Haruna38

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteria[withTransforms][0][class] that reaches ImageTransforms::normalizeTransform(), then use a PHP gadget chain with yiirbacPhpManager to execute code by pointing itemFile to a request log containing PHP payload in the User-Agent header.

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.123.73 n8n versions prior to 2.35.4 n8n versions prior to 2.36.2 **Description** An expression sandbox escape exists in the `$fromAI` handler. The `$fromAI` handler resolved caller-supplied placeholder names without verifying if they were own properties and allowed reserved keys. When used against a primitive input value, it returned a live host-prototype reference. An attacker with workflow-build privileges can exploit this by walking the prototype chain to the `Function` constructor to compile and execute arbitrary code within the main n8n process, resulting in remote code execution. **Recommendations** Update n8n to version 1.123.73 or later. Update n8n to version 2.35.4 or later. Update n8n to version 2.36.2 or later.

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 2.33.4 n8n versions 2.34.x prior to 2.34.1 **Description** A remote code execution issue exists in the @n8n/workflow-sdk node-schema loader used for MCP node-schema loading. The loader determines a node's schema module path using a node type string provided by the user without validating path-traversal sequences. An authenticated user with `global:member` privileges can use path traversal to reference malicious files, leading to code execution within the n8n main process. **Recommendations** Update to version 2.33.4 or later. Update to version 2.34.1 or later.

**Name of the Vulnerable Software and Affected Versions** Lodash versions prior to 4.18.0 **Description** Lodash versions 4.17.23 and earlier are susceptible to prototype pollution through the ` .unset` and ` .omit` functions. The initial fix did not fully address the issue, as an attacker can bypass the check by using array-wrapped path segments. This allows for the deletion of properties from built-in prototypes like Object.prototype, Number.prototype, and String.prototype. The issue allows deletion of prototype properties but does not permit overwriting their original behavior. **Recommendations** Upgrade to version 4.18.0 or later.