Geo-Chen

**Name of the Vulnerable Software and Affected Versions** ToolJet Database versions prior to 3.16.44 **Description** A privilege escalation issue exists in the '/join tables' endpoint. The system fails to validate the role or workspace membership of authenticated users, granting them the JOIN TABLES ability. This allows an authenticated attacker to read arbitrary tables from any workspace by providing the target workspace identifiers in the request path while using their own valid credentials. **Recommendations** Update ToolJet Database to version 3.16.44 or later. Restrict access to the '/join tables' endpoint as a temporary mitigation measure.

**Name of the Vulnerable Software and Affected Versions** Budibase versions prior to 3.41.3 **Description** An authorization flaw exists in the 'POST /api/resources/duplicate' endpoint. Authenticated builders can inject tables, automations, queries, and screens into any application by specifying an arbitrary destination workspace ID in the request body, even without a role in the target workspace. This allows attackers to trigger injected automations using outgoing webhooks to exfiltrate data from the victim applications. **Recommendations** Update Budibase to version 3.41.3 or later.

**Name of the Vulnerable Software and Affected Versions** Budibase versions prior to 3.41.3 **Description** Low-privilege users with the BASIC role can bypass table-level access controls by submitting crafted query requests to the 'POST /api/datasources/query' endpoint. This allows them to read, create, update, or delete rows in any table, regardless of the configured per-table role restrictions. **Recommendations** Update to version 3.41.3 or later.

**Name of the Vulnerable Software and Affected Versions** Wazuh versions 4.14.0 through 4.14.6 **Description** A low-privilege API user can access the cleartext cluster key through a configuration endpoint that fails to redact sensitive information. While the REST API typically uses a masking control called `mask sensitive config` to hide fields like `authd.pass` and `cluster.key` from users without `update-config` permissions, the 'GET /cluster/local/config' endpoint does not implement this control. This endpoint, which uses the `read config wrapper` function, only requires `cluster:read` permissions. Consequently, accounts with `readonly` or `cluster readonly` roles can retrieve the actual cluster key. Since this key is used to authenticate and encrypt traffic between cluster nodes, its disclosure can facilitate remote code execution chains between cluster peers. **Recommendations** Update to version 4.14. Restrict access to the 'GET /cluster/local/config' endpoint for users with `readonly` or `cluster readonly` roles until the update is applied.

**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 4.6.58 **Description** A Cross-Site Request Forgery (CSRF) issue exists in the MCP HTTP-stream transport. The ` validate origin()` function in `transports/http stream.py` uses a prefix match via `startswith()` to validate the `request origin` variable against an allowlist. This allows an attacker to bypass the check by using a domain that begins with an allowed prefix, such as `http://localhost.attacker.com`. Because the server may be run without an API key by default and parses request bodies regardless of the `Content-Type` header, an attacker can send a CORS simple request using `text/plain`. This bypasses the browser preflight check and allows the unauthenticated invocation of the `tools/call` endpoint. An attacker can exploit this to perform state-changing actions, most notably using the `praisonai.rules.create` tool to write malicious files into the global rules directory. This results in persistent prompt injection, where attacker-controlled instructions are applied to every subsequent agent run on the victim's machine, potentially leading to the exfiltration of sensitive data like SSH keys and API keys. Other affected tools include `praisonai.rules.delete`, `praisonai.todo.add`, `praisonai.todo.delete`, and `praisonai.schedule.add`. **Recommendations** Update PraisonAI to version 4.6.58. As a temporary mitigation, configure the MCP server with a strong API key using the `--api-key` flag to enable authentication for the HTTP-stream transport.

**Name of the Vulnerable Software and Affected Versions** mediasoup npm package versions 3.20.0 through 3.20.5 mediasoup Rust crate versions 0.22.0 through 0.22.4 **Description** The built-in SCTP stack authenticates state cookies using hardcoded magic values instead of a per-instance secret and HMAC, which deviates from RFC 9260 Section 5.1.3. This flaw in `StateCookie::IsMediasoupStateCookie()` and `Association::HandleReceivedCookieEchoChunk()` allows an on-path attacker targeting `PlainTransport` or `PipeTransport` with SCTP enabled and without DTLS protection to forge a COOKIE-ECHO. By matching the packet verification tag with a `localVerificationTag` controlled by the attacker, an unauthorized SCTP association can be established, enabling DataChannel message injection as a trusted peer. SCTP is a transport layer protocol used to ensure reliable delivery of data. **Recommendations** Update the npm package to version 3.20.6. Update the Rust crate to version 0.22.5.

**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 4.6.58 **Description** The MCP HTTP Stream `mcp post` handler fails to enforce a maximum number of sessions and does not invoke the ` cleanup sessions()` function to expire old entries. Consequently, every `initialize` request creates a new in-memory session that is never removed. Additionally, the `notifications/cancelled` endpoint populates a ` cancelled requests` set that is never pruned. Since the `initialize` request is unauthenticated, a remote attacker can send repeated requests to exhaust system memory, leading to a denial of service when the process is terminated by the out-of-memory killer. This issue is further amplified by the fact that the server retains SSE event history for each session. **Recommendations** Update to version 4.6.58. As a temporary mitigation, restrict access to the `mcp post` handler or the `notifications/cancelled` endpoint to trusted sources only. Configure the `PRAISONAI MCP MAX SESSIONS` variable to limit the number of concurrent sessions.

**Name of the Vulnerable Software and Affected Versions** EverShop versions prior to 2.2.1 **Description** An authorization flaw exists in the customer update route. The route is incorrectly configured as public, allowing the admin authentication middleware to bypass caller verification. Additionally, the route lacks customer-session middleware protection. The handler in `updateCustomer.js` processes updates based on a `uuid` provided in the URL path without verifying if the requester owns the record. This allows an unauthenticated attacker with a known customer `uuid` to overwrite a customer's email address and password via the PATCH '/api/customers/:id' endpoint, leading to full account takeover. Customer `uuid` values may be exposed through administrative URLs and order confirmation email links. **Recommendations** Update to version 2.2.1.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** An authenticated user can trigger the server to send repeated requests to internal endpoints, including link-local metadata addresses. This occurs because the `setWebhookResolver` function in `packages/api/src/resolvers/webhooks/index.ts` stores a user-supplied `url` without performing address validation. When a subscribed event is triggered, the `callWebhook()` function in `packages/api/src/jobs/call webhook.ts` executes an `axios.request` using the stored `url`, the recorded method, and the Content-Type. The process is blind, as the `callWebhook()` function discards the response and only logs the success or error, meaning the response is not returned via the API. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** langchain-community (affected versions not specified) **Description** The `SitemapLoader.parse sitemap` function in `langchain community/document loaders/sitemap.py` fails to apply the `restrict to same domain` control to nested sitemap entries. While leaf URL entries are filtered, nested sitemap elements are passed directly to the `scrape all()` function, which triggers an aiohttp GET request without domain comparison or checks for private, loopback, or link-local destinations. This allows an attacker to influence an ingested sitemap to point to internal addresses, leading to Server-Side Request Forgery (SSRF), where internal responses are fetched and disclosed to the caller. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NLTK versions prior to 3.10.1 **Description** The URLS regular expression in `nltk/tokenize/casual.py`, which is compiled into `TweetTokenizer.WORD RE` and used by `TweetTokenizer.tokenize`, contains an unbounded domain-label prefix. When processing input with many alternating label separators that lacks a trailing top-level domain, the regular expression engine explores an exponential number of partitions, leading to catastrophic backtracking. This results in high CPU consumption, where a few kilobytes of input can stall a single-threaded process for seconds or minutes. This issue affects services using `TweetTokenizer` or the `casual tokenize` function to process untrusted social-media text, allowing unauthenticated requests to cause a denial of service. **Recommendations** Update to version 3.10.1.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** An authenticated user can trigger the server to make requests to arbitrary internal endpoints because the `scanFeedsResolver` in `packages/api/src/resolvers/subscriptions/index.ts` passes a user-supplied `url` directly to `axios.get()` without address validation. While other paths use `validateUrl()` to reject private and reserved IP ranges, this specific resolver lacks such checks. The impact is limited to the disclosure of feed-shaped metadata and link elements advertising RSS or Atom feeds from the response. Additionally, the resulting errors allow an attacker to distinguish between reachable and unreachable internal ports. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AIL Framework (affected versions not specified) **Description** A server-side request forgery (SSRF) issue exists in the crawler submission functionality. A low-privileged authenticated user can submit arbitrary URLs for crawling due to insufficient validation of the destination host. This allows the crawler to make direct HTTP(S) requests to restricted addresses, such as loopback addresses, RFC1918 private networks, link-local addresses, and cloud metadata services like 169.254.169.254. Manual crawler tasks bypass the domain blacklist because they are assigned a non-zero priority, and IP literals are fetched directly instead of using a proxy. An attacker can use the server as a network pivot to access internal services. Since the crawler interface provides access to the resulting HTML, screenshots, and HAR data, the SSRF is non-blind, potentially leading to the disclosure of sensitive internal data, service information, or cloud instance credentials. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Bastillion (affected versions not specified) **Description** Bastillion fails to properly validate request URI paths in its controller dispatcher. This allows unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Consequently, attackers can access administrative controllers to read user listings, create manager accounts, and register managed systems, which enables them to gain control over SSH access to the managed fleet. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Kraken (affected versions not specified) **Description** Kraken agents do not verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing them to the content-addressable cache. Instead, the system relies solely on CRC32 checksums for piece validation. This allows attackers on the agent-to-agent path or malicious peers to provide substituted content with forged CRC32 corrections that pass per-piece checks. This process can poison the cache with attacker-chosen container image layers or manifests, which are then re-seeded and executed by other hosts. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SpiderFoot (affected versions not specified) **Description** The software fails to HTML-escape correlation titles generated from external scan data sources, such as server banners and metadata. This allows attackers to inject malicious HTML elements containing event handlers into correlation results. When an operator opens the correlations view, these scripts execute in the browser, which could lead to the theft of API keys. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** phpIPAM versions prior to 1.8.2 **Description** An issue exists where the software fails to verify if a requested IP address belongs to the subnet for which a temporary share token was issued. In the endpoints 'app/temp share/index.php' and 'app/temp share/address.php', when the share type is set to 'subnets', the `subnetId` parameter is used as a database primary key to retrieve an address without validating its membership in the authorized subnet. An unauthenticated user with a valid, non-expired temporary share URL can enumerate the `subnetId` parameter to access all IP address records across all sections and subnets, potentially exposing hostnames, DNS names, MAC addresses, owner/contact fields, and notes that may contain credentials or configuration details. **Recommendations** Update phpIPAM to version 1.8.2 or later.

**Name of the Vulnerable Software and Affected Versions** Evidently UI (affected versions not specified) **Description** An issue exists where the software fails to properly validate the `filename` parameter in the dataset materialization endpoint. This allows unauthenticated attackers to read arbitrary files outside the workspace directory by using traversal sequences or absolute paths. These system files are then materialized into datasets and can be retrieved via the download endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Determined (affected versions not specified) **Description** Authenticated attackers can disrupt the workloads of other users because the API handlers fail to authorize requests on the generic task kill, pause, and unpause endpoints. This allows an attacker to terminate, pause, or unpause tasks that they do not own. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SWE-agent's trajectory inspector version 1.1.0 **Description** The HTTP server fails to properly sanitize request paths in the '/trajectory/' endpoint, allowing the use of parent-directory ('..') references to perform path traversal. The server binds to all interfaces (0.0.0.0), uses wildcard CORS (Cross-Origin Resource Sharing), and lacks authentication. This allows an unauthenticated network client or a malicious web page to read files outside the intended directory. Access is limited to JSON files formatted as trajectories, which may contain repository contents, command output, and secrets or API keys. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.