Ethankim88

**Name of the Vulnerable Software and Affected Versions** Starlette (affected versions not specified) FastAPI (affected versions not specified) **Description** A Denial of Service (DoS) issue exists in the `request.form()` function when processing `application/x-www-form-urlencoded` requests. While limits for `max fields` and `max part size` are enforced for `multipart/form-data`, they are ignored for url-encoded bodies. This allows an unauthenticated attacker to cause resource exhaustion through two methods: sending a large number of fields (e.g., 1,000,000 fields), which blocks the worker's event loop and consumes CPU, or sending a single very large field, which forces unbounded memory allocation. **Recommendations** Upgrade to a patched version of Starlette and FastAPI to ensure `max fields` and `max part size` are enforced for url-encoded parsers. As a temporary workaround, restrict the request body size via a reverse proxy to reduce the risk of memory exhaustion, although this may not fully prevent event-loop blocking.

**Name of the Vulnerable Software and Affected Versions** Pillow versions 10.3.0 through 12.1.x **Description** Processing a malicious PSD file can lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This occurs because bounds checks for tile extents in PSD image decoding and encoding used types susceptible to integer overflow. A PSD image with specifically crafted tile dimensions could cause values to wrap around, bypassing the checks and triggering an out-of-bounds write in the `src/decode.c` and `src/encode.c` files. **Recommendations** Update to version 12.2.0.

Name of the Vulnerable Software and Affected Versions Drizzle versions prior to 0.45.2 and 1.0.0-beta.20 Description Drizzle ORM does not properly escape quoted SQL identifiers in its `escapeName()` implementations. This can allow an attacker to terminate the quoted identifier and inject SQL when applications pass attacker-controlled input to APIs that construct SQL identifiers or aliases, such as `sql.identifier()` and `.as()`. Recommendations Update to version 0.45.2 or 1.0.0-beta.20.

**Name of the Vulnerable Software and Affected Versions** Kysely versions up to and including 0.28.11 **Description** Kysely, a type-safe TypeScript SQL query builder, has a SQL injection issue in JSON path compilation for MySQL and SQLite dialects. The `visitJSONPathLeg()` function directly appends user-controlled values from `.key()` and `.at()` into single-quoted JSON path string literals without escaping single quotes. This allows an attacker to break out of the JSON path string context and inject arbitrary SQL. This behavior differs from `sanitizeIdentifier()`, which correctly handles delimiters for identifiers. The issue arises because both identifiers and JSON path keys are non-parameterizable SQL constructs requiring manual escaping, but only identifiers are protected. PostgreSQL is not affected as it uses a different approach to JSON path construction that includes proper string literal sanitization. A proof-of-concept demonstrates the ability to exfiltrate data, such as an administrator password, from a SQLite database using a crafted JSON key name. This issue can be exploited in applications that dynamically select JSON fields, such as search APIs or admin panels. **Recommendations** Versions prior to 0.28.12 are vulnerable. Update to version 0.28.12 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Sequelize versions prior to 6.37.8 **Description** Sequelize, a Node.js ORM tool, contains a SQL injection flaw due to unescaped cast type handling within JSON/JSONB where clause processing. The ` traverseJSON()` function splits JSON path keys using '::' to determine a cast type, which is then directly incorporated into SQL queries using `CAST(... AS <type>)`. An attacker controlling JSON object keys can inject arbitrary SQL code, potentially leading to data exfiltration from any table. The vulnerable component is the ` traverseJSON()` function. **Recommendations** Update to version 6.37.8 or later.

**Name of the Vulnerable Software and Affected Versions** Multer versions prior to 2.1.0 **Description** A flaw exists in Multer, a node.js middleware used for processing `multipart/form-data`. This issue can be exploited to initiate a Denial of Service (DoS) attack by submitting specially crafted requests, which may lead to resource exhaustion. **Recommendations** Upgrade to version 2.1.0 to address the issue.

**Name of the Vulnerable Software and Affected Versions** path-to-regexp versions prior to 0.1.13 **Description** A flawed regular expression is generated when three or more parameters are present within a single segment, separated by characters other than a period (`.`). For example, `/:a-:b-:c` or `/:a-:b-:c-:d`. The backtrack protection introduced in `path-to-regexp@0.1.12` only addresses ambiguity for two parameters. With three or more parameters, the generated lookahead does not prevent single separator characters from causing capture groups to overlap, leading to catastrophic backtracking. Custom regular expression patterns defined in route definitions, such as `/:a-:b([^-/]+)-:c([^-/]+)`, are not affected as they override the default capture group. **Recommendations** Upgrade to path-to-regexp@0.1.13. As a workaround, provide a custom regular expression for parameters after the first in a single segment, ensuring it does not match the text preceding the parameter. For example, change `/:a-:b-:c` to `/:a-:b([^-/]+)-:c([^-/]+)`. If paths cannot be rewritten and versions cannot be upgraded, limit the URL length.