512352 matches found
NPM: JSONata: Arbitrary Code Execution via crafted JSONata expressions
NPM: JSONata: Arbitrary Code Execution via crafted JSONata expressions vulnerability discovered by ? in WordPress Npm jsonata versions = 1.8.7...
Arbitrary Code Injection
Overview jsonata is a JSON query and transformation language Affected versions of this package are vulnerable to Arbitrary Code Injection via the lookup function due to a missing hasOwnProperty check. An attacker can execute arbitrary code by submitting crafted expressions. Remediation Upgrade...
GHSA-8GQ3-VP5J-2GRP JSONata: Arbitrary Code Execution via crafted JSONata expressions
Impact Before JSONata 2.2.0 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to a missing hasOwnProperty check in the lookup function: https://github.com/jsonata-js/jsonata/blob/f9632e01e6e67d4f9f00593f9795420cb4b57f48/src/functions.jsL1686-L1705 This was fixed wi...
GHSA-XHJ3-7XW9-VR34 kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding
Summary An uncontrolled resource consumption vulnerability in openapi3filter lets any unauthenticated client force multi-gigabyte heap allocation with a single, tiny HTTP request. When a spec declares a deepObject-style query parameter whose schema contains an array a normal, documented pattern,...
kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding
Summary An uncontrolled resource consumption vulnerability in openapi3filter lets any unauthenticated client force multi-gigabyte heap allocation with a single, tiny HTTP request. When a spec declares a deepObject-style query parameter whose schema contains an array a normal, documented pattern,...
Memory Allocation with Excessive Size Value
Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value through sliceMapToSlice in openapi3filter/reqrespdecoder.go. An attacker can force multi-gigabyte heap allocation and a denial of service by sending a deepObject query parameter with a large...
GHSA-X2RJ-828P-HX9M Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing
Summary Xinference used Python's unsafe eval function when parsing Llama3 tool-call output generated by a large language model. Because the model output can be influenced by attacker-controlled prompts sent to the chat completion API, a remote attacker can craft prompts that cause the model to...
Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing
Summary Xinference used Python's unsafe eval function when parsing Llama3 tool-call output generated by a large language model. Because the model output can be influenced by attacker-controlled prompts sent to the chat completion API, a remote attacker can craft prompts that cause the model to...
GHSA-HRWP-4HH9-C8R8 Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)
Summary The Volt template compiler in Phalcon generates the PHP for the join filter by string-concatenating the filter's raw template-literal argument bytes with no escaping. The separator literal is dropped verbatim between two single quotes the compiler emits, and the piped array argument is...
Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)
Summary The Volt template compiler in Phalcon generates the PHP for the join filter by string-concatenating the filter's raw template-literal argument bytes with no escaping. The separator literal is dropped verbatim between two single quotes the compiler emits, and the piped array argument is...
GHSA-MMFR-PMJX-HW9W kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS
Summary A nil-pointer dereference in openapi3filter.ConvertErrors lets any unauthenticated client crash a server with a single HTTP request. When an application validates a multipart/form-data request body and renders the resulting validation error through the library-provided...
kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS
Summary A nil-pointer dereference in openapi3filter.ConvertErrors lets any unauthenticated client crash a server with a single HTTP request. When an application validates a multipart/form-data request body and renders the resulting validation error through the library-provided...
NULL Pointer Dereference
Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in convertParseError in openapi3filter/validationerrorencoder.go. An attacker can crash a server by sending a malformed multipart/form-data request body that triggers validation and is rendered through...
GHSA-26W5-6G95-GJ28 Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation
Summary Atlantis versions = 0.19.8 and 0.45.0 did not consistently validate user-controlled workspace values before using them to construct local workspace paths. A crafted workspace value containing path traversal segments could cause Atlantis to resolve workspace paths outside the intended...
Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation
Summary Atlantis versions = 0.19.8 and 0.45.0 did not consistently validate user-controlled workspace values before using them to construct local workspace paths. A crafted workspace value containing path traversal segments could cause Atlantis to resolve workspace paths outside the intended...
GHSA-CQMQ-8755-7XVH Keystone vulnerable to `graphql.maxTake` bypass with negative `take`
Summary The value of graphql.maxTake can be bypassed by providing a negative input. This can be used to exceed the developer's intended graphql.maxTake value, allowing queries to return results in excess of the graphql.maxTake value set. Impact This affects any project relying on graphql.maxTake ...
Keystone vulnerable to `graphql.maxTake` bypass with negative `take`
Summary The value of graphql.maxTake can be bypassed by providing a negative input. This can be used to exceed the developer's intended graphql.maxTake value, allowing queries to return results in excess of the graphql.maxTake value set. Impact This affects any project relying on graphql.maxTake ...
NPM: Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors
NPM: Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors vulnerability discovered by ? in WordPress Npm defuddle versions = 0.19.0...
Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors
Summary An Improper Neutralization of Input During Web Page Generation issue in the site extractor component allows an attacker-controlled attribute value to be injected into output HTML without escaping. An attacker who crafts a malicious HTML page or controls content on a matching domain can...
GHSA-JG4P-G6XJ-4QMF Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors
Summary An Improper Neutralization of Input During Web Page Generation issue in the site extractor component allows an attacker-controlled attribute value to be injected into output HTML without escaping. An attacker who crafts a malicious HTML page or controls content on a matching domain can...