async helper returns an opaque placeholder that is escaped; however, hbs subsequently replaces this placeholder with the raw callback return value without escaping it. This occurs across cached, uncached, and layout render paths. If an application passes attacker-influenced data, such as user-supplied content from a database, into an async helper callback, it can lead to stored or reflected cross-site scripting (XSS), where arbitrary HTML and JavaScript are injected into the server-rendered page. **Recommendations** Upgrade to version 4.3.0.

**Name of the Vulnerable Software and Affected Versions** ash authentication versions 3.10.5 through 4.14.1 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.12 **Description** Improper authentication allows purpose-limited JSON Web Tokens (JWTs) to be replayed as full bearer API credentials when a resource uses stateless bearer-token verification. The helper function `retrieve from bearer/3` verifies the signature of an Authorization: Bearer JWT and rejects tokens with an `act` claim, but fails to verify if the token's `purpose` claim equals `user`. When the resource is configured with `require token presence for authentication?` set to `false`, the `validate token/3` helper returns `{:ok, nil}` without consulting the token resource, bypassing downstream purpose checks. Consequently, valid, non-expired JWTs issued for narrow purposes—such as the `sign in` token emitted by WebAuthn or the Password strategy—are accepted as general-purpose bearer credentials, granting full `current user` assignment. An attacker who obtains a valid `sign in` token can authenticate as the target subject, bypassing one-time-use and revocation semantics. This requires the application to use `retrieve from bearer/3` on a reachable route and employ either WebAuthn or the Password strategy with `sign in tokens enabled?` set to `true`. **Recommendations** Update ash authentication to version 4.14.2 or later. Update ash authentication to version 5.0.0-rc.13 or later. Set `require token presence for authentication?` to `true` to enforce purpose verification against the stored token record. Restrict access to routes utilizing the `retrieve from bearer/3` helper function.

**Name of the Vulnerable Software and Affected Versions** QWED versions prior to 5.1.2 **Description** Authenticated users can execute arbitrary Python code within the API server process because the `qwed` package passes user-controlled math expressions to the SymPy `parse expr()` function without restricting the `global dict` and `local dict` namespaces. Since `parse expr()` internally utilizes Python's `eval()`, this allows for full system compromise, including reading or writing files, executing operating system commands, and accessing data from other tenants in shared deployments. Technical details include two vulnerable paths: - The `POST /verify/math` endpoint reads the `expression` variable and passes it to `parse expr()` after a cosmetic normalization. - The `POST /verify/batch` endpoint processes items where the `query` variable is passed to `parse expr()` when the type is set to `VerificationType.MATH`. Attackers can obtain the necessary authentication by using the default-enabled `POST /auth/signup` endpoint to create a tenant account and the `POST /auth/api-keys` endpoint to generate an API key. **Recommendations** Update QWED to version 5.1.2. As a temporary mitigation, restrict access to the `POST /verify/math` and `POST /verify/batch` endpoints or disable the `POST /auth/signup` endpoint to prevent unauthorized account creation.

**Name of the Vulnerable Software and Affected Versions** ArcadeDB versions prior to 26.8.1 **Description** An issue exists in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. Authenticated attackers can craft LOAD CSV queries pointing to internal network addresses or cloud metadata endpoints, causing the server to fetch and return sensitive data from restricted services. This is a server-side request forgery, which occurs when a server is tricked into making requests to an unintended location. **Recommendations** Update ArcadeDB to version 26.8.1 or later.

**Name of the Vulnerable Software and Affected Versions** @neo4j/graphql versions prior to 7.5.6 @neo4j/graphql versions prior to 5.12.14 **Description** The library fails to verify the authenticity of a pre-decoded JSON Web Token (JWT) object provided by a client through GraphQL subscription `connectionParams`. An unauthenticated remote client establishing a GraphQL-over-WebSocket connection can forge arbitrary JWT claims, such as `sub` and `roles`, within `connectionParams.jwt`. These forged claims are accepted as a valid authenticated identity during the evaluation of `@authentication` and `@subscriptionsAuthorization` directives, allowing an attacker to receive subscription events intended for restricted roles or users. **Recommendations** Update to version 7.5.6 or later. Update to version 5.12.14 or later.

**Name of the Vulnerable Software and Affected Versions** @fastify/aws-lambda version 6.4.0 **Description** In the default configuration, the getter that populates request decorations reads the client-controlled `x-apigateway-event` and `x-apigateway-context` HTTP headers before falling back to the trusted internal request token. Because these reserved headers are not stripped from the incoming event, an unauthenticated attacker can set these headers to forge the entire Lambda proxy event, including the authorizer context. This allows the attacker to override genuine data, leading to a full authentication and authorization bypass and privilege escalation for applications that rely on `request.awsLambda.event` or `request.awsLambda.context` for identity or access control. **Recommendations** Upgrade to @fastify/aws-lambda version 6.4.1.

**Name of the Vulnerable Software and Affected Versions** Network-AI versions prior to 5.13.4 **Description** An improper cryptographic signature verification issue exists in the APSAdapter component. The default local verifier incorrectly accepts any non-empty string as a valid signature. This allows unauthenticated attackers to submit forged APS delegation payloads with arbitrary scopes, bypassing signature verification to obtain signed permission-grant tokens for sensitive resources, such as `SHELL EXEC`. **Recommendations** Update Network-AI to version 5.13.4 or later.

**Name of the Vulnerable Software and Affected Versions** clawvet self-hosted API server (apps/api) versions prior to 0.7.5 **Description** The software contains a hard-coded fallback JWT (JSON Web Token) secret in `auth.ts` and provides it as the default in `.env.example`. An unauthenticated remote attacker can exploit this by first accessing the 'GET /api/v1/scans' endpoint to harvest `userId` values. Using the known secret, the attacker can forge a valid HS256 `cg session` cookie offline and subsequently call the 'GET /api/v1/auth/me' endpoint to retrieve a victim's email address, subscription plan, and secret `apiKey`. **Recommendations** Update clawvet self-hosted API server (apps/api) to version 0.7.5 or later.

**Name of the Vulnerable Software and Affected Versions** Prowler versions prior to 5.30.3 **Description** The SAML authentication flow trusts the email domain asserted in a SAMLResponse to determine the recipient tenant of the final token. Additionally, the ACS finish logic in the endpoint 'api/src/backend/api/v1/views.py' recalculates the tenant based on the `user.email` variable instead of binding token issuance to the validated SAML configuration. An authenticated attacker using a controlled SAML Identity Provider (IdP) can complete a valid SAML flow for a domain they control while asserting an email address from a different configured domain. This allows the issuance of a SAMLToken and a tenant-scoped JSON Web Token (JWT)—a compact, URL-safe means of representing claims to be transferred between two parties—for the incorrect tenant, leading to cross-tenant account takeover. **Recommendations** Update to version 5.30.3.

**Name of the Vulnerable Software and Affected Versions** @opentelemetry/propagator-jaeger versions prior to 2.9.0 **Description** The @opentelemetry/propagator-jaeger component decodes incoming `uber-trace-id` and `uberctx-*` HTTP header values using the `decodeURIComponent()` function without proper error handling. An unauthenticated remote attacker can send a malformed percent-encoded value, triggering an uncaught URIError (a type of error occurring when the URI decoding function encounters an invalid sequence) that terminates the Node.js process utilizing the `JaegerPropagator` as the active propagator. **Recommendations** Update to version 2.9.0.

**Name of the Vulnerable Software and Affected Versions** Cline versions prior to 3.0.30 **Description** The Cline Hub dashboard server, initiated via the `cline dashboard` command, fails to validate the Origin header for WebSocket connections on the `/browser` endpoint. When the `ROOM SECRET` is unset for local 127.0.0.1 binds, the `isAuthorizedBrowserRequest()` function allows malicious websites to send `desktopCommand` frames. This can lead to the unauthorized reading of workspace state, mutation of MCP and provider settings, and trigger command execution if a provider or model is configured. **Recommendations** Update to version 3.0.30.

**Name of the Vulnerable Software and Affected Versions** @rtk-ai/rtk-rewrite version 1.0.0 **Description** The @rtk-ai/rtk-rewrite OpenClaw plugin fails to properly escape input passed to a shell-backed `execSync()` function. While `JSON.stringify()` is used to wrap values in double quotes, it does not neutralize shell metacharacters such as `$()` and backticks. Since `execSync()` delegates execution to `/bin/sh -c`, the shell performs command substitution within double-quoted strings. An attacker capable of influencing the `command` parameter of the exec tool, such as through an LLM agent prompt or gateway input, can execute arbitrary operating system commands with the privileges of the plugin or gateway process. **Recommendations** Update @rtk-ai/rtk-rewrite to a version newer than 1.0.0. As a temporary mitigation, restrict or sanitize the `command` parameter used in the exec tool to prevent the injection of shell metacharacters.

**Name of the Vulnerable Software and Affected Versions** MCP Appium versions prior to 1.85.10 **Description** The `createLocatorGeneratorUI` function fails to escape HTML or JavaScript context when interpolating element attributes—specifically `text`, `content-desc`, `resource-id`, and locator selector values—into an HTML template literal. An attacker controlling the UI of the application under test can inject arbitrary HTML and JavaScript into the MCP UI resource returned by the `generate locators` tool. When the MCP client renders this resource, the injected script executes and can invoke arbitrary MCP tools via `window.parent.postMessage`, enabling unauthorized actions such as taking screenshots or reading page source. **Recommendations** Update to version 1.85.10.

**Name of the Vulnerable Software and Affected Versions** Pi versions prior to 0.79.0 **Description** Pi loaded project-local configuration and resources from a repository's `.pi` directory, including executable TypeScript or JavaScript modules known as project-local extensions, without requiring the user to trust the repository. Because extensions are not sandboxed and run within the Pi process, an attacker controlling a repository could execute arbitrary code with the same privileges as the local Pi process if a user started Pi from that working tree. This allows access to files, environment variables, credentials, the network, and local tools available to the user. The issue resides in the project resource loading path, where `.pi/settings.json`, auto-discovered resources, package-managed resources, and project instruction files were loaded during session initialization before a trust boundary was established. **Recommendations** Update Pi to version 0.79.0 or later. As a temporary workaround, avoid running Pi in untrusted repositories or use an external operating-system sandbox, container, or VM to isolate the execution environment. Inspect and remove project-local Pi configuration and resources, specifically project-local extensions and package configuration, before use in untrusted repositories.