Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-41881 State: PUBLISHED Published: 2023-10-11T19:30:43.808Z Last Updated: 2024-09-17T14:02:51.483Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: vantage6 Products: vantage6 Problem Types: CWE-200, CWE-708 Description: vantage6 is privacy preserving federated learning infrastructure. When a collaboration is deleted, the linked resources (such as tasks from that collaboration) should be deleted. This is partly to manage data properly, but also to prevent a potential (but unlikely) side-effect that affects versions prior to 4.0.0, where if a collaboration with id=10 is deleted, and subsequently a new collaboration is created with id=10, the authe
0, where if a collaboration with id=10 is deleted, and subsequently a new collaboration is created with id=10, the authenticated users in that collaboration could potentially see results of the deleted collaboration in some cases. Version 4.0.0 contains a patch for this issue. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/vantage6/vantage6/security/advisories/GHSA-rf54-7qrr-96j6 - https://github.com/vantage6/vantage6/pull/748 - https://github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f76/docs/release_notes.rst#400
CVE ID: CVE-2023-41882 State: PUBLISHED Published: 2023-10-11T19:48:44.606Z Last Updated: 2024-09-17T14:01:08.232Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: vantage6 Products: vantage6 Problem Types: CWE-863, CWE-284 Description: vantage6 is privacy preserving federated learning infrastructure. The endpoint /api/collaboration/{id}/task is used to collect all tasks from a certain collaboration. To get such tasks, a user should have permission to view the collaboration and to view the tasks in it. However, prior to version 4.0.0, it is only checked if the user has permission to view the collaboration. Version 4.0.0 contains a patch. There are no known wo
only checked if the user has permission to view the collaboration. Version 4.0.0 contains a patch. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/vantage6/vantage6/security/advisories/GHSA-gc57-xhh5-m94r - https://github.com/vantage6/vantage6/pull/711 - https://github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f76/docs/release_notes.rst#400
CVE ID: CVE-2023-41884 State: PUBLISHED Published: 2024-08-12T19:39:34.575Z Last Updated: 2024-08-13T17:34:56.389Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: ZoneMinder Products: zoneminder Problem Types: CWE-89 Description: ZoneMinder is a free, open source Closed-circuit television software application. In WWW/AJAX/watch.php, Line: 51 takes a few parameter in sql query without sanitizing it which makes it vulnerable to sql injection. This vulnerability is fixed in 1.36.34. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-2qp3-fwpv-mc96 - https://github.com/ZoneMinder/zonem
- https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-2qp3-fwpv-mc96 - https://github.com/ZoneMinder/zoneminder/commit/677f6a31551f128554f7b0110a52fd76453a657a - https://github.com/ZoneMinder/zoneminder/commit/a194fe81d34c5eea2ab1dc18dc8df615fca634a6
CVE ID: CVE-2023-41885 State: PUBLISHED Published: 2023-09-12T20:03:27.585Z Last Updated: 2024-09-26T13:36:08.365Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: piccolo-orm Products: piccolo Problem Types: CWE-204 Description: Piccolo is an ORM and query builder which supports asyncio. In versions 0.120.0 and prior, the implementation of `BaseUser.login` leaks enough information to a malicious user such that they would be able to successfully generate a list of valid users on the platform. As Piccolo on its own does not also enforce strong passwords, these lists of valid accounts are likely to be used in a password spray attack with the outcome being attem
g passwords, these lists of valid accounts are likely to be used in a password spray attack with the outcome being attempted takeover of user accounts on the platform. The impact of this vulnerability is minor as it requires chaining with other attack vectors in order to gain more then simply a list of valid users on the underlying platform. The likelihood of this vulnerability is possible as it requires minimal skills to pull off, especially given the underlying login functionality for Piccolo based sites is open source. This issue has been patched in version 0.121.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/piccolo-orm/pic
tional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/piccolo-orm/piccolo/security/advisories/GHSA-h7cm-mrvq-wcfr - https://github.com/piccolo-orm/piccolo/commit/edcfe3568382922ba3e3b65896e6e7272f972261
CVE ID: CVE-2023-41886 State: PUBLISHED Published: 2023-09-15T20:05:20.651Z Last Updated: 2024-09-25T18:48:19.859Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: OpenRefine Products: OpenRefine Problem Types: CWE-89 Description: OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, an arbitrary file read vulnerability allows any unauthenticated user to read a file on a server. Version 3.7.5 fixes this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-qqh2-wvmv-h72m - https://github.com/OpenRefine/OpenR
- https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-qqh2-wvmv-h72m - https://github.com/OpenRefine/OpenRefine/commit/2de1439f5be63d9d0e89bbacbd24fa28c8c3e29d
CVE ID: CVE-2023-41887 State: PUBLISHED Published: 2023-09-15T20:06:55.728Z Last Updated: 2024-09-25T18:55:03.906Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: OpenRefine Products: OpenRefine Problem Types: CWE-89 Description: OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, a remote code execution vulnerability allows any unauthenticated user to execute code on the server. Version 3.7.5 has a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-p3r5-x3hr-gpg5 - https://github.co
ment: References: - https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-p3r5-x3hr-gpg5 - https://github.com/OpenRefine/OpenRefine/commit/693fde606d4b5b78b16391c29d110389eb605511
CVE ID: CVE-2023-41888 State: PUBLISHED Published: 2023-09-26T22:44:02.121Z Last Updated: 2024-09-23T19:32:50.812Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-22 Description: GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The lack of path filtering on the GLPI URL may allow an attacker to transmit a malicious URL of login page that can be used to attempt a phishing attack on user credentials. Users are advised to upgrade to version 10.0.10. There are no known workaro
tempt a phishing attack on user credentials. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-2hcg-75jj-hghp
CVE ID: CVE-2023-41889 State: PUBLISHED Published: 2023-09-15T20:09:27.714Z Last Updated: 2024-09-25T18:54:14.277Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: shirasagi Products: shirasagi Problem Types: CWE-176 Description: SHIRASAGI is a Content Management System. Prior to version 1.18.0, SHIRASAGI is vulnerable to a Post-Unicode normalization issue. This happens when a logical validation or a security check is performed before a Unicode normalization. The Unicode character equivalent of a character would resurface after the normalization. The fix is initially performing the Unicode normalization and then strip for all whitespaces and then checking for
tion. The fix is initially performing the Unicode normalization and then strip for all whitespaces and then checking for a blank string. This issue has been fixed in version 1.18.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shirasagi/shirasagi/security/advisories/GHSA-xr45-c2jv-2v9r - https://github.com/shirasagi/shirasagi/blob/f249ce3f06f6bfbc0017b38f5c13de424334c3ea/app/models/concerns/rdf/object.rb#L68-L72 - https://sim4n6.beehiiv.com/p/unicode-characters-bypass-security-checks
CVE ID: CVE-2023-41890 State: PUBLISHED Published: 2023-09-19T14:38:55.861Z Last Updated: 2024-10-15T18:32:14.776Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Sustainsys Products: Saml2 Problem Types: CWE-289, CWE-294 Description: Sustainsys.Saml2 library adds SAML2P support to ASP.NET web sites, allowing the web site to act as a SAML2 Service Provider. Prior to versions 1.0.3 and 2.9.2, when a response is processed, the issuer of the Identity Provider is not sufficiently validated. This could allow a malicious identity provider to craft a Saml2 response that is processed as if issued by another identity provider. It is also possible for a malicious end us
a Saml2 response that is processed as if issued by another identity provider. It is also possible for a malicious end user to cause stored state intended for one identity provider to be used when processing the response from another provider. An application is impacted if they rely on any of these features in their authentication/authorization logic: the issuer of the generated identity and claims; or items in the stored request state (AuthenticationProperties). This issue is patched in versions 2.9.2 and 1.0.3. The `AcsCommandResultCreated` notification can be used to add the validation required if an upgrade to patched packages is not possible. Additional Analyst Notes: - CVE Program Conta
the validation required if an upgrade to patched packages is not possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Sustainsys/Saml2/security/advisories/GHSA-fv2h-753j-9g39 - https://github.com/Sustainsys/Saml2/issues/712 - https://github.com/Sustainsys/Saml2/issues/713
CVE ID: CVE-2023-41891 State: PUBLISHED Published: 2023-10-30T18:01:17.453Z Last Updated: 2024-09-06T18:17:36.935Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: flyteorg Products: flyteadmin Problem Types: CWE-89 Description: FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. Prior to version 1.1.124, list endpoints on FlyteAdmin have a SQL vulnerability where a malicious user can send a REST request with custom SQL statements as list filters. The attacker needs to have access to the FlyteAdmin installation, typically either behind a VPN or authentication. Version 1.1.124 contains a patch for thi
o the FlyteAdmin installation, typically either behind a VPN or authentication. Version 1.1.124 contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/flyteorg/flyteadmin/security/advisories/GHSA-r847-6w6h-r8g4 - https://github.com/flyteorg/flyteadmin/commit/b3177ef70f068e908140b8a4a9913dfa74f289fd - https://owasp.org/www-community/attacks/SQL_Injection#
CVE ID: CVE-2023-41892 State: PUBLISHED Published: 2023-09-13T19:45:25.736Z Last Updated: 2025-02-13T17:09:04.188Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L) Vendors: craftcms Products: cms Problem Types: CWE-94 Description: Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. This issue has been fixed in Craft CMS 4.4.15. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g - https://github.com/craftcm
iner: References: - https://github.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g - https://github.com/craftcms/cms/commit/7359d18d46389ffac86c2af1e0cd59e37c298857 - https://github.com/craftcms/cms/commit/a270b928f3d34ad3bd953b81c304424edd57355e - https://github.com/craftcms/cms/commit/c0a37e15cc925c473e60e27fe64054993b867ac1 - https://github.com/craftcms/cms/commit/c0a37e15cc925c473e60e27fe64054993b867ac1#diff-47dd43d86f85161944dfcce2e41d31955c4184672d9bd9d82b948c6b01b86476 - https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4415---2023-07-03-critical - http://packetstormsecurity.com/files/176303/Craft-CMS-4.4.14-Remote-Code-Execution.html
CVE ID: CVE-2023-41893 State: PUBLISHED Published: 2023-10-19T23:27:09.318Z Last Updated: 2024-09-12T15:02:45.555Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: home-assistant Products: core Problem Types: CWE-200 Description: Home assistant is an open source home automation. The audit team’s analyses confirmed that the `redirect_uri` and `client_id` are alterable when logging in. Consequently, the code parameter utilized to fetch the `access_token` post-authentication will be sent to the URL specified in the aforementioned parameters. Since an arbitrary URL is permitted and `homeassistant.local` represents the preferred, default domain likely used and tru
nce an arbitrary URL is permitted and `homeassistant.local` represents the preferred, default domain likely used and trusted by many users, an attacker could leverage this weakness to manipulate a user and retrieve account access. Notably, this attack strategy is plausible if the victim has exposed their Home Assistant to the Internet, since after acquiring the victim’s `access_token` the adversary would need to utilize it directly towards the instance to achieve any pertinent malicious actions. To achieve this compromise attempt, the attacker must send a link with a `redirect_uri` that they control to the victim’s own Home Assistant instance. In the eventuality the victim authenticates via
ect_uri` that they control to the victim’s own Home Assistant instance. In the eventuality the victim authenticates via said link, the attacker would obtain code sent to the specified URL in `redirect_uri`, which can then be leveraged to fetch an `access_token`. Pertinently, an attacker could increase the efficacy of this strategy by registering a near identical domain to `homeassistant.local`, which at first glance may appear legitimate and thereby obfuscate any malicious intentions. This issue has been addressed in version 2023.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnr
ere are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/home-assistant/core/security/advisories/GHSA-qhhj-7hrc-gqj5 - https://www.home-assistant.io/blog/2023/10/19/security-audits-of-home-assistant/
CVE ID: CVE-2023-41894 State: PUBLISHED Published: 2023-10-19T23:23:17.909Z Last Updated: 2024-09-12T15:03:41.114Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: home-assistant Products: core Problem Types: CWE-669 Description: Home assistant is an open source home automation. The assessment verified that webhooks available in the webhook component are triggerable via the `*.ui.nabu.casa` URL without authentication, even when the webhook is marked as Only accessible from the local network. This issue is facilitated by the SniTun proxy, which sets the source address to 127.0.0.1 on all requests sent to the public URL and forwarded to the local Home Assistant
ch sets the source address to 127.0.0.1 on all requests sent to the public URL and forwarded to the local Home Assistant. This issue has been addressed in version 2023.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/home-assistant/core/security/advisories/GHSA-wx3j-3v2j-rf45 - https://www.home-assistant.io/blog/2023/10/19/security-audits-of-home-assistant/
CVE ID: CVE-2023-41895 State: PUBLISHED Published: 2023-10-19T22:37:23.942Z Last Updated: 2024-09-12T15:04:43.051Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: home-assistant Products: core Problem Types: CWE-79 Description: Home assistant is an open source home automation. The Home Assistant login page allows users to use their local Home Assistant credentials and log in to another website that specifies the `redirect_uri` and `client_id` parameters. Although the `redirect_uri` validation typically ensures that it matches the `client_id` and the scheme represents either `http` or `https`, Home Assistant will fetch the `client_id` and check for `<link rel="
and the scheme represents either `http` or `https`, Home Assistant will fetch the `client_id` and check for `<link rel="redirect_uri" href="...">` HTML tags on the page. These URLs are not subjected to the same scheme validation and thus allow for arbitrary JavaScript execution on the Home Assistant administration page via usage of `javascript:` scheme URIs. This Cross-site Scripting (XSS) vulnerability can be executed on the Home Assistant frontend domain, which may be used for a full takeover of the Home Assistant account and installation. This issue has been addressed in version 2023.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additiona
version 2023.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/home-assistant/core/security/advisories/GHSA-jvxq-x42r-f7mv
CVE ID: CVE-2023-41896 State: PUBLISHED Published: 2023-10-19T22:30:49.623Z Last Updated: 2024-09-12T15:06:52.374Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: home-assistant Products: core Problem Types: CWE-345 Description: Home assistant is an open source home automation. Whilst auditing the frontend code to identify hidden parameters, Cure53 detected `auth_callback=1`, which is leveraged by the WebSocket authentication logic in tandem with the `state` parameter. The state parameter contains the `hassUrl`, which is subsequently utilized to establish a WebSocket connection. This behavior permits an attacker to create a malicious Home Assistant link with a
to establish a WebSocket connection. This behavior permits an attacker to create a malicious Home Assistant link with a modified state parameter that forces the frontend to connect to an alternative WebSocket backend. Henceforth, the attacker can spoof any WebSocket responses and trigger cross site scripting (XSS). Since the XSS is executed on the actual Home Assistant frontend domain, it can connect to the real Home Assistant backend, which essentially represents a comprehensive takeover scenario. Permitting the site to be iframed by other origins, as discussed in GHSA-935v-rmg9-44mw, renders this exploit substantially covert since a malicious website can obfuscate the compromise strategy
5v-rmg9-44mw, renders this exploit substantially covert since a malicious website can obfuscate the compromise strategy in the background. However, even without this, the attacker can still send the `auth_callback` link directly to the victim user. To mitigate this issue, Cure53 advises modifying the WebSocket code’s authentication flow. An optimal implementation in this regard would not trust the `hassUrl` passed in by a GET parameter. Cure53 must stipulate the significant time required of the Cure53 consultants to identify an XSS vector, despite holding full control over the WebSocket responses. In many areas, data from the WebSocket was properly sanitized, which hinders post-exploitation.
the WebSocket responses. In many areas, data from the WebSocket was properly sanitized, which hinders post-exploitation. The audit team eventually detected the `js_url` for custom panels, though generally, the frontend exhibited reasonable security hardening. This issue has been addressed in Home Assistant Core version 2023.8.0 and in the npm package home-assistant-js-websocket in version 8.2.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/home-assistant/core/security/advisories/GHSA-cr83-q7r2-7f5q - https://github.com/home-assistant/core/securi
//github.com/home-assistant/core/security/advisories/GHSA-cr83-q7r2-7f5q - https://github.com/home-assistant/core/security/advisories/GHSA-935v-rmg9-44mw
CVE ID: CVE-2023-41897 State: PUBLISHED Published: 2023-10-19T22:23:32.278Z Last Updated: 2024-09-12T15:08:55.086Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: home-assistant Products: core Problem Types: CWE-1021 Description: Home assistant is an open source home automation. Home Assistant server does not set any HTTP security headers, including the X-Frame-Options header, which specifies whether the web page is allowed to be framed. The omission of this and correlating headers facilitates covert clickjacking attacks and alternative exploit opportunities, such as the vector described in this security advisory. This fault incurs major risk, considering the
it opportunities, such as the vector described in this security advisory. This fault incurs major risk, considering the ability to trick users into installing an external and malicious add-on with minimal user interaction, which would enable Remote Code Execution (RCE) within the Home Assistant application. This issue has been addressed in version 2023.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/home-assistant/core/security/advisories/GHSA-935v-rmg9-44mw - https://github.com/home-assistant/core/security/advisories/GHSA-cr83-q7r2-7f5
/security/advisories/GHSA-935v-rmg9-44mw - https://github.com/home-assistant/core/security/advisories/GHSA-cr83-q7r2-7f5q - https://www.home-assistant.io/blog/2023/10/19/security-audits-of-home-assistant/
CVE ID: CVE-2023-41898 State: PUBLISHED Published: 2023-10-19T22:08:40.783Z Last Updated: 2024-09-12T15:12:08.060Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: home-assistant Products: core Problem Types: CWE-345, CWE-94 Description: Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in a WebView. This enables all sorts of attacks, including arbitrary JavaScript execution, limited native code execution, and credential theft. This issue has been patched in version 2023.9.2 and all users are advised to upgrade. There are no known workarounds for this vuln
has been patched in version 2023.9.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GitHub Security Lab (GHSL) Vulnerability Report: `GHSL-2023-142`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/home-assistant/core/security/advisories/GHSA-jvpm-q3hq-86rg