Jacobbrackett

An authorization bypass exists in the WebSocket REST interface. Unauthenticated attackers can skip permission checks by sending a failed authentication message on public-mode WebSocket connections. By providing an invalid token, the `handleAuthRequest()` function sets accountability to null, enabling the attacker to read, create, update, or delete records in any user-defined collection.

An integer overflow exists in the ICO loader, specifically within the `vips/icoload.c` file. A remote attacker can exploit this by submitting a crafted ICO image with a malicious `data size` value that wraps the memory allocation, leading to a heap buffer overflow. This memory corruption can result in a process crash or remote code execution.

An incomplete fix for unsafe name handling in `pbjs` static and static-module code generation allows the emission of unsafe JavaScript references when generating static output from crafted JSON descriptor input. An attacker who can provide or influence pre-parsed JSON descriptors passed to `pbjs` static code generation may cause the generated JavaScript output to contain attacker-controlled code. This injected code may execute if the generated file is later executed or imported and an affected generated API path is invoked. Parsing schemas from `.proto` files is not affected.