CVE-2022-40274

CVE-2022-40274 affects Gridea 0.9.3. The root cause is the application running with nodeIntegration enabled, allowing an attacker to remotely execute arbitrary code when a user views a malicious Markdown file. Impact is described as high in multiple sources. The documentation does not indicate a ...

CVE-2019-12047

CVE-2019-12047 affects Gridea v0.8.0 with an XSS flaw that allows an attacker to trigger arbitrary code execution by invoking a Node.js module (e.g., via child_process.exec) from crafted input, demonstrated by an onerror payload. The issue is caused by insufficient input sanitization leading to ...