Liangjs

**Name of the Vulnerable Software and Affected Versions** better-auth versions 1.3.8-beta.3 through 1.7.0-rc.2 **Description** The `deviceAuthorization` plugin contains a UI misrepresentation issue. The endpoint 'GET /device' fails to display the requesting `client id` and `scope`. This allows an attacker to initiate a device request via the '/device/code' endpoint and deceive authenticated users into approving the code, which the attacker can then redeem at the '/device/token' endpoint to obtain a live session token. **Recommendations** Update better-auth to version 1.7.0-rc.3 or later.

**Name of the Vulnerable Software and Affected Versions** Electron versions prior to 41.10.6 Electron versions prior to 42.9.2 Electron versions prior to 43.4.1 Electron versions prior to 44.0.0-beta.5 **Description** An Electron `<webview>` guest can enable `nodeIntegrationInWorker` for its Web Workers even when the unsandboxed embedder has Node.js integration disabled. This allows untrusted guest content to create a Node-enabled worker with higher privileges than those granted by the embedder. This issue only affects applications that enable the `<webview>` tag and maintain an unsandboxed embedder. **Recommendations** Update to version 41.10.6. Update to version 42.9.2. Update to version 43.4.1. Update to version 44.0.0-beta.5. Remove `nodeIntegrationInWorker` from the guest preferences in a `will-attach-webview` handler. Avoid enabling the `<webview>` tag when loading untrusted content.

**Name of the Vulnerable Software and Affected Versions** vm2 versions prior to 3.11.7 **Description** An incorrect authorization issue exists in the external package allowlist check. The system uses non-exact substring matching instead of full package-name boundary validation. This allows attackers to bypass the allowlist by requesting a colliding package name that contains a substring of an allowed package, leading to the loading and execution of unauthorized host packages within the host context. **Recommendations** Update to version 3.11.7 or later.