Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-54781 State: PUBLISHED Published: 2025-08-01T23:35:23.713Z Last Updated: 2025-08-04T15:26:00.494Z Severity: LOW (CVSS 2.8 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N) Vendors: himmelblau-idm Products: himmelblau Problem Types: CWE-532 Description: Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. When debugging is enabled for Himmelblau in version 1.0.0, the himmelblaud_tasks service leaks an Intune service access token to the system journal. This short-lived token can be used to detect the host's Intune compliance status, and may permit additional administrative operations for the Intune host device (though the API for these operations is und
d may permit additional administrative operations for the Intune host device (though the API for these operations is undocumented). This is fixed in version 1.1.0. To workaround this issue, ensure that Himmelblau debugging is disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-78qg-vmrw-574w - https://github.com/himmelblau-idm/himmelblau/commit/2d512bded90ac6a54fcdf737b43ff5d9d4cdb59e - https://github.com/himmelblau-idm/himmelblau/releases/tag/1.1.0
CVE ID: CVE-2025-54782 State: PUBLISHED Published: 2025-08-01T23:36:58.421Z Last Updated: 2025-08-04T15:23:30.116Z Vendors: nestjs Products: nest Problem Types: CWE-77, CWE-78, CWE-352 Description: Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (safe-eval-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arb
o improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. The package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, /inspector/graph/interact, accepts JSON input containing a code field and executes the provided code in a Node.js vm.runInNewContext sandbox. This is fixed in version 0.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nestjs/nest/security/advisories/GHSA-85cg-cmq5-qjm7 - https://github.com/JLLeitschuh/nestjs-devtools-integration-rce-poc - https://github.com/JLLeitschuh/nestjs-typescript-starter-w-
github.com/JLLeitschuh/nestjs-devtools-integration-rce-poc - https://github.com/JLLeitschuh/nestjs-typescript-starter-w-devtools-integration - https://nodejs.org/api/vm.html - https://socket.dev/blog/nestjs-rce-vuln
CVE ID: CVE-2025-54783 State: PUBLISHED Published: 2025-08-07T00:05:11.823Z Last Updated: 2025-08-07T13:38:51.739Z Vendors: SuiteCRM Products: SuiteCRM Problem Types: CWE-79 Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability. This vulnerability allows an attacker to execute JavaScript code by modifying the HTTP Referer header to include some arbitrary domain with malicious JavaScript code at the end. The server will attempt to block the arbitrary domain but allow the JavaScript code to execute. This is fixed in version 7.14.7. Additional Anal
to block the arbitrary domain but allow the JavaScript code to execute. This is fixed in version 7.14.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-vqrj-gp9m-8c6r - https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_7
CVE ID: CVE-2025-54784 State: PUBLISHED Published: 2025-08-07T00:07:07.525Z Last Updated: 2025-08-07T13:59:34.417Z Vendors: SuiteCRM Products: SuiteCRM Problem Types: CWE-79 Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. There is a Cross Site Scripting (XSS) vulnerability in the email viewer in versions 7.14.0 through 7.14.6. An external attacker could send a prepared message to the inbox of the SuiteCRM-instance. By simply viewing emails as the logged-in user, the payload can be triggered. With that, an attacker is able to run arbitrary actions as the logged-in user - like extracting data, or if it is an admin executing
n attacker is able to run arbitrary actions as the logged-in user - like extracting data, or if it is an admin executing the payload, takeover the instance. This is fixed in versions 7.14.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-vg8q-xcq5-mh3p - https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_7
CVE ID: CVE-2025-54785 State: PUBLISHED Published: 2025-08-06T23:15:16.718Z Last Updated: 2025-08-07T14:48:26.266Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SuiteCRM Products: SuiteCRM Problem Types: CWE-20 Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, user-supplied input is not validated/sanitized before it is passed to the unserialize function, which could lead to penetration, privilege escalation, sensitive data exposure, Denial of Service, cryptomining and ransomware. This issue is fixed in version 7.14.7 and 8.8.1. Additional Analyst Notes: - CISA
Service, cryptomining and ransomware. This issue is fixed in version 7.14.7 and 8.8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-53cp-mpfw-qj67 - https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_7
CVE ID: CVE-2025-54786 State: PUBLISHED Published: 2025-08-06T23:23:00.948Z Last Updated: 2025-08-07T14:47:54.710Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SuiteCRM Products: SuiteCRM-Core Problem Types: CWE-200, CWE-284, CWE-287 Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, the broken authentication in the legacy iCal service allows unauthenticated access to meeting data. An unauthenticated actor can view any user's meeting (calendar event) data given their username, related functionality allows user enumeration. This is fixed in versions 7.14.7 and
ar event) data given their username, related functionality allows user enumeration. This is fixed in versions 7.14.7 and 8.8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SuiteCRM/SuiteCRM-Core/security/advisories/GHSA-rf2v-4mv3-qcgm - https://docs.suitecrm.com/8.x/admin/releases/8.8
CVE ID: CVE-2025-54787 State: PUBLISHED Published: 2025-08-07T21:15:39.708Z Last Updated: 2025-08-08T15:02:10.051Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SuiteCRM Products: SuiteCRM Problem Types: CWE-285 Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. There is a vulnerability in SuiteCRM version 7.14.6 which allows unauthenticated downloads of any file from the upload-directory, as long as it is named by an ID (e.g. attachments). An unauthenticated attacker could download internal files when he discovers a valid file-ID. Valid IDs could be brute-forced, but this is quite time-consu
download internal files when he discovers a valid file-ID. Valid IDs could be brute-forced, but this is quite time-consuming as the file-IDs are usually UUIDs. This issue is fixed in version 7.14.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-8r72-224q-g9fv - https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_7
CVE ID: CVE-2025-54788 State: PUBLISHED Published: 2025-08-06T23:48:55.847Z Last Updated: 2025-08-07T14:45:17.480Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SuiteCRM Products: SuiteCRM Problem Types: CWE-89 Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions and below, the InboundEmail module allows the arbitrary execution of queries in the backend database, leading to SQL injection. This can have wide-reaching implications on confidentiality, integrity, and availability, as database data can be retrieved, modified, or removed entirely. This issue is fixed in version 7.14.7. A
availability, as database data can be retrieved, modified, or removed entirely. This issue is fixed in version 7.14.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-v3m9-8wg7-c72x - https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_7
CVE ID: CVE-2025-54789 State: PUBLISHED Published: 2025-08-01T23:26:32.195Z Last Updated: 2025-08-04T15:40:11.383Z Vendors: humhub Products: cfiles Problem Types: CWE-80 Description: Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that prevents injection of arbitrary JavaScript, which can lead to Browser JS code execution in the context of the user’s session. This is fixed in version 0.16.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/humhub/cfiles/security/advisories/GHSA-cw2v-c62w-5r43 - https://github.com/humhub/cfiles/commit/f022bdd1cc54334a7a2a6
om/humhub/cfiles/security/advisories/GHSA-cw2v-c62w-5r43 - https://github.com/humhub/cfiles/commit/f022bdd1cc54334a7a2a6f90a8168bb9583a2f00 - https://github.com/humhub/cfiles/releases/tag/v0.16.10
CVE ID: CVE-2025-54790 State: PUBLISHED Published: 2025-08-01T23:37:23.353Z Last Updated: 2025-08-04T15:22:29.986Z Vendors: humhub Products: cfiles Problem Types: CWE-89 Description: Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, Files does not have logic to prevent the exploitation of backend SQL queries without direct output, potentially allowing unauthorized data access. This is fixed in version 0.16.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/humhub/cfiles/security/advisories/GHSA-rfvq-g9rm-pgqj - https://github.com/humhub/cfiles/pull/252 - https://github.com/humhub/cfiles/releases/tag/v0.16.
s/GHSA-rfvq-g9rm-pgqj - https://github.com/humhub/cfiles/pull/252 - https://github.com/humhub/cfiles/releases/tag/v0.16.10
CVE ID: CVE-2025-54791 State: PUBLISHED Published: 2025-08-13T14:08:19.607Z Last Updated: 2025-08-13T14:25:28.402Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ome Products: omero-web Problem Types: CWE-209 Description: OMERO.web provides a web based client and plugin infrastructure. Prior to version 5.29.2, if an error occurred when resetting a user's password using the Forgot Password option in OMERO.web, the error message displayed on the Web page can disclose information about the user. This issue has been patched in version 5.29.2. A workaround involves disabling the Forgot password option in OMERO.web using the omero.web.show_forgot_password configu
A workaround involves disabling the Forgot password option in OMERO.web using the omero.web.show_forgot_password configuration property. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ome/omero-web/security/advisories/GHSA-gpmg-4x4g-mr5r - https://github.com/ome/omero-web/commit/8aa2789e8f759c73f1517abe9a0abd44e86644ad
CVE ID: CVE-2025-54792 State: PUBLISHED Published: 2025-08-01T23:04:29.207Z Last Updated: 2025-08-04T14:19:20.337Z Vendors: localsend Products: localsend Problem Types: CWE-300, CWE-345 Description: LocalSend is an open-source app to securely share files and messages with nearby devices over local networks without needing an internet connection. In versions 1.16.1 and below, a critical Man-in-the-Middle (MitM) vulnerability in the software's discovery protocol allows an unauthenticated attacker on the same local network to impersonate legitimate devices, silently intercepting, reading, and modifying any file transfer. This can be used to steal sensitive data or inject malware, like ransomwar
ng, reading, and modifying any file transfer. This can be used to steal sensitive data or inject malware, like ransomware, into files shared between trusted users. The attack is hardly detectable and easy to implement, posing a severe and immediate security risk. This issue was fixed in version 1.17.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/localsend/localsend/security/advisories/GHSA-424h-5f6m-x63f - https://github.com/localsend/localsend/commit/e8635204ec782ded45bc7d698deb60f3c4105687 - https://github.com/localsend/localsend/releases/tag/v1.17.0
CVE ID: CVE-2025-54793 State: PUBLISHED Published: 2025-08-08T00:02:38.299Z Last Updated: 2025-08-08T16:55:38.979Z Vendors: withastro Products: astro Problem Types: CWE-601 Description: Astro is a web framework for content-driven websites. In versions 5.2.0 through 5.12.7, there is an Open Redirect vulnerability in the trailing slash redirection logic when handling paths with double slashes. This allows an attacker to redirect users to arbitrary external domains by crafting URLs such as https://mydomain.com//malicious-site.com/. This increases the risk of phishing and other social engineering attacks. This affects sites that use on-demand rendering (SSR) with the Node or Cloudflare adapters.
social engineering attacks. This affects sites that use on-demand rendering (SSR) with the Node or Cloudflare adapters. It does not affect static sites, or sites deployed to Netlify or Vercel. This issue is fixed in version 5.12.8. To work around this issue at the network level, block outgoing redirect responses with a Location header value that starts with `//`. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/withastro/astro/security/advisories/GHSA-cq8c-xv66-36gw - https://github.com/withastro/astro/commit/0567fb7b50c0c452be387dd7c7264b96bedab48f
CVE ID: CVE-2025-54794 State: PUBLISHED Published: 2025-08-05T00:08:13.864Z Last Updated: 2025-08-05T14:17:31.870Z Vendors: anthropics Products: claude-code Problem Types: CWE-22 Description: Claude Code is an agentic coding tool. In versions below 0.2.111, a path validation flaw using prefix matching instead of canonical path comparison, makes it possible to bypass directory restrictions and access files outside the CWD. Successful exploitation depends on the presence of (or ability to create) a directory with the same prefix as the CWD and the ability to add untrusted content into a Claude Code context window. This is fixed in version 0.2.111. Additional Analyst Notes: - CISA ADP Vulnrichm
tent into a Claude Code context window. This is fixed in version 0.2.111. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/anthropics/claude-code/security/advisories/GHSA-pmw4-pwvc-3hx2
CVE ID: CVE-2025-54795 State: PUBLISHED Published: 2025-08-05T00:07:29.465Z Last Updated: 2025-08-05T14:21:47.500Z Vendors: anthropics Products: claude-code Problem Types: CWE-78 Description: Claude Code is an agentic coding tool. In versions below 1.0.20, an error in command parsing makes it possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. This is fixed in version 1.0.20. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/anthropics/claude-code/security/advisories/GHSA-x56v-x2h6-7j34
CVE ID: CVE-2025-54796 State: PUBLISHED Published: 2025-08-01T23:38:27.221Z Last Updated: 2025-08-04T15:19:59.399Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: 9001 Products: copyparty Problem Types: CWE-400, CWE-1333, CWE-833 Description: Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. This is fixed in version 1.18.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/9001/copyparty/security/advisories/GHSA-5662-2rj7-f2v6 - h
es: - CISA ADP Vulnrichment: References: - https://github.com/9001/copyparty/security/advisories/GHSA-5662-2rj7-f2v6 - https://github.com/9001/copyparty/commit/09910ba80784c3980947d92f45db696398c0fd83 - https://github.com/9001/copyparty/releases/tag/v1.18.9
CVE ID: CVE-2025-54797 State: REJECTED Published: N/A Last Updated: 2025-08-04T23:10:06.817Z Description: No description available.
CVE ID: CVE-2025-54798 State: PUBLISHED Published: 2025-08-07T00:04:35.370Z Last Updated: 2025-11-03T20:06:39.242Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: raszi Products: node-tmp Problem Types: CWE-59 Description: tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/raszi/node-tmp/security/advisories/GHSA-52f5-9888-hmc6 - https://github.com/raszi/node-tmp/issues/207 - https://githu
om/raszi/node-tmp/security/advisories/GHSA-52f5-9888-hmc6 - https://github.com/raszi/node-tmp/issues/207 - https://github.com/raszi/node-tmp/commit/188b25e529496e37adaf1a1d9dccb40019a08b1b
CVE ID: CVE-2025-54799 State: PUBLISHED Published: 2025-08-07T00:04:14.718Z Last Updated: 2025-08-07T14:07:32.104Z Vendors: go-acme Products: lego Problem Types: CWE-319 Description: Let's Encrypt client and ACME library written in Go (Lego). In versions 4.25.1 and below, the github.com/go-acme/lego/v4/acme/api package (thus the lego library and the lego cli as well) don't enforce HTTPS when talking to CAs as an ACME client. Unlike the http-01 challenge which solves an ACME challenge over unencrypted HTTP, the ACME protocol requires HTTPS when a client communicates with the CA to performs ACME functions. However, the library fails to enforce HTTPS both in the original discover URL (configure
CA to performs ACME functions. However, the library fails to enforce HTTPS both in the original discover URL (configured by the library user) and in the subsequent addresses returned by the CAs in the directory and order objects. If users input HTTP URLs or CAs misconfigure endpoints, protocol operations occur over HTTP instead of HTTPS. This compromises privacy by exposing request/response details like account and request identifiers to network attackers. This was fixed in version 4.25.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/go-acme/lego/security/advisories/GHSA-q82r-2j7m-9rv4 - https://github.com/go-acme/lego/commit/238454b5f74f3cfcbb244ff0d0
go-acme/lego/security/advisories/GHSA-q82r-2j7m-9rv4 - https://github.com/go-acme/lego/commit/238454b5f74f3cfcbb244ff0d0dc914a4ad44b96
CVE ID: CVE-2025-54800 State: PUBLISHED Published: 2025-08-12T15:47:11.337Z Last Updated: 2025-08-12T15:57:41.274Z Vendors: NixOS Products: hydra Problem Types: CWE-79 Description: Hydra is a continuous integration service for Nix based projects. Prior to commit dea1e16, a malicious package can introduce arbitrary JavaScript code into the Hydra database that is automatically evaluated in a client's browser when anyone visits the build page. This could be done by a third-party project as part of its build process. This also happens in other places like with hydra-release-name. This issue has been patched by commit dea1e16. A workaround involves either not building untrusted packages or not vi
e. This issue has been patched by commit dea1e16. A workaround involves either not building untrusted packages or not visiting the builds page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/NixOS/hydra/security/advisories/GHSA-7qwg-q53v-vh99 - https://github.com/NixOS/hydra/commit/dea1e168f590efb27db32dbacc82b09e15f8ae4b
CVE ID: CVE-2025-54801 State: PUBLISHED Published: 2025-08-05T23:33:28.221Z Last Updated: 2025-08-07T14:00:09.981Z Vendors: gofiber Products: fiber Problem Types: CWE-789 Description: Fiber is an Express inspired web framework written in Go. In versions 2.52.8 and below, when using Fiber's Ctx.BodyParser to parse form data containing a large numeric key that represents a slice index (e.g., test.18446744073704), the application crashes due to an out-of-bounds slice allocation in the underlying schema decoder. The root cause is that the decoder attempts to allocate a slice of length idx + 1 without validating whether the index is within a safe or reasonable range. If the idx is excessively lar
length idx + 1 without validating whether the index is within a safe or reasonable range. If the idx is excessively large, this leads to an integer overflow or memory exhaustion, causing a panic or crash. This is fixed in version 2.52.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gofiber/fiber/security/advisories/GHSA-qx2q-88mx-vhg7 - https://github.com/gofiber/fiber/commit/e115c08b8f059a4a031b492aa9eef0712411853d
CVE ID: CVE-2025-54802 State: PUBLISHED Published: 2025-08-05T00:06:48.834Z Last Updated: 2025-08-05T14:29:43.201Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: pyload Products: pyload Problem Types: CWE-22 Description: pyLoad is the free and open-source Download Manager written in pure Python. In versions 0.5.0b3.dev89 and below, there is an opportunity for path traversal in pyLoad-ng CNL Blueprint via package parameter, allowing Arbitrary File Write which leads to Remote Code Execution (RCE). The addcrypted endpoint in pyload-ng suffers from an unsafe path construction vulnerability, allowing unauthenticated attackers to write arbitrary files outside t
rs from an unsafe path construction vulnerability, allowing unauthenticated attackers to write arbitrary files outside the designated storage directory. This can be abused to overwrite critical system files, including cron jobs and systemd services, leading to privilege escalation and remote code execution as root. This issue is fixed in version 0.5.0b3.dev90. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pyload/pyload/security/advisories/GHSA-48rp-jc79-2264 - https://github.com/pyload/pyload/pull/4596 - https://github.com/pyload/pyload/commit/70a44fe02c03bce92337b5d370d2a45caa4de3d4
CVE ID: CVE-2025-54803 State: PUBLISHED Published: 2025-08-05T00:06:15.916Z Last Updated: 2025-08-05T14:31:35.284Z Vendors: sunnyadn Products: js-toml Problem Types: CWE-1321 Description: js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. In versions below 1.0.2, a prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML input. This is fixed in version 1.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sunnyadn/js-toml/security/advisories/GHSA-65fc-cr5f-v7r2 - https://github.com/sunnyadn/js-toml/commit/b125910a3f
hub.com/sunnyadn/js-toml/security/advisories/GHSA-65fc-cr5f-v7r2 - https://github.com/sunnyadn/js-toml/commit/b125910a3f094b744c9c3571360d4b9e3a472f66 - https://gist.github.com/siunam321/f3dc4d21a5a932c67b6c11d0026f5afc