Kilkat

The HTTP-Redirect binding decoder decompresses SAML messages provided by an attacker without limiting the output size before signature validation. This allows an unauthenticated remote attacker to exhaust server memory, leading to a denial of service.

The application renders attacker-supplied SVG files via Apache Batik. A scheme-less root-relative image reference can bypass the `isExternalUrl()` function in `SvgSanitizer`, allowing Batik to resolve the reference against the `file:///input.svg` document base as a same-origin local file. This occurs within the `convert()` and `addSvgAsPage()` functions in `app/core/src/main/java/stirling/software/SPDF/utils/SvgToPdf.java`. Consequently, image-decodable server files such as PNG, JPG, GIF, or SVG can be rendered into the resulting PDF. This can be exploited without authentication on deployments where login is disabled, or by users with non-admin access when login is enabled. The issue also provides an existence oracle for image-decodable paths, but does not disclose plain text, binary files, directories, XInclude text, external entities, explicit file URLs, or HTTP references. The affected endpoint is 'POST /api/v1/convert/svg/pdf'.

The Serve static Middleware for the Cloudflare Workers adapter in Hono does not properly validate user-controlled paths, potentially allowing attackers to read arbitrary keys from the Workers environment. This improper validation can result in unintended access to internal asset keys. The issue affects applications running on Cloudflare Workers that utilize Serve static Middleware with user-controllable request paths and may lead to information disclosure. The exposed data is limited to readable asset keys and does not allow modification of stored data or execution of arbitrary code.

A Cross-Site Scripting (XSS) issue exists in the `ErrorBoundary` component of the hono/jsx library. Untrusted data from users may be rendered as raw HTML, potentially allowing execution of arbitrary scripts in a user's browser.

The 'wheel' package, a tool for manipulating Python wheel files, contains a flaw in the `unpack` function. This flaw allows for file permission modification through mishandling of file permissions after extraction. The logic incorrectly trusts the filename from the archive header when setting file permissions, even after the extraction process has sanitized the path. An attacker can craft a malicious wheel file that, when unpacked, alters the permissions of critical system files, potentially enabling Privilege Escalation or arbitrary code execution. The vulnerability is triggered when the `unpack` function applies permissions based on the unsanitized filename from the archive header. This can lead to critical system files becoming world-writable.