Vnth4Nhnt

The `nvm ls` function uses a sed program to filter installed versions by embedding the requested version pattern in a `#...#` address. Because backslashes are not escaped, a version string containing `#` or `#` can prematurely close the address, causing the remaining string to be interpreted as sed commands. On systems with GNU sed, the `e` command can execute shell commands as the user, while BSD sed allows reading and writing files via the `r` and `w` commands. This issue is triggered when an attacker-influenced version string is passed to `nvm use`, `nvm which`, `nvm ls`, `nvm version`, `nvm run`, `nvm exec`, or to `nvm-exec` via the `NODE VERSION` variable. Additionally, users employing the `cdnvm` bash hook or `load-nvmrc` zsh hook are susceptible to command execution simply by entering a directory containing a malicious `.nvmrc` file, as these hooks pass the file content directly to `nvm ls` and `nvm version`.

Certain document creation endpoints fail to verify if the requesting authenticated portal user belongs to the target party. This missing authorization allows authenticated portal users to create documents on behalf of other parties.

Missing input validation in certain endpoints allows authenticated attackers to perform SQL injection. By sending specially crafted requests, an attacker can manipulate database queries to extract sensitive information from the database.

Missing input validation in certain endpoints allows authenticated attackers with low privileges to perform SQL injection, which is a technique used to manipulate database queries. By sending specially crafted requests, an attacker can extract sensitive information from the database.

Certain project-related endpoints fail to enforce permission checks. This allows authenticated low-privileged users to call these endpoints directly to read project data that exceeds the permissions assigned to their role.

Missing input validation in certain endpoints allows authenticated attackers to execute SQL injection. By sending specially crafted requests, an attacker can inject SQL into database queries to extract sensitive information from the underlying database.

Server-side template injection occurs because user-controlled message fields are not validated before template rendering, which allows expressions to run in an unrestricted context. Authenticated attackers with a common operational role can inject template expressions to read and write arbitrary database data, delete documents, send outbound requests from the server, and send mail from the site.

Certain endpoints fail to enforce proper role-based authorization checks. This allows authenticated low-privileged users to send requests to these endpoints to modify inventory records beyond their permitted role.

Certain endpoints fail to enforce proper authorization checks on item master data. This allows authenticated attackers with low-privileged accounts to access and read item master data that exceeds the permissions assigned to their role.

Certain endpoints fail to enforce proper permission checks. This allows authenticated users to access and read financial data that exceeds the permissions granted to their assigned role.

Certain endpoints fail to enforce proper permission checks, allowing authenticated low-privileged users to deactivate master records and modify data beyond their assigned role permissions.

An issue exists in a record-creation endpoint that accepts the record type from the request and inserts the record while permission checks are disabled. This allows any authenticated user, regardless of their operational role, to specify a privileged record type to create privileged accounts and gain full control of the site.

Certain endpoints that handle party records lack proper authorization. This allows authenticated users with low-privileged accounts to send requests to these endpoints and modify data beyond their permitted role, resulting in unauthorized changes to party records.

Certain endpoints fail to enforce proper authorization checks during record status changes. This allows authenticated low-privileged users to modify data beyond their permitted role, bypassing role-based access restrictions.

An authorization bypass exists where an endpoint honors a caller-supplied flag that disables permission enforcement. Authenticated attackers can use this flag to skip permission checks and read party records that exceed their assigned role permissions.

The `nvm alias()` function fails to perform a containment check when concatenating a requested version or alias name to the `$NVM DIR/alias` directory. This allows a name containing `..` components to escape the alias directory and access arbitrary files readable by the user, such as `../../.npmrc`. The `nvm print alias file()` function then outputs non-comment, non-empty lines from the accessed file. This can be triggered via an untrusted `.nvmrc` file when a developer executes `nvm use`, `nvm install`, or `nvm which` within a malicious repository, disclosing the first non-comment line in an error message. Additionally, using `nvm alias <traversing-name>` can disclose all non-comment lines of the target file.

The local backend fails to mask special permission bits when applying source-supplied mode metadata. This allows an attacker to set setuid or setgid bits on files they control. When copying files with metadata preservation from an untrusted remote source, an attacker can plant a setuid binary to escalate privileges to root if the process runs as root, or to the associated service account user.

An unauthenticated Cross Site Scripting (XSS) issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication.

The default `security.http.urls` policy fails to properly block requests to loopback, internal, and cloud-metadata IPv4 literals because the deny rule only matches dotted-decimal notation. Consequently, alternate IPv4 encodings such as integer, hex, or octal bypass the policy. When a template provides an untrusted or data-derived URL to the `resources.GetRemote()` function and the host platform utilizes the cgo system resolver, these encodings resolve to blocked addresses. This allows unauthorized build-time server-side requests to loopback and internal services, including cloud-metadata endpoints in hosted or CI builds. This bypass also applies to each redirect hop as the same check is reused.

A sandbox volume reference `volumeId` (which may also be a volume name) was forwarded to the runner and used to build the host bind-mount source path without confinement. A reference containing path-traversal sequences—characters used to access files and directories outside the current working directory—could potentially resolve the mount source outside the intended per-volume base directory. If reachable, an authenticated user could cause the runner to bind-mount an unintended host path into their sandbox, potentially allowing read and write access to other tenants' volume data.