最新のセキュリティ情報
2 ページ目
10月21日(水)昨日
A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery
影響: maven:org.a2aproject.sdk:a2a-java-sdk-server-common < 1.3.0.Final → 1.3.0.Final --- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common (push-notification delivery) - Affected versions: /latest/meta-data/iam/security-credentials/. Use returnImmediately: true, header A2A-Version: 1.0, and role ROLE_USER. The URL is stored verbatim. (Equivalent via CreateTaskPushNotificationConfig on an existing task.) 3. As the task emits state/artifact updates, the sender POSTs each one to the stored URL, from the server's own network position: POST /latest…
A2A Java SDK has a fail-open default task authorization
影響: maven:org.a2aproject.sdk:a2a-java-sdk-server-common < 1.3.0.Final → 1.3.0.Final Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships._ --- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common (task store / authorization) - Affected versions: <= 1.2.0.Final (and 1.2.1.Final-SNAPSHOT on main prior to the fix) - Patched version: _(the release that carries the fix, e.g. 1.2.1.Final)_ - CWE: CW…
A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect
影響: maven:org.a2aproject.sdk:a2a-java-sdk-parent < 1.3.0.Final → 1.3.0.Final Impact. A malicious or compromised A2A agent can cause the client's API key credential to be forwarded to an arbitrary third-party server. The agent serves an AgentCard with an APIKeySecurityScheme specifying a custom header name, then responds with an HTTP redirect. The JDK HttpClient follows the redirect and forwards the custom header containing the credential, since only the standard Authorization header may be stripped on cross-origin redirects. Where. client/transport/spi/src/main/java/org…
Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
影響: pip:Pillow <= 12.3.0 → 13.0.0 Summary A PPM or PGM file can declare a width of 0, which Pillow accepts, producing an image of size (0, N). Passing that image to ImageMorph.MorphOp.apply() makes the native morphology code index a row buffer at outrow[width - 1], which is outrow[-1] when the width is 0. The process crashes. Details The PPM parser reads width and height with no lower-bound check: - src/PIL/PpmImagePlugin.py:119 The native apply() writes the row edges with no guard that the width is positive: - src/_imagingmorp…
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
影響: pip:Pillow >= 9.2.0, < 13.0.0 → 13.0.0 ============================================================================ GIF seek keeps rejected size after DecompressionBombError, allowing DoS Location: src/PIL/GifImagePlugin.py:293 in GifImageFile._seek() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ A GIF of about 60 bytes can make Pillow allocate gigabytes of memory. This affects applications that catch the "image too large" error raised while stepping to…
Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit
影響: pip:Pillow >= 2.3.0, <= 12.3.0 → 13.0.0 ============================================================================ EPS load(scale) lets Ghostscript render past the decompression bomb limit Location: src/PIL/EpsImagePlugin.py:92 in Ghostscript() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ When an application opens an untrusted Encapsulated PostScript file and asks Pillow to render it at a larger scale, Pillow has Ghostscript produce an image several ti…
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
影響: pip:Pillow >= 5.3.0, < 13.0.0 → 13.0.0 ============================================================================ TiffDecode returns uninitialized memory as pixels for short JPEG strips Location: src/libImaging/TiffDecode.c:554 in _decodeStrip() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ Pillow hands back leftover process memory as image pixels when it opens a small crafted TIFF file. Anyone who can get an application to open their image, and can se…
Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
影響: pip:Pillow <= 12.3.0 → 13.0.0 Summary A small attacker-supplied TIFF can be opened and loaded normally, then reach an out-of-bounds read when an application saves it back to TIFF with retained metadata. The fixed reproducer is a 1×1, 16-bit grayscale, PackBits-compressed TIFF containing tag 320 (ColorMap) with 768 SHORT values: three zero-filled planes of 256 entries each. No Python object is forged and no metadata is injected after loading. Pillow's TIFF encoder allocates 768 × 2 = 1536 bytes, then passes three plane point…
Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
影響: pip:pillow >= 5.1.0, < 13.0.0 → 13.0.0 Summary When an application appends to an existing PDF with Image.save(..., format="PDF", append=True), Pillow parses that file with PdfParser. Two recursive parsers have no effective bound. linearize_page_tree follows /Kids with no visited set or depth limit, so a cyclic or duplicated page tree recurses without end. read_prev_trailer rejects only an exactly repeated /Prev offset, so a long chain of unique offsets still recurses. The trailer-loop guard added for CVE-2026-42310 does not cover ei…
Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)
影響: pip:pillow >= 8.2.0, < 13.0.0 → 13.0.0 Summary Pillow's libImaging _decodeTile decoder, used to decode tiled TIFF images, allocates a per-tile buffer using realloc(state->buffer, TIFFTileSize(tiff)). After each TIFFReadTile it then iterates tile_y from 0 up to current_tile_length and calls the configured row unpacker (here copy4) with the source pointer state->buffer + tile_y row_byte_size. When libtiff returns a tile_bytes_size smaller than the worst-case row_byte_size tile_length, the inner stride-and-copy loop walks past the real…
Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
影響: pip:Pillow >= 8.1.0, < 13.0.0 → 13.0.0 ============================================================================ OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels Location: src/libImaging/TiffDecode.c:483 in _decodeTile() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ Pillow reads past the end of a heap buffer when decoding certain malformed compressed TIFF files, and copies the bytes it reads into the pixels of the image it re…
Pillow: Heap buffer overflow in ImagingJpegDecode
影響: pip:Pillow <= 12.3.0 → 13.0.0 Summary JpegImageFile.draft() — which Image.thumbnail() calls automatically — requests 1/2, 1/4 or 1/8 scaled JPEG output and shrinks self._size and the tile extents to match, so _setimage() allocates a single-row decode buffer of ceil(W/s) samples. ImagingJpegDecode() sets cinfo.scale_num/scale_denom, calls jpeg_start_decompress(), and then reads scanlines into that buffer without ever comparing cinfo.output_width, cinfo.output_height or cinfo.out_color_components against state->xsize, state->…
@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)
影響: npm:@angular/common >= 21.0.0, < 21.0.3 → 21.0.3, npm:@angular/common >= 20.0.0, < 20.3.34 → 20.3.34, npm:@angular/common <= 19.2.25 An incomplete fix for [GHSA-58c5-g7wp-6w37](https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37) (CVE-2025-66035) in @angular/common's HTTP Client (HttpClient) allows Cross-Site Request Forgery (XSRF) tokens to be leaked to attacker-controlled cross-origin domains when requests use URLs that exploit parsing discrepancies between regular expressions and the browser's WHATWG URL parser. Technical Description To address CVE-2025-66035, xsrfInterceptorFn introduced a regular…
Upcoming Critical PHP Security Release
The PHP security team would like to give advance notice of an . upcoming security release It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC. It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available. We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild. Full details, affected versions, and the fixed versions will be published with the release. Thank you for helping us keep…
markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)
影響: npm:markdown-it >= 14.1.0, < 14.3.3 → 14.3.3, npm:markdown-it >= 15.0.0, < 15.0.3 → 15.0.3 Summary A link reference definition whose label or title is never closed is O(n²) in markdown-it 15.0.2 with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. It is a regression introduced by PR #1004 in 14.0.0: 13.0.2 processed a 313 KB input in 125 ms, while every…
FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024
The FBI and cyber agencies in the UK and Germany said SafePay is targeting businesses and critical infrastructure by guessing passwords, exploiting vulnerabilities and using phishing attacks.
MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another
影響: npm:@modelcontextprotocol/server >= 2.0.0, < 2.3.0 → 2.3.0 Summary In affected versions, an MCP server reached over HTTP could deliver one client's responses and notifications to another client. This happened when clients shared one stateless transport, or one McpServer or Server instance. Messages were matched to a connection by JSON-RPC id alone. SDK clients number requests from 0, so ids collide in normal use. Am I affected? Yes, if more than one client can reach your HTTP endpoint and your code creates the transport or the server once at startup, i…
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
影響: npm:@modelcontextprotocol/sdk >= 1.3.0, < 1.32.0 → 1.32.0, npm:@modelcontextprotocol/server >= 2.0.0, < 2.3.0 → 2.3.0 Summary In affected versions, servers put no limit on how many array elements and object keys they validated in one request. One HTTP request within the default 4 MiB size limit could exhaust the server's memory, and the process aborted with JavaScript heap out of memory. No credentials are needed, unless you authenticate requests before they reach the SDK. Am I affected? Yes, if clients you do not fully trust can reach your server over HTTP. The risk is highest for McpServer tools whose input…
AIOHTTP: Absolute-form request targets can spoof Request.scheme
影響: pip:aiohttp <= 3.14.3 → 3.14.4 Summary An attacker sending an absolute-form request can spoof the scheme used. Impact If user code depends on the Request.scheme attribute for anything security related, an attacker may be able to circumvent this logic, tricking the application into thinking a connection is encrypted when it is not, or vice versa. Workaround A WAF rule to reject absolute-form requests (legitimate requests should only use this form for proxies).
AIOHTTP: Connector pool exhaustion via Max-Age overflow
影響: pip:aiohttp <= 3.14.3 → 3.14.4 Summary An overflow in Max-Age processing can skip closing a connection. Impact An attacker may be able to exhaust the connection pool temporarily, until garbage collection resolves the connections.
AIOHTTP: Pure-Python parser request smuggling
影響: pip:aiohttp <= 3.14.3 → 3.14.4 Summary The pure Python parser is vulnerable to an HTTP request smuggling attack. Impact If users are using the Python parser (AIOHTTP_NO_EXTENSIONS, or not a standard wheel installed), then an application may be vulnerable to a request smuggling attack. Workaround Switch to the default C parser.
AIOHTTP: File descriptor exhaustion in multipart requests
影響: pip:aiohttp >= 2.0.0, < 3.14.4 → 3.14.4 Summary An attacker can exhaust file descriptors with specially crafted multipart requests. Impact If a handler uses Request.post(), it may be possible for an attacker to use an unlimited number of file descriptors, potentially resulting in resource exhaustion.
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
影響: npm:launch-editor <= 2.14.1 → 2.14.2, npm:vite >= 8.3.0, <= 8.3.2 → 8.3.3, npm:vite >= 8.2.0, <= 8.2.3 → 8.2.4, npm:vite >= 8.0.0, <= 8.1.5 → 8.1.6, npm:vite >= 7.0.0, <= 7.3.6 → 7.3.7, npm:vite <= 6.4.3 → 6.4.4, npm:vite-plus <= 1.0.0 → 1.1.0 Summary launch-editor forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution. Impact Direct launch-editor users Only apps that match all of the following conditions are affected: - The attacker is able to create a file system entry (e.g. a file or directory) starting with + or - in the working directory - The user uses or the app specifies a…
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
影響: npm:launch-editor <= 2.14.1 → 2.14.2, npm:vite >= 8.3.0, <= 8.3.2 → 8.3.3, npm:vite >= 8.2.0, <= 8.2.3 → 8.2.4, npm:vite >= 8.0.0, <= 8.1.5 → 8.1.6, npm:vite >= 7.0.0, <= 7.3.6 → 7.3.7, npm:vite <= 6.4.3 → 6.4.4, npm:vite-plus <= 1.0.0 → 1.1.0 Summary launch-editor checked fs.existsSync(fileName) before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in \\..:line:column. This removes the requirement that the attacker be able to place a file with a malicious filename. Combined with the % escaping issue described in [GHSA-698v-4r3x-3vcv](https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv), this bypass can lead to OS command injection whe…
MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service
影響: npm:@modelcontextprotocol/sdk >= 1.6.0, < 1.32.0 → 1.32.0, npm:@modelcontextprotocol/server >= 2.0.0, < 2.3.0 → 2.3.0, npm:@modelcontextprotocol/express >= 2.0.0, < 2.0.2 → 2.0.2, npm:@modelcontextprotocol/server-legacy >= 2.0.0, < 2.3.1 → 2.3.1 Summary In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server (its audience). Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server. Am I affected? Yes, if your HTTP server uses requireBearerAuth() or verifyBearerToken(), its authorization server also issues tokens for other services, and your verifyAccessToken() does not check the token's a…
uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
影響: pip:uv < 0.13.4 → 0.13.4 By default, uv verifies TLS connections against a vendored copy of the webpki-root-certs bundle. Versions before 0.13.4 include the emSign ECC Root CA - G3 root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them. An attacker with one of the compromised keys can issue certificates that uv accepts for any hostname, and can be used to issue certificates to enable MITM attacks. uv 0.13.4 removes the root from its vendored b…
certifi bundles emSign root CAs with compromised intermediate CA keys
影響: pip:certifi >= 2019.03.09, < 2026.10.19 → 2026.10.19 Certifi versions before 2026.10.18 include the emSign ECC Root CA - G3 root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them. An attacker with one of the compromised keys can issue valid-looking certificates for any hostname. If the attacker is also on-path, they can intercept or modify TLS traffic from clients that trust the certifi bundle. Examples include requests, urllib3 and p…
launch-editor: escapeCmdArgs() omits % escaping on Windows
影響: npm:launch-editor <= 2.14.1 → 2.14.2, npm:vite >= 8.3.0, <= 8.3.2 → 8.3.3, npm:vite >= 8.2.0, <= 8.2.3 → 8.2.4, npm:vite >= 8.0.0, <= 8.1.5 → 8.1.6, npm:vite >= 7.0.0, <= 7.3.6 → 7.3.7, npm:vite <= 6.4.3 → 6.4.4, npm:vite-plus <= 1.0.0 → 1.1.0 Summary launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. Impact Only apps that match all of the following conditions are affected: - The user uses Windows - An attacker can place a file with the malicious filename containing & or % - Either of - An attacker can inject an environment variable with a malicious value - An attacker can add a NTFS alternate data strea…
MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
影響: npm:@modelcontextprotocol/sdk >= 1.24.0, < 1.32.0 → 1.32.0 Summary In affected versions, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. Experimental tasks are deprecated. The 2026-07-28 specification replaced them with a redesigned extension. The best course of action is to stop using them. Am I affected? Only if your HTTP server passes taskStore to McpServer or Server. If grep -ri taskstore --exclude-dir=node_modules . finds no…
MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
影響: npm:@modelcontextprotocol/sdk < 1.32.0 → 1.32.0, npm:@modelcontextprotocol/client >= 2.0.0, < 2.3.0 → 2.3.0 Summary In affected versions, the SDK's HTTP client transports and OAuth requests followed redirects to any origin. If an MCP server or authorization server redirected a request to another origin, that origin received custom request headers (such as an X-API-Key set in requestInit.headers) and the mcp-session-id header. On a 307 or 308 it also received the request body, including OAuth token requests with their refresh_token and client_secret. On current runtimes fetch already drops the Authori…
ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)
影響: npm:apostrophe < 4.33.0 → 4.33.0 Impact Even though it is correctly applied to guests, contributors, etc., viewRole is not applied to the general public. This means that a secured content type like @apostrophecms/user can in theory be accessed. This is greatly mitigated by the fact that there is no automatic public REST API for any content type. One has to expressly allow it. However, it does mean that developers can make the mistake of setting up a relationship between a content type like a blog post, and @apostrophecms/user.…
ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
影響: npm:@apostrophecms/import-export < 3.7.0 → 3.7.0 Summary The tar-extraction guard added to @apostrophecms/import-export for GHSA-mwxc-m426-3f78 is a literal substring test for ../, and ./.. does not contain that substring. An entry named ./.. therefore passes the guard, path.join normalizes it to the parent of the export directory, and the resulting fs.WriteStream opens a directory and emits EISDIR with no error listener attached, which terminates the Node process. Confirmed on default-branch HEAD 1bd5d0a7a6fe880836fa75adad6964f1c577d640, pac…
ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
影響: npm:uploadfs >= 1.25.0, < 1.28.0 → 1.28.0 Summary When uploadfs is configured with the Azure backend and sas: true (a supported configuration introduced in uploadfs 1.25.0), createContainer() builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. As a result, getUrl() returns a base URL carrying the complete account/container SAS signature (?sv=...&sig=...), and Apostrophe's attachment.url() prepends it to every public attachment link — broadcasting a…
ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers
影響: npm:apostrophe < 4.33.0 → 4.33.0 Summary ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria. The issue was reproduced against a real local ApostropheCMS application running the reviewed source code. The test used a synthetic guest account and synthetic restricted draft records. Det…
ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document
影響: npm:@apostrophecms/import-export < 3.7.0 → 3.7.0 Summary @apostrophecms/import-export's update-by-key feature lets an imported document carry a :key property (for example slug:key) whose value is used to find an existing document to update instead of inserting a new one. getUpdateKey()/insertOrUpdateDocWithKey() (lib/methods/import.js) use that value directly as a MongoDB query value with no laundering: js const matchingDraftPromise = manager.findForEditing( req.clone({ mode: 'draft' }), { aposMode: 'draft', [updateField]: doc[updateKey] }).t…
ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users
影響: npm:apostrophe < 4.33.0 → 4.33.0 Summary The client-side helper apos.http.parseQuery() in ApostropheCMS builds a nested object from a URL query string without sanitizing the keys __proto__, constructor, or prototype. Parsing an attacker-controlled query string therefore writes arbitrary properties onto Object.prototype (client-side prototype pollution). ApostropheCMS's admin UI calls this parser with window.location.search on every authenticated page load (the admin context bar's data() initializer). Because the admin UI is bu…
ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing
影響: npm:apostrophe < 4.33.0 → 4.33.0 Summary The self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving a lockout or throttle response. Exact source path packages/apostrophe/modules/@apostrophecms/settings/index.js:621-664 The password-change route is: PATCH /api/v1/@apostrophecms/settings/password The ro…
ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs
影響: npm:sanitize-html < 2.18.0 → 2.18.0 Summary CVE-2026-53606 expanded allowedSchemesAppliedToAttributes so named URL attributes (action, formaction, data, poster, background, later ping, xlink:href, …) go through naughtyHref(). A URL nested inside meta content (http-equiv=refresh) is not an attribute name on that list, so the embedded destination is never scheme-checked. Default allowedTags still omit meta. Same non-default integrator config as 53606: allow meta plus http-equiv / content. On 2.17.7: text sanitizeHtml( ' ', { allowe…
ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)
影響: npm:apostrophe < 4.33.0 → 4.33.0 Summary The REST route GET /api/v1/ /:_id/locales (and the equivalent page route) does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this route for any document _id and learn whether the document exists and which locales it is published in — a document-existence and locale-metadata disclosure that the read-API is otherwise supposed to gate. Affected - Repository: apostrophecms/apostrophe (monorepo package apo…
ApostropheCMS: Page REST API authorization bypass
影響: npm:apostrophe < 4.33.0 → 4.33.0 Summary The core page REST API reads full page documents with .permission(false) in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated visitors and low-privilege contributors can read admin-only and non-public page content by _id/slug. Details packages/apostrophe/modules/@apostrophecms/page/index.js: - getOne (L456–465): await self.publicApiCheckAsync(req); ... self.getRestQuery(req).permission(false).and(c…
ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF
影響: npm:@apostrophecms/ai-helper >= 1.0.0-beta.10, < 1.0.0-beta.13 → 1.0.0-beta.13 Summary The @apostrophecms/ai-helper package builds the URL for a server-side image fetch by resolving a storage-relative path against req.baseUrl. When the site does not set a global base URL (the default), req.baseUrl is derived from the incoming HTTP Host header. An authenticated editor can generate a base64 AI image (which is persisted without a stored url) and then send an unauthorized PATCH accept request with an attacker-chosen Host header. The server then issues an outbound GET to the a…
ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
影響: npm:apostrophe < 4.33.0 → 4.33.0 Summary A rejected upload can remain in the operating system temporary directory. Multer writes the file before its extension is checked, and the rejection path does not remove that temporary file. An unauthenticated requester can repeat this with large files and steadily consume temporary disk space. Details The endpoint is: text POST /api/v1/@apostrophecms/rich-text-widget/generate-csv-table In packages/apostrophe/modules/@apostrophecms/rich-text-widget/lib/apiRoutes.js, Multer first writes t…
ApostropheCMS: Cross-domain session token in URL confers session takeover
影響: npm:apostrophe < 4.33.0 → 4.33.0, npm:@apostrophecms/passport-bridge < 1.6.1 → 1.6.1 Summary Apostrophe's cross-domain session migration emits a single-use session token as a URL query parameter and stores it in the Mongo cache. Any client that presents the token silently adopts the target user's full session (including passport.user) with no credentials. Details packages/apostrophe/modules/@apostrophecms/i18n/index.js: - Token generation on cross-host/locale flows (L479–487) and passport-bridge cross-locale redirect (passport-bridge/index.js L557–593) places the token in the U…
ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS
影響: npm:@apostrophecms/form < 1.5.5 → 1.5.5 Summary The form submission endpoint runs multer({ dest: os.tmpdir() }).any() before authentication, API-key, CSRF-equivalent, or form-existence logic, with no size/count/rate limits. Unauthenticated users can stream unbounded bodies to disk per request; cleanup occurs only after the full body is received. Details packages/form/index.js apiRoutes.post.submit (L274–296): [ multer({ dest: os.tmpdir() }).any(), self.normalizeFiles, async function (req) { try { submitForm } finally { unlink files }…
ApostropheCMS: CAPTCHA response token not URL-encoded
影響: npm:@apostrophecms/form < 1.5.5 → 1.5.5, npm:@apostrophecms/login-recaptcha < 1.2.1 → 1.2.1, npm:@apostrophecms/login-hcaptcha < 1.3.0 → 1.3.0 Summary Form and login CAPTCHA verification interpolate the user-supplied widget token unencoded into the server-side verification URL/body, allowing a crafted token to inject query parameters into the reCAPTCHA/hCaptcha verify request. Details - packages/form/lib/recaptcha.js:39 — recaptchaUri = 'https://www.google.com/recaptcha/api/siteverify?secret=${recaptchaSecret}&response=${input.recaptcha}' - packages/login-recaptcha/index.js:44 — same pattern for login - packages/login-hcaptcha/index.j…
ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization
影響: npm:apostrophe < 4.33.0 → 4.33.0 Summary ApostropheCMS enforces per-type authorization on pages: a page type may declare editRole / publishRole (the core @apostrophecms/archive-page does), so a project can define restricted subtrees that only higher-privileged roles may create or edit within. The move() operation in the @apostrophecms/page module is supposed to enforce that a page may only be moved into a parent the actor has create rights over, the same boundary the page-insert route enforces. The destination-parent authoriza…
ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
影響: npm:@apostrophecms/db-connect < 1.1.0 → 1.1.0, npm:apostrophe < 4.33.0 → 4.33.0 Summary @apostrophecms/db-connect ships an in-memory MongoDB emulation used by its SQLite, PostgreSQL, and multipostgres adapters. Its unsetNestedField helper walks an attacker-controlled dotted field path with no segment validation and calls delete on the resolved property. A low-privileged authenticated user (any role holding view-draft, which every editor and contributor has; reduced to any logged-in user when guestApiAccess is enabled) can send a piece-type REST GET request whose project qu…
ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render
影響: npm:sanitize-html < 2.18.0 → 2.18.0 Summary sanitize-html discards the content of every element in nonTextTags. It delimits that region using htmlparser2's close events, and ignores the isImplied flag htmlparser2 passes it. Closing a still-open ancestor from inside a makes htmlparser2 unwind its stack past the noscript; the synthetic implied close it emits on the way ends the discard region early, and everything after it is treated as ordinary body content. A browser with scripting enabled parses content as raw text, so the same…
follow-redirects array-form headers bypass cross-origin credential stripping
影響: npm:follow-redirects >= 1.16.0, < 1.16.1 → 1.16.1 Summary follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying http.request, which follow-redirects…
follow-redirects sensitiveHeaders regex escaping can expose credential headers
影響: npm:follow-redirects >= 1.16.0, < 1.16.1 → 1.16.1 Summary follow-redirects 1.16.0 introduced the sensitiveHeaders option (the fix for CVE-2026-40895 / GHSA-r4q5-vmmm-2653), which lets an application declare extra header names that must be removed when a redirect crosses to a different host or downgrades protocol. The filter is a single case-insensitive regular expression built by concatenating the declared header names into an alternation after passing each through escapeRegex. escapeRegex escapes only a partial set of metacharacters and leave…