From GitHub Advisory Database
Sat, October 24Yesterday
filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name
影響: pip:filelock >= 4.1.0, <= 4.2.0 → 4.2.1 ReadWriteLock and AsyncReadWriteLock (the SQLite-backed reader/writer lock) remove their private .filelock- link directories with shutil.rmtree (a recursive delete) on a remembered path. They do not check that the path still names the directory they created. This happens on the hard-link route (a hard link is a second name for the same file). That route is every connection on macOS since 4.1.1 and any POSIX process without a usable /proc/self/fd (a Linux path that names the process's own open f…
virtualenv: Temporary app-data can leave dangling seed package links
影響: pip:virtualenv >= 21.14.8, < 21.14.10 → 21.14.10 The app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlink_app_data can enable this state even though the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its owner no longer controls. Anthropic's OSS Scanner reported this as ANT-2026-ZOE2GEPC in virtualenv-20261015-005, received on 15 October 2026. T…
virtualenv: Xonsh activation literals depend on the script decoding codec
影響: pip:virtualenv < 21.14.9 → 21.14.9 Caller-supplied prompt text can become executable syntax in the xonsh activation script. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment. Affected area Xonsh reads a UTF-8 activation script using a legacy multibyte encoding such as GBK. Printable non-ASCII bytes can change how the reader recognizes an adjacent quote. The report concerns POSIX activation. It does not establish exposure through unrelated activators. Attacker-control…
virtualenv: Seeded files retain permissions from an older cache
影響: pip:virtualenv < 21.14.9 → 21.14.9 The app-data copy seeder uses shutil.copy, which preserves cached file modes independently of the current umask. A cache populated under permissive permissions can therefore produce files with wider access in later environments. Anthropic's OSS Scanner reported this as ANT-2026-487MH6OW in virtualenv-20261015-005, received on 15 October 2026. Affected area Permissions of files copied from app-data into a new environment. Attacker-controlled input The cache must contain files created with broade…
virtualenv: Bash prompt values can change meaning under older compatibility modes
影響: pip:virtualenv < 21.14.9 → 21.14.9 Caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. Affected area Bash runs with compatibility level 4.2 and draws the environment prompt. Its replacement-string behavior differs from newer compatibility modes, leaving prompt text subject to a second interpretation. The report concerns POSIX activation. It does not establish ex…
virtualenv: Seed replacement does not contain metadata deletion paths
影響: pip:virtualenv < 21.14.9 → 21.14.9 The app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths without checking containment within the environment. Anthropic's OSS Scanner reported this as ANT-2026-SXOEHWP7 in virtualenv-20261015-005, received on 15 October 2026. Affected area Removal of a previously installed seed package. Attacker-controlled input An environment being reused must contain distribution metadata influenced by another account. The invoking user must have del…
MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint
影響: npm:@azure/msal-node >= 5.0.0-beta.0, < 7.1.0 → 7.1.0 Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow. Patches Version 7.1.0 and higher are patched. Workarounds Ensure you pass in only the auth_code to to acquireTokenByCode
undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
影響: npm:undici >= 6.23.0, < 6.29.1 → 6.29.1, npm:undici >= 7.18.0, < 7.30.1 → 7.30.1, npm:undici >= 8.0.0, < 8.12.2 → 8.12.2 undici's fetch() crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses (a content-encoding limit), but it created the internal response stream before that check and returned without attaching an error listener or aborting the request. The early close then surfaces a content-length mismatch on that orphaned internal stream, which Node.js treats as an unhandled err…
undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
影響: npm:undici >= 6.5.0, < 6.29.1 → 6.29.1, npm:undici >= 7.0.0, < 7.30.1 → 7.30.1, npm:undici >= 8.0.0, < 8.12.2 → 8.12.2 undici's EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data: fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing amount of per-field and per-chunk state. The byte-based maxEventSize and maxResponseSize limits do not bound that retained state, and maxResponseSize is enforced on the compressed body before decompression, so a…
undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
影響: npm:undici >= 7.15.0, < 7.30.1 → 7.30.1, npm:undici >= 8.0.0, < 8.12.2 → 8.12.2 undici's fetch() verifies Subresource Integrity (SRI) metadata by looking up the algorithm token in a lowercase-only set, but the SRI specification defines a valid token by its ASCII-lowercase form. A correct but non-lowercase token such as SHA256-... or Sha256-... is therefore treated as unknown and skipped. When no recognized algorithm remains, undici treats the integrity list as empty and accepts the response, so a server that returns a body different from the pinned digest passes the check.…
multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
影響: npm:multer >= 2.0.0, < 2.5.0 → 2.5.0 When multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If a request is aborted (for example when one file is rejected) while another file's async fileFilter is still pending, the pending callback later resumes a parsing stream that multer has already torn down. busboy then emits an error on a stream that no longer has an error listener, which Node raises as an unhandled 'error' event, and the process exits. A single unauthenticated request is…
MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
影響: pip:mlflow >= 3.12.0rc0, < 3.17.0 → 3.17.0 MLflow's tracking server exposes POST /ajax-api/3.0/mlflow/scorer/invoke with no authentication, and the handler reflectively instantiates an attacker-named class from attacker-supplied JSON with unconstrained constructor kwargs. With the optional trulens + trulens-providers-litellm packages installed, an unauthenticated attacker can force the server to make an outbound HTTP request to an arbitrary host of their choosing, carrying attacker-controlled headers (SSRF). Details Scorer.model_validat…
LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores
影響: pip:langgraph-checkpoint-postgres < 3.1.3 → 3.1.3, pip:langgraph-checkpoint-sqlite < 3.1.2 → 3.1.2 The Postgres and SQLite stores save a namespace as its labels joined with ., so ("tenant", "bob") and ("tenant.bob",) map to the same stored namespace. put rejected labels containing ., but get, search, delete, list_namespaces, their async versions, and ops passed directly to batch/abatch did not. A caller that could pass such a label could read, overwrite or delete items in another namespace. Details BaseStore checked namespace labels only in put/aput. The other methods passed the namespace on…
Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
影響: npm:happy-dom >= 17.0.0, <= 21.0.3 → 21.0.4 The ESM compiler in happy-dom@20.14.5 does not validate imported local binding aliases before interpolating them into generated JavaScript. As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed. This appears to be an alternate injection path and incomplete remediation of GHSA-6q6h-j7hj-3r64 / CVE-2026-33943. The previous fix validates importName in the local export { ... } handler, but the named import handler still pl…
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
影響: rust:wasmtime >= 46.0.0, < 48.0.7 → 48.0.7, rust:wasmtime >= 49.0.0, < 49.0.4 → 49.0.4 Wasmtime may panic when the host lowers a component model stream or future into a guest, if the host created that stream or future with one payload type and the guest expects a different one. This can happen when an embedder creates a stream or future, passes it through a guest, receives it back under a type-erased type such as StreamAny or FutureAny, and then passes it to a guest function with a different payload type. GHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this ar…
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
影響: rust:wasmtime < 36.0.19 → 36.0.19, rust:wasmtime >= 37.0.0, < 43.0.0 → 43.0.0 In Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox. Cranelift was changed in Wasmtime v43 to use a full u32 index, with checks…
filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse
影響: pip:filelock >= 4.1.0, <= 4.2.0 → 4.2.1 SoftFileLock and MarkerSoftFileLock evict an unparsable marker (the lock file at , whose presence says a process holds the lock) once a waiting contender has watched it unchanged for two seconds. SoftFileLease expires a lease the same way. The watch tells two looks apart by the marker's modification time (mtime) and inode number (the kernel's identity for a file, independent of its name) alone. Another local user (the other user below) who can create files in the lock's directory, a sticky /tmp…
filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory
影響: pip:filelock >= 4.1.0, <= 4.2.0 → 4.2.1 When a soft-lock stale break finds that the marker (the lock file at ) it renamed aside was a live one recreated by a successor, the restore branch of break_lock_file() checks the break name with lstat (a check that reads a name without following a symbolic link) and then calls os.link(break_path, lock_file) by name. On CPython 3.12 and later on Linux (and on macOS) that call follows a symbolic link (a file that redirects to another path). A local user (the other user below) who can write a sha…
filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files
影響: pip:filelock >= 3.20.4, <= 4.2.0 → 4.2.1 ReadWriteLock and AsyncReadWriteLock (the SQLite-backed reader/writer lock) hand SQLite a name they do not control. On Linux the lock validates its database through a descriptor (the number the kernel gives a process for an open file). It then connects SQLite to /proc/self/fd/ , a Linux path that names the process's own open file n. SQLite turns that path back into a plain path and reopens it by name, following symlinks (a symlink is a file that points at another path). On every POSIX route SQL…
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
影響: pip:pillow <= 12.3.0 → 13.0.0 Credits Researcher: Alex Bouffard (mixbo@pebwalker.com) Summary A heap buffer overflow in Pillow's FlashPix (FPX) JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with Image.open(). The file is recognized by content (the OLE2 magic), not by extension, so any service that opens or thumbnails untrusted uploads with the optional olefile dependency installed is reachable with no user interaction. In the PoC below, opening on…
postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words
影響: npm:postal-mime >= 3.0.0, < 4.0.8 → 4.0.8 Decoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as =?utf-8?B?QUJD?= repeated tens of thousands of times in a Subject, From, To, a filename or a description, took time quadratic in the number of words. The join check ran a regex over the text joined so far for every word, which flattens the accumulated string each time. A single well formed message of about 1.6 MB blocked the event loop for one to twenty seconds depending on the host, and inline message/rf…
Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1
影響: pip:Pillow >= 11.2.1, < 13.0.0 → 13.0.0 When [PILLOW_ALIGNMENT](https://pillow.readthedocs.io/en/stable/reference/block_allocator.html#memory-pools) is set above 1, exporting an image to Arrow returns uninitialized heap memory mixed in with the pixel data. That memory can include pixels from images the process freed earlier. Details With an alignment above 1, the default allocator pads each row up to aligned_linesize and starts the first row at an aligned offset into the block. It then exports im->blocks[0].ptr as xsize ysize tightly…
Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient
影響: npm:nodemailer >= 3.0.0, < 10.1.4 → 10.1.4 Vulnerability summary RFC 5322 comments nest. addressparser ended a comment at the first ), including the one that closes a nested comment, and parsed the rest of the outer comment as header text. Victim (x(y) ) names v@victim.com with x(y) as a comment, and Nodemailer read it as the address evil@evil.com. This is the same shape as the escaped parenthesis fixed in 10.1.2, reached through nesting instead of a quoted-pair. Affected: 3.0.0 through 10.1.3. Attacker capabilities The attacker control…
Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient
影響: npm:nodemailer >= 3.0.0, < 10.1.4 → 10.1.4 Vulnerability summary addressparser ends an RFC 5322 group at the first ;, including one inside a quoted display name or a comment. The text after it is parsed again as top level recipients with the quoting flipped, so text that every conformant parser reads as a display name or comment becomes a live address. G: (a; ) ; names only v@victim.com, and Nodemailer read it as the single recipient evil@evil.com. Affected: 3.0.0 through 10.1.3. Attacker capabilities The attacker controls the text of a…
Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name
影響: npm:nodemailer >= 3.0.0, < 10.1.4 → 10.1.4 Vulnerability summary addressparser ends an angle-addr at the first > it sees, including one inside a quoted local part, a comment or a domain literal. The domain is then read off the text in front of that >. "@good.com> is the mailbox "a@evil.com>"@good.com under RFC 5322, and Nodemailer read it as an address at evil.com. The unbracketed spelling of the same value was already read correctly. Affected: 3.0.0 through 10.1.3. Attacker capabilities The attacker controls the text of a recipient or…
Laravel TokenGuard authentication bypass through non-string API credentials
影響: composer:laravel/framework >= 13.0.0, < 13.29.0 → 13.29.0, composer:laravel/framework < 12.68.0 → 12.68.0 Laravel's built-in TokenGuard, when configured with a standard token-based API guard, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. Under certain database configurations (MySQL/MariaDB) an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected. Impact An unauth…
Laravel relationship inclusion can trigger unauthorized data destruction
影響: composer:laravel/framework >= 12.45.0, < 12.68.0 → 12.68.0, composer:laravel/framework >= 13.0.0, < 13.27.0 → 13.27.0 A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data. Impact A user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applicati…
fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
影響: npm:fast-uri < 2.4.8 → 2.4.8, npm:fast-uri >= 3.0.0, < 3.1.9 → 3.1.9, npm:fast-uri >= 4.0.0, < 4.2.3 → 4.2.3 fast-uri percent-decodes the scheme component with the legacy global unescape() before validating it, so an input whose decoded scheme is a valid but dangerous token is emitted as a live scheme. RFC 3986 section 3.1 does not allow percent-encoding in a scheme, so no RFC or WHATWG parser treats such input as having that scheme, but fast-uri does. For example, normalize('%6Aavascript:alert(1)') returns javascript:alert(1), resolve('https://a.example/', '%6Aavascript:alert(1)') returns javascript:…
fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
影響: npm:fast-uri >= 2.4.2, < 2.4.8 → 2.4.8, npm:fast-uri >= 3.1.3, < 3.1.9 → 3.1.9, npm:fast-uri >= 4.0.1, < 4.2.3 → 4.2.3 fast-uri versions >= 2.4.2, = 3.1.3, = 4.0.1, <= 4.2.2 can silently rewrite the host of an HTTP-family URL (http, https, ws, wss, or any scheme with domainHost: true). For those schemes canonicalizeHost() passes the parsed host to the WHATWG URL parser and adopts its .hostname without checking that the parser read the whole input as a host. RFC 3986 permits @ inside the host group and the WHATWG parser strips TAB, LF, and CR, so the authority fast-uri reports is rewritten by that second parser…
FastMCP: Post-transform component authorization is skipped on direct calls
影響: pip:fastmcp >= 3.0.0, < 3.4.10 → 3.4.10, pip:fastmcp >= 4.0.0, < 4.1.2 → 4.1.2, pip:fastmcp-slim >= 3.0.0, < 3.4.10 → 3.4.10, pip:fastmcp-slim >= 4.0.0, < 4.1.2 → 4.1.2 Maintainer assessment and remediation This report is accepted as a FastMCP authorization vulnerability. In supported configurations, a server transform can change the metadata used by a component's authorization policy. Direct lookups previously checked the original component but returned the transformed component without rechecking its policy. A client that knows the component identifier can invoke a tool or retrieve a resource or prompt that the configured policy denies. The fixes authorize t…
FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server
影響: pip:fastmcp >= 4.0.0a1, < 4.1.2 → 4.1.2, pip:fastmcp-slim >= 4.0.0a1, < 4.1.2 → 4.1.2 Maintainer assessment and remediation This report is accepted as a FastMCP credential-binding vulnerability. Affected versions of the OAuth client credentials providers do not expose the authorization-server issuer that owns pre-registered credentials. An untrusted or compromised MCP server can therefore advertise a different authorization server and receive the client secret or a signed assertion. Signing keys themselves remain local; assertion replayability depends on the assertion source and…
vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)
影響: pip:vllm >= 0.7.3, < 0.31.0 → 0.31.0 API clients can supply arbitrary mm_processor_kwargs per request. vLLM forwards these values through the multimodal rendering and processing pipeline to Hugging Face and custom image/video processor constructors and calls. Resource-sensitive values such as image size, patch size, patch count, crop count, or frame count can therefore be controlled by a remote client. For processors that upscale inputs, a single request can force an allocation large enough to terminate the API server or worker wi…
chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For
影響: go:github.com/go-chi/chi/v5 <= 5.3.2 → 5.4.0 ClientIPFromXFF skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP. The attack is remote and requires one unauthenticated HTTP request with no user interaction (AV:N/AC:L/PR:N/UI:N). It changes security decisions and exposes one protect…
odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values
影響: npm:odf-kit >= 0.9.8, < 0.14.2 → 0.14.2 ODF style values are interpolated into style="..." attributes without HTML-escaping in odf-kit's ODS to-HTML renderer (odsToHtml()). A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute injection — and therefore script execution (XSS) — from a crafted .ods file wherever the rendered output is inserted as HTML, which is the documented purpose of the function. Details Two emission sites in src/ods/to-html/html-renderer.t…
pypdf: Possible long runtimes for repeated references to the same missing object
影響: pip:pypdf < 6.21.2 → 6.21.2 An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading relevant parts of a file (like their pages) where the same, but non-existent indirect object is referenced multiple times. Patches This has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2). Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4240](https://github.com/py-pdf/pypdf/pull/4240).
pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)
影響: pip:pypdf < 6.21.2 → 6.21.2 An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams. Patches This has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2). Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4240](https://github.com/py-pdf/pypdf/pull/4240). Notes This is a follow-up to https://github.com/py-pdf/pypdf/security/advisories/GHSA-55h5-xmcq-…
pypdf: Possible long runtimes for large xref table header limits
影響: pip:pypdf < 6.21.2 → 6.21.2 An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires opening a file with large/wrong upper limits in the xref table. Patches This has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2). Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4239](https://github.com/py-pdf/pypdf/pull/4239).
Tokio: Race condition in `tokio::time::Interval`
影響: rust:tokio = 1.54.0 → 1.54.1 On the multi-threaded runtime, there is a race condition between Interval::poll_tick and the runtime's time driver. This affects Interval only. Sleep and Timeout are not affected. Details In Tokio v1.54.0, a race condition between tokio::time::Interval::poll_tick (including .tick().await) and the runtime time driver can drop an internal timer entry without synchronizing with the driver thread that is firing it. This causes a data race and use-after-free on the timer's waker and task state in sa…
Electron: Mitigation for compromised eMudhra intermediate certificates
影響: npm:electron >= 45.0.0-alpha.1, < 45.0.0-beta.6 → 45.0.0-beta.6, npm:electron >= 44.0.0-alpha.1, < 44.9.1 → 44.9.1, npm:electron >= 43.0.0-alpha.1, < 43.8.1 → 43.8.1, npm:electron < 42.11.16 → 42.11.16 A set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS clients. This Electron update adds the same block to both Chromium networking and Node.js tls, https and fetch. On earlier versions, an attacker holding a certificate issued through these intermediates and able to intercept network traffic could impersonate a TLS server to an app. Apps are only affected if they make TLS connections over a network an attacker can intercept. Apps that make…
body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
影響: npm:body-parser >= 2.0.0, < 2.4.0 → 2.4.0, npm:body-parser < 1.20.9 → 1.20.9 A single request can crash any application using body-parser with default options. When a request carries a Content-Encoding (for example gzip), body-parser pipes it into a decompression stream and, after reading the body, leaves that stream piped with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an unca…
gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()
影響: rust:gix >= 0.88.0, <= 0.89.0 → 0.90.0 In the gix crate, Cache::protect_options() in gix/src/config/cache/access.rs reads the three filesystem path-protection settings (core.protectHFS, core.protectNTFS, and gitoxide.core.protectWindows) with the unfiltered gix_config::File::boolean() accessor instead of the trust-aware boolean_filter() accessor used by every other security-critical config read in the same file. When a repository is opened with reduced trust (an ownership mismatch, which maps .git/config sections to Trust::Reduced),…
Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order
影響: composer:livewire/livewire >= 4.3.0, < 4.4.8 → 4.4.8 Three issues allowed actions protected by the #[Authorize] attribute to run against records the current user is not authorized for: 1. Out-of-order parameter keys on actions. #[Authorize] resolved a model parameter by its array key, while the action itself received parameters positionally. A request sending params as an object with reordered integer keys (e.g. {"1": 2, "0": 1}) could pass authorization with a record the user owns while the action received a different record. With #[Authorize('d…
Echo: X-Real-IP extractor trusts the header value instead of the sending peer
影響: go:github.com/labstack/echo/v5 >= 5.0.0, < 5.4.1 → 5.4.1 In Echo v5, ExtractIPFromRealIPHeader checked whether the address supplied in X-Real-IP belonged to a trusted range instead of checking the address of the direct network peer. An untrusted client could therefore supply a loopback or private address and have it returned by c.RealIP() with the extractor's default trust options. Applications using this extractor for IP allowlists, IP-based rate limiting, audit logs or forwarding headers could accept a spoofed client identity. Exploitation requires…
Echo: WebSocket proxy can retain connections and handlers after client disconnect
影響: go:github.com/labstack/echo/v4 >= 4.15.0, < 4.16.1 → 4.16.1, go:github.com/labstack/echo/v5 >= 5.0.0, < 5.4.1 → 5.4.1 Echo's Proxy middleware could retain a handler, copy goroutines and network connections after a WebSocket client disconnected if the upstream kept its connection open. The raw proxy waited for both copy directions to finish without reliably closing the other connection when one direction ended. Rejected upgrade responses with HTTP keep-alive were one way to trigger this behavior. Repeated connections can accumulate resources and cause denial of service. The impact depends on the proxy route's a…
Echo: Decompress permits unbounded gzip expansion in v4
影響: go:github.com/labstack/echo/v4 >= 4.0.0, < 4.16.1 → 4.16.1 Echo v4's opt-in Decompress middleware exposed a gzip-decoded request stream without limiting its expanded size. A small compressed request could therefore produce a very large decoded body. Handlers that read or bind that body could consume excessive memory or CPU, and repeated or concurrent requests could cause denial of service. The middleware is not enabled by default. A limit on the compressed request size alone does not bound the decompressed size. Applications that already apply an effec…
Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
影響: go:github.com/labstack/echo/v4 >= 4.0.0, < 4.16.1 → 4.16.1, go:github.com/labstack/echo/v5 >= 5.0.0, < 5.4.1 → 5.4.1 Echo's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validating whether the configured upstream accepted it. If the upstream returned an ordinary HTTP response and kept the connection alive, subsequent HTTP requests on that connection were forwarded directly to the same upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only at Echo's routes. Exploitation requires an…
Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests
影響: go:github.com/labstack/echo/v5 >= 5.0.0, < 5.4.1 → 5.4.1 Echo v5's BodyDump middleware captured a bounded prefix, drained the remaining request body while ignoring read errors, and then replaced the body with the captured prefix. With an outer BodyLimit, an unknown-length request such as an HTTP/1.1 chunked request, and a BodyDump capture limit below the BodyLimit threshold, an overflow detected during that drain could be discarded. The handler could consequently process a truncated request and return success even though the original body exceeded th…
Echo: BodyDump captures request and response bodies without size limits in v4
影響: go:github.com/labstack/echo/v4 >= 4.0.0, < 4.16.1 → 4.16.1 Echo v4's opt-in BodyDump middleware read complete request bodies into memory and retained complete response bodies without a capture limit. A client able to submit large requests to a route using BodyDump could cause large allocations before the application handler ran. Large responses, including responses whose size can be influenced by a client, also caused an additional unbounded capture allocation. Repeated or concurrent requests can exhaust process memory and cause denial of service. Body…
Strands Agents SDK: Exposure of data element to wrong session in the A2A Server
影響: pip:strands-agents < 1.43.0 → 1.43.0, npm:@strands-agents/sdk < 1.5.0 → 1.5.0 Strands Agents SDK is an open-source SDK, available for Python (strands-agents) and TypeScript (@strands-agents/sdk), for building and running AI agents. An issue exists where, under certain circumstances, the Agent2Agent (A2A) server shares conversation history across callers with different context\_id values, allowing one caller to read and influence another caller's session. Impact The A2A server did not properly isolate conversation state between callers. In multi-tenant deployments, an aut…
virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)
影響: pip:virtualenv >= 21.14.9, < 21.14.13 → 21.14.13 The bash activator puts the caller-supplied prompt value into PS1 unescaped whenever promptvars is off at activation time, and assumes prompt expansion can never run afterwards. promptvars and posix mode are runtime shell state, not a property of the activation moment: re-enabling prompt expansion in the same shell (shopt -s promptvars, set -o posix) or starting an interactive child bash that inherits the exported PS1 makes bash expand the stored value and run the command substitution in it. An…