GHSA-W9X9-J56R-H98R @eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy

Unauthenticated Danswer API Confused Deputy Proxy in @eeacms/volto-chatbot Summary @eeacms/volto-chatbot exposes an Express middleware route /v1da/ that accepts unauthenticated HTTP requests from any network client and proxies them to the configured upstream Danswer API, automatically attaching t...

GHSA-8VFG-2R28-HVHJ Crass: Non-ASCII characters cause superlinear CPU consumption

Impact When parsing an input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled input consisting of many non-ASCII characters could cause excessive CPU consumption and potentially...

GHSA-WWPR-JFF3-395C Crass: A large number of adjacent CSS comments can trigger a SystemStackError

Impact When the :preservecomments option is not enabled which is the default behavior, Crass discards CSS comments by recursively consuming the next token. An attacker who provides a stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a...

GHSA-6JXJ-PX6V-747W Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage

Impact Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value containing many deeply nested blocks can recurse until Ruby raises SystemStackError: stack level too deep, or can cause excessive memory usage. Patches This is fixed in Crass 1.0.7,...

GHSA-C33X-VCV4-VG3G Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence

Cedar users must be using all of the following features to be affected by this advisory: JSON format policies, policy templates, and the is in scope condition. This advisory only affects JSON-formatted Cedar policy templates containing is in scope conditions that are malformed according to the...

GHSA-Q344-5V34-GM84 @sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY

Impact When @sylphx/pdf-reader-mcp is run as an HTTP server MCPTRANSPORT=http, it reads the MCPAPIKEY environment variable and logs API key authentication enabled X-API-Key header at startup, but it never validated the X-API-Key header on incoming requests. The key was read into a variable and...

GHSA-R899-H629-J84R Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist

Impact Parse Server's file upload validation uses the fileUpload.fileExtensions option enabled by default with a blocklist to reject files that browsers may render as active content, mitigating stored cross-site scripting XSS. When an uploaded file's extension is not recognized by the mime packag...

GHSA-RHJ7-VH3V-MCQ6 Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware

Summary Daptin's LanguageMiddleware registered as a global gin middleware calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header of every HTTP request without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of...

GHSA-PG53-P7QP-65CV PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets

Summary During the resource pack stage of logging in, after the server sends ResourcePackStackPacket, a malicious client can send a batch of multiple ResourcePackClientResponsePacket packets with status ResourcePackClientResponsePacket::STATUSCOMPLETED causing the server to repeatedly execute...

GHSA-68WQ-PHQ7-P2VG MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow

Impact In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user's email account. CMS 6 is not affected...

GHSA-R4J5-9XPP-3985 Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

Summary When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have already arrived without yielding to the event loop. A client can send a body made of millions of 1-byte chunks, which blocks the event loop and therefore every other connection serve...

GHSA-PW9P-V7R6-GX4P Tornado: Open redirect in RedirectHandler via protocol-relative URLs

Summary tornado.web.RedirectHandler builds its target URL by substituting parts of the request path into a template. Depending on where those substitutions appear in the template, an attacker can craft a request that redirects to a host of their choosing. This creates an open redirect on the...

GHSA-PCG2-G6CJ-Q92C Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

Summary Tornado's HTTP header parser takes quadratic time On² when a header value is continued across many "obsolete line folding" obs-fold lines. An unauthenticated attacker can send a request whose header block is mostly short continuation lines. Parsing it uses a large amount of CPU on the...

GHSA-PQ4G-8RXF-4G29 Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass

Summary Crass's tokenizer didn't terminate a bad URL token at a that followed an escaped backslash \. As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked into passing...

GHSA-3F7J-7JWC-FXFJ systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks

Summary On Windows, [email protected] builds a PowerShell command using the value passed to services. The default sanitizer removes ASCII quotes but keeps Unicode curly quotes, spaces, and parentheses. A crafted service name can use those characters to break out of the generated filter...

GHSA-W658-MH9P-WW8F Backstage catalog rules can be bypassed for URL locations using encoded path segments

Summary @backstage/plugin-catalog-backend matches URL-type locations against catalog.rules location patterns using the raw URL string submitted by the user, while URL readers resolve that same string in canonical form when fetching the location's content. A URL can therefore be crafted so that it...

GHSA-6JP4-8V48-CC5V Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it

Summary The main Electrum server the client connects to is trusted with mempool "unconfirmed" transactions. This is documented design. 0 However now someone figured out a way to practically exploit it: - when the client broadcasts a new tx1, a malicious server can swallow it, - and update the...

GHSA-2HW4-C9M4-F2FJ knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion

⚠️ Update verification, 2026-05-19: C-2 confirmed end-to-end — 4.5× amplification observed worse than the advisory's conservative 2× claim Built a Go PoC cmd/poc-c2/main.go that runs the exact 8-line vulnerable snippet from webhook/admission.go:109-117 verbatim under the same http.HandlerFunc shap...

GHSA-JF75-Q64Q-G65R Waline login accepts a non-string email as a match-all MongoDB query

Summary The login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string for example a JSON object such as "$ne": null, the MongoDB storage adapter's parseWhere silently DROPS...

GHSA-F86P-H4J2-7QGJ Seroval: Code injection through a typed array's own constructor property

Summary seroval writes a typed array as a call to its constructor. In affected versions, the constructor name in the output is read from a property that data on the value can replace, and it is written without checks. A typed array that received properties from untrusted data can then put arbitra...

GHSA-9WX9-5PV9-3349 Seroval: Script injection through RegExp sources in serialized output

Summary seroval writes a RegExp as a regular expression literal. In affected versions, the element that the serialized output is placed in, and run script in the page. Details seroval escapes element. RegExp sources did not get the same escaping: - Versions before 1.0.0 wrote the source as is. -...

GHSA-97R2-QH9M-474H Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)

Summary fromJSON and fromCrossJSON used two node fields without checking them. - An array node's element list was not checked to be an array. A small payload could set the length the decoder looped over. This part is also tracked in GHSA-wp97-x4hv-qvhp. - A sequence node's done index was not...

GHSA-WP97-X4HV-QVHP Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

Summary fromJSON and fromCrossJSON did not check that an array node's element list is an array. A small crafted payload could set the length the decoder used. That length controlled how much memory was allocated and how many times the decoder looped, and it did not depend on the size of the...

GHSA-7RV5-MRXV-XCR9 Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check

Summary When fromJSON rebuilt an async iterator, it called on on the iterator's source without checking that the source was a seroval stream. A crafted payload could pick another value as the source, such as a function returned by an application plugin. The deserializer then called that value's o...

GHSA-5324-3W58-QPP2 Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)

Summary buildsessionscope in mem0/memory/main.py builds the conversation-history scope key used to fetch/store the last N raw messages by naively joining caller-supplied userid/agentid/runid values with unescaped & and = delimiters: def buildsessionscopefilters: parts = for key in sorted"userid",...

GHSA-H2R5-X5M7-3935 Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim

Summary The generic OpenID Connect backend OpenIdConnectAuth and every backend built on it stores the nonce in the shared Association table, not in the user's session. When the ID token comes back, validateclaims only checks that the nonce exists in that table and is not expired. It does not chec...

GHSA-6PWM-X34P-FVJ2 ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank

Summary ONNX ConvTranspose shape inference performed an out-of-bounds read when the weight tensor had fewer than three dimensions and the model did not provide a kernelshape attribute. The inference function derived an empty effectivekernelshape vector from the undersized weight tensor, then...

GHSA-Q69G-F4F5-V8M7 ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs

Summary ONNX's Python tensor-materialization helpers could allocate memory according to attacker-controlled tensor dimensions without verifying that a packed sub-byte payload contained the declared number of elements. A very small model could therefore cause a disproportionately large allocation...

GHSA-M4PR-6V3C-6FGR ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute

Summary ONNX shape inference did not safely validate the required Scan numscaninputs attribute. Two malformed values could terminate or disrupt the process: 1. If the attribute was missing, ctx.getAttribute"numscaninputs" returned null and was dereferenced. 2. If the attribute was negative,...

GHSA-48M4-24CQ-37QF ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)

Summary ONNX shape inference performed an out-of-bounds read when processing a malformed RNN, GRU, or LSTM node from opsets 1–6 whose first input had a rank other than three. RNNShapeInferenceopset1to6 checked whether the input shape was present but accessed dim0 and dim1 without first checking i...

GHSA-VVPG-RRWW-WPMH vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

Summary The OpenAI-compatible server registers Starlette CORSMiddleware with allowedorigins defaulting to "", and performs no authentication unless --api-key or VLLMAPIKEY is configured. A web page on any origin can send requests to a vLLM server that the victim's browser can reach for example...

GHSA-8397-8QF6-F2GM vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine

Summary The Phi-4 multimodal audio encoder phi4mmaudio.py / phi4mmutils.py runs its conformer attention in eager mode by default: the official HF config of microsoft/Phi-4-multimodal-instruct does not set useptscaleddotproductattention, so the default False applies phi4mmaudio.py:166, :876;...

GHSA-GQ5Q-89C7-VHVX vLLM DeepSeek-OCR image processing vulnerable to denial of service

Summary Any vLLM deployment serving a model of the DeepSeek-OCR family — deepseek-ai/DeepSeek-OCR, deepseek-ai/DeepSeek-OCR-2, or baidu/Unlimited-OCR whose UnlimitedOCRForCausalLM subclasses DeepseekOCRForCausalLM — can be killed by a single unauthenticated chat request carrying an ordinary,...

GHSA-H3RC-J82P-2C3H vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE

Summary In vLLM 0.30.0, ImageMediaIO passes attacker-controlled image bytes to Pillow's format autodetection without restricting the accepted formats; the request's MIME label does not constrain decoder selection. An EPS payload labeled image/png reached the host's Ghostscript executable. On a ho...

GHSA-6757-HGGM-HP2W vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM 0.32.0. Summary When --mm-processor-cache-type shm is enabled, vLLM's multimodal SHM cache represents a cached item with an address and monotonicid pair and treats that pair as authority to dereference shared memory in the worke...

GHSA-Q97C-P368-75C4 vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)

For a model whose vocabulary size is an exact multiple of the embedding padding size 64 — e.g. any Llama-2-family model, vocab 32000 — a single request carrying a pre-tokenized prompt with token id equal to the vocab size 32000 passes vLLM's input-id validation but is one past the last embedding...

GHSA-X567-49G5-P4CF vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs

Summary vLLM's /v1/responses endpoint accepts request-level chattemplatekwargs, but does not apply the --trust-request-chat-template gate that protects Chat Completions, render, tokenize, and pooling paths. When the server is run with the documented default trustrequestchattemplate=False and no...

GHSA-542M-9234-8GVF vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool

Summary vLLM renders chat templates by passing the resolved Jinja2 source to tokenizer.applychattemplate, which compiles and .renders it in an ImmutableSandboxedEnvironment. The sandbox prevents code-execution escapes but imposes no wall-clock timeout, no output-size cap, and no nested-loop or...

GHSA-MGHF-WJFP-P5XM Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction

Summary When running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than 256k targets on one brtable instruction in a way that results in an incorrect conditional branch target. This conditional branch could then jump to arbitrary other code...

GHSA-VVM8-GF78-28G4 Go JOSE: Panics in JSON parsing

Summary Parsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash. Note: this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4. Impact Denial of service vulnerability. Any application that parses untrusted JS...

GHSA-4W3G-JFJ2-CW2Q Go JOSE: Panic during CBC-HMAC processing

Summary Decrypting a ciphertext with "A128CBC-HS256", "A192CBC-HS384", or "A256CBC-HS512" can result in a panic on untrusted input. Note this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4. Details Insufficient validation of parameters can lead ...

GHSA-4VJG-VX72-QQ4G systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net

Summary On Linux, [email protected] builds /sys/class/net/ paths from the caller-supplied networkStatsiface value without checking that the resolved path stays inside /sys/class/net. A caller who can create a symlink fixture and control the value passed to this API can make the function...

GHSA-7648-JMWF-VW7J systeminformation has prototype pollution in `networkStats()` via the interface name

Summary networkStats keeps a per interface cache for computing rxsec / txsec between calls. The cache is a plain JavaScript object and is indexed with the interface name the caller supplied. Passing the name proto makes every cache write land on Object.prototype instead of the cache, polluting...

GHSA-8PRR-F582-JQQ3 LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output

Summary langgraph deploy --verbose printed the temporary registry push token that the CLI uses to log Docker in to the deployment's image registry. Anyone who could read that output, for example in CI logs, could use the token until it expired. Details When Docker is available, langgraph deploy...

GHSA-X8RM-F576-GQ67 graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service

Summary The regular expression behind GraphQLPhoneNumber since 1.24.1 backtracks exponentially. A string made of a run of digits followed by one character that makes the match fail for example "1".repeat30 + "x" blocks the JavaScript thread for seconds, and every additional digit doubles the time...

GHSA-PJH6-C8MG-3X7M Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)

Summary permessage-brotli inflates each frame fully before checking maxMessagePayloadSize, so one 421-byte frame makes the server allocate about 545 MiB even with a 1 MiB message limit brotli expands about 1,000,000:1. Any unauthenticated client can exhaust server memory this way on servers that...

GHSA-3CMX-XJWW-583X i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

Summary The URL-segment check added for GHSA-q89c-q3h5-w34g blocks ?, , %, :, / and @ in lng, but not & or =, and the checked value is inserted into the URL without encoding. The README documents a multiload loadPath of the form /locales/resources.json?lng=de+en&ns=ns1+ns2. With a template like...

GHSA-GG6H-894W-4M9C RE2JS: Quadratic-time denial of service in re2js lookbehind matching

Summary Using the opt-in LOOKBEHINDS flag together with any repeated-matching API matcher.find in a loop, matchAll, split, matcher.replaceAll causes quadratic-time Θn² matching, contradicting the library's own "linear time matching" guarantee. A single call with a 16,000-character input takes...

GHSA-M665-V7PM-7GRJ zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

Summary A critical architectural parser differential exists in the zip crate = 9.0.4 between random-access archive readers ZipArchive and streaming readers ZipStreamReader. ZipArchive considers the Central Directory File Header CDFH authoritative and ignores the filename declared in the Local Fil...

GHSA-4HM6-W6QQ-W73V LangGraph JavaScript custom authentication may permit cross-user Store access

Summary LangGraph deployments using JavaScript or TypeScript custom authentication may fail to apply Store authorization changes returned by an authorization handler. In affected deployments, an authenticated user may be able to access Store data outside their authorized namespace. Required...