CVE Vulnerability Catalog

January, the media proxy/embed service of stoatchat, before version 0.15.5 improperly resolves SVG <image href> values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who causes the service to proxy an attacker-hosted SVG can determine whether local files exist through observable response-time differences, and can cause supported local image files to be disclosed after re-encoding.

The Grav Data Manager plugin versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view without escaping, applying Twig's `raw` filter. An unauthenticated visitor who submits a front-end form whose submissions are saved to user/data can store an HTML payload that executes as JavaScript in the session and origin of an administrator who later opens that entry in the classic admin panel.

The Comments plugin for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin(), which only indicates that the admin service is registered on the current route rather than that the visitor is authenticated. On a site using the classic Admin plugin with Comments enabled, an unauthenticated remote attacker can request /admin/comments/page:<n> and retrieve every comment from the last 7 days, including each commenter's email address and the absolute server filesystem path of the data file.

Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page content authored by a user holding only page-write permission is rendered through a Twig sandbox that allowlists get_cookie(), which returns any cookie sent with the current request, including the visitor's session cookie. Grav then stores the finished post-Twig output in a page-content cache keyed only on page identity and the configuration checksum, with no session, user or request dimension.

Grav CMS 2.0.14 through 2.0.24 has a privilege escalation vulnerability in group and account blueprints. Dot-notation keys like `access.admin.super` bypass guards and let an operator with admin.users grant themselves full super-admin.

Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively. In web.config (IIS), every deny rule sets ignoreCase="false", allowing bypass by varying case in folder names or file extensions. On case-insensitive NTFS, an unauthenticated remote attacker can access sensitive files like configuration secrets or password hashes.

Netty HttpServerCodec up to 4.2.17.Final and 4.1.137.Final incorrectly pairs responses with requests when HTTP/1.1 pipelining with Expect: 100-continue is used, leading to response splitting and unsafe connection reuse.

Netty from 4.2.11.Final before 4.2.18.Final has an incomplete hostname verification fix in the QUIC certificate path when using a plain X509TrustManager, allowing attackers to present a certificate for the wrong hostname.

Netty's HTTP/3 codec from 4.2.2.Final through 4.2.17.Final builds the :authority pseudo-header from the Host header before considering the authority of an absolute-form request-target, leading to authority confusion.

Netty's HTTP/3 codec from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets, resulting in malformed HTTP/3 CONNECT with attacker-controlled authority.

Netty's HTTP/3 codec from 4.2.0.Final through 4.2.17.Final has an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder, allowing an attacker to declare huge literal lengths, causing unbounded heap growth and OutOfMemoryError.

Netty's QPACK prefixed-integer decoder (netty-codec-http3) from 4.2.0.Final through 4.2.17.Final does not bound continuation bytes, allowing an attacker to cause O(N^2) CPU cost and memory growth, leading to OOM and event-loop starvation.

Netty's HTTP/3 codec from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state, allowing an attacker to cause unbounded heap growth and denial of service.

SiYuan versions up to and including 3.8.3 have authentication guards (CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go) that fail open when the HTTP Origin header is absent. Browsers omit Origin on cross-site top-level GET navigations and no-cors GET subresource loads, and the session cookie is SameSite=Lax, so a single cross-site GET from an attacker-controlled page is granted RoleAdministrator. Combined with content-type sniffing on /api/network/proxy, this allows an unauthenticated remote attacker to execute arbitrary script in the SiYuan origin, invoke administrator APIs, and exfiltrate the persistent kernel API token.

SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnerability in gallery and kanban database renderers where field descriptions are not escaped in aria-label attributes. In the Electron desktop app with nodeIntegration enabled, attackers can inject JavaScript that calls Node.js child_process APIs to execute arbitrary commands with user privileges.

SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database rows from all notebooks.

SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScript by modifying field descriptions, template sources, select option descriptions, or footer calculation templates. Attackers can execute stored JavaScript when other users open affected database menus, and in the Electron desktop app with nodeIntegration enabled, this leads to command execution with SiYuan process privileges.

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to terminate the kernel process, read workspace configuration and proxy settings, and trigger administrative actions via zero-credential cross-origin requests from the victim's browser.

SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/getRiffCards is inserted into a card item template in app/src/card/viewCards.ts and assigned to listElement.innerHTML, so content such as <img src=invalid onerror=...> becomes an executable event-handler attribute. Because the SiYuan desktop (Electron) main window is created with nodeIntegration enabled and contextIsolation disabled, an administrator who opens the card manager on a workspace containing attacker-supplied flashcard content executes the attacker's script in a privileged renderer, which can lead to arbitrary code execution on the host.

SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup (app/src/protyle/gutter/button.ts, assigned via innerHTML in app/src/protyle/gutter/index.ts) from content pasted as plain-text Markdown containing a Kramdown inline attribute list (IAL). Because the shared Lute renderer parses Kramdown IAL from text/plain input, an attacker-supplied Markdown snippet using entity-encoded quotes in data-subtype breaks out of the attribute value when the gutter markup is re-parsed by the browser, injecting additional attributes such as autofocus and onfocus. If a victim pastes the crafted Markdown and the affected gutter control receives focus, the injected handler executes; in the Electron desktop application, where the main BrowserWindow enables Node integration and disables context isolation, this results in JavaScript execution with renderer Node.js privileges (remote code execution).