Zsxsoft

An authorization bypass exists in the skill command dispatch mechanism. This issue allows lower-trust callers to execute or persist actions that exceed their intended authorization levels. When the affected feature is enabled and reachable, attackers can bypass tool policy restrictions via configured input paths to perform unauthorized actions.

An authorization bypass exists in the browser act route due to improper validation of current-tab URL checks. This allows attackers with lower-trust access or configured input paths to execute actions that require stronger authorization or policy checks.

An issue exists in the browser snapshot routes where post-navigation destinations are not properly validated. This allows attackers with lower-trust access to perform Server-Side Request Forgery (SSRF)—a technique where the server is coerced into making unauthorized requests—to bypass policy checks and access restricted network destinations.

An authorization bypass exists in the exec allowlist glob matching mechanism. This issue allows lower-trust callers to execute actions beyond their intended authorization by crafting input paths that traverse the allowlist glob patterns, enabling the execution or persistence of unauthorized actions when the affected feature is enabled.

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Under the default configuration, the `classDef` directive in state diagrams allows HTML injection that escapes the SVG context, leading to DOM injection. While `<script>` tags are stripped to prevent cross-site scripting (XSS), the issue still allows for the injection of arbitrary HTML elements into the Document Object Model (DOM), which is the programming interface for HTML and XML documents.

Default configuration allows the injection of CSS that applies outside of the Mermaid diagram. This occurs through the `fontFamily`, `themeCSS`, and `altFontFamily` configuration options, exploiting how stylis handles scope references. Specifically, using `:not(&)` escapes automatic scoping, allowing styles to be applied to all page elements. Additionally, global at-rules such as `@font-face`, `@keyframes`, and `@counter-style` can be injected as they are hoisted to the top level. This can lead to page defacement and the exfiltration of DOM attributes using CSS `:has()` selectors.