Y4Rvin

**Name of the Vulnerable Software and Affected Versions** Renovate versions 32.124.0 through 42.68.4 Mend renovate-ce/renovate-ee versions prior to 13.3.0 **Description** Command injection occurs during Gradle Wrapper artifact handling. When processing updates, the software invokes a wrapper update command via a shell. If a malicious `gradle-wrapper.properties` file is introduced into a scanned repository, an attacker can use shell command substitution syntax within the `distributionUrl` variable. The shell evaluates this syntax before Gradle parses the URL, allowing arbitrary command execution in the runtime. This issue persists even when `allowScripts` is disabled. **Recommendations** Update Renovate to version 42.68.5 or later. Update Mend renovate-ce/renovate-ee to version 13.3.0 or later.

**Name of the Vulnerable Software and Affected Versions** NiceGUI versions 3.3.1 and below **Description** NiceGUI, a Python-based UI framework, contains a flaw that allows a remote attacker to read arbitrary files on the server filesystem. This is due to a directory traversal issue present in the `App.add media files()` function. The `App.add media files()` function does not properly sanitize file paths, allowing an attacker to potentially access sensitive information. **Recommendations** Update to version 3.4.0 or later.