Zerotrail-Ai

An issue exists where the action handler of the dashboard run replay route does not perform authentication or organization checks. The system retrieves task runs using only the `friendlyId` variable, allowing a remote attacker who knows this ID to replay a task into an environment of their choosing. This can lead to the exposure of the victim's task payload or the execution of the task using the victim's secrets and API keys. Additionally, a similar issue affects the batch completion endpoint, which allows any authenticated user to trigger completion for any batch ID. The affected endpoints are '/resources/taskruns/$runParam/replay' and '/resources/batches/$batchId/check-completion'.

The in-chat markdown renderer contains an unsafe custom rule for images that interpolates the markdown image `alt` text into an HTML `alt` attribute without HTML encoding. While most call-sites use `DOMPurify.sanitize()` for defense-in-depth, the `Chartable` component renders chart captions without sanitization. An attacker capable of influencing the LLM output—such as through indirect prompt injection in a shared workspace document or by creating a chart record in a multi-user workspace—can trigger stored DOM-level Cross-Site Scripting (XSS), which is a vulnerability allowing the execution of malicious scripts in a user's browser. The chat history is loaded via the 'GET /api/workspace/:slug/chats' endpoint and rendered in the UI.

The `jq:` and `jqraw:` include filter expressions in changedetection.io allow the use of the jq `env` builtin, which reads all process environment variables and stores them as the watch snapshot. An authenticated user, or an unauthenticated user when no password is set, can leak sensitive environment variables including `SALTED PASS`, `PLAYWRIGHT DRIVER URL`, `HTTP PROXY`, and any secrets passed as environment variables to the container. The vulnerability resides in the `html tools.py` file, specifically lines 380-388, where user-supplied jq filter expressions are compiled and executed without restricting dangerous jq builtins. The form validator only checks that the expression compiles, failing to block dangerous functions like `env`. This allows an attacker to create a watch for any JSON endpoint using `jqraw:env` as the include filter, which then exposes all environment variables in the processed text file. This can lead to secret exposure, infrastructure credential theft, and potential cascading access to other internal systems.