Tepel-Chen

The `mergeDeep()` function in the GraphQL Tools utils package fails to exclude ` proto `, `constructor`, or `prototype` keys while recursively merging source objects. An unauthenticated client can alias fields to these names, causing responses from two subgraphs to collide during supergraph result merging. This allows the function to traverse Object and Function prototypes and overwrite `Function.prototype.call` with a value supplied by a subgraph, resulting in a denial of service that breaks all subsequent requests until the process is restarted.

Improper Neutralization of CRLF Sequences allows HTTP Request Splitting. The software fails to percent-encode carriage return (`r`) or line feed (` `) characters in the URL query component before constructing the HTTP/1.1 request target. Specifically, the `hackney url:make url/3` function passes the query binary directly without validation or escaping, violating RFC 3986 Section 3.4. An attacker controlling part of a URL can inject raw CRLF sequences into the query string, enabling the injection of arbitrary HTTP headers or the splitting of the HTTP request.

A flaw exists in Frappe that allows an attacker to inject malicious code through a crafted image URL. This can lead to Cross-Site Scripting (XSS) when a user’s avatar is displayed. The issue can be triggered for other users through website page comments.