Yaniv-Git

**Name of the Vulnerable Software and Affected Versions** serverless-dns versions through 0.1.30 **Description** serverless-dns is a RethinkDNS resolver that deploys to various platforms including Cloudflare Workers, Deno Deploy, Fastly, and Fly.io. A flaw exists where the `pr.yml` GitHub Action interpolates untrusted input, specifically the `github.event.pull request.head.repo.clone url` and `github.head ref` variables, into a command executed by the runner. Because the action uses the `pull request target` trigger, it has permissive permissions by default. An attacker can exploit this to push arbitrary data to the repository, leading to the execution of the attacker's code when running serverless-dns. **Recommendations** Update to version 0.1.31 or later.

**Name of the Vulnerable Software and Affected Versions:** Meshtastic versions prior to 2.6.6 **Description:** Meshtastic is an open source mesh networking solution. The `main matrix.yml` GitHub Action is triggered by the `pull request target` event, which has extensive permissions and can be initiated by an attacker who has forked the repository and created a pull request. In the shell code execution part, user-controlled input is interpolated unsafely into the code. If exploited, attackers could inject unauthorized code into the repository. **Recommendations:** Update to version 2.6.6 or later.

**Name of the Vulnerable Software and Affected Versions** Gradio versions prior to 4.11.0 **Description** The issue concerns a vulnerability in the `/file` route of Gradio, making it susceptible to file traversal attacks. An attacker could access arbitrary files on a machine running a Gradio app with a public URL if they knew the path of files to look for. This was possible through programmatic tools such as `curl` with the `--pass-as-is` flag, but not through regular URLs passed into a browser. Additionally, the `/file` route was vulnerable to Server-Side Request Forgery (SSRF) attacks. **Recommendations** For Gradio versions prior to 4.11.0, update to version 4.11.0 to resolve the issue. As a temporary workaround, consider restricting access to the `/file` route to minimize the risk of exploitation. Avoid using the `/file` route in Gradio apps until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** HtmlSanitizer versions prior to 8.0.723 HtmlSanitizer version 8.1.722-beta and earlier **Description** The issue occurs in configurations where foreign content is allowed, specifically when `svg` or `math` are in the list of allowed elements. This allows an attacker to bypass sanitization and inject arbitrary HTML, including JavaScript code, when an application sanitizes user input with a vulnerable configuration. The default configuration is not affected. **Recommendations** For HtmlSanitizer versions prior to 8.0.723, update to version 8.0.723 or later. For HtmlSanitizer version 8.1.722-beta and earlier, update to a version later than 8.1.722-beta. As a temporary workaround, consider disallowing foreign elements `svg` and `math` to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Codiad versions 1.7.8 and later **Description** A Cross Site Scripting (XSS) issue was found due to improper sanitization of the folder's name `$path` variable in `components/filemanager/class.filemanager.php`. The vendor states that Codiad is no longer under active maintenance by core contributors. **Recommendations** As a temporary workaround, consider disabling the `class.filemanager.php` component until a patch is available. Restrict access to the `components/filemanager` module to minimize the risk of exploitation. Avoid using the `$path` variable in the affected file manager functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Codiad versions 1.7.8 and later **Description** A Server-Side Request Forgery (SSRF) issue was found in the software. It allows a user with admin privileges to use the plugin install feature to make the server request any URL via components/market/class.market.php, potentially resulting in remote code execution. The vendor has stated that the product is no longer under active maintenance by core contributors. **Recommendations** For versions 1.7.8 and later, as a temporary workaround, consider disabling the plugin install feature until a patch is available. Restrict access to the components/market/class.market.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Codiad versions 1.7.8 and later **Description** A Cross Side Request Forgery (CSRF) vulnerability was found in the request to download a plugin from the marketplace, which is only available to admin users. The issue lies in the `components/market/controller.php` file, where the request is not CSRF protected. This might cause admins to make a vulnerable request without their knowledge, potentially resulting in remote code execution. The vendor has stated that Codiad is no longer under active maintenance by core contributors. **Recommendations** For Codiad versions 1.7.8 and later, consider disabling the plugin download feature from the marketplace until a patch is available, as a temporary workaround to minimize the risk of exploitation. Restrict access to the `components/market/controller.php` file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.