Pig-Tail

**Name of the Vulnerable Software and Affected Versions** GitPython versions prior to 3.1.59 **Description** An issue exists when parsing `.gitmodules` files where the software fails to disable `merge includes`. This allows an attacker to disclose the content of local files by using `[include]` directives to point to arbitrary file paths. When the `repo.submodules` property is accessed, the `GitConfigParser` function raises a `MissingSectionHeaderError` that includes the first line of the targeted file within the exception message. **Recommendations** Update GitPython to version 3.1.59 or later.

**Name of the Vulnerable Software and Affected Versions** GitPython versions prior to 3.1.59 **Description** GitPython fails to safely re-serialize multi-line git-config values during write operations. This allows attackers to craft configuration files containing embedded newlines that can be corrupted into injected directives, such as `core.hooksPath`. When any unrelated configuration write occurs, these dormant quoted values become active git directives, which can lead to arbitrary code execution through hook invocation. **Recommendations** Update GitPython to version 3.1.59 or later.

**Name of the Vulnerable Software and Affected Versions** GitPython versions prior to 3.1.59 **Description** GitPython fails to include the `--separate-git-dir` flag in its `unsafe git clone options`. This allows an attacker to provide a `separate git dir` parameter to the `Repo.clone from()` or `Repo.clone()` functions, redirecting repository metadata to an arbitrary filesystem path. This behavior can lead to the creation of unauthorized directories and the potential execution of git hooks, which are scripts that run automatically when certain events occur in a git repository. **Recommendations** Update GitPython to version 3.1.59 or later.

**Name of the Vulnerable Software and Affected Versions** SurrealDB versions prior to 3.1.5 **Description** A server-side request forgery (SSRF) issue exists in the JWKS fetcher. The system follows HTTP redirects without re-validating the redirect targets against network capabilities. Users with the Owner role can configure a JWKS URL pointing to an allowlisted host that redirects to blocked internal addresses, allowing them to bypass network access controls. **Recommendations** Update SurrealDB to version 3.1.5 or later.

**Name of the Vulnerable Software and Affected Versions** Traefik versions prior to 2.11.51 Traefik versions prior to 3.6.22 Traefik versions prior to 3.7.6 **Description** The ForwardAuth middleware in this HTTP reverse proxy and load balancer incorrectly derives the `X-Forwarded-Port` header sent to the authentication service from the original incoming request rather than the sanitized forwarded request, even when `trustForwardHeader` is set to `false`. This allows an unauthenticated remote attacker to inject an `X-Forwarded-Proto: https` header via a plain HTTP connection, leading the system to forward `X-Forwarded-Port: 443` to the authentication service and bypass port-based authorization checks. **Recommendations** Update to version 2.11.51. Update to version 3.6.22. Update to version 3.7.6.

**Name of the Vulnerable Software and Affected Versions** webpack-dev-server versions prior to 5.2.6 **Description** Internal developer endpoints '/webpack-dev-server/open-editor' and '/webpack-dev-server/invalidate' perform state-changing actions on GET requests without verifying the request origin. This allows any website visited by a developer to trigger these endpoints cross-origin. An attacker can open arbitrary local files in the developer's editor, including those outside the project root. Additionally, repeated requests can spawn multiple editor processes and force recompilations, leading to system performance degradation. **Recommendations** Upgrade to webpack-dev-server 5.2.6.

**Name of the Vulnerable Software and Affected Versions** nodemailer versions prior to 9.0.1 **Description** Authenticated attackers can read arbitrary local files or perform server-side request forgery (SSRF) by exploiting a failure to apply the `disableFileAccess` and `disableUrlAccess` flags to the message-level `raw` option. While these flags are intended to sandbox untrusted input by preventing the reading of local files or fetching of URLs, the `MailComposer.compile()` function fails to pass these flags when constructing the root MIME node for a `raw` message. An attacker can exploit this by providing a `raw` object containing a `path` property to read sensitive server files or an `href` property to make requests to internal or metadata endpoints. The fetched content is then included in the body of the outgoing message and delivered to a recipient chosen by the attacker. This issue affects all bundled transports, including SMTP, SES, sendmail, stream, and JSON. **Recommendations** Update nodemailer to version 9.0.1 or later. As a temporary mitigation, avoid using the `raw` option when processing untrusted input if `disableFileAccess` or `disableUrlAccess` are required.