Vladimirelitokarev

An issue exists in the `general ChromaV1ToYUV444()` function during AVC444 chroma plane reconstruction. A malicious RDP server can send a specially crafted `RFX AVC444 BITMAP STREAM` with specific frame geometry to trigger a heap out-of-bounds read, which occurs when the system reads memory past the allocated luma plane.

Uninitialized heap memory is transmitted in the reserved padding fields of the Save Session Info PDU. This occurs because three PDU writers in `libfreerdp/core/info.c` (`rdp write logon info v2()`, `rdp write logon info plain()`, and `rdp write logon info ex()`) utilize `Stream Seek` instead of `Stream Zero` for reserved pad bytes. Since the send buffer is allocated using `malloc` without being zeroed, stale heap data, potentially including cleartext credentials from previous sessions, can be disclosed to the receiving peer. This affects FreeRDP-based servers using `rdpUpdate::SaveSessionInfo` and `freerdp-proxy`.

A double-free issue exists in the `sftp open()` function within src/sftp.c. This occurs when a malicious SSH server responds to SSH FXP OPEN with SSH FXP STATUS containing FX OK, causing the response data buffer to be freed. If a subsequent `sftp packet require()` call returns a specific error, such as `LIBSSH2 ERROR CHANNEL PACKET EXCEEDED`, the same pointer is freed again. On glibc systems, this can lead to tcache dup conditions, which allow for overlapping allocations and the overwriting of function pointers, enabling heap corruption for any authenticated client opening an SFTP session.

A pre-authentication heap buffer overflow occurs during Encrypt-then-MAC (ETM) cipher negotiation. A malicious SSH server can corrupt heap metadata in a connecting client by sending a packet where the `packet length` is smaller than the cipher's block size. In the `fullpacket()` function within `src/transport.c`, the ETM path allocates a buffer based on `packet length` but copies `blocksize` minus one bytes using `memcpy`. On 32-bit glibc, this allows an attacker to write controlled bytes into the SIZE field of an adjacent chunk, potentially leading to tcache bin confusion, overlapping live objects, and function pointer overwrites during the session handshake.

A missing bounds check in the publickey subsystem allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and the free of an uninitialized pointer. In the `libssh2 publickey list fetch()` function, the version 1 response parser reads a server-controlled `comment len` value and advances the parse pointer without verifying if sufficient bytes remain in the buffer. This leads to an out-of-bounds read that can leak heap pointers from adjacent allocations, defeating ASLR (Address Space Layout Randomization, a security technique that randomly arranges the address space positions of key data areas). Subsequently, heap allocator state corruption occurs when the error cleanup path frees an uninitialized pointer from a non-zeroed `realloc()` region.

A pre-authentication integer underflow exists in the `ssh2 cipher crypt()` function within `src/openssl.c`. A malicious SSH server can trigger this issue during the handshake by negotiating AES-GCM ciphers. The underflow occurs during the calculation of blocksize minus `aadlen` minus authentication tag length, leading to an out-of-bounds read and a `memcpy` call with a length argument near `SIZE MAX`, which results in an immediate process crash.

protobufjs allows certain schema option paths to traverse inherited object properties during option application. A crafted protobuf schema or JSON descriptor can cause option handling to write to properties on global JavaScript constructors, corrupting built-in process-wide functionality. This can lead to a persistent denial of service for the lifetime of the affected process. The issue affects applications that parse or load protobuf schemas or descriptors from untrusted sources using reflection APIs such as `parse()`, `Root.load()`, `Root.loadSync()`, or `Root.fromJSON()`. Applications using bundled or trusted schemas to decode untrusted payloads are not directly affected.

protobufjs uses plain objects with inherited prototypes for internal type lookup tables within generated encode and decode functions. If `Object.prototype` is polluted, these lookup tables may resolve attacker-controlled inherited properties as valid protobuf type information, potentially causing attacker-controlled strings to be emitted into generated JavaScript code. This can lead to arbitrary JavaScript execution if an attacker can first trigger a prototype pollution vulnerability. Prototype pollution is a technique where an attacker manipulates the prototype of a base object to inject properties that are inherited by other objects.

An issue in Dgraph allows an unauthenticated attacker to gain full read access to all data in the database when the default configuration is used and Access Control Lists (ACL) are not enabled. The flaw is a DQL injection that occurs because the `Lang` field in JSON mutation keys is not validated. An attacker can exploit this by sending two HTTP POST requests to port 8080. First, they use the '/alter' endpoint to set up a schema predicate with `@unique`, `@index(exact)`, and `@lang`. Second, they send a crafted JSON mutation to the '/mutate?commitNow=true' endpoint. By including a DQL injection payload in the language tag position of a JSON key, the attacker can escape the `eq()` function and execute arbitrary named query blocks server-side. This process exploits the `addQueryIfUnique()` function in `edgraph/server.go`, which uses `fmt.Sprintf` to construct queries with the unsanitized `predicateName` variable, including the raw `pred.Lang` value. The results of the injected query are then returned in the HTTP response.

An issue exists in Dgraph that allows an unauthenticated attacker to gain full read access to all data in the database. This occurs in the default configuration where Access Control Lists (ACL) are disabled. The flaw is a DQL injection located in the `/mutate?commitNow=true` endpoint. By sending a crafted `cond` variable within an upsert mutation, an attacker can inject an additional DQL query block. This happens because the `cond` value is concatenated directly into a DQL query string via the `strings.Builder.WriteString` function after only a cosmetic transformation, without proper escaping, parameterization, or structural validation. The injected query executes on the server, and the results are returned in the HTTP response. Even when ACL is enabled, users with mutation-only permissions can use this method to bypass per-predicate ACL authorization.

The external engine plugin loader concatenates a user-supplied engine name into a filesystem path without filtering path separators or dot-dot (..) components. An authenticated user with CREATE FUNCTION privileges can use a crafted `ENGINE` parameter to perform path traversal and load an arbitrary shared library from any location on the filesystem. The initialization code of the library executes immediately upon loading, before the system validates the module, allowing for code execution under the server's operating system account.

Multiple functions within `langchain core.prompts.loading` read files from paths embedded in deserialized configuration dictionaries without validating against absolute path injection or directory traversal (a technique used to access files and directories outside the intended folder). When an application passes user-influenced prompt configurations to the `load prompt()` or `load prompt from config()` endpoints, an attacker can read arbitrary files on the host filesystem. This access is limited by file-extension checks, where `.txt` is required for templates and `.json` or `.yaml` for examples. The affected internal functions include ` load template()`, ` load examples()`, and ` load few shot prompt()`. Specifically, the `template path`, `suffix path`, and `prefix path` variables are processed by ` load template()`, while the `examples` variable (when provided as a string) is processed by ` load examples()`, and the `example prompt path` variable is processed by ` load few shot prompt()`.

Grist is spreadsheet software that utilizes Python as its formula language. When configured to run formulas in the Pyodide sandbox (`GRIST SANDBOX FLAVOR` set to `pyodide`), a crafted spreadsheet formula can escape the sandbox and execute arbitrary processes on the host server. This allows an attacker to run operating system commands and potentially access sensitive information like database credentials and API keys. The issue stems from the lack of a robust sandbox barrier within the Pyodide implementation on Node.js.

n8n is an open source workflow automation platform. A sandbox bypass vulnerability exists in the Python Code Node that uses Pyodide, affecting versions from 1.0.0 up to, but not including, 2.0.0. An authenticated user with permission to create or modify workflows can exploit this issue to execute arbitrary commands on the host system running n8n, with the same privileges as the n8n process. This vulnerability, tracked as CVE-2025-68668, has a CVSS score of 9.9 (Critical). Workarounds include disabling the Code Node by setting the environment variable `NODES EXCLUDE` to "["n8n-nodes-base.code"]", disabling Python support in the Code node by setting the environment variable `N8N PYTHON ENABLED` to false (available in n8n version 1.104.0), and configuring n8n to use the task runner based Python sandbox via the `N8N RUNNERS ENABLED` and `N8N NATIVE PYTHON RUNNER` environment variables. The task runner-based Python implementation became the default starting with n8n version 2.0.0.

LangChain is a framework designed for building applications powered by Large Language Models (LLMs). A serialization issue exists in the `toJSON()` method of LangChain JS, impacting versions prior to 0.3.37 and 1.2.3 for LangChain, and prior to 0.3.80 and 1.1.8 for @langchain/core. This issue arises because the method does not properly escape objects containing 'lc' keys when serializing data using `JSON.stringify()`. The 'lc' key is used internally by LangChain to identify serialized objects. If user-supplied data includes this key structure, it may be incorrectly interpreted as a legitimate LangChain object during deserialization instead of being treated as plain user data. This could potentially lead to unauthorized access or manipulation of data.

Name of the Vulnerable Software and Affected Versions: LangChain versions prior to 0.3.81 and 1.2.5 Description: A serialization injection vulnerability exists in LangChain's `dumps()` and `dumpd()` functions. These functions do not properly escape dictionaries containing 'lc' keys when serializing data. The 'lc' key is used internally by LangChain to identify serialized objects. When user-controlled data includes this key structure, it is incorrectly treated as a legitimate LangChain object during deserialization instead of plain user data. This allows attackers to potentially extract sensitive information, such as environment variables, and potentially execute arbitrary code. The vulnerability is exploitable through prompt injection via LLM responses and can affect various components, including streaming operations and cached data. Recommendations: Upgrade to LangChain version 0.3.81 or 1.2.5 or later. If upgrading is not immediately possible, restrict deserialization to a predefined allowlist of trusted objects and disable automatic loading of secrets from environment variables. Treat all LLM outputs as untrusted data, especially when serialization or deserialization is involved.