Muhammad Sobirov

An OS command injection issue exists on Windows when the `shell quote nt` function fails to properly escape `cmd.exe` metacharacters or embedded double quotes within archive filenames. This allows attackers to execute arbitrary commands with the privileges of the patool process by providing specially crafted filenames, such as `report&calc.gz`, for single-file formats executed with `shell=True`.

Cross-site scripting occurs in the `makehtml` link and image subparsers due to a failure to escape double quotes in destination URLs used within `href` and `src` attributes. This allows attackers to create markdown links or images containing a double quote followed by `onerror` or `onmouseover` handlers to execute arbitrary scripts when a user views the rendered HTML.

The software follows symbolic links at the extraction destination. The `Utils.sanitize` function in `util/utils.js` fails to properly enforce containment by comparing only the string form of an archive entry name against the resolved extraction root. Additionally, the `Utils.writeFileTo` function uses `fs.openSync(path, "w", 0o666)`, which resolves symbolic links and lacks both the `O NOFOLLOW` flag and a pre-write `fs.lstatSync` check. If a path component at the destination is a symbolic link pointing outside the extraction root, the functions `extractAllTo`, `extractAllToAsync`, and `extractEntryTo` will write entry contents through that link and modify the target's permissions. This allows an attacker who can create a symbolic link in a shared or predictable extraction directory to overwrite files the process has permission to write, provided that the overwrite option is enabled.

The software starts an HTTP Artifacts V4 backend when workflows use actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs, including 'CreateArtifact', 'GetSignedArtifactURL', 'ListArtifacts', 'FinalizeArtifact', and 'DeleteArtifact', accept a caller-supplied `workflow run backend id` without verifying if it belongs to the requester. This occurs because the `validateRunIDV4()` function in pkg/artifacts/artifacts v4.go parses the value but does not perform the necessary comparison against the requesting task's run ID. Additionally, signed URLs are authenticated using a hardcoded HMAC key (0xba 0xdb 0xee 0xf0), making signatures forgeable and ambiguous between different artifact name and task ID pairs. By default, the `--artifact-server-addr` flag uses the host's outbound address instead of the loopback address, making the backend reachable from the surrounding network. This allows unauthorized clients to read, overwrite, or delete artifacts of concurrently running jobs, potentially exposing secrets and deployment credentials.

TypeORM's `SelectQueryBuilder.distinctOn` accepts an array of strings and stores it on the expression map without validation. For PostgreSQL-family drivers, the `createSelectDistinctExpression()` function in `src/query-builder/SelectQueryBuilder.ts` joins this array and interpolates the result into the generated statement as `SELECT DISTINCT ON (values)`. This process occurs without escaping, quoting, identifier validation, or an allowlist, and bypasses the driver's escape helper and `replacePropertyNames`. Since the interpolation point is a parenthesized SQL expression list, an attacker can provide arbitrary expressions, including correlated subqueries. If an application passes client-controlled values into `distinctOn`, it allows the client to read data accessible to the application's database role through boolean or time-based inference, regardless of the entity being queried. This path is not protected by the `validateOrderByCondition` allowlist check used by the `orderBy` family.

The software fails to sufficiently validate URL addresses before returning local files, allowing potential access to files on the developer's machine. This occurs in the `getFilenameFromUrl()` function when the `publicPath` is configured without a trailing slash. An attacker can craft a request where a dot-dot sequence is embedded within a path segment (e.g., `/assets../.env`), bypassing the traversal guard. The system then slices the path at a fixed offset, resulting in a path traversal that resolves one directory above the output path. This issue specifically affects environments where the middleware is backed by the physical filesystem, such as when the `writeToDisk` variable is set to `true` or a custom `outputFileSystem` is provided. If the development server is exposed to a network or allows cross-origin requests, an attacker could exfiltrate sensitive files like passwords or source code.