P3Ngu1Nw

**Name of the Vulnerable Software and Affected Versions** AnythingLLM versions 1.11.1 and earlier **Description** AnythingLLM is an application designed to enhance Large Language Models (LLMs) by providing contextual information from content. A Streaming Phase Cross-Site Scripting (XSS) issue exists in the chat rendering pipeline, potentially leading to Remote Code Execution (RCE) on the host operating system. This is due to an insecure Electron configuration, specifically the combination of `nodeIntegration: true` and `contextIsolation: false`. The vulnerability arises from the interpolation of token content directly into the `alt` attribute within the custom markdown-it image renderer located in `frontend/src/utils/chat/markdown.js` without proper HTML entity escaping. The `PromptReply` component then renders this output using `dangerouslySetInnerHTML` without DOMPurify sanitization, unlike the `HistoricalMessage` component which correctly applies DOMPurify.sanitize(). An attacker can exploit this by influencing the content generated by the LLM, such as through poisoned Retrieval-Augmented Generation (RAG) documents or compromised LLM endpoints, to achieve full host compromise. **Recommendations** Update to version 1.11.2 or later.

**Name of the Vulnerable Software and Affected Versions** latchset Jose versions prior to 11 **Description** The issue is related to an uncontrolled resource consumption in the latchset Jose module for signing and encrypting JSON objects. This can be exploited by an attacker to cause a denial of service through CPU consumption by using a large `p2c` (also known as PBES2 Count) value. **Recommendations** For versions prior to 11, consider restricting the use of large `p2c` values to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** erlang-jose versions through 1.11.6 **Description** The issue is related to an uncontrolled resource consumption in the erlang-jose module for JSON object signing and encryption for Erlang and Elixir languages. This can be exploited by a remote attacker to cause a denial of service through CPU consumption by using a large `p2c` (PBES2 Count) value in a JOSE header. **Recommendations** For versions through 1.11.6, limit access to the vulnerable module and monitor usage to minimize the risk of exploitation. Await a patch for a permanent fix.

**Name of the Vulnerable Software and Affected Versions** jose versions prior to 2.0.7 jose versions prior to 4.15.5 **Description** A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions, it is possible to have the user's environment consume an unreasonable amount of CPU time or memory during JWE Decryption operations. The impact is limited to Node.js users utilizing the JWE decryption APIs to decrypt JWEs from untrusted sources. **Recommendations** For versions prior to 2.0.7, update to version 2.0.7 to limit the decompression routine and prevent excessive CPU time or memory consumption. For versions prior to 4.15.5, update to version 4.15.5 to limit the decompression routine and prevent excessive CPU time or memory consumption. In version 4.x, further adjust the limit via the `inflateRaw` decryption option implementation. As a temporary workaround, detect and reject JWEs with compressed payloads by checking the token's protected header and throwing an error if compression is detected.

**Name of the Vulnerable Software and Affected Versions** jwcrypto versions prior to 1.5.6 **Description** The issue is related to an uncontrolled resource consumption in the jwcrypto library. An attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. **Recommendations** For versions prior to 1.5.6, to mitigate this vulnerability, it is recommended to limit the maximum token length to 250K. As a temporary workaround, consider restricting the processing of tokens with high compression ratios until a patch is available. Update to version 1.5.6 or later to fix the vulnerability.

**Name of the Vulnerable Software and Affected Versions** l8w8jwt version 2.2.1 **Description** The issue arises from the use of `memcmp` to verify authentication, which is not constant time. This makes it easier to bypass authentication via a timing side channel. **Recommendations** For l8w8jwt version 2.2.1, consider using a constant-time comparison function to verify authentication as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libjwt version 1.15.3 **Description** The issue arises from the use of `strcmp` to verify authentication, which is not a constant time operation. This makes it easier for attackers to bypass authentication via a timing side channel. **Recommendations** For libjwt version 1.15.3, consider updating to a version that uses constant time string comparison to mitigate the risk of timing side channel attacks.

**Name of the Vulnerable Software and Affected Versions** json-jwt versions 1.16.3 through 1.16.5 json-jwt versions 1.15.x through 1.15.3 **Description** The issue allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes be used to bypass JSON::JWT.decode. **Recommendations** For json-jwt versions 1.16.3 through 1.16.5, update to version 1.16.6 or later. For json-jwt versions 1.15.x through 1.15.3, update to version 1.15.3.1 or later. As a temporary workaround, consider restricting the use of JWE to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** lestrrat-go/jwx versions prior to 1.2.27 lestrrat-go/jwx versions prior to 2.0.18 **Description** The issue is related to the JWE key management algorithms based on PBKDF2, which require a JOSE Header Parameter called `p2c` (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its primary purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the `p2c` parameter in JWE to a very large number, it can cause excessive computational consumption, resulting in a denial of service. **Recommendations** For versions prior to 1.2.27, upgrade to version 1.2.27 or later. For versions prior to 2.0.18, upgrade to version 2.0.18 or later. As a temporary workaround, consider restricting the use of the `p2c` parameter in JWE to minimize the risk of exploitation.