Megamansec

On Windows, the `src/PIL/WmfImagePlugin.py` component passes unchecked 32-bit WMF or EMF dimensions to the native `drawwmf()` handler in `src/display.c`. The handler determines the size of a Device Independent Bitmap (DIB) allocation using 16-bit-truncated `bcWidth` and `bcHeight` fields, but subsequently copies pixel data using the original full dimensions. A specially crafted wide and short metafile can bypass the pixel-count decompression-bomb check, causing the renderer to read beyond the heap buffer, which may lead to memory disclosure or a process crash.

Pillow can exhaust system resources when parsing an existing PDF during an append operation. The `PdfParser` follows page-tree child references without tracking cycles or duplications and follows previous-trailer chains with only an exact repeated-offset guard. Consequently, deep or cyclic page trees and long chains of unique trailer offsets can exhaust the Python stack. Additionally, repeated non-cyclic `/Kids` references can lead to super-linear CPU and memory consumption. An attacker can trigger this by providing a specially crafted PDF to an application that calls the `Image.save()` function with the `append` parameter set to `True`. This can result in an uncaught `RecursionError` or excessive resource consumption, leading to a denial of service. The issue specifically involves the `linearize page tree()` and `read prev trailer()` functions.

The MSP RLE decoder in the Pillow imaging library allows a small file to expand into an unbounded in-memory buffer. This occurs because the decoder writes run-length output to `BytesIO` without limiting the expansion to the declared image size. An attacker can provide a specially crafted MSP image to an application that loads its pixels, leading to memory exhaustion and a denial of service, even if the declared pixel count passes the decompression-bomb check (a security mechanism designed to prevent resource exhaustion from overly large images).

A heap use-after-free occurs when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. This happens when an application saves attacker-influenced TIFF tags to BytesIO, causing libtiff to reject a tag during encoding in the `ImagingLibTiffEncode()` function. The error path frees the output buffer without closing or clearing the TIFF handle, leading to a subsequent cleanup process that flushes data through the write callback into the freed memory. This can result in a process crash or potential arbitrary code execution.

During FreeType rendering with an active stroker, the library may free an invalid glyph pointer. This occurs when the `FT Load Glyph()` function fails, leading the cleanup process to call `FT Done Glyph()` on a stale or uninitialized glyph variable. An attacker can trigger this failure path by providing a malformed font as untrusted bytes to an application that renders text with a nonzero stroke width, potentially resulting in memory corruption or a process crash.

The `Image.merge()` function can dereference a null image8 plane because validation skips the first input band. This allows a 32-bit integer or floating-point image backed by image32 storage to be merged as a narrower multiband image. A native process crash can be triggered if a caller invokes `Image.merge()` directly with such a first band or if an application opens and loads a crafted IPTC file.

A flaw exists in the Python imaging library where the `ImageMorph.MorphOp.apply()` function can access memory before a row buffer when processing images with a width of zero. This occurs because the PPM and PGM parsers do not perform lower-bound checks on the image width, allowing the creation of images with size `(0, N)`. When such an image is processed by the native morphology routine, it attempts to index `outrow[width - 1]`, which results in an out-of-bounds write at `outrow[-1]`. An attacker can trigger this by supplying a specially crafted PPM or PGM image to an application that performs morphology operations, leading to a process crash or potential memory corruption.

A code injection flaw exists during multi-component template inheritance where the top-level `nocache hash` is not restored and remains null. This allows an attacker to provide assigned data containing a forged SmartyNocache marker. This marker is then copied directly into the regenerated PHP cache file, leading to remote code execution when the file is included.

The `BalancedPool` constructor uses an internal deep-clone process that serializes and reparses the options object as JSON. Since JSON does not support functions, any function-valued TLS options, such as a custom `checkServerIdentity` callback or a custom connector within the `connect` option, are silently discarded. This can lead to a TLS certificate validation bypass where a peer that should be rejected by a custom `checkServerIdentity` function is accepted if it passes the default Node.js hostname and chain checks.

The cache interceptor incorrectly handles the caching of unsafe HTTP methods. While documentation states only safe methods are cached, the logic used to skip caching fails to include unsafe methods like POST, PUT, or DELETE in the skip list. Consequently, these requests enter the cache-read path. Additionally, the response-storage gate does not verify the HTTP method, allowing responses to unsafe requests that are heuristically cacheable or contain a Cache-Control directive to be stored. This allows a remote origin to provide a cacheable response that the client will later replay for subsequent state-changing requests, preventing them from reaching the origin and causing an integrity failure.

An OS command injection issue exists in the netrw standard plugin. An attacker can execute arbitrary shell commands with the privileges of the Vim process by inducing a user to open a crafted URL, specifically utilizing the 'sftp://' or 'file://' protocol handlers.

The software contains a command injection issue in the `scripts/update-clawtributors.ts` script. This affects contributors or maintainers, and CI systems, who execute `bun scripts/update-clawtributors.ts` on a source checkout containing a malicious commit author email. The script extracts a GitHub login from `git log` author metadata and uses it in a shell command via `execSync`. A crafted commit record can inject shell metacharacters, leading to arbitrary command execution. Normal CLI usage, such as `npm i -g openclaw`, is not affected as the script is not part of the shipped CLI and is not executed during routine operation.

The optional BlueBubbles iMessage channel plugin could accept webhook requests as authenticated based solely on the TCP peer address being loopback (`127.0.0.1`, `::1`, `::ffff:127.0.0.1`) even when the configured webhook secret was missing or incorrect. This does not affect the default iMessage integration unless BlueBubbles is installed and enabled. If a deployment exposes the BlueBubbles webhook endpoint through a same-host reverse proxy or an attacker can reach loopback via Server-Side Request Forgery (SSRF), an unauthenticated party may be able to inject inbound webhook events into the agent pipeline.

The OpenClaw software, with the Twitch plugin installed and enabled, has an issue where access control is bypassed. Specifically, the `allowFrom` allowlist is not properly enforced when `allowedRoles` is not set or is empty. This allows unauthorized Twitch users to trigger agent dispatch by mentioning the bot in Twitch chat. The problematic logic resides in the `checkTwitchAccessControl()` function within the Twitch plugin (`extensions/twitch/src/access-control.ts`). When `allowFrom` is configured, the code does not return `allowed: false` for non-members, causing execution to continue. If `allowedRoles` is unset or empty, the function defaults to `allowed: true`, even when `allowFrom` is configured. This can lead to unintended actions, responses, and potential resource exhaustion for operators who relied on `allowFrom` to restrict bot invocation in Twitch chat.

An authentication bypass exists in the optional `voice-call` extension when inbound allowlist policy validation is used. The system accepts empty caller IDs and uses suffix-based matching instead of strict equality. This allows remote attackers to bypass inbound access controls by placing calls with missing caller IDs or numbers ending with allowlisted digits, potentially reaching the voice-call agent and executing tools. The issue affects deployments that have the `voice-call` extension installed and enabled. The vulnerability is related to the inbound allowlist check in the `extensions/voice-call/src/manager.ts` file, which used suffix-based matching and accepted empty caller IDs after normalization. Specifically, missing or empty `from` values normalized to an empty string, causing the allowlist predicate to evaluate as allowed. Additionally, suffix-based matching meant any caller number whose digits ended with an allowlisted number would be accepted. The vulnerable component is the `voice-call` extension.

The software contains a flaw where direct message (DM) allowlist matching can be circumvented by precisely matching sender display names and localparts without homeserver verification. This allows remote Matrix users to impersonate permitted identities by utilizing attacker-controlled display names or matching localparts from different homeservers, potentially reaching the routing and agent pipeline. The issue arises because DM allowlist decisions are made by exact-matching entries against sender-derived candidates, including the sender display name and the sender MXID localpart without the homeserver component. If an operator configures Matrix allowlists with display names or bare localparts, a remote Matrix user may be able to impersonate an allowed identity.

A flaw exists in Wekan that allows for improper authorization. This issue is related to the `setCreateTranslation` function within the `client/components/settings/translationBody.js` file of the Custom Translation Handler component. The attack can be initiated remotely.

A weakness exists in WeKan related to the Activity Publication Handler component, specifically in the processing of the file `server/publications/activities.js`. A manipulation of this component can lead to information disclosure and can be launched remotely.

A flaw exists in Wekan that could allow information disclosure. This issue impacts an unspecified part of the `server/publications/cards.js` file within the Meteor Publication Handler component. The attack can be initiated remotely.

A security flaw exists in WeKan up to version 8.20. The issue affects unknown code within the `server/methods/fixDuplicateLists.js` file of the Administrative Repair Handler component, leading to improper access controls. This allows for remote exploitation.