Muhammad Sobirov

**Name of the Vulnerable Software and Affected Versions** adm-zip versions 0.5.9 through 0.6.0 **Description** The software follows symbolic links at the extraction destination. The `Utils.sanitize` function in `util/utils.js` fails to properly enforce containment by comparing only the string form of an archive entry name against the resolved extraction root. Additionally, the `Utils.writeFileTo` function uses `fs.openSync(path, "w", 0o666)`, which resolves symbolic links and lacks both the `O NOFOLLOW` flag and a pre-write `fs.lstatSync` check. If a path component at the destination is a symbolic link pointing outside the extraction root, the functions `extractAllTo`, `extractAllToAsync`, and `extractEntryTo` will write entry contents through that link and modify the target's permissions. This allows an attacker who can create a symbolic link in a shared or predictable extraction directory to overwrite files the process has permission to write, provided that the overwrite option is enabled. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** nektos/act versions 0.2.81 through 0.2.89 **Description** The software starts an HTTP Artifacts V4 backend when workflows use actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs, including 'CreateArtifact', 'GetSignedArtifactURL', 'ListArtifacts', 'FinalizeArtifact', and 'DeleteArtifact', accept a caller-supplied `workflow run backend id` without verifying if it belongs to the requester. This occurs because the `validateRunIDV4()` function in pkg/artifacts/artifacts v4.go parses the value but does not perform the necessary comparison against the requesting task's run ID. Additionally, signed URLs are authenticated using a hardcoded HMAC key (0xba 0xdb 0xee 0xf0), making signatures forgeable and ambiguous between different artifact name and task ID pairs. By default, the `--artifact-server-addr` flag uses the host's outbound address instead of the loopback address, making the backend reachable from the surrounding network. This allows unauthorized clients to read, overwrite, or delete artifacts of concurrently running jobs, potentially exposing secrets and deployment credentials. **Recommendations** For versions 0.2.81 through 0.2.89, bind the artifact server to the loopback address and avoid using actions/upload-artifact@v4 and actions/download-artifact@v4 until a patch is available.

**Name of the Vulnerable Software and Affected Versions** TypeORM versions 0.2.21 through 1.1.0 **Description** TypeORM's `SelectQueryBuilder.distinctOn` accepts an array of strings and stores it on the expression map without validation. For PostgreSQL-family drivers, the `createSelectDistinctExpression()` function in `src/query-builder/SelectQueryBuilder.ts` joins this array and interpolates the result into the generated statement as `SELECT DISTINCT ON (values)`. This process occurs without escaping, quoting, identifier validation, or an allowlist, and bypasses the driver's escape helper and `replacePropertyNames`. Since the interpolation point is a parenthesized SQL expression list, an attacker can provide arbitrary expressions, including correlated subqueries. If an application passes client-controlled values into `distinctOn`, it allows the client to read data accessible to the application's database role through boolean or time-based inference, regardless of the entity being queried. This path is not protected by the `validateOrderByCondition` allowlist check used by the `orderBy` family. **Recommendations** Update TypeORM to a version later than 1.1.0. As a temporary workaround, avoid passing client-controlled values into the `distinctOn` method of `SelectQueryBuilder`.

**Name of the Vulnerable Software and Affected Versions** webpack-dev-middleware versions 5.3.4 through 5.x webpack-dev-middleware versions 6.1.2 through 6.x webpack-dev-middleware versions 7.1.0 through 7.x **Description** The software fails to sufficiently validate URL addresses before returning local files, allowing potential access to files on the developer's machine. This occurs in the `getFilenameFromUrl()` function when the `publicPath` is configured without a trailing slash. An attacker can craft a request where a dot-dot sequence is embedded within a path segment (e.g., `/assets../.env`), bypassing the traversal guard. The system then slices the path at a fixed offset, resulting in a path traversal that resolves one directory above the output path. This issue specifically affects environments where the middleware is backed by the physical filesystem, such as when the `writeToDisk` variable is set to `true` or a custom `outputFileSystem` is provided. If the development server is exposed to a network or allows cross-origin requests, an attacker could exfiltrate sensitive files like passwords or source code. **Recommendations** For webpack-dev-middleware versions 5.3.4 through 5.x, 6.1.2 through 6.x, and 7.1.0 through 7.x, set the `writeToDisk` variable to `false` or avoid using a custom `outputFileSystem` to prevent physical filesystem access. As a temporary mitigation, ensure the `publicPath` configuration ends with a trailing slash to prevent the offset slicing bypass.