MAL-2025-16882 Malicious code in checkout-automated-tests (npm)

The package checkout-automated-tests was found to contain malicious code...

MAL-2025-14818 Malicious code in argo-checkout-vue (npm)

The package argo-checkout-vue was found to contain malicious code...

MAL-2025-16884 Malicious code in checkout-web (npm)

The package checkout-web was found to contain malicious code...

GHSA-X6GV-2RVH-QMP6 m00nl1ght-dev/steam-workshop-deploy: Exposure of Version-Control Repository to an Unauthorized Control Sphere and Insufficiently Protected Credentials

Summary The steam-workshop-deploy github action does not exclude the .git directory when packaging content for deployment and provides no built-in way to do so. If a .git folder exists in the target directory e.g., due to a local Git repo, custom project structure, or via the actions/checkout...

m00nl1ght-dev/steam-workshop-deploy: Exposure of Version-Control Repository to an Unauthorized Control Sphere and Insufficiently Protected Credentials

Summary The steam-workshop-deploy github action does not exclude the .git directory when packaging content for deployment and provides no built-in way to do so. If a .git folder exists in the target directory e.g., due to a local Git repo, custom project structure, or via the actions/checkout...

PT-2025-34541 · Github Actions · Boldestdungeon/Steam-Workshop-Deploy +1

Summary The steam-workshop-deploy github action does not exclude the .git directory when packaging content for deployment and provides no built-in way to do so. If a .git folder exists in the target directory e.g., due to a local Git repo, custom project structure, or via the actions/checkout...

MAL-2025-6811 Malicious code in checkout-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3f3f3a1d0b011d00d475a42f290ecb00025114dbb878def81003f3cbd0ea26e7 The OpenSSF Package Analysis project identified 'checkout-app' @ 1.5.1 npm as malicious. It is considered malicious because: - The package...

Malicious code in checkout-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3f3f3a1d0b011d00d475a42f290ecb00025114dbb878def81003f3cbd0ea26e7 The OpenSSF Package Analysis project identified 'checkout-app' @ 1.5.1 npm as malicious. It is considered malicious because: - The package...

Race Condition

Overview shopware/shopware is an open source e-commerce software made in Germany Affected versions of this package are vulnerable to Race Condition due to the checkout process. An attacker can bypass intended restrictions and redeem vouchers beyond their allowed usage by exploiting timing...

Adobe Commerce/Magento Open Source Input validation Vulnerability (APSB22-12)

The version of Adobe Commerce/Magento Open Source installed on the remote host is prior to a patched version. It is, therefore, affected by a arbitracy code execution as referenced in the APSB22-12 advisory. - Adobe Commerce versions 2.4.3-p1 and earlier and 2.3.7-p2 and earlier are affected by a...

git: Git arbitrary code execution

A line-end handling flaw was found in Git. When writing a config entry, values with a trailing carriage return CR are not quoted, resulting in the CR being lost when the config is read later. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read,...

git: Git arbitrary code execution

A line-end handling flaw was found in Git. When writing a config entry, values with a trailing carriage return CR are not quoted, resulting in the CR being lost when the config is read later. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read,...

git: Git arbitrary code execution

A line-end handling flaw was found in Git. When writing a config entry, values with a trailing carriage return CR are not quoted, resulting in the CR being lost when the config is read later. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read,...

git: Git arbitrary code execution

A line-end handling flaw was found in Git. When writing a config entry, values with a trailing carriage return CR are not quoted, resulting in the CR being lost when the config is read later. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read,...

Exploit for Improper Input Validation in Jenkins Git_Parameter

CVE-2025-53652: Jenkins Git Parameter Plugin Unvalidated Input...

git: Git arbitrary code execution

A line-end handling flaw was found in Git. When writing a config entry, values with a trailing carriage return CR are not quoted, resulting in the CR being lost when the config is read later. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read,...

WordPress Simple Stripe Checkout plugin <= 1.1.28 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Simple Stripe Checkout versions = 1.1.28...

WordPress Breeze Checkout plugin <= 1.4.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Martino Spagnuolo r3verii in WordPress Plugin Breeze Checkout versions = 1.4.0...

Improper Input Validation

git is vulnerable to improper input validation. The vulnerability is due to improper handling of carriage return CR characters in configuration and submodule paths, which allows an attacker to exploit the altered path and potentially trigger unintended execution of a submodule’s post-checkout hoo...

OESA-2025-1793 git security update

Security Fixes: Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed CRLF. When writing a config...