Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
performing arbitrary system operation or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7085-13321-1.html
CVE ID: CVE-2023-30604 State: PUBLISHED Published: 2023-06-02T00:00:00.000Z Last Updated: 2025-02-12T16:46:05.763Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hitron Technologies Inc. Products: Hitron CODA-5310 Problem Types: CWE-306 Description: It is identified a vulnerability of insufficient authentication in the system configuration interface of Hitron Technologies CODA-5310. An unauthorized remote attacker can exploit this vulnerability to access system configuration interface, resulting in performing arbitrary system operation or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www
r disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7086-35622-1.html
CVE ID: CVE-2023-30605 State: PUBLISHED Published: 2023-04-18T22:35:43.842Z Last Updated: 2025-02-05T20:54:08.309Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: hhyo Products: Archery Problem Types: CWE-89 Description: Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. User input coming from the `variable_name` and `variable_value` parameter value in the `sql/instance.py` `param_edit` endpoint is passed to a set of methods in given SQL engine implementations, which concatenate user input unsafely into a SQL query and afterwards pass
methods in given SQL engine implementations, which concatenate user input unsafely into a SQL query and afterwards pass it to the `query` method of each database engine for execution. The affected methods are: `set_variable` in `sql/engines/goinception.py` which concatenates input which is passed to execution on the database in the `sql/engines/goinception.py`, `get_variables` in `sql/engines/goinception.py` which concatenates input which is passed to execution on the database in the `sql/engines/goinception.py`, `set_variable` in `sql/engines/mysql.py` which concatenates input which is passed to execution on the database in the `sql/engines/mysql.py` `query`, and `get_variables` in `sql/eng
nput which is passed to execution on the database in the `sql/engines/mysql.py` `query`, and `get_variables` in `sql/engines/mysql.py`which concatenates input which is passed to execution on the database in the `sql/engines/mysql.py` `query`. Each of these issues may be mitigated by escaping user input or by using prepared statements when executing SQL queries. This advisory is also indexed as `GHSL-2022-104`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hhyo/Archery/security/advisories/GHSA-6mqc-w2qp-fvhp - https://github.com/hhyo/Archery/blob/bc86cda4c3b7d59f759d0d23bb63a54f52616752/sql/instance.py#L161-L202
CVE ID: CVE-2023-30606 State: PUBLISHED Published: 2023-04-18T21:36:08.683Z Last Updated: 2025-02-06T16:37:26.242Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H) Vendors: discourse Products: discourse Problem Types: CWE-732 Description: Discourse is an open source platform for community discussion. In affected versions a user logged as an administrator can call arbitrary methods on the `SiteSetting` class, notably `#clear_cache!` and `#notify_changed!`, which when done on a multisite instance, can affect the entire cluster resulting in a denial of service. Users not running in multisite environments are not affected. This issue is patched in the latest stable, beta
service. Users not running in multisite environments are not affected. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-jj93-w3mv-3jvv
CVE ID: CVE-2023-30607 State: PUBLISHED Published: 2023-07-05T17:42:54.496Z Last Updated: 2024-10-24T19:06:17.105Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Icinga Products: icingaweb2-module-jira Problem Types: CWE-352 Description: icingaweb2-module-jira provides integration with Atlassian Jira. Starting in version 1.3.0 and prior to version 1.3.2, template and field configuration forms perform the deletion action before user input is validated, including the cross site request forgery token. This issue is fixed in version 1.3.2. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - htt
are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Icinga/icingaweb2-module-jira/security/advisories/GHSA-gh7w-7f7j-gwp5 - https://github.com/Icinga/icingaweb2-module-jira/commit/7f0c53b7a3e87be2f4c2e8840805d7b7c9762424 - https://github.com/Icinga/icingaweb2-module-jira/releases/tag/v1.3.2
CVE ID: CVE-2023-30608 State: PUBLISHED Published: 2023-04-18T21:32:11.145Z Last Updated: 2025-11-03T21:48:07.853Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: andialbrecht Products: sqlparse Problem Types: CWE-1333 Description: sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This issue was introduced by commit `e75e358`. The vulnerability may lead to Denial of Service (DoS). This issues has been fixed in sqlparse 0.4.4 by commit `c457abd5f`. Users are advised to upgrade. There are no known workarounds for this i
n fixed in sqlparse 0.4.4 by commit `c457abd5f`. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2 - https://github.com/andialbrecht/sqlparse/commit/c457abd5f097dd13fb21543381e7cfafe7d31cfb - https://github.com/andialbrecht/sqlparse/commit/e75e35869473832a1eb67772b1adfee2db11b85a - https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS - https://lists.debian.org/debian-lts-announce/2023/05/msg00017.html
CVE ID: CVE-2023-30609 State: PUBLISHED Published: 2023-04-25T20:58:27.966Z Last Updated: 2025-02-03T17:54:55.060Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L) Vendors: matrix-org Products: matrix-react-sdk Problem Types: CWE-74 Description: matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. No cross-site scripting attack is possible due to the hardcoded content security policy. Version 3
ML injection payload. No cross-site scripting attack is possible due to the hardcoded content security policy. Version 3.71.0 of the SDK patches over the issue. As a workaround, restarting the client will clear the HTML injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-xv83-x443-7rmw - https://github.com/matrix-org/matrix-react-sdk/commit/bf182bc94556849d7acdfa0e5fdea2aa129ea826 - https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.71.0
CVE ID: CVE-2023-30610 State: PUBLISHED Published: 2023-04-19T17:18:54.703Z Last Updated: 2025-02-05T14:56:14.270Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: awslabs Products: aws-sdk-rust Problem Types: CWE-532 Description: aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs. All users of the AW
SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs. All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically are affected. This issue has been addressed in a set of new releases. Users are advised to upgrade. Users unable to upgrade should disable TRACE-level logging for AWS Rust SDK crates. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/awslabs/aws-sdk-rust/security/advisories/GHSA-mjv9-vp6w-3rc9
CVE ID: CVE-2023-30611 State: PUBLISHED Published: 2023-04-19T17:21:43.310Z Last Updated: 2025-02-05T14:52:50.148Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: discourse Products: discourse-reactions Problem Types: CWE-200 Description: Discourse-reactions is a plugin that allows user to add their reactions to the post in the Discourse messaging platform. In affected versions data about what reactions were performed on a post in a private topic could be leaked. This issue has been addressed in version 0.3. Users are advised to upgrade. Users unable to upgrade should disable the discourse-reactions plugin to fully mitigate the issue. Additional Analyst Note
ers unable to upgrade should disable the discourse-reactions plugin to fully mitigate the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse-reactions/security/advisories/GHSA-4cgc-c7vh-94g6 - https://github.com/discourse/discourse-reactions/commit/01aca15b2774c088f3673118e92e9469f37d2fb6
CVE ID: CVE-2023-30612 State: PUBLISHED Published: 2023-04-19T17:25:40.446Z Last Updated: 2025-02-05T14:51:40.315Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: cloud-hypervisor Products: cloud-hypervisor Problem Types: CWE-306 Description: Cloud hypervisor is a Virtual Machine Monitor for Cloud workloads. This vulnerability allows users to close arbitrary open file descriptors in the Cloud Hypervisor process via sending malicious HTTP request through the HTTP API socket. As a result, the Cloud Hypervisor process can be easily crashed, causing Deny-of-Service (DoS). This can also be a potential Use-After-Free (UAF) vulnerability. Users require to have the wr
ing Deny-of-Service (DoS). This can also be a potential Use-After-Free (UAF) vulnerability. Users require to have the write access to the API socket file to trigger this vulnerability. Impacted versions of Cloud Hypervisor include upstream main branch, v31.0, and v30.0. The vulnerability was initially detected by our `http_api_fuzzer` via oss-fuzz. This issue has been addressed in versions 30.1 and 31.1. Users unable to upgrade may mitigate this issue by ensuring the write access to the API socket file is granted to trusted users only. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cloud-hypervisor/cloud-hypervisor/security/adviso
m Container: - CISA ADP Vulnrichment: References: - https://github.com/cloud-hypervisor/cloud-hypervisor/security/advisories/GHSA-g6mw-f26h-4jgp - https://github.com/cloud-hypervisor/cloud-hypervisor/pull/5350 - https://github.com/cloud-hypervisor/cloud-hypervisor/pull/5373 - https://oss-fuzz.com/testcase-detail/5260873569796096 - https://oss-fuzz.com/testcase-detail/5426283514560512
CVE ID: CVE-2023-30613 State: PUBLISHED Published: 2023-04-24T16:29:16.202Z Last Updated: 2025-02-04T18:45:16.191Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: kiwitcms Products: Kiwi Problem Types: CWE-434 Description: Kiwi TCMS, an open source test management system, allows users to upload attachments to test plans, test cases, etc. In versions of Kiwi TCMS prior to 12.2, there is no control over what kinds of files can be uploaded. Thus, a malicious actor may upload an `.exe` file or a file containing embedded JavaScript and trick others into clicking on these files, causing vulnerable browsers to execute malicious code on another computer. Kiwi TCMS v12
s into clicking on these files, causing vulnerable browsers to execute malicious code on another computer. Kiwi TCMS v12.2 comes with functionality that allows administrators to configure additional upload validator functions which give them more control over what file types are accepted for upload. By default `.exe` are denied. Other files containing the `<script>` tag, regardless of their type are also denied b/c they are a path to XSS attacks. There are no known workarounds aside from upgrading. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-fwcf-753v-fgcj - https://huntr.dev/bounties/c30d
References: - https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-fwcf-753v-fgcj - https://huntr.dev/bounties/c30d3503-600d-4d00-9571-98826a51f12c - https://kiwitcms.org/blog/kiwi-tcms-team/2023/04/23/kiwi-tcms-122/
CVE ID: CVE-2023-30614 State: PUBLISHED Published: 2023-04-19T17:28:30.937Z Last Updated: 2025-02-05T16:55:39.522Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: pay-rails Products: pay Problem Types: CWE-79 Description: Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL could be distributed via email to specifically target certain individuals. If the targeted application contains a functionality to submit user-genera
l to specifically target certain individuals. If the targeted application contains a functionality to submit user-generated content (such as comments) the attacker could even distribute the URL using that functionality. This has been patched in version 6.3.2 and above. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pay-rails/pay/security/advisories/GHSA-cqf3-vpx7-rxhw - https://github.com/pay-rails/pay/commit/5d6283a24062bd272a524ec48415f536a67ad57f
CVE ID: CVE-2023-30615 State: PUBLISHED Published: 2023-05-25T17:39:06.887Z Last Updated: 2025-01-16T19:17:57.459Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: dfir-iris Products: iris-web Problem Types: CWE-80 Description: Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. A stored Cross-Site Scripting (XSS) vulnerability has been identified in iris-web, affecting multiple locations . The vulnerability in allows an attacker to inject malicious scripts into the application, which are then executed when a user visits the affected locations. This can lead to unauthorized access, data thef
tion, which are then executed when a user visits the affected locations. This can lead to unauthorized access, data theft, or other malicious activities. An attacker need to be authenticated on the application to exploit this vulnerability. The issue was patched in version 2.2.1 of iris-web. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dfir-iris/iris-web/security/advisories/GHSA-gc6j-6276-2m49 - https://github.com/dfir-iris/iris-web/releases/tag/v2.2.1
CVE ID: CVE-2023-30616 State: PUBLISHED Published: 2023-04-20T17:14:08.027Z Last Updated: 2025-02-04T21:12:15.877Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: epiphyt Products: form-block Problem Types: CWE-352 Description: Form block is a wordpress plugin designed to make form creation easier. Versions prior to 1.0.2 are subject to a Cross-Site Request Forgery due to a missing nonce check. There is potential for a Cross Site Request Forgery for all form blocks, since it allows to send requests to the forms from any website without a user noticing. Users are advised to upgrade to version 1.0.2. There are no known workarounds for this vulnerability. Addit
er noticing. Users are advised to upgrade to version 1.0.2. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/epiphyt/form-block/security/advisories/GHSA-j4c2-7p87-q824 - https://github.com/epiphyt/form-block/commit/cf0012fa0710d906c594346ba775c5dc433a9426
CVE ID: CVE-2023-30617 State: PUBLISHED Published: 2024-01-03T15:29:17.552Z Last Updated: 2025-06-16T18:10:14.525Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: openkruise Products: kruise Problem Types: CWE-250, CWE-269 Description: Kruise provides automated management of large-scale applications on Kubernetes. Starting in version 0.8.0 and prior to versions 1.3.1, 1.4.1, and 1.5.2, an attacker who has gained root privilege of the node that kruise-daemon run can leverage the kruise-daemon pod to list all secrets in the entire cluster. After that, the attacker can leverage the "captured" secrets (e.g. the kruise-manager service account token) to gain extra
ter that, the attacker can leverage the "captured" secrets (e.g. the kruise-manager service account token) to gain extra privileges such as pod modification. Versions 1.3.1, 1.4.1, and 1.5.2 fix this issue. A workaround is available. For users that do not require imagepulljob functions, they can modify kruise-daemon-role to drop the cluster level secret get/list privilege. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/openkruise/kruise/security/advisories/GHSA-437m-7hj5-9mpw
CVE ID: CVE-2023-30618 State: PUBLISHED Published: 2023-04-21T19:34:56.438Z Last Updated: 2025-02-04T19:58:19.338Z Severity: LOW (CVSS 3.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: newcontext-oss Products: kitchen-terraform Problem Types: CWE-532 Description: Kitchen-Terraform provides a set of Test Kitchen plugins which enable the use of Test Kitchen to converge a Terraform configuration and verify the resulting infrastructure systems with InSpec controls. Kitchen-Terraform v7.0.0 introduced a regression which caused all Terraform output values, including sensitive values, to be printed at the `info` logging level during the `kitchen converge` action. Prior to v7.0.0, the outpu
itive values, to be printed at the `info` logging level during the `kitchen converge` action. Prior to v7.0.0, the output values were printed at the `debug` level to avoid writing sensitive values to the terminal by default. An attacker would need access to the local machine in order to gain access to these logs during an operation. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/newcontext-oss/kitchen-terraform/security/advisories/GHSA-65g2-x53q-cmf6 - https://github.com/newcontext-oss/kitchen-terraform/commit/3d20d60e7a891e2dd747df995a31226fa0b4a
s/GHSA-65g2-x53q-cmf6 - https://github.com/newcontext-oss/kitchen-terraform/commit/3d20d60e7a891e2dd747df995a31226fa0b4ac48
CVE ID: CVE-2023-30619 State: PUBLISHED Published: 2023-05-04T13:35:35.432Z Last Updated: 2025-01-29T16:41:09.864Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Enalean Products: tuleap Problem Types: CWE-79 Description: Tuleap Open ALM is a Libre and Open Source tool for end to end traceability of application and system developments. The title of an artifact is not properly escaped in the tooltip. A malicious user with the capability to create an artifact or to edit a field title could force victim to execute uncontrolled code. This issue has been patched in version 14.7.99.143. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: R
e has been patched in version 14.7.99.143. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Enalean/tuleap/security/advisories/GHSA-7fm3-cr3g-5922 - https://github.com/Enalean/tuleap/commit/fdc93a736cbccad05de16ff0cc7cc3ef18dc93df - https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=fdc93a736cbccad05de16ff0cc7cc3ef18dc93df - https://tuleap.net/plugins/tracker/?aid=31586
CVE ID: CVE-2023-30620 State: PUBLISHED Published: 2023-04-21T20:11:26.129Z Last Updated: 2025-02-04T19:57:49.168Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: mindsdb Products: mindsdb Problem Types: CWE-22 Description: mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction is being performed using `tarfile.extractall()` from a remotely retrieved tarball. Which may lead to the writing of the extracted files to an unintended location. Sometimes, the vulnerability is called a TarSlip or a ZipSlip variant. An attacker may leverage this vulnerability to overwrite any local file which the server p
TarSlip or a ZipSlip variant. An attacker may leverage this vulnerability to overwrite any local file which the server process has access to. There is no risk of file exposure with this vulnerability. This issue has been addressed in release `23.2.1.0 `. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mindsdb/mindsdb/security/advisories/GHSA-2g5w-29q9-w6hx - https://github.com/mindsdb/mindsdb/commit/4419b0f0019c000db390b54d8b9d06e1d3670039 - https://github.com/mindsdb/mindsdb/releases/tag/v23.2.1.0
CVE ID: CVE-2023-30621 State: PUBLISHED Published: 2023-04-21T20:14:54.294Z Last Updated: 2025-02-04T19:55:57.857Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Curiosity-org Products: Gipsy Problem Types: CWE-78 Description: Gipsy is a multi-purpose discord bot which aim to be as modular and user-friendly as possible. In versions prior to 1.3 users can run command on the host machine with sudoer permission. The `!ping` command when provided with an IP or hostname used to run a bash `ping <IP>` without verification that the IP or hostname was legitimate. This command was executed with root permissions and may lead to arbitrary command injection on the ho
me was legitimate. This command was executed with root permissions and may lead to arbitrary command injection on the host server. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Curiosity-org/Gipsy/security/advisories/GHSA-6cw6-r8pg-j7wh - https://github.com/Gunivers/Gipsy/pull/24 - https://github.com/Gunivers/Gipsy/pull/24/commits/716818e967069f144aae66d51464b237c22b6cdf