Junmin Zhu

An issue exists where unauthenticated attackers can cause server memory exhaustion by sending a compressed Erlang external term within a gRPC message body. The `GRPC.Codec.Erlpack.decode/2` function passes the message body to `:erlang.binary to term/2`, which inflates compressed terms fully without a size limit. Because the server's `max body size` limit only tracks compressed bytes, a request using `Content-Type: application/grpc+erlpack` can force the server to allocate memory significantly larger than the actual request body. This occurs because the codec's type checks are only performed after the term has been decoded.

A security issue exists that allows attackers to affect the system.

The issue is related to Command Injection due to improper input sanitization in the `check` function in the bwm-ng.js file. To potentially exploit this, an attacker needs the ability to run Node.js code within the target environment, which typically requires some level of access to the system or application hosting the Node.js environment.

The issue is related to Command Injection via the `getGitTagsRemote` function due to improper input sanitization. This allows for potential exploitation. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

The issue is related to Command Injection via the `info` method due to improper input sanitization. This allows for potential exploitation. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.