Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-25618 State: PUBLISHED Published: 2024-02-14T20:45:50.621Z Last Updated: 2025-05-12T15:16:42.597Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: mastodon Products: mastodon Problem Types: CWE-287 Description: Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows new identities from configured authentication providers (CAS, SAML, OIDC) to attach to existing local users with the same e-mail address. This results in a possible account takeover if the authentication provider allows changing the e-mail address or multiple authentication providers are configured. When a user logs in through an external authen
g the e-mail address or multiple authentication providers are configured. When a user logs in through an external authentication provider for the first time, Mastodon checks the e-mail address passed by the provider to find an existing account. However, using the e-mail address alone means that if the authentication provider allows changing the e-mail address of an account, the Mastodon account can immediately be hijacked. All users logging in through external authentication providers are affected. The severity is medium, as it also requires the external authentication provider to misbehave. However, some well-known OIDC providers (like Microsoft Azure) make it very easy to accidentally allo
ider to misbehave. However, some well-known OIDC providers (like Microsoft Azure) make it very easy to accidentally allow unverified e-mail changes. Moreover, OpenID Connect also allows dynamic client registration. This issue has been addressed in versions 4.2.6, 4.1.14, 4.0.14, and 3.5.18. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mastodon/mastodon/security/advisories/GHSA-vm39-j3vx-pch3 - https://github.com/mastodon/mastodon/commit/b31af34c9716338e4a32a62cc812d1ca59e88d15
CVE ID: CVE-2024-25619 State: PUBLISHED Published: 2024-02-14T20:50:10.809Z Last Updated: 2024-08-01T23:44:09.688Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: mastodon Products: mastodon Problem Types: CWE-613, CWE-672 Description: Mastodon is a free, open-source social network server based on ActivityPub. When an OAuth Application is destroyed, the streaming server wasn't being informed that the Access Tokens had also been destroyed, this could have posed security risks to users by allowing an application to continue listening to streaming after the application had been destroyed. Essentially this comes down to the fact that when Doorkeeper sets up the rel
g after the application had been destroyed. Essentially this comes down to the fact that when Doorkeeper sets up the relationship between Applications and Access Tokens, it uses a `dependent: delete_all` configuration, which means the `after_commit` callback setup on `AccessTokenExtension` didn't actually fire, since `delete_all` doesn't trigger ActiveRecord callbacks. To mitigate, we need to add a `before_destroy` callback to `ApplicationExtension` which announces to streaming that all the Application's Access Tokens are being "killed". Impact should be negligible given the affected application had to be owned by the user. None the less this issue has been addressed in versions 4.2.6, 4.1.1
e affected application had to be owned by the user. None the less this issue has been addressed in versions 4.2.6, 4.1.14, 4.0.14, and 3.5.18. Users are advised to upgrade. There are no known workaround for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/mastodon/mastodon/security/advisories/GHSA-7w3c-p9j8-mq3x - https://github.com/mastodon/mastodon/commit/68eaa804c9bafdc5f798e114e9ba00161425dd71
CVE ID: CVE-2024-25620 State: PUBLISHED Published: 2024-02-14T23:24:57.651Z Last Updated: 2024-08-26T14:49:43.726Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: helm Products: helm Problem Types: CWE-22 Description: Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. When either the Helm client or SDK is used to save a chart whose name within the `Chart.yaml` file includes a relative path change, the chart would be saved outside its expected directory based on the changes in the relative path. The validation and linting did not detect the path changes in the name. This issue has been resolved in Helm v3.14.1. Use
he validation and linting did not detect the path changes in the name. This issue has been resolved in Helm v3.14.1. Users unable to upgrade should check all charts used by Helm for path changes in their name as found in the `Chart.yaml` file. This includes dependencies. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/helm/helm/security/advisories/GHSA-v53g-5gjp-272r - https://github.com/helm/helm/commit/0d0f91d1ce277b2c8766cdc4c7aa04dbafbf2503
CVE ID: CVE-2024-25621 State: PUBLISHED Published: 2025-11-06T18:36:21.566Z Last Updated: 2025-11-06T19:35:13.415Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: containerd Products: containerd Problem Types: CWE-279 Description: containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths `/var/lib/containerd`, `/run/containerd/io.containerd.grpc.v1.cri` and `/run/containerd/io.containerd.sandbox.controller.v1.shim` were all created with incorrect permissions. This issue is fixed i
/containerd/io.containerd.sandbox.controller.v1.shim` were all created with incorrect permissions. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system administrator permissions so the host can manually chmod the directories to not have group or world accessible permissions, or to run containerd in rootless mode. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w - https://github.com/containerd/containerd/commit/7c59e8e9e970d38061a77b586b23655c352bfec5 - https://github.com/containerd/containerd/blob/main/docs/rootless.md
CVE ID: CVE-2024-25622 State: PUBLISHED Published: 2024-10-11T14:20:31.921Z Last Updated: 2024-10-11T14:46:36.996Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: h2o Products: h2o Problem Types: CWE-670 Description: h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The configuration directives provided by the headers handler allows users to modify the response headers being sent by h2o. The configuration file of h2o has scopes, and the inner scopes (e.g., path level) are expected to inherit the configuration defined in outer scopes (e.g., global level). However, if a header directive is used in the inner scope, all the definition in outer sco
scopes (e.g., global level). However, if a header directive is used in the inner scope, all the definition in outer scopes are ignored. This can lead to headers not being modified as expected. Depending on the headers being added or removed unexpectedly, this behavior could lead to unexpected client behavior. This vulnerability is fixed in commit 123f5e2b65dcdba8f7ef659a00d24bd1249141be. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/h2o/h2o/security/advisories/GHSA-5m7v-cj65-h6pj - https://github.com/h2o/h2o/issues/3332 - https://github.com/h2o/h2o/commit/123f5e2b65dcdba8f7ef659a00d24bd1249141be
CVE ID: CVE-2024-25623 State: PUBLISHED Published: 2024-02-19T15:28:15.296Z Last Updated: 2024-08-01T23:44:09.828Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N) Vendors: mastodon Products: mastodon Problem Types: CWE-434 Description: Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.2.7, 4.1.15, 4.0.15, and 3.5.19, when fetching remote statuses, Mastodon doesn't check that the response from the remote server has a `Content-Type` header value of the Activity Streams media type, which allows a threat actor to upload a crafted Activity Streams document to a remote server and make a Mastodon server fetch it, if the remote ser
to upload a crafted Activity Streams document to a remote server and make a Mastodon server fetch it, if the remote server accepts arbitrary user uploads. The vulnerability allows a threat actor to impersonate an account on a remote server that satisfies all of the following properties: allows the attacker to register an account; accepts arbitrary user-uploaded documents and places them on the same domain as the ActivityPub actors; and serves user-uploaded document in response to requests with an `Accept` header value of the Activity Streams media type. Versions 4.2.7, 4.1.15, 4.0.15, and 3.5.19 contain a fix for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program C
.15, 4.0.15, and 3.5.19 contain a fix for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/mastodon/mastodon/security/advisories/GHSA-jhrq-qvrm-qr36 - https://github.com/mastodon/mastodon/commit/9fee5e852669e26f970e278021302e1a203fc022
CVE ID: CVE-2024-25624 State: PUBLISHED Published: 2024-04-25T16:30:43.979Z Last Updated: 2024-08-01T23:44:09.705Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: dfir-iris Products: iris-web Problem Types: CWE-1336 Description: Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. Due to an improper setup of Jinja2 environment, reports generation in `iris-web` is prone to a Server Side Template Injection (SSTI). Successful exploitation of the vulnerability can lead to an arbitrary Remote Code Execution. An authenticated administrator has to upload a crafted report template containing the pay
bitrary Remote Code Execution. An authenticated administrator has to upload a crafted report template containing the payload. Upon generation of a report based on the weaponized report, any user can trigger the vulnerability. The vulnerability is patched in IRIS v2.4.6. No workaround is available. It is recommended to update as soon as possible. Until patching, review the report templates and keep the administrative privileges that include the upload of report templates limited to dedicated users. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/dfir-iris/iris-web/security/advisories/GHSA-m64w-f7fg-hpcr
CVE ID: CVE-2024-25625 State: PUBLISHED Published: 2024-02-19T15:41:29.147Z Last Updated: 2024-08-14T13:47:42.851Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: pimcore Products: admin-ui-classic-bundle Problem Types: CWE-74 Description: Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. A potential security vulnerability has been discovered in `pimcore/admin-ui-classic-bundle` prior to version 1.3.4. The vulnerability involves a Host Header Injection in the `invitationLinkAction` function of the UserController, specifically in the way `$loginUrl` trusts user input. The host header from incoming HTTP requests is used unsafely when generating U
in the way `$loginUrl` trusts user input. The host header from incoming HTTP requests is used unsafely when generating URLs. An attacker can manipulate the HTTP host header in requests to the /admin/user/invitationlink endpoint, resulting in the generation of URLs with the attacker's domain. In fact, if a host header is injected in the POST request, the $loginURL parameter is constructed with this unvalidated host header. It is then used to send an invitation email to the provided user. This vulnerability can be used to perform phishing attacks by making the URLs in the invitation links emails point to an attacker-controlled domain. Version 1.3.4 contains a patch for the vulnerability. The m
itation links emails point to an attacker-controlled domain. Version 1.3.4 contains a patch for the vulnerability. The maintainers recommend validating the host header and ensuring it matches the application's domain. It would also be beneficial to use a default trusted host or hostname if the incoming host header is not recognized or is absent. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-3qpq-6w89-f7mx - https://github.com/pimcore/admin-ui-classic-bundle/commit/b9fee9d383fc73dbd5e1d98dbb0ff3266d6b5a82
CVE ID: CVE-2024-25626 State: PUBLISHED Published: 2024-02-19T19:31:37.398Z Last Updated: 2024-08-28T16:34:04.491Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: yoctoproject Products: poky Problem Types: CWE-78 Description: Yocto Project is an open source collaboration project that helps developers create custom Linux-based systems regardless of the hardware architecture. In Yocto Projects Bitbake before 2.6.2 (before and included Yocto Project 4.3.1), with the Toaster server (included in bitbake) running, missing input validation allows an attacker to perform a remote code execution in the server's shell via a crafted HTTP request. Authentication is not nec
attacker to perform a remote code execution in the server's shell via a crafted HTTP request. Authentication is not necessary. Toaster server execution has to be specifically run and is not the default for Bitbake command line builds, it is only used for the Toaster web based user interface to Bitbake. The fix has been backported to the bitbake included with Yocto Project 5.0, 3.1.31, 4.0.16, and 4.3.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/yoctoproject/poky/security/advisories/GHSA-75xw-78mm-72r4
CVE ID: CVE-2024-25627 State: PUBLISHED Published: 2024-02-16T20:27:58.176Z Last Updated: 2024-08-26T14:48:53.643Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: alfio-event Products: alf.io Problem Types: CWE-79, CWE-434 Description: Alf.io is a free and open source event attendance management system. An administrator on the alf.io application is able to upload HTML files that trigger JavaScript payloads. As such, an attacker gaining administrative access to the alf.io application may be able to persist access by planting an XSS payload. This issue has been addressed in version 2.0-M4-2402. Users are advised to upgrade. There are no known workarounds for this
s issue has been addressed in version 2.0-M4-2402. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/alfio-event/alf.io/security/advisories/GHSA-gpmg-8f92-37cf
CVE ID: CVE-2024-25628 State: PUBLISHED Published: 2024-02-16T20:23:44.693Z Last Updated: 2024-08-06T15:49:15.967Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: alfio-event Products: alf.io Problem Types: CWE-613 Description: Alf.io is a free and open source event attendance management system. In versions prior to 2.0-M4-2402 users can access the admin area even after being invalidated/deleted. This issue has been addressed in version 2.0-M4-2402. All users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/alfio-event/alf.
ional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/alfio-event/alf.io/security/advisories/GHSA-8p6m-mm22-q893
CVE ID: CVE-2024-25629 State: PUBLISHED Published: 2024-02-23T14:52:24.967Z Last Updated: 2025-02-13T17:40:51.243Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: c-ares Products: c-ares Problem Types: CWE-127 Description: c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using a c-ares version prior to 1.27.0, the `/etc/hosts` file. If any of these configuration files has an embedded `NULL` character as the first character in a new line, it can lead to attempting to read memory prior to the start of the given buf
acter as the first character in a new line, it can lead to attempting to read memory prior to the start of the given buffer which may result in a crash. This issue is fixed in c-ares 1.27.0. No known workarounds exist. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/c-ares/c-ares/security/advisories/GHSA-mg26-v6qh-x48q - https://github.com/c-ares/c-ares/commit/a804c04ddc8245fc8adf0e92368709639125e183 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX37LFPFQ3T6FFMMFYQTEGIQXXN7F27U/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2P76QYI
QTEGIQXXN7F27U/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2P76QYINQNPEHUTEEDOUYIRZ2X6UVZ5K/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CSCMTSPDIE2UHU34TIXQQHZ6JTE3Y3VF/
CVE ID: CVE-2024-25630 State: PUBLISHED Published: 2024-02-20T17:53:16.685Z Last Updated: 2024-08-01T23:44:09.747Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: cilium Products: cilium Problem Types: CWE-311 Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who are using CRDs to store Cilium state (the default configuration) and Wireguard transparent encryption, traffic to/from the Ingress and health endpoints is not encrypted. This issue affects Cilium v1.14 before v1.14.7 and has been patched in Cilium v1.14.7. There is no workaround to this issue. Additional Analyst Notes: - CISA ADP
.14.7 and has been patched in Cilium v1.14.7. There is no workaround to this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/cilium/cilium/security/advisories/GHSA-7496-fgv9-xw82 - https://docs.cilium.io/en/stable/security/network/encryption-wireguard/#encryption-wg - https://github.com/cilium/cilium/releases/tag/v1.14.7
CVE ID: CVE-2024-25631 State: PUBLISHED Published: 2024-02-20T18:08:56.946Z Last Updated: 2024-08-26T14:46:55.989Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: cilium Products: cilium Problem Types: CWE-311 Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who have enabled an external kvstore and Wireguard transparent encryption, traffic between pods in the affected cluster is not encrypted. This issue affects Cilium v1.14 before v1.14.7 and has been patched in Cilium v1.14.7. There is no workaround to this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichme
v1.14.7. There is no workaround to this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cilium/cilium/security/advisories/GHSA-x989-52fc-4vr4 - https://docs.cilium.io/en/stable/installation/k8s-install-external-etcd/#when-do-i-need-to-use-a-kvstore - https://docs.cilium.io/en/stable/security/network/encryption-wireguard/#encryption-wg - https://github.com/cilium/cilium/releases/tag/v1.14.7
CVE ID: CVE-2024-25632 State: PUBLISHED Published: 2024-10-01T14:36:50.451Z Last Updated: 2024-10-01T15:00:01.610Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: elabftw Products: elabftw Problem Types: CWE-266, CWE-842 Description: eLabFTW is an open source electronic lab notebook for research labs. In the context of eLabFTW, an administrator is a user account with certain privileges to manage users and content in their assigned team/teams. A user may be an administrator in one team and a regular user in another. The vulnerability allows a regular user to become administrator of a team where they are a member, under a reasonable configuration. Additionally,
regular user to become administrator of a team where they are a member, under a reasonable configuration. Additionally, in eLabFTW versions subsequent to v5.0.0, the vulnerability may allow an initially unauthenticated user to gain administrative privileges over an arbitrary team. The vulnerability does not affect system administrator status. Users should upgrade to version 5.1.0. System administrators are advised to turn off local user registration, saml_team_create and not allow administrators to import users into teams, unless strictly required. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/elabftw/elabftw/security/advisories/GHSA-6m7p-gh9f-5mgg
CVE ID: CVE-2024-25633 State: PUBLISHED Published: 2024-08-15T18:23:57.786Z Last Updated: 2024-08-19T13:29:47.792Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: elabftw Products: elabftw Problem Types: CWE-266 Description: eLabFTW is an open source electronic lab notebook for research labs. In an eLabFTW system, one can configure who is allowed to create new user accounts. A vulnerability has been found starting in version 4.4.0 and prior to version 5.0.0 that allows regular users to create new, validated accounts in their team. If the system has anonymous access enabled (disabled by default) an unauthenticated user can create regular users in any team. Th
stem has anonymous access enabled (disabled by default) an unauthenticated user can create regular users in any team. This vulnerability has been fixed since version 5.0.0, released on February 17th 2024. Some workarounds are available. Disabling both options that allow *administrators* to create users will provide a mitigation. Additionally, disabling anonymous user access will stop anonymous access (including using existing access keys). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/elabftw/elabftw/security/advisories/GHSA-v677-8x8p-636v
CVE ID: CVE-2024-25634 State: PUBLISHED Published: 2024-02-19T19:53:52.668Z Last Updated: 2024-08-01T23:44:09.810Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: alfio-event Products: alf.io Problem Types: CWE-497 Description: alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, an attacker can access data from other organizers. The attacker can use a specially crafted request to receive the e-mail log sent by other events. Version 2.0-M4-2402 fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/alfio-event/alf.io/security/advisories/GHSA-5wcv-pjc6-mxvv
CVE ID: CVE-2024-25635 State: PUBLISHED Published: 2024-02-19T19:48:10.379Z Last Updated: 2024-08-28T18:02:07.113Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: alfio-event Products: alf.io Problem Types: CWE-612 Description: alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USERS of other organization owners using the `http://192.168.26.128:8080/admin/api/users/<user_id>` endpoint, which exposes the details of the provided user ID. This may also expose the API KEY in the username of the user. Version 2.0-M4-2402 fixes this issue. Additional Analyst Notes: - CVE Program Co
he API KEY in the username of the user. Version 2.0-M4-2402 fixes this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/alfio-event/alf.io/security/advisories/GHSA-ffr5-g3qg-gp4f