Iaohkut-From-Nightwolf-Team

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped distributionType values to achieve remote code execution when Renovate processes Maven Wrapper updates in binarySource=docker mode.

Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in binarySource=docker mode.

Renovate is a dependency update automation tool. In versions before 44.14.7 (and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0), the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository's gradle/wrapper/gradle-wrapper.properties file before invoking the Gradle Wrapper CLI. In self-hosted deployments configured with binarySource=docker and allowedUnsafeExecutions=['gradleWrapper', ...], a repository that supplies a crafted distributionUrl (for example, appending a shell metacharacter and command) can cause arbitrary commands to be executed as the Renovate user when Renovate processes a Gradle Wrapper update. The issue is fixed in Renovate 44.14.7; as a workaround, remove 'gradleWrapper' from allowedUnsafeExecutions.

Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. Attackers can inject shell metacharacters through malicious dependency names to execute arbitrary commands as the Renovate user during Go module major version updates with postUpdateOptions gomodUpdateImportPaths enabled.

**Name of the Vulnerable Software and Affected Versions** morgan versions prior to 1.12.0 **Description** An issue exists in the internal helper used to escape log token values. The software fails to neutralize Unicode line separator characters U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator). An unauthenticated remote client can inject these characters into an attacker-controlled log token, such as a Basic auth username processed via the `remote-user` token. This allows for log forging, where Unicode-aware downstream log processing systems split a single request log into multiple logical records. **Recommendations** Upgrade to version 1.12.0.

**Name of the Vulnerable Software and Affected Versions** Faktory versions prior to 1.10.0 **Description** The embedded Redis bootstrapper contains an insecure temporary file flaw. The system writes startup configuration to a fixed, predictable, and world-writable path `/tmp/redis.conf`, creating the file only if it does not already exist and failing to validate it during subsequent boots. A local unprivileged user can pre-create this file with malicious Redis directives. While Faktory overrides the `unixsocket`, `dir`, and `logfile` options, other directives such as `bind`, `protected-mode`, `requirepass`, and `loadmodule` remain attacker-controlled. This allows an attacker to expose the job queue over an unauthenticated network port or use the `loadmodule` directive to execute arbitrary native code within the root-owned Redis process, resulting in privilege escalation from a local unprivileged user to root. **Recommendations** Update to version 1.10.0.

**Name of the Vulnerable Software and Affected Versions** Faktory versions prior to 1.10.0 **Description** An unauthenticated denial of service exists where a single malformed command can crash the entire process. The server uses a line-based wire protocol where several command handlers perform slicing or indexing on received lines at fixed offsets without verifying the presence of a payload. Sending a bare verb without a payload—such as PUSH, ACK, FAIL, BEAT, PUSHB, or QUEUE—triggers a Go slice or index out-of-range panic. Since the command-dispatch path lacks a `recover()` function, an unrecovered panic in a handler goroutine terminates the entire Go process, disconnecting all clients, workers, and in-flight jobs. The attack requires only a connection to the command port and the completion of the handshake, requiring no credentials if no password is configured. **Recommendations** Update to version 1.10.0.

**Name of the Vulnerable Software and Affected Versions** @better-auth/sso versions prior to 1.4.8 @better-auth/sso versions prior to 1.6.27 @better-auth/sso versions prior to 1.7.0-rc.5 **Description** Two domain-ownership flaws exist when the SSO plugin is active. If domain verification is disabled, automatic organization assignment accepts unverified provider domains. This allows an authenticated organization owner or administrator to register an SSO provider for any domain, causing users with matching email domains to be added to the attacker's organization with default member permissions. If domain verification is enabled, a race condition occurs between the 'verify-domain' and 'update-provider' endpoints, which can apply a completed DNS proof to an incorrect domain. When combined with implicit account linking, this allows an attacker-controlled identity provider to be linked to an existing user account. The organization plugin must also be enabled for the organization assignment path to be exploited. **Recommendations** Update @better-auth/sso to version 1.4.8 or later for the 1.4.x line. Update @better-auth/sso to version 1.6.27 or later. Update @better-auth/sso to version 1.7.0-rc.5 or later for the 1.7 prerelease line.

**Name of the Vulnerable Software and Affected Versions** Grav API plugin versions prior to 1.0.14 **Description** An open redirect weakness exists in the `SsoController::sanitizeReturnTo()` function. The function fails to account for browsers that normalize backslashes to slashes in http or https schemes. Consequently, a `returnTo` value containing a backslash, such as `/evil.com`, can bypass the security guard and be interpreted by the browser as a protocol-relative URL. This allows an attacker to use the `returnTo` parameter during a legitimate OAuth login flow to redirect an authenticated user to a malicious site for phishing purposes. **Recommendations** Update Grav API plugin to version 1.0.14 or later.

**Name of the Vulnerable Software and Affected Versions** Grav API plugin versions prior to 1.0.15 **Description** An authorization bypass exists in the `BlueprintPathResolver::resolveUserScope()` function. The system checks the account's super-admin ACL flag `access.api.super` instead of validating the actual scope of the provided API key. An attacker with an API key scoped only to `api.media.write` created from a super-admin account can bypass authorization. This allows the attacker to use the 'POST /blueprint-upload' or 'GET /blueprint-files' endpoints to write files into another user's scope within the shared `user/accounts/` directory (limited to image extensions by `assertSafeExtension()`) and browse that scope's file listing, even without the `api.users.write` permission. **Recommendations** Update Grav API plugin to version 1.0.15.

**Name of the Vulnerable Software and Affected Versions** Grav API plugin versions prior to 1.0.14 **Description** The Grav API plugin fails to enforce authorization requirements within the `MenubarController::executeAction()` function. While the 'GET /menubar/items' endpoint correctly filters items, the 'POST /api/v1/menubar/actions/{plugin}/{action}' endpoint only verifies the basic `api.access` permission and ignores the `authorize` field registered by a plugin for that action. Consequently, any authenticated user with `api.access` can execute privileged menubar actions, bypassing intended authorization. This issue affects first- or third-party plugins that rely on documented authorize semantics. **Recommendations** Update to version 1.0.14 or later.

**Name of the Vulnerable Software and Affected Versions** Grav API plugin (getgrav/grav-plugin-api) versions prior to 1.0.14 **Description** An issue exists in the `userPassesAuthorize()` function within `AbstractApiController.php` where the system fails to verify the API key scopes of the calling request. Instead, it relies on the account's raw super-admin flag and Access Control List (ACL) grants. This allows an authenticated attacker using a scoped API key from a privileged account to bypass scope restrictions and access protected UI metadata and item definitions, such as sidebar, menubar, and widget items, as well as users-list columns, row-actions, and filter-tabs, leading to information disclosure. **Recommendations** Update Grav API plugin (getgrav/grav-plugin-api) to version 1.0.14 or later.

**Name of the Vulnerable Software and Affected Versions** Grav versions prior to 2.0.14 **Description** A stored cross-site scripting issue exists in the `Security::detectXss()` function located in system/src/Grav/Common/Security.php. The XSS detection patterns utilize the PCRE /u (UTF-8) modifier, which causes `preg match()` to return false for all patterns if a single invalid UTF-8 byte is present in the page content. This behavior allows the save-time XSS safety gate `Validation::checkSafety()` to be bypassed. An authenticated attacker with page-edit permissions, who lacks the `security.xss whitelist` privilege, can store malicious JavaScript that executes in the browser of any visitor viewing the affected page. **Recommendations** Update to version 2.0.14 or later.

**Name of the Vulnerable Software and Affected Versions** @fastify/multipart versions 5.3.0 through 10.1.0 **Description** An issue exists in the multipart form-data parser where the plugin clears its internal current-file reference while the underlying stream remains open when the busboy `fileSize` limit truncates a file part. If an unauthenticated client aborts the connection before sending the terminating boundary, the abort cleanup fails to find the stream to destroy. Consequently, the `saveRequestFiles()` function never settles, causing the request handler to hang and preventing the cleanup of temporary files written to disk. Repeated exploitation can lead to disk and event-loop exhaustion. **Recommendations** Upgrade to version 10.1.1.

**Name of the Vulnerable Software and Affected Versions** rclone versions prior to 1.74.4 **Description** The software fails to strip the `X-Amz-Security-Token` header when an S3 redirect changes the scheme from HTTPS to HTTP on the same host. This allows attackers to intercept plaintext HTTP traffic and capture AWS Security Token Service (STS) session tokens sent in request headers. **Recommendations** Update rclone to version 1.74.4 or later.

**Name of the Vulnerable Software and Affected Versions** SvelteKit versions prior to 2.69.1 **Description** Remote form functions with file input fields that accept arbitrary user-controlled path names are susceptible to prototype pollution. This occurs when an attacker manipulates the deletion path to remove methods on the prototype, which can lead to the disabling of application functionality. Prototype pollution is a technique where an attacker modifies the base prototype of an object, affecting all objects derived from it. **Recommendations** Update to version 2.69.1 or later.