CVE-2025-55214 Copier safe template has filesystem write access outside destination path

Copier library and CLI app for rendering project templates. From 7.1.0 to before 9.9.1, Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use unsafe features like custom Jinja extensions which would require passing the --UNSAFE,--trust flag. As it...

CVE-2025-55214 Copier safe template has filesystem write access outside destination path

Copier library and CLI app for rendering project templates. From 7.1.0 to before 9.9.1, Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use unsafe features like custom Jinja extensions which would require passing the --UNSAFE,--trust flag. As it...

CVE-2025-55201 Copier safe template has arbitrary filesystem read/write access

Copier library and CLI app for rendering project templates. Prior to 9.9.1, a safe template can currently read and write arbitrary files because Copier exposes a few pathlib.Path objects in the Jinja context which have unconstrained I/O methods. This effectively renders the security model w.r.t...

CVE-2025-4962

An Insecure Direct Object Reference IDOR vulnerability was identified in the POST /v1/templates endpoint of the Lunary API, affecting versions up to 0.8.8. This vulnerability allows authenticated users to create templates in another user's project by altering the projectId query parameter. The ro...

CVE-2025-4962

An Insecure Direct Object Reference IDOR vulnerability was identified in the POST /v1/templates endpoint of the Lunary API, affecting versions up to 0.8.8. This vulnerability allows authenticated users to create templates in another user's project by altering the projectId query parameter. The ro...

CVE-2025-4962

CVE-2025-4962 describes an Insecure Direct Object Reference (IDOR) in Lunary API. The vulnerability exists in the endpoint POST /v1/templates and allows an authenticated user to create templates in another user’s project by manipulating the projectId query parameter. Root cause: missing server-si...

CVE-2025-4962 IDOR Vulnerability in Template Creation via `projectId` Manipulation in lunary-ai/lunary

An Insecure Direct Object Reference IDOR vulnerability was identified in the POST /v1/templates endpoint of the Lunary API, affecting versions up to 0.8.8. This vulnerability allows authenticated users to create templates in another user's project by altering the projectId query parameter. The ro...

Malicious code in module-templates-shared-modules (npm)

The package module-templates-shared-modules was found to contain malicious code...

Malicious code in engage-builder-templates-react (npm)

The package engage-builder-templates-react was found to contain malicious code...

MAL-2025-22888 Malicious code in ice-templates (npm)

The package ice-templates was found to contain malicious code...

MAL-2025-37019 Malicious code in toloka-templates-kit (npm)

The package toloka-templates-kit was found to contain malicious code...

MAL-2025-37020 Malicious code in toloka-templates-server (npm)

The package toloka-templates-server was found to contain malicious code...

Malicious code in toloka-templates-server (npm)

The package toloka-templates-server was found to contain malicious code...

Malicious code in ice-templates (npm)

The package ice-templates was found to contain malicious code...

Malicious code in toloka-templates-kit (npm)

The package toloka-templates-kit was found to contain malicious code...

MAL-2025-26609 Malicious code in module-templates-shared-modules (npm)

The package module-templates-shared-modules was found to contain malicious code...

MAL-2025-19654 Malicious code in engage-builder-templates-react (npm)

The package engage-builder-templates-react was found to contain malicious code...

Security update for ImageMagick

This update for ImageMagick fixes the following issues: CVE-2025-53014: Fixed an off-by-one error may cause an out-of-bounds memory access bsc1246530 CVE-2025-53015: Fixed specific XMP file conversion may cause an infinite loop bsc1246531 CVE-2025-53019: Fixed format specifiers in a filename...

EulerOS 2.0 SP11 : python-jinja2 (EulerOS-SA-2025-1940)

According to the versions of the python-jinja2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filte...

EulerOS 2.0 SP11 : python-jinja2 (EulerOS-SA-2025-1966)

According to the versions of the python-jinja2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filte...