Katriel Moses

**Name of the Vulnerable Software and Affected Versions** Nango versions prior to 0.71.6 **Description** The runner tRPC server contains a missing authentication flaw that allows unauthenticated attackers with network access to the runner port to execute arbitrary JavaScript code. This is achieved by invoking the exposed `start` procedure without credentials, which bypasses the unenforced `RUNNER SECRET KEY` environment variable, leading to remote code execution within the runner process. **Recommendations** Update to version 0.71.6 and set the `NANGO INTERNAL AUTH REQUIRED` environment variable to `true`.

**Name of the Vulnerable Software and Affected Versions** Apache CloudStack version 4.20.3.0 Apache CloudStack version 4.22.1.0 **Description** Certificate validation failures in SAML authentication allow a malicious agent to forge a SAML response to the management server. To exploit this, an attacker must spoof the IP address of the Identity Provider (IdP) or register a URL of their choice in the management server, enabling unauthorized login using forged signatures. **Recommendations** Upgrade version 4.20.3.0 to 4.20.3.1 or above. Upgrade version 4.22.1.0 to 4.22.1.1 or above.

**Name of the Vulnerable Software and Affected Versions** Apache CloudStack versions 4.19.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 **Description** Exposure of sensitive information to an unauthorized actor occurs within the OAuth2 authentication plugin and Google OAuth integration. **Recommendations** Upgrade Apache CloudStack versions 4.19.0.0 through 4.20.3.0 to version 4.20.3.1. Upgrade Apache CloudStack versions 4.21.0.0 through 4.22.1.0 to version 4.22.1.1.

**Name of the Vulnerable Software and Affected Versions** Apache CloudStack versions 4.14.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 **Description** An authenticated tenant can perform Server-Side Request Forgery (SSRF) by registering a template that points to a malicious metalink file containing internal targets, allowing the Secondary Storage VM to retrieve and persist this data. Additionally, a tenant with the default User role can achieve Remote Code Execution (RCE) as root on the KVM hypervisor host. This occurs when a user registers a VM template with the `directDownload` variable set to true and a URL pointing to a .metalink file; the management server fetches the XML and dispatches the download to the KVM agent without re-validating the inner URLs against the scheme allowlist. **Recommendations** For versions 4.14.0.0 through 4.20.3.0, upgrade to version 4.20.3.1 or later. For versions 4.21.0.0 through 4.22.1.0, upgrade to version 4.22.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** ZeroBrew versions prior to 0.3.2 **Description** A missing integrity verification in the Ruby compatibility shim allows network attackers to execute arbitrary code. By substituting malicious content at formula resource or URL-based patch URLs, attackers can bypass checksum validation. This occurs when downloads for secondary resource and patch paths in `shim.rb` are intercepted or replaced, allowing the injection of attacker-controlled build steps or source tree modifications. These modifications execute during source builds performed via the `zb install --build-from-source` command without triggering an integrity warning. **Recommendations** Update ZeroBrew to version 0.3.2 or later.

**Name of the Vulnerable Software and Affected Versions** tablib versions prior to 3.10.0 **Description** A stored cross-site scripting issue exists in the HTML export functionality. Attackers can execute arbitrary JavaScript by embedding malicious payloads in dataset titles. This occurs when the `export book()` function in the ` html.py` format handler interpolates these titles unsanitized into the HTML output, rendering them unescaped inside an HTML h3 tag. The attack can be triggered by renaming worksheet sheets in imported files such as XLSX, ODS, XLS, or YAML with script payloads assigned to the `Dataset` title attribute. This can lead to session hijacking, unauthorized administrative actions, and sensitive data exposure when the output is rendered in a browser. **Recommendations** Update to version 3.10.0 or later.

**Name of the Vulnerable Software and Affected Versions** OpenChamber version 1.11.7 **Description** An issue exists in the file-serving endpoints '/api/fs/read', '/api/fs/stat', and '/api/fs/raw' that allows unauthenticated remote attackers to read arbitrary files. By providing an absolute path and setting the `allowOutsideWorkspace` query parameter to `true`, attackers can bypass the workspace boundary check within the `resolveReadPathFromContext()` function. This occurs because the `isPathWithinRoot` guard is vacuous, potentially exposing sensitive data such as JWT signing secrets, SSH private keys, API credentials, and environment variables, which could lead to a full authentication bypass via forged session cookies on password-protected deployments. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `allowOutsideWorkspace` parameter in the '/api/fs/read', '/api/fs/stat', and '/api/fs/raw' endpoints.

**Name of the Vulnerable Software and Affected Versions** Ground Station versions prior to 0.6.0 **Description** An unauthenticated database-destruction and arbitrary-data-injection issue exists in the Socket.IO server's `database backup` event handler. Due to disabled authentication enforcement and a wildcard CORS (Cross-Origin Resource Sharing) policy, unauthenticated network peers can connect to the server on port 7000. By emitting the `database backup` event with a `full restore` command containing a caller-supplied SQL blob, an attacker can execute raw `exec driver sql` commands. This allows for the deletion of all existing tables and the recreation of the SQLite database using attacker-controlled `CREATE TABLE` and `INSERT INTO` statements. This can result in the permanent loss of satellite records, orbital sources, hardware configurations, and observation schedules, or the injection of fabricated orbital-source URLs and observation entries that redirect the system to malicious servers during the next scheduled synchronization. **Recommendations** Update Ground Station to version 0.6.0 or later.

**Name of the Vulnerable Software and Affected Versions** Ground Station versions prior to 0.6.0 **Description** An unauthenticated blind server-side request forgery (SSRF) exists in the orbital-source configuration path. This allows an unauthenticated Socket.IO client to force the process to issue outbound HTTP requests to arbitrary destinations. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication and a wildcard CORS policy. By submitting a `data submission` event with a `submit-orbital-sources` action, an attacker can persist a URL in the database. Triggering an orbital sync via the `background task:start` event then causes the system to process this URL. The system fails to implement a scheme allowlist, host validation, or rejection of loopback, RFC1918, or link-local addresses (such as cloud instance metadata at 169.254.169.254). The URL is passed directly to `requests.get` within the ` fetch http 3le()` and ` fetch http omm()` functions in `backend/tlesync/source adapters.py`. While the raw response body is not leaked, HTTP status codes and error messages are emitted via the `orbital sync state` Socket.IO event, acting as an oracle for interpreting internal-service and cloud-metadata responses. This effect is durable as the malicious source persists in the database and re-triggers every 24 hours during the scheduled sync cycle. **Recommendations** Update Ground Station to version 0.6.0 or later.

**Name of the Vulnerable Software and Affected Versions** Ground Station versions prior to 0.6.0 **Description** An unauthenticated denial-of-service issue exists in the Socket.IO server's `service control` event handler. Due to disabled authentication enforcement and a wildcard CORS (Cross-Origin Resource Sharing) policy, any network peer can connect to the server on port 7000 without credentials. By emitting the `service control` event with a `restart service` command, an attacker can forcibly terminate the ground-station process. This action stops all active satellite-tracking sessions, SDR recording pipelines, demodulators, decoders, and rotator controllers. In Docker deployments, this can be triggered repeatedly to maintain a persistent denial-of-service state. **Recommendations** Update Ground Station to version 0.6.0 or later.

**Name of the Vulnerable Software and Affected Versions** OpenChamber version 1.11.7 **Description** An authentication bypass allows unauthenticated remote attackers to terminate the server process, resulting in a denial of service for all active AI coding sessions and locking out legitimate users. This occurs because the '/api/system/shutdown' endpoint is registered in `bootstrap-runtime.js` before the authentication middleware in the Express route handler chain, allowing the shutdown handler to be reached regardless of whether `UI PASSWORD` is configured. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the '/api/system/shutdown' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenChamber version 1.11.7 **Description** An unauthenticated remote code execution issue exists where remote attackers can execute arbitrary shell commands. This occurs when crafted POST requests are sent to the '/api/fs/exec' endpoint, which passes commands directly to the Node.js `spawn()` function without any allowlist, blocklist, or argument validation. In default Docker deployments where `UI PASSWORD` is not configured, the authentication middleware is bypassed, allowing attackers to execute OS commands as the application user and retrieve the full command output, including stdout, stderr, and exit code, from the server response. **Recommendations** Update OpenChamber version 1.11.7 to a newer version that addresses this issue. Configure the `UI PASSWORD` variable to enable authentication middleware and prevent unauthenticated access to the '/api/fs/exec' endpoint.

**Name of the Vulnerable Software and Affected Versions** SuperPlane versions prior to 0.30.0 **Description** An SMTP header injection issue exists where unauthenticated attackers can inject arbitrary SMTP headers by including CRLF (Carriage Return Line Feed) sequences in the event payload title field delivered via webhook. By manipulating the unsanitized title field passed to the SMTP DATA command, attackers can add Bcc recipients for content exfiltration, forge the From address to bypass SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) checks, or inject Content-Type and MIME boundary headers to corrupt message bodies for phishing purposes. **Recommendations** Update SuperPlane to version 0.30.0 or later.

**Name of the Vulnerable Software and Affected Versions** SuperPlane versions prior to 0.27.0 **Description** An issue exists in the `CanvasService` gRPC handlers where broken object-level authorization allows authenticated users with viewer-level access in one organization to access resources of other organizations. This occurs when arbitrary canvas or queue UUIDs are supplied without organization scoping. This flaw enables attackers to read cross-tenant execution history and event payloads containing sensitive secrets, write queue items and canvas events into victim organizations, delete arbitrary canvases, and disrupt automation workflows across tenant boundaries. **Recommendations** Update SuperPlane to version 0.27.0 or later.

**Name of the Vulnerable Software and Affected Versions** Milkdown versions prior to 7.21.3 **Description** A stored cross-site scripting issue exists in the `@milkdown/preset-commonmark` and `@milkdown/components` packages. Attackers with document write access can execute arbitrary JavaScript in the browser context of users who open the document or click a rendered link. This occurs because the `parseMarkdown` runner stores raw URL values from the remark AST as `href` mark attributes without validating the URL scheme. Additionally, a call to `DOMPurify.sanitize()` in `edit-view.ts` fails to sanitize bare URL strings, treating them as text nodes and allowing `javascript:` payloads to persist in the link-tooltip preview component and read-only mode anchor elements. **Recommendations** Update to version 7.21.3 or later.

**Name of the Vulnerable Software and Affected Versions** Milkdown versions prior to 7.21.3 **Description** A DOM cross-site scripting issue exists in the `@milkdown/plugin-emoji` package. Unauthenticated attackers can execute arbitrary JavaScript in the host application origin by tricking a victim into pasting attacker-controlled content. The `parseDOM.getAttrs` handler stores the raw `innerHTML` of pasted `span` elements containing `data-type="emoji"` without sanitization. Subsequently, the `toMarkdown` runner assigns this unsanitized value directly to a live DOM element's `innerHTML`, which bypasses the DOMPurify sanitization used in the `toDOM` path and triggers payload execution during every markdown serialization cycle. **Recommendations** Update to version 7.21.3 or later.

**Name of the Vulnerable Software and Affected Versions** QueryWeaver (affected versions not specified) **Description** An authentication bypass allows unauthenticated attackers to obtain valid session tokens for existing accounts. By submitting a signup request with a known victim email address, the server uses a Cypher MERGE operation to unconditionally create and link a new token to the matching Identity before verifying if the email is already associated with an account. This results in the server returning an authenticated session token for the victim without requiring credentials or user interaction. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** urwid (affected versions not specified) **Description** The web display backend in `urwid/display/web.py` uses Python's Mersenne Twister PRNG to generate web session identifiers `urwid id` within the `Screen.start()` function. Because this PRNG is not cryptographically secure, an attacker observing approximately 334 session IDs, such as those found in the `X-Urwid-ID` HTTP response header, can reconstruct the internal state and predict all past and future session IDs. Additionally, these identifiers are used as filenames for FIFOs created in the world-listable `/tmp` directory, allowing any local user to enumerate active session tokens. A valid session ID enables an attacker to read the victim's terminal screen via the polling endpoint, inject keystrokes—potentially leading to OS-level code execution if a shell is running—or crash the session by flooding the FIFO. **Recommendations** Update urwid to the release containing fix commit 24acd12. As a temporary mitigation, restrict access to the web display backend or avoid using it if not strictly necessary.

**Name of the Vulnerable Software and Affected Versions** Hermes WebUI versions prior to 0.51.788 **Description** An unauthenticated remote code execution issue allows remote attackers to execute arbitrary shell commands. This is achieved by accessing embedded terminal API endpoints without credentials through four sequential HTTP requests to create a session, attach a PTY shell, and write commands via the terminal input endpoint. This results in full command execution with the privileges of the server process user. **Recommendations** Update Hermes WebUI to version 0.51.788 or later.

**Name of the Vulnerable Software and Affected Versions** WebP Server Go versions prior to 0.14.5 **Description** An issue on Windows allows unauthenticated attackers to read files outside the configured `IMG PATH` directory. This occurs because the `path.Clean()` sanitization in `handler/router.go` is bypassed when requests contain percent-encoded backslashes (%5C). The flaw stems from a discrepancy where Go performs path normalization using only forward slashes, while Windows file system APIs treat both backslashes and forward slashes as equivalent, enabling access to arbitrary files on the host filesystem accessible to the server process. **Recommendations** Update to version 0.14.5 or later.