Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
packet matches the IPv6 address assigned to the Talos peer. However, it performs no validation on the packet's destination address. The Talos end of the SideroLink connection cannot be considered a trusted environment. Workloads running on Kubernetes, especially those configured with host networking, could gain direct access to this link. Therefore, a malicious workload could theoretically send arbitrary packets over the SideroLink interface. This issue has been patched in version 0.48.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/siderolabs/omni/security/advisories/GHSA-hqrf-67pm-wgfq - https://github.com/siderolabs/omni/commit/a5efd816a239e6c9e5ea7c
derolabs/omni/security/advisories/GHSA-hqrf-67pm-wgfq - https://github.com/siderolabs/omni/commit/a5efd816a239e6c9e5ea7c0d43c02c04504d7b60
CVE ID: CVE-2025-59825 State: PUBLISHED Published: 2025-09-23T20:00:44.253Z Last Updated: 2025-09-24T18:41:57.505Z Vendors: astral-sh Products: tokio-tar Problem Types: CWE-22, CWE-61 Description: astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of their intended destination directory when using the Entry::unpack_in_raw API. Additionally, the Entry::allow_external_symlinks control (which defaults to true) could be bypassed via a pair of symlinks that individually point within the destination but combine to point outside of it. These behaviors could be used individually or combined to
nt within the destination but combine to point outside of it. These behaviors could be used individually or combined to bypass the intended security control of limiting extraction to the given directory. This in turn would allow an attacker with a malicious tar archive to perform an arbitrary file write and potentially pivot into code execution. This issue has been patched in version 0.5.4. There is no workaround other than upgrading. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-3wgq-wrwc-vqmv - https://github.com/astral-sh/uv/issues/12163 - https://github.com/astral-sh/tokio-tar/commit/036fdecc85c52458ace92d
mv - https://github.com/astral-sh/uv/issues/12163 - https://github.com/astral-sh/tokio-tar/commit/036fdecc85c52458ace92dc9e02e9cef90684e75
CVE ID: CVE-2025-59826 State: PUBLISHED Published: 2025-09-23T20:26:26.517Z Last Updated: 2025-09-24T13:23:04.111Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: FlagForgeCTF Products: flagForge Problem Types: CWE-862 Description: Flag Forge is a Capture The Flag (CTF) platform. In version 2.1.0, non-admin users can create arbitrary challenges, potentially introducing malicious, incorrect, or misleading content. This issue has been patched in version 2.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-q7pg-qchv-3pc5
CVE ID: CVE-2025-59827 State: PUBLISHED Published: 2025-09-24T20:23:59.156Z Last Updated: 2025-09-24T20:39:24.431Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) Vendors: FlagForgeCTF Products: flagForge Problem Types: CWE-862 Description: Flag Forge is a Capture The Flag (CTF) platform. In version 2.1.0, the /api/admin/assign-badge endpoint lacks proper access control, allowing any authenticated user to assign high-privilege badges (e.g., Staff) to themselves. This could lead to privilege escalation and impersonation of administrative roles. This issue has been patched in version 2.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.c
sue has been patched in version 2.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-7944-xvv7-cv79
CVE ID: CVE-2025-59828 State: PUBLISHED Published: 2025-09-24T19:30:09.297Z Last Updated: 2025-09-24T19:49:14.654Z Vendors: anthropics Products: claude-code Problem Types: CWE-829, CWE-862 Description: Claude Code is an agentic coding tool. Prior to Claude Code version 1.0.39, when using Claude Code with Yarn versions 2.0+, Yarn plugins are auto-executed when running yarn --version. This could lead to a bypass of the directory trust dialog in Claude Code, as plugins would be executed prior to the user accepting the risks of working in an untrusted directory. Users running Yarn Classic were unaffected by this issue. This issue has been fixed in version 1.0.39. Users on standard Claude Code au
arn Classic were unaffected by this issue. This issue has been fixed in version 1.0.39. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest version. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/anthropics/claude-code/security/advisories/GHSA-2jjv-qf24-vfm4
CVE ID: CVE-2025-59829 State: PUBLISHED Published: 2025-10-03T20:03:02.999Z Last Updated: 2025-10-03T20:45:39.617Z Vendors: anthropics Products: claude-code Problem Types: CWE-61 Description: Claude Code is an agentic coding tool. Versions below 1.0.120 failed to account for symlinks when checking permission deny rules. If a user explicitly denied Claude Code access to a file and Claude Code had access to a symlink pointing to that file, it was possible for Claude Code to access the file. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest version. This issue is fixed in version 1.0.120. Addi
sers performing manual updates are advised to update to the latest version. This issue is fixed in version 1.0.120. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/anthropics/claude-code/security/advisories/GHSA-66m2-gx93-v996
CVE ID: CVE-2025-59830 State: PUBLISHED Published: 2025-09-25T14:37:06.967Z Last Updated: 2025-09-25T16:16:15.255Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: rack Products: rack Problem Types: CWE-400, CWE-770 Description: Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters than intended. Applications or middleware that directly invoke Rack::QueryParser with its default configuration (no explicit delimiter) could
tions or middleware that directly invoke Rack::QueryParser with its default configuration (no explicit delimiter) could be exposed to increased CPU and memory consumption. This can be abused as a limited denial-of-service vector. This issue has been patched in version 2.2.18. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rack/rack/security/advisories/GHSA-625h-95r8-8xpm - https://github.com/rack/rack/commit/54e4ffdd5affebcb0c015cc6ae74635c0831ed71
CVE ID: CVE-2025-59831 State: PUBLISHED Published: 2025-09-25T13:34:02.449Z Last Updated: 2025-09-25T14:43:16.185Z Vendors: snowyu Products: git-commiters.js Problem Types: CWE-77, CWE-78 Description: git-commiters is a Node.js function module providing committers stats for their git repository. Prior to version 0.1.2, there is a command injection vulnerability in git-commiters. This vulnerability manifests with the library's primary exported API: gitCommiters(options, callback) which allows specifying options such as cwd for current working directory and revisionRange as a revision pointer, such as HEAD. However, the library does not sanitize for user input or practice secure process execut
revision pointer, such as HEAD. However, the library does not sanitize for user input or practice secure process execution API to separate commands from their arguments and as such, uncontrolled user input is concatenated into command execution. This issue has been patched in version 0.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/snowyu/git-commiters.js/security/advisories/GHSA-g38c-wxjf-xrh6 - https://github.com/snowyu/git-commiters.js/commit/7f0abfedbf506e3a61ac875d91324a8dbe756e84
CVE ID: CVE-2025-59832 State: PUBLISHED Published: 2025-09-25T14:45:19.214Z Last Updated: 2025-09-25T15:48:38.332Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: horilla-opensource Products: horilla Problem Types: CWE-79 Description: Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, there is a stored XSS vulnerability in the ticket comment editor. A low-privilege authenticated user could run arbitrary JavaScript in an admin’s browser, exfiltrate the admin’s cookies/CSRF token, and hijack their session. This issue has been patched in version 1.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
heir session. This issue has been patched in version 1.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/horilla-opensource/horilla/security/advisories/GHSA-8x78-6q9g-hv2h - https://github.com/Mmo-kali/CVE/blob/main/CVE-2025-59832/2025-08-Horilla_Vulnerability_1.pdf
CVE ID: CVE-2025-59833 State: PUBLISHED Published: 2025-09-24T20:25:35.167Z Last Updated: 2025-09-24T20:44:08.116Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: FlagForgeCTF Products: flagForge Problem Types: CWE-200 Description: Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.1.0 to before 2.3.0, the API endpoint GET /api/problems/:id returns challenge hints in plaintext within the question object, regardless of whether the user has unlocked them via point deduction. Users can view all hints for free, undermining the business logic of the platform and reducing the integrity of the challenge system. This issue has been patched in version
siness logic of the platform and reducing the integrity of the challenge system. This issue has been patched in version 2.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-hm85-2j65-j8j2
CVE ID: CVE-2025-59834 State: PUBLISHED Published: 2025-09-25T13:41:15.676Z Last Updated: 2025-09-25T14:36:27.801Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: srmorete Products: adb-mcp Problem Types: CWE-77, CWE-78 Description: ADB MCP Server is a MCP (Model Context Protocol) server for interacting with Android devices through ADB. In versions 0.1.0 and prior, the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. This issue has been patched via commit 041729c. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.c
e has been patched via commit 041729c. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/srmorete/adb-mcp/security/advisories/GHSA-54j7-grvr-9xwg - https://github.com/srmorete/adb-mcp/commit/041729c0b25432df3199ff71b3163a307cf4c28c - https://github.com/srmorete/adb-mcp/blob/master/src/index.ts#L334-L355
CVE ID: CVE-2025-59835 State: PUBLISHED Published: 2025-10-02T18:59:42.808Z Last Updated: 2025-10-02T19:50:39.752Z Vendors: langbot-app Products: LangBot Problem Types: CWE-23, CWE-434 Description: LangBot is a global IM bot platform designed for LLMs. In versions 4.1.0 up to but not including 4.3.5, authorized attackers can exploit the /api/v1/files/documents interface to perform arbitrary file uploads. Since this interface does not strictly restrict the storage directory of files on the server, it is possible to upload dangerous files to specific system directories. This is fixed in version 4.3.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/langbot-a
is fixed in version 4.3.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/langbot-app/LangBot/security/advisories/GHSA-7j3j-qj83-9qv4 - https://github.com/langbot-app/LangBot/pull/1691 - https://github.com/langbot-app/LangBot/releases/tag/v4.3.5
CVE ID: CVE-2025-59836 State: PUBLISHED Published: 2025-10-13T20:43:40.844Z Last Updated: 2025-10-14T14:28:17.108Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: siderolabs Products: omni Problem Types: CWE-703, CWE-476 Description: Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, there is a nil pointer dereference vulnerability in the Omni Resource Service allows unauthenticated users to cause a server panic and denial of service by sending empty create/update resource requests through the API endpoints. The vulnerability exists in the isSensitiveSpec function which calls grpcomni.CreateResource without chec
API endpoints. The vulnerability exists in the isSensitiveSpec function which calls grpcomni.CreateResource without checking if the resource's metadata field is nil. When a resource is created with an empty Metadata field, the CreateResource function attempts to access resource.Metadata.Version causing a segmentation fault. This vulnerability is fixed in 1.1.5 and 1.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/siderolabs/omni/security/advisories/GHSA-4p3p-cr38-v5xp - https://github.com/siderolabs/omni/commit/1396083f766a1b0380e9949968d7fc17b7afecaa - https://github.com/siderolabs/omni/commit/1fd954af64985a8b3dbf5b11deddbf7cd953f5ae
CVE ID: CVE-2025-59837 State: PUBLISHED Published: 2025-10-28T19:54:28.683Z Last Updated: 2025-10-29T17:42:43.327Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: withastro Products: astro Problem Types: CWE-918, CWE-79 Description: Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery (SSRF) and potentially cross-site scripting (XSS). This vulnerability exists due to an incomplete fix for CVE-2025-58179. Fixed in 5.13.10. Additio
s-site scripting (XSS). This vulnerability exists due to an incomplete fix for CVE-2025-58179. Fixed in 5.13.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/withastro/astro/security/advisories/GHSA-qcpr-679q-rhm2 - https://github.com/withastro/astro/commit/1e2499e8ea83ebfa233a18a7499e1ccf169e56f4 - https://github.com/withastro/astro/commit/9ecf3598e2b29dd74614328fde3047ea90e67252
CVE ID: CVE-2025-59838 State: PUBLISHED Published: 2025-09-25T14:52:16.612Z Last Updated: 2025-10-28T15:22:28.927Z Vendors: monkeytypegame Products: monkeytype Problem Types: CWE-79 Description: Monkeytype is a minimalistic and customizable typing test. In versions 25.36.0 and prior, improper handling of user input when loading a saved custom text results in XSS. This issue has been fixed in version 25.44.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/monkeytypegame/monkeytype/security/advisories/GHSA-j4xx-fww5-774w - https://github.com/monkeytypegame/monkeytype/commit/f025b121cbe437e29de432b4aa72e0de22c755b7 - https://github.com/monkeytypegame/monkeyt
om/monkeytypegame/monkeytype/commit/f025b121cbe437e29de432b4aa72e0de22c755b7 - https://github.com/monkeytypegame/monkeytype/releases/tag/v25.44.0
CVE ID: CVE-2025-59839 State: PUBLISHED Published: 2025-09-25T13:56:13.804Z Last Updated: 2025-09-25T14:19:53.153Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: StarCitizenWiki Products: mediawiki-extensions-EmbedVideo Problem Types: CWE-79 Description: The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. In versions 4.0.0 and prior, the EmbedVideo extension allows adding arbitrary attributes to an HTML element, allowing for stored XSS through wikitext. This issue has been patched via commit 4e075d3. Additional Analyst Notes: - CISA ADP
ng for stored XSS through wikitext. This issue has been patched via commit 4e075d3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-4j5h-mvj3-m48v - https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/4e075d3dc9a15a3ee53f449a684d5ab847e52f01 - https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/blob/440fb331a84b2050f4cc084c1d31d58a1d1c202d/resources/ext.embedVideo.videolink.js#L5-L20 - https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/blob/440fb331a84b2050f4cc084c1d31d58a1d1c202d/resources/modules/iframe.js#L139-L155
CVE ID: CVE-2025-59840 State: PUBLISHED Published: 2025-11-13T19:54:26.256Z Last Updated: 2025-11-14T16:00:05.602Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: vega Products: vega Problem Types: CWE-79 Description: Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 6.2.0, applications meeting 2 conditions are at risk of arbitrary JavaScript code execution, even if "safe mode" expressionInterpreter is used. They are vulnerable if they use `vega` in an application that attaches `vega` library and a `vega.View` instance similar to the Vega Editor to the global `win
in an application that attaches `vega` library and a `vega.View` instance similar to the Vega Editor to the global `window` and if they allow user-defined Vega `JSON` definitions (vs JSON that was is only provided through source code). Patches are available in the following Vega applications. If using the latest Vega line (6.x), upgrade to `vega` `6.2.0` / `vega-expression` `6.1.0` / `vega-interpreter` `2.2.1` (if using AST evaluator mode). If using Vega in a non-ESM environment, upgrade to `vega-expression` `5.2.1` / `1.2.1` (if using AST evaluator mode). Some workarounds are available. Do not attach `vega` View instances to global variables, and do not attach `vega` to the global window.
are available. Do not attach `vega` View instances to global variables, and do not attach `vega` to the global window. These practices of attaching the vega library and View instances may be convenient for debugging, but should not be used in production or in any situation where vega/vega-lite definitions could be provided by untrusted parties. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vega/vega/security/advisories/GHSA-7f2v-3qq3-vvjf
CVE ID: CVE-2025-59841 State: PUBLISHED Published: 2025-09-25T15:15:45.438Z Last Updated: 2025-09-29T15:48:10.233Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: FlagForgeCTF Products: flagForge Problem Types: CWE-384, CWE-613 Description: Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation. Authenticated users can continue to access protected endpoints, such as /api/profile, even after logging out. CSRF tokens are also still valid post-logout, which can allow unauthorized actions. This issue has been patched in version 2.3.1. Additional Analyst Note
post-logout, which can allow unauthorized actions. This issue has been patched in version 2.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-h6pr-4cwv-6cjg - https://github.com/FlagForgeCTF/flagForge/commit/304b6c82a4f76871b336404b91e5cdd8a7d7d5bd
CVE ID: CVE-2025-59842 State: PUBLISHED Published: 2025-09-26T15:53:37.253Z Last Updated: 2025-09-26T17:52:42.227Z Vendors: jupyterlab Products: jupyterlab Problem Types: CWE-1022 Description: jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to version 4.4.8, links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the noopener attribute. This is deemed to have no impact on the default installations. Theoretically users of third-party LaTeX-rendering extensions could find themselves vulnerable to reverse tabnabbing attacks if links generat
f third-party LaTeX-rendering extensions could find themselves vulnerable to reverse tabnabbing attacks if links generated by those extensions included target=_blank (no such extensions are known at time of writing) and they were to click on a link generated in LaTeX (typically visibly different from other links). This issue has been patched in version 4.4.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-vvfj-2jqx-52jm - https://github.com/jupyterlab/jupyterlab/commit/88ef373039a8cc09f27d3814382a512d9033675c
CVE ID: CVE-2025-59843 State: PUBLISHED Published: 2025-09-26T16:03:34.038Z Last Updated: 2025-09-26T17:51:22.644Z Vendors: FlagForgeCTF Products: flagForge Problem Types: CWE-359 Description: Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.1, the public endpoint /api/user/[username] returns user email addresses in its JSON response. The problem has been patched in FlagForge version 2.3.1. The fix removes email addresses from public API responses while keeping the endpoint publicly accessible. Users should upgrade to version 2.3.1 or later to eliminate exposure. There are no workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichme
to eliminate exposure. There are no workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-qqjv-8r5p-7xpj
CVE ID: CVE-2025-59844 State: PUBLISHED Published: 2025-09-26T16:24:55.126Z Last Updated: 2025-09-26T17:31:50.867Z Vendors: SonarSource Products: sonarqube-scan-action Problem Types: CWE-78 Description: SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. A command injection vulnerability exists in SonarQube GitHub Action in version 4.0.0 to before version 6.0.0 when workflows pass user-controlled input to the args parameter on Windows runners without proper validation. This vulnerability bypasses a previous security fix and allows arbitrary command execution, potentially leading to exposure of sensitive environment variables and compr
fix and allows arbitrary command execution, potentially leading to exposure of sensitive environment variables and compromise of the runner environment. The vulnerability has been fixed in version 6.0.0. Users should upgrade to this version or later. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SonarSource/sonarqube-scan-action/security/advisories/GHSA-5xq9-5g24-4g6f - https://community.sonarsource.com/t/sonarqube-scanner-github-action-v6/149281 - https://github.com/SonarSource/sonarqube-scan-action/releases/tag/v6.0.0
CVE ID: CVE-2025-59845 State: PUBLISHED Published: 2025-09-26T22:38:57.350Z Last Updated: 2025-09-29T15:02:04.057Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N) Vendors: apollographql Products: embeddable-explorer Problem Types: CWE-346, CWE-352 Description: Apollo Studio Embeddable Explorer & Embeddable Sandbox are website embeddable software solutions from Apollo GraphQL. Prior to Apollo Sandbox version 2.7.2 and Apollo Explorer version 3.7.3, a cross-site request forgery (CSRF) vulnerability was identified. The vulnerability arises from missing origin validation in the client-side code that handles window.postMessage events. A malicious website can send forged mes