FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files

Summary POST /upload uses the request-supplied resumableFilename directly as a key into the shared temporary directory, without the character filter it applies to resumableIdentifier and without namespacing it per user. A valid user holding the upload permission can read any file in that director...

FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive

Summary GET /batchdownload streams a batch ZIP to any requester who supplies its uniqid, without checking that the current user/session created it. In deployments where users have separate home directories, a valid low-privileged user who obtains an active archive id can download another user's...

Code Graph RAG structural tools follow out-of-root symlinks

A remote/local attacker who can get a symbolic link included in a source-code repository that code-graph-rag analyzes can cause the structuralsearch and structuralreplace tools backed by AstGrepService, exposed both as MCP tools and as agentic AI tools to read and -- via structuralreplace with...

GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin

Impact In GPUStack before v2.2.0, getcurrentuser in gpustack/api/auth.py promotes any request whose source is considered loopback to the built-in administrator account when forceauthlocalhost is False the default. The "source" is derived by clientipgetter, which can be made to report 127.0.0.1...

Malware in @injectivelabs/sdk-ts

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing

Summary An authenticated Pocket ID user can request an email-verification token while their account uses an address they control, change the account email address, and then redeem the previously issued token. The token is bound only to the user ID, not to the address to which it was sent, and...

Urwid: handle_short_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS)

Summary The handleshortrequest function in urwid/display/web.py raises an unhandled UnicodeEncodeError when processing a POST request body containing non-ASCII bytes. The function reads POST input and encodes it to ASCII before writing to a named pipe. Any byte value above 0x7F causes the CGI...

esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversal

Summary The documented web.NewHandler static file server can read files outside Config.AppDir when the request path contains URL-encoded dot-segments such as %2e%2e. Go's ServeMux redirects plain /../ paths, but it passes encoded dot-segments to the handler after decoding r.URL.Path. The handler...

fast-agent: `fast-agent serve` binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote command execution

Summary fast-agent serve exposes the agent over MCP. By default it uses HTTP transport bound to 0.0.0.0 all interfaces on port 8000 with no authentication auth=None and prints no warning. Any host that can reach the port can call the exposed agent tool. When the server is started with --shell whi...

Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment secrets

Summary Telepresence's Traffic Manager gRPC API port 8081 requires no authentication. Any pod with cluster-network access to the Traffic Manager can register as a client in an arbitrary managed namespace and create intercepts against services in that namespace, regardless of Kubernetes RBAC. On...

Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackable

Summary The Traffic Manager Tunnel gRPC streaming endpoint accepts a session ID from the first bytes of the client-controlled message payload. No verification confirms the caller owns the session. An attacker supplying a valid active session ID receives a fully routed tunnel for that session,...

zizmor: Debug logging prints available GitHub credentials in cleartext

Summary zizmor 1.27.0 exposes GitHub access tokens in cleartext when debug-level logging is enabled. Tokens supplied via environment variables GHTOKEN, GITHUBTOKEN, ZIZMORGITHUBTOKEN, or the corresponding command-line options --gh-token, --github-token, --zizmor-github-token are included in the...

ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header

Summary A remote attacker from any IP address defeats the operator-configured source-IP allowlist mcpallowedremoteips / apitokenallowedremoteips by sending a single X-Forwarded-For: header. The router is created with gin.New and never calls SetTrustedProxies, so gin trusts every proxy by default...

OmniAuth: Host Header Injection Vulnerability

Impact Host header injection risk when using Omniauth with a web framework that does not verify incoming host headers. An example of a framework that provides host header validation is modern Rails when configured appropriately Patches 2.2.0 Workarounds Set the fullhost config in the Omniauth con...

Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization

Summary ShadowCopyAction in the Shadow plugin does not validate or sanitize ZIP entry names before writing them to the output fat JAR. A malicious upstream dependency containing path traversal sequences e.g. ../../../../tmp/pwned.txt in entry names will have those entries reproduced verbatim in t...

Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read

Summary The readfile MCP tool in codebaserag/mcp/tools.py contains a path traversal vulnerability in its paginated branch when offset or limit is supplied. The handler constructs a file path using Pathself.projectroot / filepath without subsequently validating that the resolved path remains withi...

Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment

Summary Remark42 applied chi's middleware.RealIP globally, trusting True-Client-IP / X-Real-IP / X-Forwarded-For headers without verifying the request came from a trusted proxy. The per-IP rate limiters key on the overwritten r.RemoteAddr, so any client can bypass every per-IP rate limiter by...

Pocket ID: The client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences

Summary The client credentials grant granttype=clientcredentials does not validate the resource parameter before embedding it as the aud claim in the issued JWT. Any authenticated OIDC client can obtain a Pocket ID-signed access token claiming authorization for any arbitrary audience, including...

tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients

Summary The HTTP mode of @tsparticles/mcp-server creates a single stateful StreamableHTTPServerTransport instance and reuses it for all clients. The first anonymous client that initializes the MCP endpoint claims the shared transport state, and later clients cannot create their own sessions. This...

tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process

Summary The HTTP mode of @tsparticles/mcp-server parses incoming /mcp request bodies with JSON.parse outside a request-local error boundary. A single malformed JSON request causes the async request handler to throw and terminates the Node.js process. This was verified on v4.3.0 at commit...

JSON-java: JSONTokener Has Unbounded Numeric String Resource-Exhaustion DoS

Executive Summary JSON-java version 20260522 contains an unguarded path from an HTTP request body to unbounded BigInteger and BigDecimal construction. JSONTokener.nextSimpleValue accumulates numeric characters into a StringBuilder with no length cap, then passes the full string to...

tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS

Summary The HTTP server mode of @tsparticles/mcp-server accumulates all incoming request body chunks into an in-memory Buffer array with no size limit before calling JSON.parse. An unauthenticated remote attacker can stream an arbitrarily large body to POST /mcp, exhausting the Node.js process...

ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass)

Summary The readPsd function in ag-psd accepts a totalMemoryLimit option to cap memory usage when parsing untrusted PSD files, but this limit is never forwarded to the layer image buffer allocation path. A property name mismatch totalMemoryLimit vs. memoryLimit causes the size guard inside...

zt-zip: ZipUtil.unpack can change file permissions of output directory

Summary When using one of the ZipUtil.unpack overloads, the file permissions of the output directory can be changed. For example, when the output directory was only accessible to the 'owner' it could be instead made accessible to every OS user. Details When the name of a ZIP entry resolves to the...

traQ: Privilege escalation by OAuth prompt=none request

In OAuth2 silent authorization prompt=none, when the scope parameter was empty or omitted, all scopes registered for the OAuth client became eligible for issuance. However, the prior consent check was performed against the empty requested scope set. As a result, an attacker could obtain an access...

traQ: XSS in the User Uploaded File Retrieval API

Impact For instances where TRAQSTORAGETYPE is set to local, the file retrieval API /files/fileId could serve user-uploaded SVG or HTML files in a way that allowed them to be rendered directly in the browser. As a result, an attacker who can upload files to traQ could upload a crafted SVG or HTML...

isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout

Summary isomorphic-git's tree parser src/models/GitTree.js validates each entry name only against the path separators / and . It does not reject the standalone reserved name .., so a malicious repository can, on a single clone/checkout, write files outside the working directory unbounded depth...

isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)

Summary A malicious server can advertise circular symref= capabilities e.g. a → b and b → a. isomorphic-git writes them to disk as loose symrefs, and GitRefManager.resolve follows them with no depth limit and no cycle detection, so any later operation that resolves one of them log, status,...

isomorphic-git: Arbitrary file write outside of working tree via directory symlink during checkout (potential RCE)

Summary git.checkout writes working-tree files through a directory symlink without checking the leading path, so a malicious repository can write outside the intended working directory. The defect is in isomorphic-git's checkout logic itself and is therefore independent of the fs provider. The...

fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator

Summary fastapi-code-generator koxudaxi emits the OpenAPI path into the generated main.py route decorator as a single-quoted string literal @app.get'/u//x' without escaping the '. A ' in the path closes the decorator string and, via concatenation, injects a live expression that the decorator...

fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict

Summary fastapi-code-generator koxudaxi emits an operation's extra responses into the route decorator's responses=... dict, using each response's status-code key as a single-quoted string literal without escaping the '. A ' in a status-code key closes the dict-key string and, via concatenation,...

fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring

Summary fastapi-code-generator koxudaxi emits an operation's summary as the generated route handler's docstring, using a triple-quoted string without escaping """. A """ in the summary closes the docstring and, via concatenation, injects a live expression that becomes an expression statement in t...

zt-zip: Path traversal in fluent API unpack

Summary ZipUtil.unpack... rejects ZIP entries that escape the target output directory, but the Zips fluent API appears to use a separate unpack implementation that does not apply the same destination-boundary check. A ZIP entry such as: text ../escape/poc.txt is written outside the configured...

Logging Redactor: PII data in str/repr of non primitive objects was not being redacted

Impact PII data in str/repr of non primitive objects was not being redacted, leading to leakage of PII in logs that should have been redacted for custom str and repr functions Patches The problem has been patched in version 0.0.7. Workarounds None without patching...

Malware in react-bootstrap-table-next-bg

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in react-bootstrap-table2-toolkit-bg

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in file-saver-bg

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in archetype-index-sdk

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @gsas/gsas-sdk

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in template-cards

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @webapp-shared/login-vmok

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in template-pictogram

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in template-projection-map

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @aaron205whitmore/postcss-animate-utils

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in dsh-ungate

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in focashi

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @liauto/darwin-arm64

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @liauto/cli

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @liauto/linux-x64

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @liauto/linux-arm64

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...