Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
SAML document is correctly signed. The default CryptoBackendXmlSec1 backend is using the xmlsec1 binary to verify the signature of signed SAML documents, but by default xmlsec1 accepts any type of key found within the given document. xmlsec1 needs to be configured explicitly to only use only _x509 certificates_ for the verification process of the SAML document signature. This is fixed in PySAML2 6.5.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/IdentityPython/pysaml2/security/advisories/GHSA-5p3x-r448-pc62 - https://pypi.org/project/pysaml2 - https://www.aleksey.com/pipermail/xmlsec/2013/009717.html - https://github.com/IdentityPython/pysaml2/release
/pysaml2 - https://www.aleksey.com/pipermail/xmlsec/2013/009717.html - https://github.com/IdentityPython/pysaml2/releases/tag/v6.5.0 - https://github.com/IdentityPython/pysaml2/commit/46578df0695269a16f1c94171f1429873f90ed99 - https://lists.debian.org/debian-lts-announce/2021/02/msg00038.html
CVE ID: CVE-2021-21240 State: PUBLISHED Published: 2021-02-08T19:45:19 Last Updated: 2024-08-03T18:09:14.827Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: httplib2 Products: httplib2 Problem Types: CWE-400 Description: httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of "\xa0" characters in the "www-authenticate" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library. Additional Analyst
sion 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/httplib2/httplib2/security/advisories/GHSA-93xj-8mrv-444m - https://github.com/httplib2/httplib2/pull/182 - https://github.com/httplib2/httplib2/commit/bd9ee252c8f099608019709e22c0d705e98d26bc - https://pypi.org/project/httplib2
CVE ID: CVE-2021-21241 State: PUBLISHED Published: 2021-01-11T20:35:16 Last Updated: 2024-08-03T18:09:15.009Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: Flask-Middleware Products: flask-security-too Problem Types: CWE-352 Description: The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't
points can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-hh7m-rx4f-4vpv - https://github.com/Flask-Middleware/flask-security/pull/422 - https://github.com/Flask-Middleware/flask-securit
f-4vpv - https://github.com/Flask-Middleware/flask-security/pull/422 - https://github.com/Flask-Middleware/flask-security/commit/61d313150b5f620d0b800896c4f2199005e84b1f - https://github.com/Flask-Middleware/flask-security/commit/6d50ee9169acf813257c37b75babe9c28e83542a - https://github.com/Flask-Middleware/flask-security/releases/tag/3.4.5 - https://pypi.org/project/Flask-Security-Too
CVE ID: CVE-2021-21242 State: PUBLISHED Published: 2021-01-15T20:05:27 Last Updated: 2024-08-03T18:09:14.970Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: theonedev Products: onedev Problem Types: CWE-74 Description: OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. AttachmentUploadServlet deserializes untrusted data from the `Attachment-Support` header. This Servlet does not enforce any authentication or authorization checks. This issue may lead to pre-auth remote code execution. This issue was fixed in 4.0.3 by removing AttachmentUploadServlet and
issue may lead to pre-auth remote code execution. This issue was fixed in 4.0.3 by removing AttachmentUploadServlet and not using deserialization Additional Analyst Notes: - CVE Program Container: References: - https://github.com/theonedev/onedev/security/advisories/GHSA-5q3q-f373-2jv8 - https://github.com/theonedev/onedev/commit/f864053176c08f59ef2d97fea192ceca46a4d9be
CVE ID: CVE-2021-21243 State: PUBLISHED Published: 2021-01-15T20:05:21 Last Updated: 2024-08-03T18:09:15.013Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: theonedev Products: onedev Problem Types: CWE-74 Description: OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, a Kubernetes REST endpoint exposes two methods that deserialize untrusted data from the request body. These endpoints do not enforce any authentication or authorization checks. This issue may lead to pre-auth RCE. This issue was fixed in 4.0.3 by not using deserialization at KubernetesResource side. Additional Analyst Notes: - CVE Program Container: References: - https:
sing deserialization at KubernetesResource side. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/theonedev/onedev/security/advisories/GHSA-9mmq-fm8c-q4fv - https://github.com/theonedev/onedev/commit/9637fc8fa461c5777282a0021c3deb1e7a48f137
CVE ID: CVE-2021-21244 State: PUBLISHED Published: 2021-01-15T20:05:13 Last Updated: 2024-08-03T18:09:14.896Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: theonedev Products: onedev Problem Types: CWE-74 Description: OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, There is a vulnerability that enabled pre-auth server side template injection via Bean validation message tampering. Full details in the reference GHSA. This issue was fixed in 4.0.3 by disabling validation interpolation completely. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/theonedev/onedev/security/advisories/GHSA-vm26-xg39-cfj
Notes: - CVE Program Container: References: - https://github.com/theonedev/onedev/security/advisories/GHSA-vm26-xg39-cfj4 - https://github.com/theonedev/onedev/commit/4f5dc6fb9e50f2c41c4929b0d8c5824b2cca3d65
CVE ID: CVE-2021-21245 State: PUBLISHED Published: 2021-01-15T20:10:52 Last Updated: 2024-08-03T18:09:15.339Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: theonedev Products: onedev Problem Types: CWE-434 Description: OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) to a user specified location (`request.getHeader("File-Name")`). This issue may lead to arbitrary file upload which can be used to upload a WebShell to OneDev server. This issue is addressed in 4.0.3 by only allowing uploaded file to be in attachments folder. The webshell issue is not
This issue is addressed in 4.0.3 by only allowing uploaded file to be in attachments folder. The webshell issue is not possible as OneDev never executes files in attachments folder. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/theonedev/onedev/security/advisories/GHSA-62m2-38q5-96w9 - https://github.com/theonedev/onedev/commit/0c060153fb97c0288a1917efdb17cc426934dacb
CVE ID: CVE-2021-21246 State: PUBLISHED Published: 2021-01-15T20:10:46 Last Updated: 2024-08-03T18:09:15.150Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: theonedev Products: onedev Problem Types: CWE-862 Description: OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the REST UserResource endpoint performs a security check to make sure that only administrators can list user details. However for the `/users/{id}` endpoint there are no security checks enforced so it is possible to retrieve arbitrary user details including their Access Tokens! These access tokens can be used to access the API or clone code in the build spec via the HTTP(
ing their Access Tokens! These access tokens can be used to access the API or clone code in the build spec via the HTTP(S) protocol. It has permissions to all projects accessible by the user account. This issue may lead to `Sensitive data leak` and leak the Access Token which can be used to impersonate the administrator or any other users. This issue was addressed in 4.0.3 by removing user info from restful api. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/theonedev/onedev/security/advisories/GHSA-66v7-gg85-f4gx - https://github.com/theonedev/onedev/commit/a4491e5f79dc6cc96eac20972eedc8905ddf6089
CVE ID: CVE-2021-21247 State: PUBLISHED Published: 2021-01-15T20:10:40 Last Updated: 2024-08-03T18:09:14.990Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: theonedev Products: onedev Problem Types: CWE-74 Description: OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the application's BasePage registers an AJAX event listener (`AbstractPostAjaxBehavior`) in all pages other than the login page. This listener decodes and deserializes the `data` query parameter. We can access this listener by submitting a POST request to any page. This issue may lead to `post-auth RCE` This endpoint is subject to authentication and, therefore, require
t to any page. This issue may lead to `post-auth RCE` This endpoint is subject to authentication and, therefore, requires a valid user to carry on the attack. This issue was addressed in 4.0.3 by encrypting serialization payload with secrets only known to server. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/theonedev/onedev/security/advisories/GHSA-6pxf-75cf-vwjp
CVE ID: CVE-2021-21248 State: PUBLISHED Published: 2021-01-15T20:10:30 Last Updated: 2024-08-03T18:09:15.318Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: theonedev Products: onedev Problem Types: CWE-74 Description: OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability involving the build endpoint parameters. InputSpec is used to define parameters of a Build spec. It does so by using dynamically generated Groovy classes. A user able to control job parameters can run arbitrary code on OneDev's server by injecting arbitrary Groovy code. The ultimate result is in the injection of a static constructor th
n OneDev's server by injecting arbitrary Groovy code. The ultimate result is in the injection of a static constructor that will run arbitrary code. For a full example refer to the referenced GHSA. This issue was addressed in 4.0.3 by escaping special characters such as quote from user input. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/theonedev/onedev/security/advisories/GHSA-gwp4-5498-hv5f - https://github.com/theonedev/onedev/commit/39d95ab8122c5d9ed18e69dc024870cae08d2d60
CVE ID: CVE-2021-21249 State: PUBLISHED Published: 2021-01-15T20:10:31 Last Updated: 2024-08-03T18:09:15.155Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: theonedev Products: onedev Problem Types: CWE-74 Description: OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is an issue involving YAML parsing which can lead to post-auth remote code execution. In order to parse and process YAML files, OneDev uses SnakeYaml which by default (when not using `SafeConstructor`) allows the instantiation of arbitrary classes. We can leverage that to run arbitrary code by instantiating classes such as `javax.script.ScriptEngineManager` and u
es. We can leverage that to run arbitrary code by instantiating classes such as `javax.script.ScriptEngineManager` and using `URLClassLoader` to load the script engine provider, resulting in the instantiation of a user controlled class. For a full example refer to the referenced GHSA. This issue was addressed in 4.0.3 by only allowing certain known classes to be deserialized Additional Analyst Notes: - CVE Program Container: References: - https://github.com/theonedev/onedev/security/advisories/GHSA-7xhq-m2q9-6hpm - https://github.com/theonedev/onedev/commit/d6fc4212b1ac1e9bbe3ce444e95f9af1e3ab8b66
CVE ID: CVE-2021-21250 State: PUBLISHED Published: 2021-01-15T20:10:21 Last Updated: 2024-08-03T18:09:15.068Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: theonedev Products: onedev Problem Types: CWE-538 Description: OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which may lead to arbitrary file read. When BuildSpec is provided in XML format, the spec is processed by XmlBuildSpecMigrator.migrate(buildSpecString); which processes the XML document without preventing the expansion of external entities. These entities can be configured to read arbitrary files from the file system and dump their conten
f external entities. These entities can be configured to read arbitrary files from the file system and dump their contents in the final XML document to be migrated. If the files are dumped in properties included in the YAML file, it will be possible for an attacker to read them. If not, it is possible for an attacker to exfiltrate the contents of these files Out Of Band. This issue was addressed in 4.0.3 by ignoring ENTITY instructions in xml file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/theonedev/onedev/security/advisories/GHSA-9pph-8gfc-6w2r - https://github.com/theonedev/onedev/commit/9196fd795e87dab069b4260a3590a0ea886e770f
CVE ID: CVE-2021-21251 State: PUBLISHED Published: 2021-01-15T20:10:14 Last Updated: 2024-08-03T18:09:14.852Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) Vendors: theonedev Products: onedev Problem Types: CWE-22 Description: OneDev is an all-in-one devops platform. In OneDev before version 4.0.3 there is a critical "zip slip" vulnerability. This issue may lead to arbitrary file write. The KubernetesResource REST endpoint untars user controlled data from the request body using TarUtils. TarUtils is a custom library method leveraging Apache Commons Compress. During the untar process, there are no checks in place to prevent an untarred file from traversing the file sy
Compress. During the untar process, there are no checks in place to prevent an untarred file from traversing the file system and overriding an existing file. For a successful exploitation, the attacker requires a valid __JobToken__ which may not be possible to get without using any of the other reported vulnerabilities. But this should be considered a vulnerability in `io.onedev.commons.utils.TarUtils` since it lives in a different artifact and can affect other projects using it. This issue was addressed in 4.0.3 by validating paths in tar archive to only allow them to be in specified folder when extracted. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/t
n specified folder when extracted. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/theonedev/onedev/security/advisories/GHSA-2w6j-wc8c-9mq2
CVE ID: CVE-2021-21252 State: PUBLISHED Published: 2021-01-13T00:00:00 Last Updated: 2024-08-03T18:09:14.663Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: jquery-validation Products: jquery-validation Problem Types: CWE-400 Description: The jQuery Validation Plugin provides drop-in validation for your existing forms. It is published as an npm package "jquery-validation". jquery-validation before version 1.19.3 contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service). This is fixed in 1.19.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jquery-validation/jquery-valid
19.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jquery-validation/jquery-validation/security/advisories/GHSA-jxwx-85vp-gvwm - https://github.com/jquery-validation/jquery-validation/pull/2371 - https://github.com/jquery-validation/jquery-validation/commit/5d8f29eef363d043a8fec4eb86d42cadb5fa5f7d - https://www.npmjs.com/package/jquery-validation - https://security.netapp.com/advisory/ntap-20210219-0005/ - https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
CVE ID: CVE-2021-21253 State: PUBLISHED Published: 2021-01-21T14:20:16 Last Updated: 2024-08-03T18:09:14.853Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: dbijaya Products: OnlineVotingSystem Problem Types: CWE-759 Description: OnlineVotingSystem is an open source project hosted on GitHub. OnlineVotingSystem before version 1.1.2 hashes user passwords without a salt, which is vulnerable to dictionary attacks. Therefore there is a threat of security breach in the voting system. Without a salt, it is much easier for attackers to pre-compute the hash value using dictionary attack techniques such as rainbow tables to crack passwords. This problem is fixed and
the hash value using dictionary attack techniques such as rainbow tables to crack passwords. This problem is fixed and published in version 1.1.2. A long randomly generated salt is added to the password hash function to better protect passwords stored in the voting system. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dbijaya/OnlineVotingSystem/security/advisories/GHSA-wwg8-372v-v332 - https://github.com/dbijaya/OnlineVotingSystem/commit/0181cb0272857696c8eb3e44fcf6cb014ff90f09
CVE ID: CVE-2021-21254 State: PUBLISHED Published: 2021-01-29T21:55:14 Last Updated: 2024-08-03T18:09:14.916Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: ckeditor Products: ckeditor5 Problem Types: CWE-400 Description: CKEditor 5 is an open source rich text editor framework with a modular architecture. The CKEditor 5 Markdown plugin (@ckeditor/ckeditor5-markdown-gfm) before version 25.0.0 has a regex denial of service (ReDoS) vulnerability. The vulnerability allowed to abuse link recognition regular expression, which could cause a significant performance drop resulting in browser tab freeze. It affects all users using CKEditor 5 Markdown plugin at versio
ficant performance drop resulting in browser tab freeze. It affects all users using CKEditor 5 Markdown plugin at version <= 24.0.0. The problem has been recognized and patched. The fix will be available in version 25.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-hgmg-hhc8-g5wr - https://github.com/ckeditor/ckeditor5/releases/tag/v25.0.0 - https://www.npmjs.com/package/%40ckeditor/ckeditor5-markdown-gfm
CVE ID: CVE-2021-21255 State: PUBLISHED Published: 2021-03-02T19:40:20 Last Updated: 2024-08-03T18:09:14.994Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-862 Description: GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI version 9.5.3, it was possible to switch entities with IDOR from a logged in user. This is fixed in version 9.5.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-v3m5-r3mx-ff9j - https://github.com/glpi-projec
erences: - https://github.com/glpi-project/glpi/security/advisories/GHSA-v3m5-r3mx-ff9j - https://github.com/glpi-project/glpi/commit/aade65b7f67d46f23d276a8acb0df70651c3b1dc
CVE ID: CVE-2021-21257 State: PUBLISHED Published: 2021-06-18T20:55:10 Last Updated: 2024-08-03T18:09:15.156Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) Vendors: contiki-ng Products: contiki-ng Problem Types: CWE-787 Description: Contiki-NG is an open-source, cross-platform operating system for internet of things devices. The RPL-Classic and RPL-Lite implementations in the Contiki-NG operating system versions prior to 4.6 do not validate the address pointer in the RPL source routing header This makes it possible for an attacker to cause out-of-bounds writes with packets injected into the network stack. Specifically, the problem lies in the rpl_ext_header_srh_updat
unds writes with packets injected into the network stack. Specifically, the problem lies in the rpl_ext_header_srh_update function in the two rpl-ext-header.c modules for RPL-Classic and RPL-Lite respectively. The addr_ptr variable is calculated using an unvalidated CMPR field value from the source routing header. An out-of-bounds write can be triggered on line 151 in os/net/routing/rpl-lite/rpl-ext-header.c and line 261 in os/net/routing/rpl-classic/rpl-ext-header.c, which contain the following memcpy call with addr_ptr as destination. The problem has been patched in Contiki-NG 4.6. Users can apply a patch out-of-band as a workaround. Additional Analyst Notes: - CVE Program Container: Refer
ki-NG 4.6. Users can apply a patch out-of-band as a workaround. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-mvc7-9p4q-c5cm - https://github.com/contiki-ng/contiki-ng/pull/1431
CVE ID: CVE-2021-21258 State: PUBLISHED Published: 2021-03-02T19:45:17 Last Updated: 2024-08-03T18:09:14.957Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-79 Description: GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI from version 9.5.0 and before version 9.5.4, there is a cross-site scripting injection vulnerability when using ajax/kanban.php. This is fixed in version 9.5.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-j4
l Analyst Notes: - CVE Program Container: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-j4xj-4qmc-mmmx - https://github.com/glpi-project/glpi/commit/e7802fc051696de1f76108ea8dc3bd4e2c880f15
CVE ID: CVE-2021-21259 State: PUBLISHED Published: 2021-01-22T17:10:19 Last Updated: 2024-08-03T18:09:14.988Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N) Vendors: hedgedoc Products: hedgedoc Problem Types: CWE-79 Description: HedgeDoc is open source software which lets you create real-time collaborative markdown notes. In HedgeDoc before version 1.7.2, an attacker can inject arbitrary JavaScript into a HedgeDoc note, which is executed when the note is viewed in slide mode. Depending on the configuration of the instance, the attacker may not need authentication to create or edit notes. The problem is patched in HedgeDoc 1.7.2. As a workaround, disallow loading JavaS
uthentication to create or edit notes. The problem is patched in HedgeDoc 1.7.2. As a workaround, disallow loading JavaScript from 3rd party sites using the `Content-Security-Policy` header. Note that this will break some embedded content. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw - https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 - https://github.com/hedgedoc/hedgedoc/commit/35b0d39a12aa35f27fba8c1f50b1886706e7efef - https://github.com/hackmdio/codimd/issues/1648