Seankohjs

**Name of the Vulnerable Software and Affected Versions** Copier versions 9.5.0 through 9.15.1 **Description** An issue exists in the `trust` setting's prefix match within `copier/ settings.py` where the template URL is compared against a trusted prefix using `str.startswith` without path normalization. Because the URL is normalized during the actual fetch process (using `Path.resolve()` for local paths and libcurl dot-segment removal for HTTPS), a template reference containing `..` that textually starts with a trusted prefix can be granted trust. This allows an attacker-controlled template to execute `tasks`, `migrations`, or `jinja extensions` without the `--trust` prompt, leading to arbitrary command execution. **Recommendations** Update to version 9.15.2.

**Name of the Vulnerable Software and Affected Versions** justhtml versions 0.9.0 through 1.21.0 **Description** A cross-site scripting issue exists in the `to markdown()` function. The problem occurs because inline code spans do not recognize blank lines as block boundaries. This allows attackers to inject blank lines into code or pre element text to break the inline span, resulting in sanitized HTML being emitted unescaped and subsequently re-parsed as live Markdown by compliant renderers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Crawl4AI versions prior to 0.9.0 **Description** The Docker API server fails to apply Server-Side Request Forgery (SSRF) destination checks on the streaming path. A remote unauthenticated client can exploit this by calling the 'POST /crawl/stream' endpoint or the 'POST /crawl' endpoint with the `crawler config.stream` variable set to true. The `handle stream crawl request()` function passes seed URLs directly to the crawler without validation, allowing the server to fetch and stream response bodies from internal, private, or link-local addresses. **Recommendations** Update to version 0.9.0.