Gasbugs

**Name of the Vulnerable Software and Affected Versions** React Router version 7 **Description** Insufficient Cross-Site Request Forgery (CSRF) checks in Framework Mode allow bypasses when using 'PUT', 'PATCH', or 'DELETE' requests, as the checks were primarily applied to 'POST' requests. CSRF is a type of attack where an unauthorized command is transmitted from a user that the web application trusts. This issue is mitigated by modern browser protections such as SameSite cookies and CORS preflight checks. **Recommendations** Update React Router version 7 to a version containing the fix. As a temporary mitigation, avoid using Framework Mode or switch to Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter`/`<RouterProvider>`).

**Name of the Vulnerable Software and Affected Versions** urllib versions prior to 2.44.1 urllib versions prior to 4.9.1 **Description** When following redirects via `followRedirect`, the software reuses caller-supplied options across different origins. Specifically, the `#requestInternal()` function recursively calls itself while preserving the original `options` object. This causes sensitive headers and authentication values to be sent to the redirect target even if it has a different scheme, host, or port. Credential-bearing headers that may be exposed include `Authorization`, `Cookie`, `Proxy-Authorization`, `x-api-key`, `x-auth-token`, and `x-access-token`. If a request is redirected to an attacker-controlled origin, these credentials can be captured and potentially reused against the original API or related services. This issue requires no user interaction. **Recommendations** Update urllib to version 2.44.1 or later. Update urllib to version 4.9.1 or later.