git: Git arbitrary code execution

A line-end handling flaw was found in Git. When writing a config entry, values with a trailing carriage return CR are not quoted, resulting in the CR being lost when the config is read later. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read,...

git: Git arbitrary code execution

A line-end handling flaw was found in Git. When writing a config entry, values with a trailing carriage return CR are not quoted, resulting in the CR being lost when the config is read later. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read,...

UBUNTU-CVE-2025-48384

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed CRLF. When writing a config entry, values with ...

CVE-2025-46820: Exposure of Sensitive Information to an Unauthorized Actor

phpgt/Dom provides access to modern DOM APIs. Versions of phpgt/Dom prior to 4.1.8 expose the GITHUBTOKEN in the Dom workflow run artifact. The ci.yml workflow file uses actions/upload-artifact@v4 to upload the build artifact. This artifact is a zip of the current directory, which includes the...

Information Disclosure

parse-git-config is vulnerable to information disclosure. The vulnerability is due to improper handling of key expansion in the expandKeys function, allows an attacker to obtain sensitive information...

CVE-2025-25975

A flaw was found in the parse-git-config package. Affected versions of this package allow an attacker to obtain sensitive information via the expandKeys function...

Prototype Pollution Vulnerability in parse-git-config

An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function...

0xrtest (1.0.0), 51xtong (>=1.0.2, <=1.0.8) +1088 more potentially affected by CVE-2025-25975 via parse-git-config (3.0.0)

parse-git-config NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on parse-git-config and may be impacted: - 0xrtest 1.0.0 - 51xtong =1.0.2, =0.1.0, =0.0.1, =0.2.1, =0.0.2, =0.0.2, =0.0.11, =1.0.0, =11.1.0, =0.0.1, =0.0.1, =0.1.2 and more...

0xrtest (1.0.0), 51xtong (>=1.0.2, <=1.0.8) +1088 more potentially affected by CVE-2025-25975 via parse-git-config (3.0.0)

parse-git-config NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on parse-git-config and may be impacted: - 0xrtest 1.0.0 - 51xtong =1.0.2, =0.1.0, =0.0.1, =0.2.1, =0.0.2, =0.0.2, =0.0.11, =1.0.0, =11.1.0, =0.0.1, =0.0.1, =0.1.2 and more...

GHSA-8G77-54RH-46HX Prototype Pollution Vulnerability in parse-git-config

An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function...

CVE-2025-25975

An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function...

CVE-2025-25975

An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function...

CVE-2025-25975

The parse-git-config package (version 3.0.0 ) is vulnerable to Prototype Pollution via the expandKeys function. An attacker can exploit improper handling of key expansion to inject properties into the JavaScript Object.prototype chain. This can lead to denial of service (DoS) , remote code execut...

parse-git-config security vulnerability

parse-git-config is a library from the individual developer Jon Schlinkert. A security vulnerability exists in parse-git-config version 3.0.0, which stems from the expandKeys function that could lead to the disclosure of sensitive information...

CVE-2025-25975: Exposure of Sensitive Information to an Unauthorized Actor

An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function...

CVE-2025-25975

An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function...

CVE-2025-25975

An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function...

PT-2025-11119

Name of the Vulnerable Software and Affected Versions: parse-git-config version 3.0.0 Description: The issue allows an attacker to obtain sensitive information via the expandKeys function. Recommendations: For parse-git-config version 3.0.0, consider disabling the expandKeys function until a patc...

Server Side Request Forgery (SSRF)

@backstage/plugin-scaffolder-node is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to improper handling of template functionality in the Backstage Scaffolder plugin, which allows Server-Side Template Injection SSTI to be exploited for Git config injection...

GHSA-QMC2-JPR5-7RG9 Backstage Scaffolder plugin vulnerable to Server-Side Request Forgery

Impact A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an attacker to capture privileged git tokens used by the Backstage Scaffolder plugin. With these...