Hackerman70000

Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext.

The Mattermost Desktop App does not properly validate help links. This allows a malicious Mattermost server to execute arbitrary executables on a user’s system when a user clicks on specific items within the Help menu. The issue involves unvalidated server-controlled URLs in the Help menu.

The `mergeConfig()` function in Axios crashes with a TypeError when processing configuration objects that contain ` proto ` as an own property. This occurs because when ` proto ` is present (for example, when created via `JSON.parse()`), the function performs a prototype chain lookup that returns `Object.prototype` instead of a function, leading to a crash. A remote attacker can exploit this by providing a malicious configuration object, resulting in a complete denial of service. This issue affects Node.js servers and any backend that passes user-controlled JSON to Axios configuration methods.

An unauthenticated local client could leverage the Gateway WebSocket API to modify configuration settings through the `config.apply` function. Specifically, the ability to set unsafe `cliPath` values, which are subsequently used for command discovery, allows for command injection with the privileges of the gateway user. The `config.apply` function accepted raw JSON and wrote it to disk after schema validation. The `cliPath` values were not restricted to safe executable names or paths. Command discovery utilized a shell invocation when resolving executables.

The Kimi Agent SDK libraries expose the Kimi Code agent runtime in applications. The `vsix-publish.js` and `ovsx-publish.js` scripts pass filenames to the `execSync()` function as shell command strings. Filenames containing shell metacharacters, such as `$(cmd)`, could potentially execute arbitrary commands. This issue is present only in the repository’s development scripts and does not affect published VSCode extensions. The scripts utilize the `execSync()` function with filenames as arguments, which allows for command injection.

FreshRSS utilizes weak random number generators (`mt rand()` and `uniqid()`) for creating remember-me authentication tokens and challenge-response nonces. This allows attackers to predict valid session tokens, potentially leading to account takeover through persistent session hijacking. The remember-me tokens provide permanent authentication and are used for the "keep me logged in" feature.