Fg0X0

**Name of the Vulnerable Software and Affected Versions** CodeWhale versions prior to 0.8.64 **Description** The `js execution` tool fails to scrub parent process environment variables before spawning Node.js. This allows attackers to execute malicious JavaScript code that reads `process.env` to leak sensitive information, such as API keys, cloud credentials, and authentication tokens, back to the model context. **Recommendations** Update CodeWhale to version 0.8.64 or later.

**Name of the Vulnerable Software and Affected Versions** CodeWhale versions prior to 0.8.64 **Description** The `image analyze` tool fails to canonicalize symlinks before reading files, leading to a path traversal issue. This allows attackers to create workspace symlinks that point to external files with image extensions, enabling the leakage of file bytes to the vision endpoint without user approval. Path traversal is a flaw that allows an attacker to access files and directories that are stored outside the web root folder. **Recommendations** Update to version 0.8.64 or later.

**Name of the Vulnerable Software and Affected Versions** DOMPurify versions 3.0.0 through 3.3.3 **Description** When using the `IN PLACE` mode, the software fails to sanitize DOM elements that originate from a different window or realm, such as an iframe's `contentDocument`. This occurs because a cross-realm `instanceof` check within the ` isNode()` function returns false for nodes from foreign realms. Consequently, the software stringifies the element, resets `IN PLACE` to false, and returns the original unsanitized element, allowing Cross-Site Scripting (XSS) payloads to remain intact. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** axios versions 0.31.1 through 0.32.x axios versions 1.15.1 through 1.17.x **Description** An incomplete depth-limit bypass exists in `lib/helpers/toFormData.js` when serializing objects with top-level keys ending in `{}`. When such a key is present, the software calls `JSON.stringify()` on the value before the `formSerializer.maxDepth` guard can inspect the nested structure. An attacker who controls object keys and nested values passed to axios form or parameter serialization can trigger a `RangeError` (Maximum call stack size exceeded), leading to a denial of service in the affected request path. This issue affects the following components: - `lib/helpers/toFormData.js` (specifically the `defaultVisitor()` function) - `lib/helpers/toURLEncodedForm.js` - `lib/helpers/AxiosURLSearchParams.js` - Request transforms in `lib/defaults/index.js` when using `multipart/form-data` or `application/x-www-form-urlencoded`. **Recommendations** Update axios to version 0.33.0 or later. Update axios to version 1.18.0 or later. As a temporary workaround, reject or depth-limit untrusted objects before passing them to axios serialization. Strip or reject top-level keys ending in `{}` from untrusted objects when using axios form serialization. For query parameters, use a custom `paramsSerializer.serialize` that enforces a depth limit. For form bodies, construct `FormData` or `URLSearchParams` manually after validating input depth.

**Name of the Vulnerable Software and Affected Versions** Hono versions prior to 4.12.25 **Description** The CORS Middleware reflects the request `Origin` and sends `Access-Control-Allow-Credentials: true` when `credentials: true` is enabled and no explicit `origin` is defined (defaulting to the wildcard). This allows any site to make credentialed cross-origin requests and read responses, exposing cookie-authenticated endpoints to arbitrary origins. The middleware reflects the request `Origin` instead of using a wildcard, which bypasses browser restrictions that normally forbid `Access-Control-Allow-Origin: *` with credentials. Additionally, the preflight process echoes requested headers, approving non-simple credentialed requests. **Recommendations** Update to version 4.12.25. Restrict the `origin` setting to specific trusted domains instead of using the wildcard when `credentials: true` is enabled.

**Name of the Vulnerable Software and Affected Versions** Net::IMAP versions prior to 0.5.15 Net::IMAP versions prior to 0.6.5 **Description** Several commands in the Net::IMAP Ruby client accept raw string arguments that are only validated to prevent CRLF injection and are then sent verbatim. An incorrect regular expression in the trailing-marker check fails to match `{0}` or `{0+}`, allowing attacker-controlled strings ending in these markers to pass validation. When these arguments are sent, the server interprets the trailing CRLF as part of a literal prefix, causing the next command sent by the client to be absorbed as a continuation of the first. This results in the first command eventually failing and the second command hanging until the connection is closed, potentially leading to a denial of service through unexpected crashes and timeouts. This issue is particularly impactful in multi-threaded environments. The affected components include: - The `criteria` variable for the `#search` and `#uid search` endpoints. - The `search keys` variable for the `#sort`, `#thread`, `#uid sort`, and `#uid thread` endpoints. - The `attr` variable for the `#fetch` and `#uid fetch` endpoints. **Recommendations** Update to version 0.5.15 or 0.6.5. As a temporary workaround, validate that user input provided to the affected command arguments does not end with the `}` character. Implement `Timeout` or other standard strategies for managing slow connections and misbehaving servers to mitigate the effects of hanging commands.

**Name of the Vulnerable Software and Affected Versions** NocoDB versions prior to 2026.04.1 **Description** The client-side `hashRedirect` plugin in the `packages/nc-gui/plugins/hashRedirect.client.ts` file performs an insufficient check on paths extracted from the URL hash fragment. The plugin uses the `startsWith('/')` method to validate the `hashPath` variable before passing it to the `window.location.replace()` function. Because protocol-relative URLs (starting with `//`) also satisfy this condition, browsers interpret them as absolute URLs, allowing a crafted link to silently redirect users to an attacker-controlled origin. This open redirect does not require authentication and can be used to lead victims to pages that impersonate a login screen. **Recommendations** Update to version 2026.04.1.

**Name of the Vulnerable Software and Affected Versions** NocoDB versions prior to 2026.04.1 **Description** The password-reset page renders the URL token directly into a JavaScript string literal within a server-rendered EJS template. Because EJS `<%= %>` HTML-entity-encodes only a fixed set of characters and fails to escape single quotes or backslashes, a crafted token can break out of the JavaScript string context. This allows for Reflected Cross-Site Scripting (XSS), where an attacker can execute arbitrary script in the NocoDB origin if a victim follows a malicious password-reset link. The issue occurs because the token is embedded as `token: '<%= token %>'`, allowing a payload such as `';alert(document.cookie);//` to execute. This can enable an attacker to read authentication states and act on behalf of the victim without requiring prior authentication. **Recommendations** Update to version 2026.04.1.

**Name of the Vulnerable Software and Affected Versions** Budibase versions prior to 3.39.0 **Description** The `executeQuery` automation step accepts a `queryId` from automation step inputs and passes it to the query execution controller without additional validation. When a REST datasource is configured to target internal infrastructure, this allows for server-side request forgery (SSRF), a flaw where the server is coerced into making outbound HTTP requests to destinations influenced by an attacker. The automation output then returns the response, which can expose internal service data. **Recommendations** Update to version 3.39.0.

**Name of the Vulnerable Software and Affected Versions** Budibase versions prior to 3.35.3 **Description** The VectorDB configuration endpoint accepts a `host` parameter that lacks validation against internal IP ranges, reserved hostnames, or URL schemes. This allows an authenticated user with builder-level access to provide arbitrary host values, such as `localhost` or `169.254.169.254`, forcing the server to initiate outbound TCP connections to internal network addresses or cloud metadata endpoints. **Recommendations** Update to version 3.35.3.

**Name of the Vulnerable Software and Affected Versions** Algernon versions prior to 1.17.8 **Description** When started with the `--domain` flag or the `--letsencrypt` flag (which enables `--domain` automatically), the request handler resolves the served directory by joining the configured `--dir` with the value of the client-supplied `Host` header using `filepath.Join` without validation. An attacker can provide a `Host: ..` header to traverse one level above the document root. This allows for arbitrary file read and full directory listing of the parent directory. Additionally, if a `.lua` file is present in the parent directory, it can lead to server-side Lua execution, enabling the execution of shell commands as the process user via the `run3()` function. **Recommendations** Update to version 1.17.8. As a temporary workaround, avoid using the `--domain` or `--letsencrypt` flags until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Scriban versions prior to 7.2.0 **Description** A denial of service issue exists in the `array.insert at()` function. The function allocates unbounded null entries and fails to respect `LoopLimit` or `LimitToString` constraints. An attacker can provide a large index parameter to trigger an `OutOfMemoryException`, which crashes the host process in less than a second. **Recommendations** Update to version 7.2.0 or later. As a temporary workaround, restrict the use of the `array.insert at()` function.

**Name of the Vulnerable Software and Affected Versions** SiYuan versions prior to 3.7.0 **Description** SiYuan's publish-mode Reader can modify configuration and SQL index data through eight ungated APIs. These endpoints are registered with `model.CheckAuth` but lack `model.CheckAdminRole` and `model.CheckReadonly` checks, allowing users with `RoleReader` (including anonymous visitors) or `RoleEditor` in read-only workspaces to write server-side state. This includes atomic rewrites of the `<workspace>/conf/conf.json` file via the `model.Conf.Save()` function. Technical details include: - **API Endpoints:** '/api/graph/getGraph', '/api/graph/getLocalGraph', '/api/sync/setSyncInterval', '/api/storage/updateRecentDocViewTime', '/api/storage/updateRecentDocCloseTime', '/api/storage/updateRecentDocOpenTime', '/api/storage/batchUpdateRecentDocCloseTime', and '/api/search/updateEmbedBlock'. - **Vulnerable Parameters or Variables:** The `interval` parameter in the sync API and the `id` and `content` parameters in the search API. - **Function Names:** `model.Conf.Save()` is used to persist unauthorized configuration changes. Impacts include the ability to manipulate cloud sync intervals, corrupt graph rendering settings, poison search results by modifying the SQL `blocks.content` column, and manipulate the administrator's recent-documents list. **Recommendations** Update to version 3.7.0.

**Name of the Vulnerable Software and Affected Versions** n8n-MCP versions 2.18.7 through 2.50.1 **Description** An authenticated server-side request forgery (SSRF) issue exists affecting the webhook trigger tools, the n8n API client `N8N API URL`, and per-request URLs provided via the `x-n8n-url` header in multi-tenant HTTP mode. A caller with access to the MCP session can force the host to send HTTP requests to internal services and cloud metadata endpoints. This allows for internal-service enumeration and the theft of credentials, such as temporary IAM, GCP service account, or Azure managed-identity credentials. In single-tenant or stdio deployments, this can be triggered via indirect prompt injection where an attacker influences the LLM's tool calls to read internal services. **Recommendations** Update n8n-MCP to version 2.50.2. Restrict network egress from the host using a firewall or security group to deny access to cloud metadata IPs and unnecessary RFC1918 networks. Run the software in stdio mode instead of HTTP if multi-tenant functionality is not required. Disable workflow management tools by setting `DISABLED TOOLS=n8n trigger webhook workflow,n8n create workflow,n8n test workflow` if they are not needed.

**Name of the Vulnerable Software and Affected Versions** Kimai versions prior to 2.56.0 **Description** Sandboxed invoice and export templates fail to restrict the `config()` Twig function, enabling administrators to access arbitrary configuration keys. Users with administrative privileges can upload malicious templates to exfiltrate server-wide secrets, such as LDAP bind passwords and SAML private keys, by embedding them into invoice or export documents that are accessible to users with lower privileges. **Recommendations** Update to version 2.56.0 or later.

**Name of the Vulnerable Software and Affected Versions** JupyterLab versions prior to 4.5.7 Jupyter Notebook versions prior to 7.5.6 **Description** The HTML sanitizer allowlists `data-commandlinker-command` and `data-commandlinker-args` on `button` elements. Because `CommandLinker` listens for all click events on `document.body` and executes named commands without verifying if the element originated from a trusted UI, a notebook with pre-saved HTML cell output containing a deceptive button can trigger arbitrary commands. This can lead to arbitrary code execution, file deletion, or server denial of availability by opening multiple kernels or terminals upon a single user click. In Chromium-based browsers, multi-click attacks combined with clipboard access may allow full terminal access. The attack surface may increase in environments with third-party frontend extensions that provide additional commands. **Recommendations** Update to version 4.5.7 or newer. Update to version 7.5.6 or newer. For downstream applications inheriting from `JupyterFrontEnd` or `JupyterLab`, disable `CommandLinker` by passing the `commandLinker: new CommandLinker({ commands: new CommandRegistry() })` option during initialization. Disable the command linker functionality via `overrides.json` by setting `@jupyterlab/apputils-extension:sanitizer` with `allowCommandLinker` set to `false`.

**Name of the Vulnerable Software and Affected Versions** ImageMagick versions prior to 7.1.2-21 ImageMagick versions prior to 6.9.13-46 **Description** An overflow can be triggered when a user opens a malicious MIFF file in the display tool and right-clicks a tile to invoke the Load / Update menu item. **Recommendations** Update to version 7.1.2-21. Update to version 6.9.13-46.

**Name of the Vulnerable Software and Affected Versions** Weblate versions prior to 5.17.1 **Description** An authenticated user with `project.add` permission can import a specially crafted project backup ZIP file. If the `components/<name>.json` file within the ZIP contains a `repo` URL pointing to a private address or uses a non-allow-listed scheme (such as `file://` or `git://`), the system fails to validate it. This occurs because the software uses the `Component.objects.bulk create([component])[0]` function, which bypasses the `full clean()` method and the `validate repo url` validator. Consequently, the malicious URL is written directly into the `.git/config` file by the `configure repo(pull=False)` function. **Recommendations** Update to version 5.17.1. Limit the number of users who have permission to create projects to reduce the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Axios versions prior to 1.15.1 Axios versions prior to 0.31.1 **Description** The `toFormData` function recursively processes nested objects without a depth limit. Consequently, providing a deeply nested value as request data can cause the Node.js process to crash due to a RangeError. **Recommendations** Update to version 1.15.1 or later. Update to version 0.31.1 or later.

**Name of the Vulnerable Software and Affected Versions** wlc versions prior to 2.0.0 **Description** The HTML output format embeds API response data into HTML without proper escaping. This allows for cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites, when the output is rendered in a web browser. **Recommendations** Update to version 2.0.0. As a temporary workaround, avoid using the opt-in HTML output format.