Koyokr

Mongoose is a MongoDB object modeling tool for asynchronous environments. The `countDocuments()` function fails to apply the configured `sanitizeFilter` defense against query selector injection. This allows a remote, unauthenticated attacker to pass query operator objects as filter values, which are processed as operators instead of literal values. Consequently, the resulting count may include documents that should not match, potentially undermining application logic or authorization mechanisms.

Mongoose fails to correctly apply the connection-level `sanitizeFilter` option when configured via `mongoose.connect()` or `createConnection()`. While the connection reports the defense as enabled, the `Query.prototype. castConditions()` function and query casting mechanisms do not read this specific configuration. This allows an attacker to pass a crafted object containing query operators into a query filter, potentially bypassing authentication by matching account records without a literal password. Global configuration via `mongoose.set('sanitizeFilter')` and per-query `Model.find().sanitizeFilter()` are not affected.

Applications that pass user input or arbitrary data into the `DSL` by calling `keyword` or `symbol` on that input can produce SQL strings that facilitate SQL injection when executed by a `JDBC` driver. This occurs because some formatters do not apply the existing suspicious-character check to the resulting entity names. The impact of this issue depends on the privileges of the database connection executing the generated statement.

The `wrap-nested-params` function in the `ring.middleware.nested-params` namespace uses a backtracking regular expression to match parameter names from URL query strings and HTTP request bodies. An attacker can provide a specially crafted parameter name that triggers quadratic O(n^2) matching work, leading to a regular-expression denial of service. Users of `Ring-Defaults` are also affected as this middleware is enabled by default.

With the default rolling session behavior, a request that restores a session before a logout can save its own copy after another request has completed the session destroy call. This allows the recreation of a destroyed session identifier along with its authenticated data. An attacker possessing a victim's valid signed session cookie can keep a request in flight during logout and replay that cookie to restore the session after it was intended to be revoked, without requiring cookie theft or signature forgery.

When using the `joker --lint <file>` command, the software searches for a `.jokerd/` directory by traversing upwards from the target file and executes any matching `linter.*` files found within that directory. Since these files contain executable Joker/Clojure code, linting a file within an untrusted repository allows for arbitrary code execution. This issue can be triggered by CI jobs or editor integrations that automatically run the linting process on checked-out source code.

A stored cross-site scripting issue exists in the `Security::detectXss()` function located in system/src/Grav/Common/Security.php. The event-handler scan uses a regular expression that fails to account for the `>` character when it appears inside a quoted attribute value. This discrepancy between the detector and the browser allows a page editor without `admin.super` privileges to save malicious content, such as `<img src=x title=">" onerror=alert(document.domain)>`. The payload is stored and subsequently executed in the site origin when viewed by any visitor, including unauthenticated users.

An issue exists in the `IN PLACE` sanitization process where element-removal hooks do not properly neutralize detached subtrees. This allows attackers to provide HTML containing event handlers on descendant elements that execute after the sanitization process is finished, despite the returned root element appearing clean. This leads to cross-site scripting, a technique where malicious scripts are injected into trusted websites.

The built-in clean-html sanitizer can be bypassed using a MathML/<style> carrier. This technique hides dangerous elements from the sanitizer's element walk, allowing no-interaction event handlers to persist in the editor value. This can lead to Mutation XSS (Cross-Site Scripting), where an attacker-influenced HTML input results in the execution of malicious handlers, such as `onload` or `onfocus` within an `<img>` tag, when the output is rendered via `element.innerHTML = editor.value` without requiring user interaction.