Jvr2022

The local server exposes the server-sent events endpoint "/events" without bearer authentication and allows cross-origin browser access. The system relies solely on a caller-supplied `client id` to select WebChannelEvent objects from the process-wide event bus. Because the system identifier is fixed, the proactive-message stream is predictable, allowing an unauthenticated local client or a malicious web page to subscribe to another client's stream by guessing or knowing the identifier. This can lead to the exposure of assistant responses, streamed message content, tool names, tool arguments, and raw tool outputs.

The local '/ws/dictation' WebSocket endpoint lacks client authentication and browser-origin validation. This allows an unauthenticated client, such as a malicious web page, to submit audio and trigger resource-intensive speech-to-text processing. In earlier versions, audio is accumulated in an unbounded buffer, which can lead to process memory exhaustion through continuous streaming. These factors can result in performance degradation, resource exhaustion, or application crashes.

The `image to GIF` command uses a request helper that validates a hostname's public IP addresses but subsequently sends the request by hostname, resulting in a `second DNS lookup`. This allows an attacker controlling a domain to bypass internal-address protection via `DNS rebinding` (a technique where a domain name resolves to different IP addresses during successive DNS queries) by returning a public address during validation and an internal address during the connection. The command accepts addresses directly from user input and is accessible to any server member. Requests are limited to `HTTPS on port 443` and only return content if the response is a `genuine image`, limiting the impact to blind internal probing and limited retrieval of image responses from loopback or internal endpoints.

By default, the `@better-auth/scim` plugin fails to bind non-organization (personal) SCIM providers to their creator. This occurs because the `providerOwnership` option and the `scimProvider.userId` column are disabled by default, allowing the access check to pass when no owner ID is present. Consequently, any authenticated user can manage other users' personal providers, including reading metadata, listing connections, and deleting connections. The most critical impact is the ability to regenerate SCIM bearer tokens via the `/scim/generate-token` endpoint using the `providerId` variable. This action invalidates the legitimate user's token and grants the attacker a valid token to authenticate against SCIM API routes, such as `/scim/v2/Users`, and manage SCIM-provisioned users.

An authorization bypass occurs because the software decodes the encoded slash %2F within path parameter values before matching middleware paths, whereas the underlying router preserves this encoding during route lookup. This discrepancy allows a request to bypass middleware used for authentication, authorization, rate limiting, or auditing on parameterized paths, enabling an attacker to reach a protected handler using a crafted URL with an encoded slash in the parameter position. This issue is agnostic to the HTTP method and requires no authentication or special preconditions.

An issue exists in the standalone engine's URL normalization and decoding process where malformed percent-encoded sequences in incoming request paths are not properly guarded. Specifically, inputs such as truncated multibyte sequences or incomplete percent escapes cause the underlying decoder to throw a synchronous exception. This exception escapes the normalization step and terminates the Node.js process, resulting in a denial of service for all connected clients. This affects applications that call the `middie.run()` function directly via the standalone engine API. Applications using the Fastify plugin path are not affected as the framework's error handler catches the exception.

A middleware scoping flaw exists where plugin prefixes are not applied to middleware mount paths when the mount path is provided as an array or a regular expression. This occurs due to improper input handling during prefix and path normalization, causing middleware to be registered without the prefix inside prefixed plugin scopes. An attacker can bypass security controls such as authentication, authorization, rate limiting, or auditing by sending requests to routes under a prefixed plugin where the middleware was mounted using non-string paths. Fastify continues to match the route, but the associated middleware is skipped.

Insufficient enforcement of hard upper bounds on total decompressed data, entry counts, or decompression ratio within extraction and parsing paths, such as `src/extract.ts`, allows a crafted gzip bomb to exhaust CPU and disk space. A gzip bomb is a highly compressed archive that expands to an enormous size when decompressed, leading to a denial of service.

The `tar.replace` function accepts a checksum-valid tar header containing a negative base-256 encoded entry size. This causes the archive scanner to enter a loop where it repeatedly parses the same header without making progress.

An issue exists where the software fails to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without PKCE (Proof Key for Code Exchange). In the `parseGenericState` function, the cookie branch decrypted the `oauth state` cookie and validated expiry but did not compare the incoming OAuth `state` query parameter to the nonce issued at sign-in. This allows attackers to forge the `state` parameter and provide an attacker-controlled authorization code to the `/api/auth/oauth2/callback/<providerId>` endpoint. This can lead to forced-login (CSRF on OAuth callback), where a victim's browser is placed into a session bound to the attacker's external identity, or persistent account linking, where an attacker's external account is bound to the victim's authenticated profile.

The generated authentication filter matches OpenAPI path templates too broadly when determining whether to attach credentials. The runtime authentication layer compares the outgoing request path and method against protected OpenAPI operations, but treats `{param}` placeholders as `.*`, which incorrectly allows a single path parameter to consume a forward slash (`/`). Consequently, a security scheme configured for one operation may be applied to a different operation of the same method if the path partially resembles the protected template. This can lead to bearer tokens, API keys, or basic credentials being sent to unintended endpoints, potentially disclosing sensitive information to lower-trust routes on the same service.

When `safeMode` is enabled, unapproved forum posts are hidden from the public list. However, the direct post-read procedure still returns the full post to any user who possesses the post UUID.

The software allows attacker-controlled comment content to be serialized into XML without validating or neutralizing comment-breaking sequences. This occurs during the DOM construction and serialization flow for comment nodes when the `createComment()` function is called; the supplied string is stored as-is and later concatenated with XML comment delimiters during serialization. Because XML comments are syntax-sensitive, an attacker can provide input containing a sequence that closes the comment, allowing them to terminate the comment early and inject arbitrary XML nodes into the serialized output. This can enable an attacker to alter the meaning and structure of generated XML documents, affecting workflows that store, forward, sign, or parse the resulting XML, such as configuration or policy documents.

Seven recursive traversals in `lib/dom.js` operate without a depth limit. When processing a sufficiently deeply nested DOM tree, the JavaScript call stack is exhausted, resulting in a `RangeError: Maximum call stack size exceeded` and crashing the application. This can lead to a denial of service if a service accepts attacker-controlled XML and performs any of the affected operations. The affected functions and entry points include - `Node.prototype.normalize()` - `XMLSerializer.serializeToString()` - `Element.getElementsByTagName()`, `getElementsByTagNameNS()`, `getElementsByClassName()`, and `getElementById()` (via the ` visitNode` function) - `Node.cloneNode(true)` - `Document.importNode(node, true)` - `node.textContent` (getter) - `Node.isEqualNode(other)`

The `downloadPackageManager()` function accepts an untrusted `version` string and uses it directly in filesystem paths. This allows a caller to use absolute paths or `../` segments to escape the `VP HOME/package manager/<pm>/` cache root, enabling the deletion, replacement, and population of directories outside the intended cache location.

Name of the Vulnerable Software and Affected Versions PolarLearn versions prior to 0-PRERELEASE-15 Description PolarLearn is a learning program affected by a privilege-escalation issue. An inverted admin check in the `account-management` module allowed authenticated non-admin users to execute the `setCustomPassword(userId, password)` and `deleteUser(userId)` actions, while legitimate administrators were blocked. The issue stems from an incorrect conditional statement that reverses the intended access control logic. Recommendations Update to version 0-PRERELEASE-15 or later.

Name of the Vulnerable Software and Affected Versions PolarLearn versions 0-PRERELEASE-15 and earlier Description The software creates a valid session for banned accounts before verifying the supplied password via the `/api/v1/auth/sign-in` API endpoint. This session is then accepted across authenticated API routes, allowing access to account data and authenticated actions as the banned user. The vulnerable parameter is the `password`. Recommendations Update to a version later than 0-PRERELEASE-15.

A flaw in the extraction logic allows an attacker to create a hardlink that points outside the intended extraction directory. By using a drive-relative link target, such as `C:../target.txt`, the software can be tricked into bypassing path restrictions. This occurs because the logic checks for `..` segments before stripping absolute roots, allowing the `linkpath` to escape the current working directory (`cwd`) during the execution of the `tar.x()` function. This results in an arbitrary file overwrite primitive with the permissions of the process performing the extraction, which is particularly critical for services that unpack untrusted archives or build pipelines consuming third-party files.

PolarLearn is a free and open-source learning program. The group chat WebSocket at `wss://polarlearn.nl/api/v1/ws` can be used without authentication. An unauthenticated client can subscribe to any group chat by providing a group UUID and send messages to any group. The server accepts and stores these messages in the group’s `chatContent`.

@isaacs/brace-expansion, a hybrid CJS/ESM TypeScript fork of brace-expansion, is subject to a denial of service (DoS) issue. This occurs due to unbounded brace range expansion when processing patterns with repeated numeric brace ranges. The library attempts to generate all possible combinations synchronously, leading to excessive CPU and memory consumption, potentially crashing the Node.js process.