PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats

Summary Injection Defense is a purpose-built prompt injection defense layer. It scans LLM inputs through six detection categories: instruction overrides, authority claims, boundary manipulation, obfuscation, financial manipulation, and self-harm instructions. The defense is misconfigured by...

Ghost: Remote Code Execution via Bookmark Card Images

Impact An image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary commands being run on the Ghost server. Vulnerable versions This...

Ghost: Stored XSS via Embed Card Previews

Impact Embed cards in the Ghost editor could be used to bypass the fix for GHSA-8vhf-xxpj-4qrg. Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the post in the editor, possibly resulting in compromise of that user's admin session...

Ghost : Stored XSS via SVG Files in Content Imports

Impact SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the site's domain, possibly resulting in compromise of staff users' admin sessions. Vulnerable versions This vulnerability is...

Ghost: Regular Expression Denial of Service in External Media Inliner

Impact A crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. Vulnerable versions This vulnerability is present in Ghost from v5.37.0 up to v6.65.0. Patches v6.67.0 contains a fix for th...

Ghost: Regular Expression Denial of Service in Content Import

Impact A crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. Vulnerable versions This vulnerability is present in Ghost from v4.0.0 up to v6.65.0. Patches v6.67.0 contains a fix for this issue. How to...

RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS

Summary com.rabbitmq.tools.json.JSONReader.read never returns when its input ends inside a quoted string or a // line comment. Both scanners walk the input with StringCharacterIterator.next but only compare against a delimiter, so once the iterator reaches CharacterIterator.DONE ￿ they loop...

Docling: Configured HTTP headers sent to every remote image host named by a document

Summary HTMLBackendOptions.headers is documented for passing authentication headers API keys, bearer tokens when fetching remote images. docling sends these headers on every remote image request, to whichever host the document names. An untrusted document that references an attacker-controlled...

Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)

Summary When remote fetching is enabled enableremotefetch=True, together with fetchimages=True or HTML renderpage=True, docling's protection against requests to private and loopback addresses can be bypassed. - The URL check resolves the host name once, to a single IPv4 address. The HTTP request...

Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine

Summary When the LaTeX backend is configured to render TikZ pictures with the Tectonic engine LatexBackendOptionstikzengine="tectonic", the TikZ body and the document preamble from the input file are compiled by Tectonic without any restriction on TeX's file primitives. A crafted .tex file can re...

Docling: Crafted DoclingDocument JSON embeds local image files into converted output

Summary docling accepts serialized DoclingDocument JSON as an input format InputFormat.JSONDOCLING, enabled by default. A crafted JSON file can set a picture's image uri to a local file path. When the converted document is exported with embedded images ImageRefMode.EMBEDDED, the CLI default for...

Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion

Summary The HTML, JATS, ODS OpenDocument spreadsheet and BoxNote backends accept table rowspan / colspan values without an upper bound. A few bytes of input, such as , make docling run loops proportional to the declared span and allocate a table grid of the declared size. The result is CPU and...

Docling imports plugin entry points before the allow_external_plugins check

Summary allowexternalplugins=False the default, and the CLI default is meant to restrict docling to its own model plugins. However, docling's plugin factories call pluggy's loadsetuptoolsentrypoints, which imports every module registered under docling's plugin entry-point group. Only afterwards...

Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Summary Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to reach the MCP server settings "Settings → MCP Servers → Add MCP Server",...

Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

Summary Before Langflow 1.10.1, two deprecated but still-routed endpoints in the chat API did not check that the authenticated caller owns the flow referenced in the URL path: - POST /api/v1/build/flowid/vertices retrieveverticesorder - POST /api/v1/build/flowid/vertices/vertexid buildvertex Any...

yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

Summary When no system-installed liblz4-java is found, net.jpountz.util.Native.load extracts the bundled native library to java.io.tmpdir and loads it with System.load. The path of the extracted library can be predicted before it is created, and the library file is opened without exclusive...

yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError

Summary When LZ4BlockInputStream is configured with stopOnEmptyBlock = false the mode for reading concatenated block streams, it handles each empty block by calling refill recursively. A long run of empty blocks exhausts the thread stack and throws StackOverflowError out of read or skip. Details ...

yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs

Summary LZ4FrameInputStream allocates two new buffers of the frame's maximum block size, up to 4 MiB each, every time it reads a frame header. Because concatenated frames are read by default, an input made of many minimal empty frames forces about 8 MiB of zeroed heap allocation for every 11 inpu...

Ghost: Server-Side Request Forgery in Bookmark Fetching

Impact A validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result in any response data being returned. Vulnerable versions This...

Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses

Impact A validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A successful attack would not result in any response data being returned...

Ghost: Stored XSS via SVG Uploads Bypassing Sanitization

Impact SVG media thumbnails, and SVG images uploaded with a non-SVG file extension, were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in compromise of other staff users' admin sessions. Vulnerable versio...

Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers

Summary Langflow's project-scoped MCP transport authenticates the caller for the projectid in the connection URL, but the subsequent resources/read operation does not authorize the resource URI being requested. An authenticated user can connect to their own project-scoped MCP endpoint and supply ...

Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

Pending use cache fills are shared across requests for the same key without distinguishing Draft Mode requests from regular requests. When two such requests overlap, the second request receives the first request's fill: - A regular request that overlaps an editor's Draft Mode request receives...

Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

Self-hosted Next.js applications that use the Pages Router with statically generated SSG or incrementally regenerated ISR pages can have a page's cache entry replaced with content from a different route, causing the affected page to serve wrong content to every visitor until the entry is...

Next.js has information disclosure in development server's Model Context Protocol endpoint

The Next.js development server next dev exposes a Model Context Protocol endpoint that does not verify which website a request originates from, allowing a malicious website visited by the developer to read sensitive development data — including the project's location on disk, source code snippets...

Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass

In Next.js App Router applications built with webpack, metadata image routes such as opengraph-image and twitter-image ignore the dynamicParams route segment option. An attacker can request metadata image URLs for dynamic segments that were deliberately excluded from generateStaticParams...

Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service

Next.js applications that use a root-level catch-all page together with statically generated or Incremental Static Regeneration routes can have their shared response cache poisoned by a single unauthenticated crafted request...

Next.js has Server-Side Request Forgery in Image Optimization

Impact An attacker-controlled, allow-listed remote URL can lead to server-side request forgery e.g. to private IPs during Image Optimization. Workaround Audit allow-listed remote URLs in images.remotePatterns see https://nextjs.org/docs/app/getting-started/imagesremote-images for hosts that may n...

Payload: SQL injection in SQLite/Postgres

Impact An attacker who has read plus create or update access to a collection can submit a request that includes a SQL injection targeting a specific field path shape and operators in Payload's SQLite and Postgres. You are affected if: - You use @payloadcms/db-sqlite or @payloadcms/db-d1-sqlite. -...

Payload: Remote Code Execution through first-register

Impact A crafted request to the public first-register operation can be used to perform a RCE exploit. You are affected if: - You use local auth strategy and your application remains without an initial user created Patches In the patched version data submission to create first user is properly...

Payload has a tenant authorization bypass in Multi-Tenant Plugin

Impact When using the default tenant array field access, an authenticated user could assign themselves to other tenants. You are affected if: - You are using @payloadcms/plugin-multi-tenant If you configure the tenants arrayFieldAccess.create/update functions, a secured replacement membership...

Payload external upload trust validation issue

Impact Under certain external upload configurations, Payload could send authentication data to a destination that was not verified as trusted. If the affected request contained a valid session, this could expose that session to an unintended recipient. You are affected if: - You have enabled...

Payload: Bypassed sanitization of user uploaded SVGs

Impact A malicious SVG file upload could bypass sanitization, be stored, and execute attacker-controlled JavaScript XSS after a user downloads it and opens it. You are affected if: - You have a collection configured to upload and allow SVG files which can then be downloaded by users. Patches The...

@payloadcms/plugin-multi-tenant has a cross-tenant create issue

Impact An authenticated user limited to one tenant could create a record in another tenant. This requires the multi-tenant plugin with at least one tenant-enabled collection. Reads and direct edits to an existing target-tenant document were not bypassed. You are affected if: - You are using...

Payload: Incomplete validation during the upload file lifecycle

Impact Under certain conditions, an authenticated user with permission to modify uploads could cause unintended files to be removed during file cleanup. This may result in data loss or service disruption. You are affected if: - You use Payload upload collections with local file storage. - Untrust...

Payload: Unauthenticated account-lockout denial of service

Impact An unauthenticated attacker who knows an account’s email address or username could trigger Payload’s account lockout mechanism and prevent that user from signing in. You are affected if: Using an affected Payload version with an auth-enabled collection that uses local authentication and...

Payload: Client uploads could overwrite S3 objects

Impact An authenticated user could overwrite an existing S3 object belonging to another upload collection, bypassing that collection’s access controls and prior file validation. You are affected if ALL of these are true: - Client uploads are enabled for multiple collections that share an S3 bucke...

Payload: Uploaded XML files could execute same-origin JavaScript

Impact Under certain local upload configurations, an uploaded XML file and stylesheet could execute JavaScript in the Payload origin when a logged-in user opens the file. You are affected if: - You accept XML uploads accepted by default. Patches Users should upgrade Payload packages to = 3.90.0 o...

Payload Form Builder has an RCE issue

Impact A vulnerability in @payloadcms/plugin-form-builder in versions = 3.90.0 or = 4.0.0-canary.34...

Payload: Unauthorized update to collection documents

Impact An attacker can submit a request to a specific endpoint that permits collection documents to be updated regardless of access control and field level access control. You are affected if: - You are configuring orderable: true with any collection or join field. Patches In the patched version...

Payload authentication token field handling issue

Impact Under certain field configurations, Payload could include unintended values in the authentication token issued at login. You are affected if: - You use an affected Payload version and have configured a custom field option that maps a field to a reserved authentication claim name. Patches...

Ghost: Stored XSS via oEmbed Photo Responses

Impact Embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the published site, and in newsletter emails, possibly resulting in compromise of a staff user's admin session. Vulnerable...

Ghost: Stored XSS via Bookmark Card Images

Impact When creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's domain, possibly resulting in compromise of other staff users' admin...

Ghost: Password Hash Ordering Disclosure in Ghost Admin API

Impact Any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. Vulnerable versions This vulnerability is present in Ghost from v0.7.2 u...

Ghost: Invite Token Disclosure in Ghost Admin API

Impact Staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their privileges by accepting a pending invite. Vulnerable versions This...

Ghost: Path Traversal via Locale Setting

Impact A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. Vulnerable versions This vulnerability is present in Ghost from v1.20.0 up to...

Ghost: Remote Code Execution via Theme Translation Files

Impact A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme. Vulnerable versions This vulnerability is present in Ghost from v6.10.3 up to v6.64.0. Patches v6.64.0 contains a fix for this issu...

Ghost: Editors Could Promote Staff Users to Their Own Role

Impact Staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. Vulnerable versions This vulnerability is present in Ghost from v0.5.0 up to v6.64.0. Patches v6.64.0 contains a fix for...

Ghost: Stored XSS via File Uploads on Local Storage

Impact Ghost restricts the content type that uploaded files are served with, to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user were served with a content type derived from their file...

RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers

Summary A single AMQP message with malformed UTF-8 in a shortstr property for example correlation-id can permanently disable a Java client RPC consumer. The client decodes malformed bytes into U+FFFD replacement characters. Each of those re-encodes to 3 bytes, so a 255-byte property becomes 765...