Therawdev

**Name of the Vulnerable Software and Affected Versions** LibreChat versions prior to 0.8.4-rc1 **Description** A flaw exists in the markdown artifact preview pipeline. The `generateMarkdownHtml()` function (located in `client/src/utils/markdown.ts`) utilizes a custom image renderer that triggers a fallback to the default renderer of the marked library (v15.0.12) when URLs pass the `isSafeUrl` allowlist check. This default renderer fails to HTML-escape double-quote characters within image alt text. An attacker can exploit this by crafting alt text containing double quotes and event handlers, such as `" onload="payload`, to break out of the attribute and execute arbitrary scripts in the victim's browser via the `innerHTML` property of the content element within the Sandpack preview iframe. **Recommendations** Update to version 0.8.4-rc1.

**Name of the Vulnerable Software and Affected Versions** gonic versions prior to 0.21.0 **Description** An authenticated Subsonic user can bypass ownership checks to read or delete playlists belonging to other users and probe arbitrary file paths on the host for existence or readability. This occurs because the `playlist.UserID` is derived from the first path segment of the playlist ID, but there is no path containment on the resolved file path. The issue involves path traversal within the `id` parameter, allowing a bypass of the boundary intended to prevent insecure direct object references (IDOR), which is a vulnerability where an application provides direct access to objects based on user-supplied input. **Recommendations** Update to version 0.21.0.

**Name of the Vulnerable Software and Affected Versions** gonic versions prior to 0.21.0 **Description** The Subsonic API endpoints '/rest/deletePlaylist.view' and '/rest/getPlaylist.view' lack per-resource authorization. An authenticated user, regardless of privilege level, can delete any playlist or read the full contents (name, comment, and song list) of any private playlist belonging to another user, including administrators, by providing the playlist `id`. The playlist `id` is generated using `base64url("<userID>/<filename>.m3u")`. Since `userID` is a small integer and filenames are either user-supplied or time-derived, these IDs are guessable or may have been previously exposed, allowing low-privileged users to delete administrator playlists or exfiltrate private data. **Recommendations** Update to version 0.21.0 or later.

**Name of the Vulnerable Software and Affected Versions** Gonic versions prior to 0.21.0 **Description** A logic error in the `ServeCreateOrUpdatePlaylist()` function allows for arbitrary file write operations within the music streaming server. **Recommendations** Update to version 0.21.0 or later. As a temporary workaround, consider restricting access to the `ServeCreateOrUpdatePlaylist()` function until the update is applied.

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.212 Description FreeScout, a help desk and shared inbox built with PHP's Laravel framework, does not properly consider the `limit user customer visibility` parameter when merging customers in versions prior to 1.8.212. Recommendations Update to version 1.8.212 or later.