36904 matches found
GHSA-QQJ6-54Q6-CXV6 Snowflake drivers writes sensitive information to logs
Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the...
GHSA-6F2X-V7Q7-M7M5 hickory-resolver follows irrelevant CNAME records
When the Hickory DNS resolver follows CNAME records, it sends queries that are not necessary to answer the original recursive query. If there are any CNAME records in the authority section or additional section of the response, queries will be sent for those names. If there are any CNAME records...
GHSA-6W6G-HM98-MHGM hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)
When the hickory-resolver name server pool implementation receives an upstream response with the TC truncated header bit set, it re-queues the request to the same nameserver to retry with UDP transport disabled. However, the retry arm never inspects the transport that just answered and carries no...
GHSA-5J98-2G5X-46V6 hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures
When calling Resolver::lookup or Resolver::lookupip on a resolver with DNSSEC validation enabled, both methods return Ok... if DNSSEC validation fails. It is possible but very inconvenient to check the validation status of individual records. These methods should instead return an error when DNSS...
GHSA-RJ75-HQRM-R3GF PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
Impact . and are not word delimiters in the tokenizer, so a flat selector such as .a.a.a... reaches splitWord as a single word token carrying n class or id indexes. Three passes scanned those index arrays linearly for every index, making the parse On^2 in the number of indexes rather than in inpu...
GHSA-7G7C-H8RR-7P6Q Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
A Path Traversal vulnerability exists in the prerendered SSG page retrieval logic of CommonEngine in @angular/ssr/node and @angular/ssr in earlier versions. When deployed on Windows, an attacker can craft a request path with backslash directory traversal sequences that causes CommonEngine to serv...
GHSA-27VJ-QCQG-25RC fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution
Summary fsspec.implementations.reference.ReferenceFileSystem parses a "references" JSON document Kerchunk format supplied either inline or via a URL. The parser renders fields from this JSON through un-sandboxed jinja2.Template....render... calls in three locations. An attacker who controls the...
GHSA-RVM3-566M-V7FV Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
Impact Capacitor's WebView navigation guard validated only the host and scheme of a target URL, not its path. Because the internal HTTP proxy path /capacitorhttpinterceptor is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed...
GHSA-QQMP-WF37-98F9 Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
Impact Multiple @opentelemetry/instrumentation- packages recorded the database connection username as the db.user span attribute on every instrumented database operation. This attribute was emitted unconditionally — it was not gated by enhancedDatabaseReporting or any other opt-in flag, and it wa...
GHSA-JGGR-W7FW-PC2J fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values
Summary fast-copy traverses values recursively with no bound on depth. Copying a sufficiently deeply-nested value exhausts the JavaScript call stack and throws a native RangeError: Maximum call stack size exceeded from inside the library. Details Both copy and copyStrict recurse once per level of...
GHSA-G2V6-RQMX-R4W6 @vue/server-renderer: XSS via missing CR in attribute-name blacklist
Description @vue/server-renderer was investigated specifically because it's the one place in Vue where template rendering output becomes a real HTTP response body -- a genuine server-side trust boundary, unlike client-side rendering which only ever affects the same browser session that's already...
GHSA-5GMW-XHRV-C9V3 Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution
tinypool passes worker options to new Worker by reading them off a plain object whose prototype is Object.prototype. Options the application did not set are resolved through the prototype chain and then passed explicitly to workerthreads.Worker. Node core ignores Worker options inherited from...
GHSA-85C8-PPGW-CCPR Tinypool: Prototype Pollution Gadget to RCE in run() options
tinypool is a fork of piscina and inherited the same prototype-pollution surface. When pool.runtask, options is called, the filename option is read from the provided options object. If that object does not have an own filename property, the lookup falls through to Object.prototype. An attacker wh...
GHSA-V853-P72Q-4CFW Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__
Summary Quart 0.23.0 contains a stray debug statement printdata inside Body.await in quart/wrappers/request.py. Any request whose body is awaited — await request.form, await request.getdata, WTForms validateonsubmit, etc. — has its raw, unparsed body printed to stdout, including plaintext form...
GHSA-FVWW-7H3R-VFHP LangGraph SDK custom auth silently ignores actions= on resource decorators
Impact What kind of vulnerability is it? Who is impacted? langgraph-sdk incorrectly applies the actions= argument on resource-scoped authorization decorators, including @auth.on.threads, @auth.on.assistants, and @auth.on.crons. In affected versions, a decorator such as: python...
GHSA-HQR4-QQ8F-HG3X stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
Summary The JSONC parser stream-json/jsonc/parser.js and verifier stream-json/jsonc/verifier.js scan a comment for its terminator starting from the comment's opening / on every input chunk. When a comment doesn't finish inside the current buffer, the scanner returns the comment's start offset and...
GHSA-MJW6-4JJ6-33HC stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects
Summary A prototype-pollution vulnerability in stream-json lets attacker-controlled JSON replace a parsed object's prototype. Details The streaming JSON parser StreamValues/StreamObject/jsonc variants writes keys via plain assignment, so a proto key replaces the parsed object's prototype with...
GHSA-F8GF-W286-FMQ2 vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM
Summary When allowAsync is set to false, vm2 is expected to reject attempts to run asynchronous code. Direct use of Promise.prototype.then is blocked, but Promise static methods still assimilate attacker-controlled thenables. Promise.resolvethenable, Promise.allthenable, Promise.racethenable,...
GHSA-88HF-G992-JG85 vm2: Sandbox Escape (NodeVM)
Summary It being possible to obtain the host proto getter/setter, has been used in many reports: - https://github.com/patriksimek/vm2/security/advisories/GHSA-vwrp-x96c-mhwq - https://github.com/patriksimek/vm2/security/advisories/GHSA-v6mx-mf47-r5wg -...
GHSA-GJQ8-XM47-88RC vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process
Summary vm2 current head v3.11.5, commit 7a1f5100b96f48d34e0fe104ab37c0acc5944f92 can still be used to terminate the host Node.js process when sandbox code calls a host-realm function that returns a rejected host Promise and then ignores the returned value. This is an incomplete-fix variant of th...
GHSA-3VGF-8M4Q-Q4QR vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix
Summary vm2's current host-intrinsic prototype protection is incomplete. The fix for GHSA-vwrp-x96c-mhwq blocks sandbox writes into classic host intrinsics such as Object.prototype, Array.prototype, and Function.prototype, but current head still lets sandbox code in a default VM reach and mutate...
GHSA-X965-FC75-JPQH vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit
Summary vm2 3.11.6 this fork's latest release contains an incomplete-fix bypass of the Error.cause host-reference sanitization added in GHSA-m283-3h24-438v commit 7e3faaf. Sandbox code that catches a host-wrapped AggregateError which is revisited within a single handleException traversal...
GHSA-R273-HXVJ-FXHP vm2: util.getCallSites() bypasses GHSA-v27g-jcqj-v8rw host-frame redaction, leaks host call stack
Summary NodeVM exposes the host util module to the sandbox through an unfiltered shallow copy Object.assign, util. On Node.js = 22.9 this hands sandboxed code util.getCallSites, a programmatic stack-introspection API that returns the host process's full call stack — absolute file paths, function...
GHSA-C8X8-7FP4-3X9W ProseMirror has a XSS vulnerability in prosemirror-view's paste handling
Impact When a user pastes attacker-provided HTML into a ProseMirror editor component, this can cause attacker-controlled JavaScript code to run in the browser window containing the editor. Patches Version 1.42.3 adds validation that prevents this attack. Workarounds No known workarounds...
GHSA-X6M4-CHR9-CG97 vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting
Summary Attacker-controlled code can trigger a host-realm syntax error and read its stack through the vm2 bridge. Host-realm stack formatting bypasses the sandbox-side redaction, so the returned value exposes absolute paths from vm2, Node.js internals, and the embedding application. Default VM an...
GHSA-R4FX-V8HH-22MV vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)
Vulnerability Summary vm2's VM timeout option is documented and relied upon as the mechanism that bounds how long sandboxed code may execute. In the current implementation, the timeout only wraps the single synchronous call to VMrun via doWithTimeout → this.runScriptscript in lib/vm.js. It does...
GHSA-J3HM-6RG5-MCHV vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE
Summary NodeVM's require.external option lets sandboxed code require local files and npm packages. When require.external is enabled and require.root is not explicitly set to a path that excludes nodemodules, two defaults combine to fully defeat the sandbox: - require.root defaults to unrestricted...
GHSA-FCQC-726X-5WFC vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool
Summary Sandboxed code is able to disclose host memory used by small allocations by Buffer.from, Buffer.concat. Details vm2 exposes Buffer object to sandboxed code by default. Small Buffer allocations for example, Buffer.allocUnsafe, Buffer.fromarray, Buffer.fromstring, and Buffer.concat use the...
GHSA-WJWH-QQVP-G4P4 vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass
Summary There is a sandbox escape in vm2 3.11.5 / current HEAD when it is used on Node.js 26. The issue is reachable from a default new VM sandbox. No NodeVM, require permission, host object injection, or intentionally unsafe configuration is required. The escape is a patch-bypass of the same...
GHSA-4XHP-XG4W-8PPM Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend
Summary The ODF backend resolves the xlink:href of a draw:image element as a filesystem path whenever the referenced part is not found inside the document archive. The value comes straight from content.xml, so it is document content, and it is used with no scheme check, no confinement to the...
GHSA-GXM5-99CW-XJW9 @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name
Impact @fastify/busboy 3.2.1 and earlier retains a bare carriage return or line feed inside the parsed Content-Disposition parameters returned to the application. The multipart header parser ends a header line only on the two-byte \r\n sequence, so a lone CR or LF embedded in a part header is...
GHSA-JXW3-MJMX-3PQM Langflow: Weak Fernet Key via random.seed()
Summary Langflow uses Python's random module Mersenne Twister, a non-cryptographic PRNG seeded with the SECRETKEY to derive the Fernet encryption key for all stored user credentials API keys, LLM provider secrets, database passwords. When the SECRETKEY is shorter than 32 characters — a common...
GHSA-CF6M-VC3M-7CGM Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass
Summary A vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOKAUTHENABLE configuration is set to False. This allows a remote attacker who knows a flow's UUID ...
GHSA-W584-2H2R-2HVF Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description
Summary: A critical Authenticated Remote Code Execution RCE vulnerability exists in the validatecode function of Langflow. The /api/v1/validate/code endpoint, meant to validate user-supplied code, leverages Python's exec function. While it attempts to restrict execution to function definitions, i...
GHSA-9FPM-3445-2VX4 Langflow: Prompt injection in Langflow Smart Transform can lead to code execution
Summary Langflow versions 1.3.0 through 1.10.2 contain a code-injection vulnerability in the Smart Transform LambdaFilterComponent component. Smart Transform places flow-author instructions and a preview of its input data into a prompt asking an LLM to generate a Python lambda. It then extracts a...
GHSA-4WWP-F6GW-6QM5 SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist)
Summary: IsForbiddenAbsPath only blocks conf/conf.json by exact match. The TLS private key conf/key.pem and CA private key conf/ca.key live in the same conf/ directory and are absent from the blocklist. Any authenticated user can retrieve them via POST /api/file/getFile. Root cause...
GHSA-3CM4-CCVW-6XR6 SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/*
Summary GHSA-c8r8-95hg-mp34 added a centralized guard, util.IsForbiddenAbsPath, specifically to block access to a small set of sensitive files: conf/conf.json plaintext accessAuthCode/API token/cookie key, data/snippets/conf.json, the entire data/templates/ directory, and...
GHSA-GCGF-FH7C-8GF2 @orpc/zod: Prototype injection in smart coercion
Summary ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin mishandle object keys that name Object.prototype members. Both coerce request input before validation, so any client that can reach a procedure whose input schema contains an object or a record can: 1. replace the prototype of...
GHSA-X4Q3-GCJ3-M6CF gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled
Summary actrunner appends workflow-controlled jobs..container.options directly to the Docker HostConfig for the job container. When runner privileged mode is disabled, only Privileged is forced false. Host namespace flags, capability expansion, and security profile overrides from workflow YAML ar...
GHSA-GJJ5-9665-RWRC probe-image-size: Quadratic-time Denial of Service in the SVG Parser
Overview probe-image-size scans the SVG header with a searching regular expression, //. On input that contains many , the engine restarts the ^ scan at every position and runs to end of input each time, giving quadratic time complexity. Both the synchronous and the streaming parser are affected...
GHSA-X8GV-G2G3-65FJ SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF)
Security Advisory — SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU Bypass of CheckHostSSRF | Field | Value | |---|---| | Disclosed by | joysinleung [email protected] | | Report date | 2026-08-13 | | Product | SiYuan 思源笔记 — siyuan-note/siyuan | | Go module |...
GHSA-P23F-CM6Q-2QP8 SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass)
Security Advisory — SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths Workspace Boundary Bypass | Field | Value | |---|---| | Disclosed by | joysinleung [email protected] | | Report date | 2026-08-13 | | Product | SiYuan 思源笔记 — siyuan-note/siyuan | | Go module |...
GHSA-X8MW-P69M-V3MX @fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header
Impact Versions of @fastify/busboy from 1.0.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The multipart header parser stores part-header names on a plain JavaScript object, so a part header named proto or constructor resolves to an inherited value that is not an array, and the parse...
GHSA-XJH9-V7X6-24JW @fastify/busboy vulnerable to Denial of Service via oversized multipart boundary
Impact Versions of @fastify/busboy from 3.1.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The vendored streaming multipart search stores its default skip distance in a Uint8Array256. A multipart boundary of exactly 252 bytes makes the search needle 256 bytes, and the table entry wra...
GHSA-MWM8-39RW-8826 sqlite3-ruby: Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument Array
Summary Using Databasecreateaggregate, createaggregatehandler, or Databasedefineaggregator to define an aggregate function that takes two or more arguments, and then evaluating it over TEXT or BLOB column values, can free the Ruby objects holding those arguments while a later argument is still...
GHSA-CJCG-CXMH-9WCR Praxis affected by HTTP/2 Bomb
Summary Multiple denial-of-service vulnerabilities have been discovered in HTTP/2 server implementations. All have been rated with a severity impact of Important. The vulnerabilities target HPACK, the header compression scheme in HTTP/2, where a small request can trigger large memory allocations ...
GHSA-H46J-26Q3-RGGF Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)
Summary The Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious...
GHSA-4VPG-GWQQ-W44C SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers
Same CWE-862 family, found via an automated bulk sweep of every /api/block/ handler in kernel/api/block.go for the presence of any access-check reference IsReadOnlyRoleContext, checkBlockPublishAccess, GetPublishAccess anywhere in the function body. 17 of 28 candidate endpoints have none...
GHSA-72QQ-P3R5-F7WQ @a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions
Summary The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitra...
GHSA-3CC2-H3V6-RQPQ SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass
High Package gomod github.com/siyuan-note/siyuan/kernel Affected versions 3.7.3 Patched versions none yet — leave blank until a fix is released Description Summary /ws/network/proxy is an admin-only WebSocket forward-proxy endpoint target URL and headers fully attacker-specifiable via query...