Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-43793 State: PUBLISHED Published: 2021-12-01T19:40:15 Last Updated: 2024-08-04T04:03:09.128Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: discourse Products: discourse Problem Types: CWE-269 Description: Discourse is an open source discussion platform. In affected versions a vulnerability in the Polls feature allowed users to vote multiple times in a single-option poll. The problem is patched in the latest tests-passed, beta and stable versions of Discourse Additional Analyst Notes: - CVE Program Container: References: - https://github.com/discourse/discourse/security/advisories/GHSA-jq7h-44vc-h6qx - https://github.com/discourse/discourse
https://github.com/discourse/discourse/security/advisories/GHSA-jq7h-44vc-h6qx - https://github.com/discourse/discourse/commit/0c6b9df77bac9c6f7c7e2eadf6fe100064afdeab - https://github.com/discourse/discourse/commit/1d0faedfbc3a8b77b971dc70d25e30791dbb6e0b
CVE ID: CVE-2021-43794 State: PUBLISHED Published: 2021-12-01T19:40:10 Last Updated: 2024-08-04T04:03:08.879Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: discourse Products: discourse Problem Types: CWE-610 Description: Discourse is an open source discussion platform. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users, such that the users are shown a JSON blob instead of the HTML page. This can lead to a partial denial-of-service. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/discourse/
ed versions of Discourse. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/discourse/discourse/commit/2da0001965c6d8632d723c46ea5df9f22a1a23f1 - https://github.com/discourse/discourse/security/advisories/GHSA-249g-pc77-65hp
CVE ID: CVE-2021-43795 State: PUBLISHED Published: 2021-12-02T18:00:11 Last Updated: 2024-08-04T04:03:08.810Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: line Products: armeria Problem Types: CWE-22 Description: Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria's path validation logic. Armeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly. This vulnerability can be worked around by in
e contains the hardened path validation logic that handles `%2F` properly. This vulnerability can be worked around by inserting a decorator that performs an additional validation on the request path. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/line/armeria/security/advisories/GHSA-8fp4-rp6c-5gcv - https://github.com/line/armeria/pull/3855 - https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284
CVE ID: CVE-2021-43797 State: PUBLISHED Published: 2021-12-09T00:00:00 Last Updated: 2024-08-04T04:03:08.898Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: netty Products: netty Problem Types: CWE-444 Description: Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header nam
e spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq - https://github.com/netty/netty/commit/07aa6b5938a8b6ed7a6586e066400e2643897323 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20220107-0003/ - https://www.oracle.com
.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20220107-0003/ - https://www.oracle.com/security-alerts/cpujul2022.html - https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html - https://www.debian.org/security/2023/dsa-5316
CVE ID: CVE-2021-43798 State: PUBLISHED Published: 2021-12-07T18:25:10.000Z Last Updated: 2025-10-21T23:25:24.009Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: grafana Products: grafana Problem Types: CWE-22 Description: Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7,
gin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p - https://github.com/grafana/grafana/commit/c798c0e958d15d9cc7f27c72113d572fa58545ce - http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html - https://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafana-directory-traversal/ - http://pack
g.html - https://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafana-directory-traversal/ - http://packetstormsecurity.com/files/165221/Grafana-8.3.0-Directory-Traversal-Arbitrary-File-Read.html - http://www.openwall.com/lists/oss-security/2021/12/09/2 - http://www.openwall.com/lists/oss-security/2021/12/10/4 - https://security.netapp.com/advisory/ntap-20211229-0004/
CVE ID: CVE-2021-43799 State: PUBLISHED Published: 2022-01-25T20:55:11.000Z Last Updated: 2025-04-23T19:09:13.932Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: zulip Products: zulip Problem Types: CWE-338 Description: Zulip is an open-source team collaboration tool. Zulip Server installs RabbitMQ for internal message passing. In versions of Zulip Server prior to 4.9, the initial installation (until first reboot, or restart of RabbitMQ) does not successfully limit the default ports which RabbitMQ opens; this includes port 25672, the RabbitMQ distribution port, which is used as a management port. RabbitMQ's default "cookie" which protects this port is generat
Q distribution port, which is used as a management port. RabbitMQ's default "cookie" which protects this port is generated using a weak PRNG, which limits the entropy of the password to at most 36 bits; in practicality, the seed for the randomizer is biased, resulting in approximately 20 bits of entropy. If other firewalls (at the OS or network level) do not protect port 25672, a remote attacker can brute-force the 20 bits of entropy in the "cookie" and leverage it for arbitrary execution of code as the rabbitmq user. They can also read all data which is sent through RabbitMQ, which includes all message traffic sent by users. Version 4.9 contains a patch for this vulnerability. As a workarou
MQ, which includes all message traffic sent by users. Version 4.9 contains a patch for this vulnerability. As a workaround, ensure that firewalls prevent access to ports 5672 and 25672 from outside the Zulip server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zulip/zulip/security/advisories/GHSA-p663-wxvv-2fjp - https://github.com/zulip/zulip/commit/a5496f4098e3998c9b84e8dc564aa983d6cdf6e8 - https://github.com/gteissier/erl-matter - https://github.com/zulip/zulip/releases/tag/4.9
CVE ID: CVE-2021-43800 State: PUBLISHED Published: 2021-12-06T18:50:10 Last Updated: 2024-08-04T04:03:08.802Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Requarks Products: wiki Problem Types: CWE-22 Description: Wiki.js is a wiki app built on Node.js. Prior to version 2.5.254, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled on a Windows host. A malicious user can potentially read any file on the file system by crafting a special URL that allows for directory traversal. This is only possible on a Wiki.js server running on Windows, when a storage module implementing local asset cach
ersal. This is only possible on a Wiki.js server running on Windows, when a storage module implementing local asset cache (e.g Local File System or Git) is enabled and that no web application firewall solution (e.g. cloudflare) strips potentially malicious URLs. Commit number 414033de9dff66a327e3f3243234852f468a9d85 fixes this vulnerability by sanitizing the path before it is passed on to the storage module. The sanitization step removes any windows directory traversal sequences from the path. As a workaround, disable any storage module with local asset caching capabilities (Local File System, Git). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Requarks/
(Local File System, Git). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Requarks/wiki/security/advisories/GHSA-r363-73gj-6j25 - https://github.com/Requarks/wiki/commit/414033de9dff66a327e3f3243234852f468a9d85 - https://github.com/Requarks/wiki/releases/tag/2.5.254
CVE ID: CVE-2021-43801 State: PUBLISHED Published: 2021-12-13T19:30:12 Last Updated: 2024-08-04T04:03:08.899Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: mercurius-js Products: mercurius Problem Types: CWE-754 Description: Mercurius is a GraphQL adapter for Fastify. Any users from Mercurius@8.10.0 to 8.11.1 are subjected to a denial of service attack by sending a malformed JSON to `/graphql` unless they are using a custom error handler. The vulnerability has been fixed in https://github.com/mercurius-js/mercurius/pull/678 and shipped as v8.11.2. As a workaround users may use a custom error handler. Additional Analyst Notes: - CVE Program Container: Referen
8.11.2. As a workaround users may use a custom error handler. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mercurius-js/mercurius/security/advisories/GHSA-273r-rm8g-7f3x - https://github.com/mercurius-js/mercurius/issues/677 - https://github.com/mercurius-js/mercurius/pull/678/commits/732b2f895312da8deadd7b173dcd2d141d54b223
CVE ID: CVE-2021-43802 State: PUBLISHED Published: 2021-12-09T22:35:12 Last Updated: 2024-08-04T04:03:08.907Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: ether Products: etherpad-lite Problem Types: CWE-790, CWE-1287 Description: Etherpad is a real-time collaborative editor. In versions prior to 1.8.16, an attacker can craft an `*.etherpad` file that, when imported, might allow the attacker to gain admin privileges for the Etherpad instance. This, in turn, can be used to install a malicious Etherpad plugin that can execute arbitrary code (including system commands). To gain privileges, the attacker must be able to trigger deletion of `express-session`
ode (including system commands). To gain privileges, the attacker must be able to trigger deletion of `express-session` state or wait for old `express-session` state to be cleaned up. Core Etherpad does not delete any `express-session` state, so the only known attacks require either a plugin that can delete session state or a custom cleanup process (such as a cron job that deletes old `sessionstorage:*` records). The problem has been fixed in version 1.8.16. If users cannot upgrade to 1.8.16 or install patches manually, several workarounds are available. Users may configure their reverse proxies to reject requests to `/p/*/import`, which will block all imports, not just `*.etherpad` imports;
their reverse proxies to reject requests to `/p/*/import`, which will block all imports, not just `*.etherpad` imports; limit all users to read-only access; and/or prevent the reuse of `express_sid` cookie values that refer to deleted express-session state. More detailed information and general mitigation strategies may be found in the GitHub Security Advisory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ether/etherpad-lite/security/advisories/GHSA-w3g3-qf3g-2mqc - https://github.com/ether/etherpad-lite/issues/5010 - https://github.com/ether/etherpad-lite/compare/b7065eb9a0ec7c3c265f8cfeb2534efe6f036456...77bcb507b30e762e9375b0511b3763e0162aae53 - htt
om/ether/etherpad-lite/compare/b7065eb9a0ec7c3c265f8cfeb2534efe6f036456...77bcb507b30e762e9375b0511b3763e0162aae53 - https://github.com/ether/etherpad-lite/releases/tag/1.8.16
CVE ID: CVE-2021-43803 State: PUBLISHED Published: 2021-12-09T23:50:10 Last Updated: 2024-08-04T04:03:08.709Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: vercel Products: next.js Problem Types: CWE-20 Description: Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0
not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vercel/next.js/security/advisories/GHSA-25mp-g6fv-mqxx - https://github.com/vercel/next.js/pull/32080 - https://github.com/vercel/next.js/commit/6d98b4fb4315dec1badecf0e9bdc212a4272b264 - https://github.com/vercel/next.js/releases/tag/v11.1.3 - https://github.com/vercel/next.js/releases/v12.0.5
CVE ID: CVE-2021-43804 State: PUBLISHED Published: 2021-12-22T00:00:00.000Z Last Updated: 2025-11-04T16:09:25.648Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: pjsip Products: pjproject Problem Types: CWE-125 Description: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming RTCP BYE message contains a reason's length, this declared length is not checked against the actual received packet size, potentially resulting in an out-of-bound read access. This issue affects all users that use PJMEDIA and RTCP. A mal
ize, potentially resulting in an out-of-bound read access. This issue affects all users that use PJMEDIA and RTCP. A malicious actor can send a RTCP BYE message with an invalid reason length. Users are advised to upgrade as soon as possible. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjsip/pjproject/security/advisories/GHSA-3qx3-cg72-wrh9 - https://github.com/pjsip/pjproject/commit/8b621f192cae14456ee0b0ade52ce6c6f258af1e - https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html - https://security.gentoo.org/glsa/202210-37 - https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html - https://www.debi
curity.gentoo.org/glsa/202210-37 - https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html - https://www.debian.org/security/2022/dsa-5285 - https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
CVE ID: CVE-2021-43805 State: PUBLISHED Published: 2021-12-07T17:25:09 Last Updated: 2024-08-04T04:03:08.816Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: solidusio Products: solidus Problem Types: CWE-1333 Description: Solidus is a free, open-source ecommerce platform built on Rails. Versions of Solidus prior to 3.1.4, 3.0.4, and 2.11.13 have a denial of service vulnerability that could be exploited during a guest checkout. The regular expression used to validate a guest order's email was subject to exponential backtracking through a fragment like `a.a.` Versions 3.1.4, 3.0.4, and 2.11.13 have been patched to use a different regular expression. The maintai
ment like `a.a.` Versions 3.1.4, 3.0.4, and 2.11.13 have been patched to use a different regular expression. The maintainers added a check for email addresses that are no longer valid that will print information about any affected orders that exist. If a prompt upgrade is not an option, a workaround is available. It is possible to edit the file `config/application.rb` manually (with code provided by the maintainers in the GitHub Security Advisory) to check email validity. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/solidusio/solidus/security/advisories/GHSA-qxmr-qxh6-2cc9 - https://github.com/solidusio/solidus/commit/9867153e01e3c3b898cdbcedd7b43375ea9
ecurity/advisories/GHSA-qxmr-qxh6-2cc9 - https://github.com/solidusio/solidus/commit/9867153e01e3c3b898cdbcedd7b43375ea922401
CVE ID: CVE-2021-43806 State: PUBLISHED Published: 2021-12-15T19:45:13 Last Updated: 2024-08-04T04:03:08.905Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Enalean Products: tuleap Problem Types: CWE-89 Description: Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does not sanitize properly user settings when constructing the SQL query to browse and search commits in the CVS repositories. A authenticated malicious user with read access to a CVS repository could execute arbitrary SQL queries. Tuleap instances without an active CVS repositories are not impacted. The following
could execute arbitrary SQL queries. Tuleap instances without an active CVS repositories are not impacted. The following versions contain the fix: Tuleap Community Edition 13.2.99.155, Tuleap Enterprise Edition 13.1-7, and Tuleap Enterprise Edition 13.2-6. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Enalean/tuleap/security/advisories/GHSA-x8fr-8gvw-cc4v - https://github.com/Enalean/tuleap/commit/b82be896b00a787ed46a77bd4700e8fccfe2e5ba - https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=b82be896b00a787ed46a77bd4700e8fccfe2e5ba - https://tuleap.net/plugins/tracker/?aid=24202
CVE ID: CVE-2021-43807 State: PUBLISHED Published: 2021-12-14T18:10:11 Last Updated: 2024-08-04T04:03:08.669Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: opencast Products: opencast Problem Types: CWE-290 Description: Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast versions prior to 9.10 allow HTTP method spoofing, allowing to change the assumed HTTP method via URL parameter. This allows attackers to turn HTTP GET requests into PUT requests or an HTTP form to send DELETE requests. This bypasses restrictions otherwise put on these types of requests and aids in cross-site request forgery (CSRF) attacks, which would other
ctions otherwise put on these types of requests and aids in cross-site request forgery (CSRF) attacks, which would otherwise not be possible. The vulnerability allows attackers to craft links or forms which may change the server state. This issue is fixed in Opencast 9.10 and 10.0. You can mitigate the problem by setting the `SameSite=Strict` attribute for your cookies. If this is a viable option for you depends on your integrations. We strongly recommend updating in any case. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/opencast/opencast/security/advisories/GHSA-j4mm-7pj3-jf7v - https://github.com/opencast/opencast/commit/59cb6731067283e54f15462be38b61
ast/security/advisories/GHSA-j4mm-7pj3-jf7v - https://github.com/opencast/opencast/commit/59cb6731067283e54f15462be38b6117d8b9ea8b#diff-9c5fb3d1b7e3b0f54bc5c4182965c4fe1f9023d449017cece3005d3f90e8e4d8 - https://github.com/opencast/opencast/commit/8f8271e1085f6f8e306c689d6a56b0bb8d076444
CVE ID: CVE-2021-43808 State: PUBLISHED Published: 2021-12-07T22:20:12 Last Updated: 2024-08-04T04:03:08.661Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: laravel Products: framework Problem Types: CWE-79 Description: Laravel is a web application framework. Laravel prior to versions 8.75.0, 7.30.6, and 6.20.42 contain a possible cross-site scripting (XSS) vulnerability in the Blade templating engine. A broken HTML element may be clicked and the user taken to another location in their browser due to XSS. This is due to the user being able to guess the parent placeholder SHA-1 hash by trying common names of sections. If the parent template contains an explo
to guess the parent placeholder SHA-1 hash by trying common names of sections. If the parent template contains an exploitable HTML structure an XSS vulnerability can be exposed. This vulnerability has been patched in versions 8.75.0, 7.30.6, and 6.20.42 by determining the parent placeholder at runtime and using a random hash that is unique to each request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw - https://github.com/laravel/framework/pull/39906 - https://github.com/laravel/framework/pull/39908 - https://github.com/laravel/framework/pull/39909 - https://github.com/laravel/framework/commit/b8
/framework/pull/39908 - https://github.com/laravel/framework/pull/39909 - https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b - https://github.com/laravel/framework/releases/tag/v6.20.42 - https://github.com/laravel/framework/releases/tag/v7.30.6 - https://github.com/laravel/framework/releases/tag/v8.75.0
CVE ID: CVE-2021-43809 State: PUBLISHED Published: 2021-12-08T18:50:12.000Z Last Updated: 2025-11-03T19:26:31.480Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: rubygems Products: rubygems Problem Types: CWE-88 Description: `Bundler` is a package for managing application dependencies in Ruby. In `bundler` versions before 2.2.33, when working with untrusted and apparently harmless `Gemfile`'s, it is not expected that they lead to execution of external code, unless that's explicit in the ruby code inside the `Gemfile` itself. However, if the `Gemfile` includes `gem` entries that use the `git` option with invalid, but seemingly harmless, values with a leading
e `Gemfile` includes `gem` entries that use the `git` option with invalid, but seemingly harmless, values with a leading dash, this can be false. To handle dependencies that come from a Git repository instead of a registry, Bundler uses various commands, such as `git clone`. These commands are being constructed using user input (e.g. the repository URL). When building the commands, Bundler versions before 2.2.33 correctly avoid Command Injection vulnerabilities by passing an array of arguments instead of a command string. However, there is the possibility that a user input starts with a dash (`-`) and is therefore treated as an optional argument instead of a positional one. This can lead to