N1Rwhex

The OCI plugin downloader contains an issue in the `ExtractPluginFromImage()` function where plugin binaries are extracted from container images by streaming decompressed tar data via `io.Copy` without a limit on the number of bytes written. An attacker controlling or compromising the OCI registry can provide a crafted image containing a decompression bomb—a file that expands to an arbitrarily large size upon decompression—leading to disk exhaustion. Because the SHA256 integrity check is performed only after the file is fully written to disk, the hash mismatch is detected too late to prevent the impact. This allows an attacker to replace a legitimate plugin image without needing to alter its signature.

A reflected DOM-based XSS (Cross-Site Scripting) issue exists in `taillog.js`. An unauthenticated attacker can inject arbitrary HTML into the admin interface by crafting a malicious URL. This occurs because the `file` query parameter is interpolated into an `innerHTML` assignment without proper escaping. Additionally, the Content-Security-Policy lacks a `form-action` directive, which allows injected `<form>` elements to exfiltrate credentials to an external origin.