CVE Vulnerability Catalog

The issue was addressed with improved checks. An app may be able to bypass launch constraint protections and execute malicious code with elevated privileges.

This issue was addressed with improved checks to prevent unauthorized actions. An app may be able to break out of its sandbox.

KanaDojo before version 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute arbitrary code by exploiting the explicit passing of the global require function into a Node.js vm.runInNewContext() sandbox context in the issue-auto-respond.yml workflow. Attackers can submit a pull request modifying messages.cjs to import arbitrary Node.js modules, bypassing sandbox restrictions and achieving remote code execution with full GitHub Actions runner privileges including access to AUTOMATION_PR_TOKEN.

The Fediverse Embeds plugin prior to version 1.5.8 registered an unauthenticated REST route that accepted a base64-encoded URL and forwarded it to wp_remote_get without enforcing an allowlist. Version 1.5.7 did not validate the request, leading to the potential for full data read by anonymous users.

A vulnerability in Sonatype Nexus Repository allows a remote unauthenticated attacker to perform credential-guessing attacks against user accounts via authentication endpoints.

In version 0.2.6 of the tmp library for node.js, there is a vulnerability that allows bypassing the _assertPath guard. This enables an attacker to create a file or directory in a location controlled by them, using incorrect type values that are not strings.

The tmp package for node.js prior to version 0.2.6 contained a path traversal vulnerability that allowed escaping the intended temporary directory. Attackers could exploit traversal sequences or path separators to create files in attacker-controlled locations.

A vulnerability in Axios (versions before 0.32.0 on 0.x and before 1.16.0 on 1.x) fails to escape regex metacharacters in the XSRF cookie name. An attacker who can influence the cookie name passed to Axios can cause expensive regex backtracking while reading document.cookie, leading to client-side availability degradation (e.g., freezing the browser tab).

Vulnerability in Axios library (HTTP client for browser and Node.js). In versions from 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability has already polluted Object.prototype.transformResponse, Axios may treat that value as request configuration.

Axios versions 1.0.0 to before 1.16.0 are vulnerable to a Prototype Pollution Gadget attack. An attacker can escalate Object.prototype pollution into a full Man-in-the-Middle (MITM) attack, intercepting and modifying all HTTP traffic including credentials.

In Axios prior to versions 0.32.0 and 1.16.0, IPv4-mapped IPv6 addresses are not normalized. When NO_PROXY lists an IPv4 address, a request using the IPv4-mapped IPv6 form still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy.

Axios versions 1.7.0 through 1.15.x do not enforce configured request and response size limits when using the fetch adapter. This can lead to server resource exhaustion.

In Axios, a promise-based HTTP client for browser and Node.js, prior to versions 0.32.0 and 1.16.0, the Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage where an initial request is sent through an authenticated HTTP proxy, followed by a redirect to a URL that is no longer proxied. The final origin may receive the proxy credential.

Axios, an HTTP client for Node.js, can leak proxy credentials to a redirect target. When a request is sent through an authenticated proxy, a Proxy-Authorization header is added and persists after a redirect, even if the new request no longer goes through that proxy.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a user to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege.

IBM Langflow OSS versions 1.0.0 through 1.9.1 could allow an authenticated user to read or modify sensitive information by bypassing authentication using insecure direct object references.

A path traversal vulnerability in Perry before 0.5.1159 allows a malicious build server to write arbitrary content to any location writable by the client process. Attackers controlling the server URL can deliver traversal payloads through the artifact_name or download_path fields in ArtifactReady WebSocket messages.

openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request sent-message details by supplying an arbitrary mail_id value.

Boruta, an authorization server, prior to version 0.9.1, sets session cookies and the 'remember me' cookie without the Secure attribute. In HTTP connections, an attacker could intercept these cookies, leading to the ability to impersonate the user.

Keras versions prior to 3.14.0 are vulnerable to a path traversal issue during archive extraction. Validation functions compare archive member paths against the current working directory (CWD) instead of the actual extraction destination, which in environments like Docker, CI/CD, or Jupyter (where CWD is '/') allows bypassing security checks and writing files outside the intended directory.