Fg0X0

Incorrect authorization in the Network component allows a remote attacker to bypass the web origin policy through the use of a crafted Chrome extension, provided the attacker can leverage social engineering.

The software folds the host to lowercase before percent-decoding it. Consequently, a percent-encoded uppercase octet, such as `%41`, decodes to a literal uppercase character that is not folded. In scheme-relative references (e.g., `//host`), the absence of a scheme prevents the host canonicalization that would typically correct this, causing the `parse`, `normalize`, and `equal` functions to disagree on the same host. Applications performing case-sensitive host decisions, such as those using an allowlist or denylist, can be bypassed using percent-encoded uppercase octets. Since DNS and HTTP hostnames are case-insensitive, the bypassed input still reaches the intended destination.

An Insecure Direct Object Reference (IDOR) exists in the Express saved search preset delete and edit dialogs. An authenticated user with only view permissions on a single Express entity can permanently delete or rename saved search presets belonging to Express entities for which they lack permission. This could lead to defacement or social engineering, as renamed presets are visible to users of the targeted entity.

The `js execution` tool fails to scrub parent process environment variables before spawning Node.js. This allows attackers to execute malicious JavaScript code that reads `process.env` to leak sensitive information, such as API keys, cloud credentials, and authentication tokens, back to the model context.

The `image analyze` tool fails to canonicalize symlinks before reading files, leading to a path traversal issue. This allows attackers to create workspace symlinks that point to external files with image extensions, enabling the leakage of file bytes to the vision endpoint without user approval. Path traversal is a flaw that allows an attacker to access files and directories that are stored outside the web root folder.

When using the `IN PLACE` mode, the software fails to sanitize DOM elements that originate from a different window or realm, such as an iframe's `contentDocument`. This occurs because a cross-realm `instanceof` check within the ` isNode()` function returns false for nodes from foreign realms. Consequently, the software stringifies the element, resets `IN PLACE` to false, and returns the original unsanitized element, allowing Cross-Site Scripting (XSS) payloads to remain intact.

An incomplete depth-limit bypass exists in `lib/helpers/toFormData.js` when serializing objects with top-level keys ending in `{}`. When such a key is present, the software calls `JSON.stringify()` on the value before the `formSerializer.maxDepth` guard can inspect the nested structure. An attacker who controls object keys and nested values passed to axios form or parameter serialization can trigger a `RangeError` (Maximum call stack size exceeded), leading to a denial of service in the affected request path. This issue affects the following components: - `lib/helpers/toFormData.js` (specifically the `defaultVisitor()` function) - `lib/helpers/toURLEncodedForm.js` - `lib/helpers/AxiosURLSearchParams.js` - Request transforms in `lib/defaults/index.js` when using `multipart/form-data` or `application/x-www-form-urlencoded`.

The CORS Middleware reflects the request `Origin` and sends `Access-Control-Allow-Credentials: true` when `credentials: true` is enabled and no explicit `origin` is defined (defaulting to the wildcard). This allows any site to make credentialed cross-origin requests and read responses, exposing cookie-authenticated endpoints to arbitrary origins. The middleware reflects the request `Origin` instead of using a wildcard, which bypasses browser restrictions that normally forbid `Access-Control-Allow-Origin: *` with credentials. Additionally, the preflight process echoes requested headers, approving non-simple credentialed requests.

Several commands in the Net::IMAP Ruby client accept raw string arguments that are only validated to prevent CRLF injection and are then sent verbatim. An incorrect regular expression in the trailing-marker check fails to match `{0}` or `{0+}`, allowing attacker-controlled strings ending in these markers to pass validation. When these arguments are sent, the server interprets the trailing CRLF as part of a literal prefix, causing the next command sent by the client to be absorbed as a continuation of the first. This results in the first command eventually failing and the second command hanging until the connection is closed, potentially leading to a denial of service through unexpected crashes and timeouts. This issue is particularly impactful in multi-threaded environments. The affected components include: - The `criteria` variable for the `#search` and `#uid search` endpoints. - The `search keys` variable for the `#sort`, `#thread`, `#uid sort`, and `#uid thread` endpoints. - The `attr` variable for the `#fetch` and `#uid fetch` endpoints.

The client-side `hashRedirect` plugin in the `packages/nc-gui/plugins/hashRedirect.client.ts` file performs an insufficient check on paths extracted from the URL hash fragment. The plugin uses the `startsWith('/')` method to validate the `hashPath` variable before passing it to the `window.location.replace()` function. Because protocol-relative URLs (starting with `//`) also satisfy this condition, browsers interpret them as absolute URLs, allowing a crafted link to silently redirect users to an attacker-controlled origin. This open redirect does not require authentication and can be used to lead victims to pages that impersonate a login screen.

The password-reset page renders the URL token directly into a JavaScript string literal within a server-rendered EJS template. Because EJS `<%= %>` HTML-entity-encodes only a fixed set of characters and fails to escape single quotes or backslashes, a crafted token can break out of the JavaScript string context. This allows for Reflected Cross-Site Scripting (XSS), where an attacker can execute arbitrary script in the NocoDB origin if a victim follows a malicious password-reset link. The issue occurs because the token is embedded as `token: '<%= token %>'`, allowing a payload such as `';alert(document.cookie);//` to execute. This can enable an attacker to read authentication states and act on behalf of the victim without requiring prior authentication.

The `executeQuery` automation step accepts a `queryId` from automation step inputs and passes it to the query execution controller without additional validation. When a REST datasource is configured to target internal infrastructure, this allows for server-side request forgery (SSRF), a flaw where the server is coerced into making outbound HTTP requests to destinations influenced by an attacker. The automation output then returns the response, which can expose internal service data.

The VectorDB configuration endpoint accepts a `host` parameter that lacks validation against internal IP ranges, reserved hostnames, or URL schemes. This allows an authenticated user with builder-level access to provide arbitrary host values, such as `localhost` or `169.254.169.254`, forcing the server to initiate outbound TCP connections to internal network addresses or cloud metadata endpoints.

When started with the `--domain` flag or the `--letsencrypt` flag (which enables `--domain` automatically), the request handler resolves the served directory by joining the configured `--dir` with the value of the client-supplied `Host` header using `filepath.Join` without validation. An attacker can provide a `Host: ..` header to traverse one level above the document root. This allows for arbitrary file read and full directory listing of the parent directory. Additionally, if a `.lua` file is present in the parent directory, it can lead to server-side Lua execution, enabling the execution of shell commands as the process user via the `run3()` function.

A denial of service issue exists in the `array.insert at()` function. The function allocates unbounded null entries and fails to respect `LoopLimit` or `LimitToString` constraints. An attacker can provide a large index parameter to trigger an `OutOfMemoryException`, which crashes the host process in less than a second.

vm2 is a sandbox for running untrusted JavaScript. The `defaultSandboxPrepareStackTrace()` function in `lib/setup-sandbox.js` uses prototype-walking index assignment to build its output array instead of a prototype-bypassing define-property primitive. Since this internal array is allocated within the sandbox realm, malicious code can install an accessor on `Array.prototype` for the relevant index. This accessor is triggered whenever the sandbox reads `error.stack` or triggers `Error.prepareStackTrace()`, allowing the sandbox code to observe and intercept each stack-trace line written by the bridge. This issue also affects the error-handling (catch) branch. Because the values written are only formatted strings, the impact is limited to an information side channel and a violation of the bridge-container defense invariant rather than a full sandbox escape.

SiYuan's publish-mode Reader can modify configuration and SQL index data through eight ungated APIs. These endpoints are registered with `model.CheckAuth` but lack `model.CheckAdminRole` and `model.CheckReadonly` checks, allowing users with `RoleReader` (including anonymous visitors) or `RoleEditor` in read-only workspaces to write server-side state. This includes atomic rewrites of the `<workspace>/conf/conf.json` file via the `model.Conf.Save()` function. Technical details include: - **API Endpoints:** '/api/graph/getGraph', '/api/graph/getLocalGraph', '/api/sync/setSyncInterval', '/api/storage/updateRecentDocViewTime', '/api/storage/updateRecentDocCloseTime', '/api/storage/updateRecentDocOpenTime', '/api/storage/batchUpdateRecentDocCloseTime', and '/api/search/updateEmbedBlock'. - **Vulnerable Parameters or Variables:** The `interval` parameter in the sync API and the `id` and `content` parameters in the search API. - **Function Names:** `model.Conf.Save()` is used to persist unauthorized configuration changes. Impacts include the ability to manipulate cloud sync intervals, corrupt graph rendering settings, poison search results by modifying the SQL `blocks.content` column, and manipulate the administrator's recent-documents list.

An authenticated server-side request forgery (SSRF) issue exists affecting the webhook trigger tools, the n8n API client `N8N API URL`, and per-request URLs provided via the `x-n8n-url` header in multi-tenant HTTP mode. A caller with access to the MCP session can force the host to send HTTP requests to internal services and cloud metadata endpoints. This allows for internal-service enumeration and the theft of credentials, such as temporary IAM, GCP service account, or Azure managed-identity credentials. In single-tenant or stdio deployments, this can be triggered via indirect prompt injection where an attacker influences the LLM's tool calls to read internal services.

Sandboxed invoice and export templates fail to restrict the `config()` Twig function, enabling administrators to access arbitrary configuration keys. Users with administrative privileges can upload malicious templates to exfiltrate server-wide secrets, such as LDAP bind passwords and SAML private keys, by embedding them into invoice or export documents that are accessible to users with lower privileges.

The HTML sanitizer allowlists `data-commandlinker-command` and `data-commandlinker-args` on `button` elements. Because `CommandLinker` listens for all click events on `document.body` and executes named commands without verifying if the element originated from a trusted UI, a notebook with pre-saved HTML cell output containing a deceptive button can trigger arbitrary commands. This can lead to arbitrary code execution, file deletion, or server denial of availability by opening multiple kernels or terminals upon a single user click. In Chromium-based browsers, multi-click attacks combined with clipboard access may allow full terminal access. The attack surface may increase in environments with third-party frontend extensions that provide additional commands.