GHSA-J5CX-PH8G-95V3 Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service

fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. The height is take...

GHSA-8PHW-XRJ9-CPQP Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

Summary Steeltoe's /actuator/httpexchanges endpoint records and displays request URIs after passing them through MaskedUri. The masking only covers the UserInfo portion of the URI inline user:password@host credentials and does not inspect the query string. With IncludeQueryString enabled by...

GHSA-6QW9-4VV5-JR97 Grav: Stored XSS via Markdown audio/video media <source> URL

Target: github.com/getgrav/grav Affected resource: Grav\Common\Media\Traits\AudioMediaTrait / VideoMediaTrait sourceParsedownElement — verified on 2.0.13 latest stable and develop HEAD 5a7070f Severity: Medium 6.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N — anchored to the sibling script-XSS...

GHSA-C3GV-825Q-FVMP libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID

Summary @libp2p/gossipsub StrictSign validation does not bind a supplied message public key to the claimed from peer ID when from is an RSA-style peer ID that does not inline its public key. An attacker can set from to a victim RSA peer ID, sign the message with the attacker's own private key,...

GHSA-269C-H76Q-8CXW Grav: Stored XSS via quoted-attribute bypass in detectXss

Summary A page editor without admin.super can place an event handler after a inside a quoted attribute. Grav accepts and stores the page, then executes the handler in the application origin when a visitor opens it. Details Security::detectXss system/src/Grav/Common/Security.php:253 anchors the...

GHSA-F8M2-889X-VW4X AsyncHttpClient re-sends client-wide realm credentials to a cross-origin redirect target

Impact A client configured with a client-wide realm a Realm set on the config builder rather than on an individual request and following redirects could re-send those credentials to a redirect target on a different origin. The redirect code strips the per-exchange realm, but when the target...

GHSA-XR57-GCX8-52HF AsyncHttpClient sends origin credentials to the proxy on the plaintext CONNECT request

Impact When a request uses an HTTP proxy to reach an HTTPS origin, the client opens the tunnel with a plaintext CONNECT sent to the proxy before any TLS exists. On affected versions the origin's preemptive credentials were added to that CONNECT. A Basic realm sent Authorization: Basic...

GHSA-7GRG-JCF7-RPMX AsyncHttpClient's unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service

Impact With automatic response decompression enabled the default, the HTTP/1.1 path decompresses response bodies with no limit on the total output size. A hostile or compromised server, or an attacker who can change a response in transit, can send a small compressed body that inflates without bou...

GHSA-FJ9W-C36G-H5X8 AsyncHttpClient doesn't verify SCRAM and Digest mutual-authentication responses

Impact For SCRAM, and for Digest with mutual authentication, the client computes the server's verification value the SCRAM ServerSignature, or the Digest rspauth but does not act on the result. If the value is present and does not verify, the client only logs it and still delivers the response to...

GHSA-MGGC-4XG6-VCXF SSH.NET: ScpClient allows server-side RCE via default SCP path handling

Summary Default SCP remote-path handling places caller-supplied paths into the command that runs scp on the server. On a shell-based server that command is interpreted by a shell, so an attacker-influenced path that is not quoted to suit that shell can execute as a command as the authenticated SS...

GHSA-HPJ9-GRJP-7VC7 Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth

Summary Kestra's Micronaut management endpoints are served on port 8081 with no authentication, even when the main API port 8080 has basic-auth enabled. Anyone who can reach :8081 can read GET /env full resolved environment/configuration and mutate runtime state via POST /loggers/name change log...

GHSA-8PW2-6JV3-MJ5J vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation

Summary Current vLLM main lets an inference request choose the PyNvVideoCodec GPU video decoder through mediaiokwargs.video.videobackend, but engine GPU memory reservation is computed only from static startup configuration and VLLMVIDEOLOADERBACKEND. If the server starts with the default...

GHSA-W3F4-8PJ2-599W Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images

Reported by: Nihad Huseynli @nihaddhuseynli https://github.com/nihaddhuseynli — [email protected] ▎ Note: I attempted to report this via [email protected] first, per SECURITY.md, but the email bounced with 550 5.1.1 Address does not exist. Filing directly here instead. Path Traversal i...

GHSA-7PGQ-CR25-XVC8 Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure

Summary Grav CMS's blueprint dynamic-field callable guard can be bypassed with a fully-qualified Class::method string, letting an account with only page-editing rights admin.pages, not super-admin plant a directive in a page's form-field frontmatter that invokes an arbitrary public static PHP...

GHSA-H7VF-4X9W-H99V oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing

Summary oras-go's pagination helper parseLink in registry/remote/utils.go follows the Link response header from a registry without validating the URL's host or scheme. When a malicious registry returns a Link header containing an absolute URL pointing to an arbitrary host e.g., a cloud metadata...

GHSA-M37J-52J7-PJW7 oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)

Summary The content/file.Store in oras-go v2 unpacks OCI layer tarballs when a descriptor carries io.deis.oras.content.unpack=true. The extraction routine validates symlink targets purely lexically filepath.Join and, for regular files placed directly at the extraction root, skips the parent-symli...

GHSA-C4WF-2XXC-68QM Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation

Summary A missing validation check in Grav's Flex framework lets an account holding nothing but an ordinary object-create permission on a single Flex directory execute arbitrary shell commands on the server. Any authenticated user with create or update rights on a Flex-based directory Flex Users,...

GHSA-5GPM-RGJ3-9Q76 Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734)

Affected component: filters/openpolicyagent/openpolicyagent.go → ExtractHttpBodyOptionally; combined with github.com/open-policy-agent/opa-envoy-plugin envoyauth/request.go → getParsedBody / checkIfHTTPBodyTruncated. Filter: opaAuthorizeRequestWithBody. - Affected versions: = 0.27.33 current HEAD...

GHSA-4V58-74MF-RJX3 RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client

Summary A vulnerability in the readField function allows a malicious or compromised AMQP server to trigger an unhandled runtime panic in the client application, leading to an immediate crash of the entire process. Details When parsing incoming AMQP frames, the readField function processes...

GHSA-C5PQ-FR2G-9JPF RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr

Summary A critical stream desynchronization vulnerability has been identified in the AMQP wire-protocol parser. When parsing a long string readLongstr within a table field, providing a length that exceeds the maximum signed 32-bit integer 2^31 - 1, or roughly 2.1 GiB triggers an improper...

GHSA-R9C8-GCJP-XFWH RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation

Summary A flaw in the recvContent function allows a malicious AMQP server to trigger an Out-of-Memory OOM error, forcing the host operating system or container runtime to immediately terminate the client process. Vulnerability Details When receiving message content payloads, the client processes...

GHSA-27GV-RFVV-22MV RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields

Summary An information disclosure vulnerability exists in the AMQP client implementation's authentication handling configuration. Following a successful connection handshake, the Connection.Config.SASL field stores the Authentication implementation state used to establish the session. For standar...

GHSA-RM6M-HRCW-JW33 RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration

Summary A logic and resource exhaustion vulnerability exists in the AMQP client's Quality of Service Qos configuration method. The Qos function accepts signed integers int for the prefetchCount and prefetchSize parameters but casts them directly to unsigned integers uint16 and uint32, respectivel...

GHSA-33MJ-CW25-M34H RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser

Summary A structural security weakness exists in the AMQP client's TLS configuration generator tlsConfigFromURI. When constructing a tls.Config object from an amqps:// connection URI, the library initializes the structure without explicitly defining the MinVersion field. While modern versions of...

GHSA-465G-FH3V-9JW4 RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection

Summary A query parameter injection vulnerability exists in the AMQP client's connection URI formatting logic. When generating or parsing connection URIs, TLS-related filesystem paths such as certificates or keys are appended directly to the URI's query string using string concatenation rather th...

GHSA-XWWF-M8FG-P9Q2 RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation

Summary A Denial of Service DoS vulnerability exists in the AMQP client's connection negotiation logic. The AMQP specification explicitly mandates a strict minimum frame size of 4096 bytes to prevent pathological packet fragmentation. While the library defines a frameMinSize = 4096 constant, the...

GHSA-89M4-43J5-VHHX Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root

Summary LocalFolderExtractor validates only the final canonical file path before extraction. However, makeFile creates intermediate directories one path segment at a time without checking whether each created directory remains inside the destination folder. A malicious RAR entry can make the fina...

GHSA-PQ59-9FQ7-M886 Zope AccessControl vulnerable to information disclosure through Python string `format` and `format_map` functions

Impact Python's string format functionality allows someone controlling the format string to "read" objects accessible recursively via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy...

GHSA-PJ96-35FP-CFCC ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion

Summary ExifReader 4.41.0 is vulnerable to denial of service through a crafted HEIC or AVIF file with a malicious iloc box. When offsetSize, lengthSize, and baseOffsetSize are set to zero in the iloc header, the extent-parsing loop allocates an unbounded number of JavaScript objects - up to...

GHSA-WXMM-Q36W-R9XJ MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests

Summary MariaDB Connector/J does not enforce allowLocalInfile=false when processing server-initiated LOCAL INFILE requests protocol packet type 0xfb. However, exploitation is constrained: the server can only request the exact filename the client already included in its LOAD DATA LOCAL INFILE quer...

GHSA-GG6F-MHQM-F7GP Duplicate Advisory: Sandbox Escape (NodeVM)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-88hf-g992-jg85. This link is maintained to preserve external references. Original Description vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host proto...

GHSA-9F3G-34X8-92JC Duplicate Advisory: vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-633r-hq9m-c4ff. This link is maintained to preserve external references. Original Description vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects,...

GHSA-MGJ2-JQJQ-Q8GG Duplicate Advisory: vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gjq8-xm47-88rc. This link is maintained to preserve external references. Original Description vm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions = 3.10.0 and = 3.11.7, Promises...

GHSA-538Q-XXPG-6H4R Duplicate Advisory: vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wjwh-qqvp-g4p4. This link is maintained to preserve external references. Original Description vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default new VM sandbox when running on...

GHSA-28Q4-XRQH-9479 Duplicate Advisory: vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8686-vhfx-7r3j. This link is maintained to preserve external references. Original Description vm2 through 3.11.6 does not normalize node:-prefixed builtin specifiers when evaluating user-supplied negative deny...

GHSA-9538-79J2-H62H Duplicate Advisory: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f8gf-w286-fmq2. This link is maintained to preserve external references. Original Description vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While...

GHSA-HC6Q-4VVG-JF79 Duplicate Advisory: vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jxxv-8r27-vm4p. This link is maintained to preserve external references. Original Description vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary...

GHSA-7C3P-84R8-H79Q Duplicate Advisory: vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6rh5-qq4q-97xh. This link is maintained to preserve external references. Original Description vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard...

GHSA-6FVH-FGMG-3X7V Duplicate Advisory: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c48m-32m9-vx93. This link is maintained to preserve external references. Original Description vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses...

GHSA-HMPR-C9RF-QCRF Duplicate Advisory: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jf8q-945g-9q4c. This link is maintained to preserve external references. Original Description vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundar...

GHSA-5V7W-95G5-PJ6Q Duplicate Advisory: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3vgf-8m4q-q4qr. This link is maintained to preserve external references. Original Description vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox...

GHSA-29X6-9QH5-83GG Duplicate Advisory: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-j3hm-6rg5-mchv. This link is maintained to preserve external references. Original Description vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit...

GHSA-X5QG-8PQ6-39H6 Duplicate Advisory: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fcqc-726x-5wfc This link is maintained to preserve external references. Original Description vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by...

GHSA-XQ74-C7JX-8W5J Duplicate Advisory: vm2 NodeVM can replace the host process TLS trust store

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-98xx-8mx4-x7cm. This link is maintained to preserve external references. Original Description vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call...

GHSA-WQG3-R97Q-73XM Duplicate Advisory: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qhwx-74w5-xhxq. This link is maintained to preserve external references. Original Description vm2 versions = 3.9.6 and therefore executes arbitrary JavaScript in an unrestricted host Node process outside the...

GHSA-8MVV-MCC3-XWHH Duplicate Advisory: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7q3f-wx44-378m. This link is maintained to preserve external references. Original Description vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string...

GHSA-M7CQ-7F2Q-F9FH Duplicate Advisory: vm2 3.11.6 allows a sandboxed plugin to execute native code through `node:sqlite`

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6w8r-xxw2-g3hx. This link is maintained to preserve external references. Original Description vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that built...

GHSA-4XMW-HH9Q-4Q7C Duplicate Advisory: vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x965-fc75-jpqh. This link is maintained to preserve external references. Original Description vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited...

GHSA-6JGM-4W45-VH8J Duplicate Advisory: vm2 crypto builtin loads attacker native code through setEngine

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-46pr-c5wc-xffx. This link is maintained to preserve external references. Original Description vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is...

GHSA-2VH9-CV26-P97M Duplicate Advisory: vm2: util.getCallSites() bypasses GHSA-v27g host-frame redaction, leaks host call stack

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r273-hxvj-fxhp. This link is maintained to preserve external references. Original Description vm2 is a sandbox for running untrusted Node.js code. In versions = 22.9 this hands sandboxed code util.getCallSites, ...