Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-52288 State: PUBLISHED Published: 2024-11-11T19:10:48.919Z Last Updated: 2024-11-12T14:48:17.830Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: goToMain Products: libosdp Problem Types: CWE-924 Description: libosdp is an implementation of IEC 60839-11-5 OSDP (Open Supervised Device Protocol) and provides a C library with support for C++, Rust and Python3. In affected versions an unexpected `REPLY_CCRYPT` or `REPLY_RMAC_I` may be introduced into an active stream when they should not be. Once RMAC_I message can be sent during a session, attacker with MITM access to the communication may intercept the original RMAC_I reply and save it. While
ng a session, attacker with MITM access to the communication may intercept the original RMAC_I reply and save it. While the session continues, the attacker will record all of the replies and save them, till capturing the message to be replied (can be detected by ID, length or time based on inspection of visual activity next to the reader) Once attacker captures a session with the message to be replayed, he stops resetting the connection and waits for signal to perform the replay to of the PD to CP message (ex: by signaling remotely to the MIMT device or setting a specific timing). In order to replay, the attacker will craft a specific RMAC_I message in the proper seq of the execution, which
iming). In order to replay, the attacker will craft a specific RMAC_I message in the proper seq of the execution, which will result in reverting the RMAC to the beginning of the session. At that phase - attacker can replay all the messages from the beginning of the session. This issue has been addressed in commit `298576d9` which is included in release version 3.0.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/goToMain/libosdp/security/advisories/GHSA-xhjw-7vh5-qxqm - https://github.com/goToMain/libosdp/commit/298576d9214b48214092eebdd892ec77be085e5a
CVE ID: CVE-2024-52289 State: PUBLISHED Published: 2024-11-21T17:18:41.161Z Last Updated: 2025-09-23T18:21:58.900Z Vendors: goauthentik Products: authentik Problem Types: CWE-185 Description: authentik is an open-source identity provider. Redirect URIs in the OAuth2 provider in authentik are checked by RegEx comparison. When no Redirect URIs are configured in a provider, authentik will automatically use the first redirect_uri value received as an allowed redirect URI, without escaping characters that have a special meaning in RegEx. Similarly, the documentation did not take this into consideration either. Given a provider with the Redirect URIs set to https://foo.example.com, an attacker can
this into consideration either. Given a provider with the Redirect URIs set to https://foo.example.com, an attacker can register a domain fooaexample.com, and it will correctly pass validation. authentik 2024.8.5 and 2024.10.3 fix this issue. As a workaround, When configuring OAuth2 providers, make sure to escape any wildcard characters that are not intended to function as a wildcard, for example replace `.` with `\.`. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/goauthentik/authentik/security/advisories/GHSA-3q5w-6m3x-64gj - https://github.com/goauthentik/authentik/commit/85bb638243c8d7ea42ddd3b15b3f51a90d2b8c54
CVE ID: CVE-2024-52290 State: PUBLISHED Published: 2025-05-14T07:19:50.045Z Last Updated: 2025-05-14T13:21:31.315Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: lf-edge Products: ekuiper Problem Types: CWE-79 Description: LF Edge eKuiper is a lightweight internet of things (IoT) data analytics and stream processing engine. Prior to version 2.1.0 user with rights to modificate the service (e.g. kuiperUser role) can inject a cross-site scripting payload into Connection Configuration key `Name` (`confKey`) parameter. After this setup, when any user with access to this service (e.g. admin) tries to delete this key, a payload acts in the victim's browser. Versi
ny user with access to this service (e.g. admin) tries to delete this key, a payload acts in the victim's browser. Version 2.1.0 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/lf-edge/ekuiper/security/advisories/GHSA-9cwv-pxcr-hfjc
CVE ID: CVE-2024-52291 State: PUBLISHED Published: 2024-11-13T16:12:14.803Z Last Updated: 2024-11-13T18:52:15.774Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: craftcms Products: cms Problem Types: CWE-22 Description: Craft is a content management system (CMS). A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double file:// scheme (e.g., file://file:////). This enables the attacker to specify sensitive folders as the file system, leading to potential file overwriting through malicious uploads, unauthorized access to sensitive files, and, under certain conditions, remote code execution (RCE) via Server-Side
oads, unauthorized access to sensitive files, and, under certain conditions, remote code execution (RCE) via Server-Side Template Injection (SSTI) payloads. Note that this will only work if you have an authenticated administrator account with allowAdminChanges enabled. This is fixed in 5.4.6 and 4.12.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/craftcms/cms/security/advisories/GHSA-jrh5-vhr9-qh7q
CVE ID: CVE-2024-52292 State: PUBLISHED Published: 2024-11-13T16:08:32.698Z Last Updated: 2024-11-13T18:53:58.779Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: craftcms Products: cms Problem Types: CWE-552, CWE-22 Description: Craft is a content management system (CMS). The dataUrl function can be exploited if an attacker has write permissions on system notification templates. This function accepts an absolute file path, reads the file's content, and converts it into a Base64-encoded string. By embedding this function within a system notification template, the attacker can exfiltrate the Base64-encoded file content through a triggered system email notificat
ication template, the attacker can exfiltrate the Base64-encoded file content through a triggered system email notification. Once the email is received, the Base64 payload can be decoded, allowing the attacker to read arbitrary files on the server. This is fixed in 5.4.9 and 4.12.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/craftcms/cms/security/advisories/GHSA-cw6g-qmjq-6w2w
CVE ID: CVE-2024-52293 State: PUBLISHED Published: 2024-11-13T16:04:52.005Z Last Updated: 2024-11-13T18:56:00.590Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: craftcms Products: cms Problem Types: CWE-22 Description: Craft is a content management system (CMS). Prior to 4.12.2 and 5.4.3, Craft is missing normalizePath in the function FileHelper::absolutePath could lead to Remote Code Execution on the server via twig SSTI. This is a sequel to CVE-2023-40035. This vulnerability is fixed in 4.12.2 and 5.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/craftcms/cms/security/advisories/GHSA-f3cw-hg6r-chfv - https://github.
DP Vulnrichment: References: - https://github.com/craftcms/cms/security/advisories/GHSA-f3cw-hg6r-chfv - https://github.com/craftcms/cms/commit/123e48a696de1e2f63ab519d4730eb3b87beaa58
CVE ID: CVE-2024-52294 State: PUBLISHED Published: 2024-12-30T16:14:35.767Z Last Updated: 2024-12-30T16:52:29.814Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: khoj-ai Products: khoj Problem Types: CWE-639 Description: Khoj is a self-hostable artificial intelligence app. Prior to version 1.29.10, an Insecure Direct Object Reference (IDOR) vulnerability in the update_subscription endpoint allows any authenticated user to manipulate other users' Stripe subscriptions by simply modifying the email parameter in the request. The vulnerability exists in the subscription endpoint at `/api/subscription`. The endpoint uses an email parameter as a direct reference t
exists in the subscription endpoint at `/api/subscription`. The endpoint uses an email parameter as a direct reference to user subscriptions without verifying object ownership. While authentication is required, there is no authorization check to verify if the authenticated user owns the referenced subscription. The issue was fixed in version 1.29.10. Support for arbitrarily presenting an email for update has been deprecated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/khoj-ai/khoj/security/advisories/GHSA-hq4h-w933-jm6c - https://github.com/khoj-ai/khoj/commit/47d3c8c23597900af708bdc60aced3ae5d2064c1
CVE ID: CVE-2024-52295 State: PUBLISHED Published: 2024-11-13T15:49:20.363Z Last Updated: 2024-11-21T15:03:25.532Z Vendors: dataease Products: dataease Problem Types: CWE-798 Description: DataEase is an open source data visualization analysis tool. Prior to 2.10.2, DataEase allows attackers to forge jwt and take over services. The JWT secret is hardcoded in the code, and the UID and OID are hardcoded. The vulnerability has been fixed in v2.10.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dataease/dataease/security/advisories/GHSA-45v9-gfcv-xcq6 - https://github.com/dataease/dataease/commit/e755248d59543bcd668ace495f293ff735fa82e9
CVE ID: CVE-2024-52296 State: PUBLISHED Published: 2024-11-12T15:58:28.434Z Last Updated: 2024-11-19T17:01:59.287Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: goToMain Products: libosdp Problem Types: CWE-476 Description: libosdp is an implementation of IEC 60839-11-5 OSDP (Open Supervised Device Protocol) and provides a C library with support for C++, Rust and Python3. At ospd_common.c, on the osdp_reply_name function, any reply id between REPLY_ACK and REPLY_XRD is valid, but names array do not declare all of the range. On a case of an undefined reply id within the range, name will be null (name = names[reply_id - REPLY_ACK];). Null name will casue a c
n undefined reply id within the range, name will be null (name = names[reply_id - REPLY_ACK];). Null name will casue a crash on next line: if (name[0] == '\0') as null[0] is invalid. As this logic is not limited to a secure connection, attacker may trigger this vulnerability without any prior knowledge. This issue is fixed in 2.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/goToMain/libosdp/security/advisories/GHSA-7945-5mcv-f2pp - https://github.com/goToMain/libosdp/commit/24409e98a260176765956ec766a04cb35984fab1
CVE ID: CVE-2024-52297 State: PUBLISHED Published: 2024-11-12T15:54:29.775Z Last Updated: 2024-11-12T18:37:23.313Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: tolgee Products: tolgee-platform Problem Types: CWE-200 Description: Tolgee is an open-source localization platform. Tolgee 3.81.1 included the all configuration properties in the PublicConfiguratioDTO publicly exposed to users. This vulnerability is fixed in v3.81.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-3wr3-889v-pgcj - https://github.com/tolgee/tolgee-platform/pull/2481/files#diff-d16735590f0f2db7cd78
ity/advisories/GHSA-3wr3-889v-pgcj - https://github.com/tolgee/tolgee-platform/pull/2481/files#diff-d16735590f0f2db7cd782e2966fa18426b94b5e4030fa8b1f5e00cd55686fe7f - https://github.com/tolgee/tolgee-platform/pull/2689/files
CVE ID: CVE-2024-52298 State: PUBLISHED Published: 2024-11-13T15:42:42.501Z Last Updated: 2024-11-13T19:06:04.381Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: xwikisas Products: macro-pdfviewer Problem Types: CWE-615 Description: macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The PDF Viewer macro allows an attacker to view any attachment using the "Delegate my view right" feature as long as the attacker can view a page whose last author has access to the attachment. For this, the attacker only needs to provide the reference to a PDF file to the macro. To obtain the reference of the desired attachment, the attacker can access the Page
eference to a PDF file to the macro. To obtain the reference of the desired attachment, the attacker can access the Page Index, Attachments tab. Even if the UI shows N/A, the user can inspect the page and check the HTTP request that fetches the live data entries. The attachment URL is available in the returned JSON for all attachments, including protected ones and allows getting the necessary values. This vulnerability is fixed in version 2.5.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwikisas/macro-pdfviewer/security/advisories/GHSA-hph4-7j37-7c97
CVE ID: CVE-2024-52299 State: PUBLISHED Published: 2024-11-13T15:29:07.107Z Last Updated: 2024-11-14T13:58:59.615Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: xwikisas Products: macro-pdfviewer Problem Types: CWE-340 Description: macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Any user with view right on XWiki.PDFViewerService can access any attachment stored in the wiki as the "key" that is passed to prevent this is computed incorrectly, calling skip on the digest stream doesn't update the digest. This is fixed in 2.5.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwikisas/macro-pdfviewer/secur
.5.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwikisas/macro-pdfviewer/security/advisories/GHSA-522m-m242-jr9p
CVE ID: CVE-2024-52300 State: PUBLISHED Published: 2024-11-13T15:24:59.125Z Last Updated: 2024-11-13T19:10:59.349Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: xwikisas Products: macro-pdfviewer Problem Types: CWE-80 Description: macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The width parameter of the PDF viewer macro isn't properly escaped, allowing XSS for any user who can edit a page. XSS can impact the confidentiality, integrity and availability of the whole XWiki installation when an admin visits the page with the malicious code. This is fixed in 2.5.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
ith the malicious code. This is fixed in 2.5.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwikisas/macro-pdfviewer/security/advisories/GHSA-84wx-6vfp-5m6g
CVE ID: CVE-2024-52301 State: PUBLISHED Published: 2024-11-12T19:32:14.415Z Last Updated: 2024-12-21T17:02:39.839Z Vendors: laravel Products: framework Problem Types: CWE-88 Description: Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gi
n on non-cli SAPIs. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/laravel/framework/security/advisories/GHSA-gv7v-rgg6-548h
CVE ID: CVE-2024-52302 State: PUBLISHED Published: 2024-11-14T15:26:49.407Z Last Updated: 2024-11-14T15:57:49.416Z Vendors: OsamaTaher Products: Java-springboot-codebase Problem Types: CWE-434 Description: common-user-management is a robust Spring Boot application featuring user management services designed to control user access dynamically. There is a critical security vulnerability in the application endpoint /api/v1/customer/profile-picture. This endpoint allows file uploads without proper validation or restrictions, enabling attackers to upload malicious files that can lead to Remote Code Execution (RCE). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.co
lead to Remote Code Execution (RCE). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OsamaTaher/Java-springboot-codebase/security/advisories/GHSA-rhcq-44g3-5xcx - https://github.com/OsamaTaher/Java-springboot-codebase/commit/204402bb8b68030c14911379ddc82cfff00b8538
CVE ID: CVE-2024-52303 State: PUBLISHED Published: 2024-11-18T20:08:15.387Z Last Updated: 2024-11-19T14:45:27.044Z Vendors: aio-libs Products: aiohttp Problem Types: CWE-772 Description: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing a unique cache entry. An attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests. Those who use any middlewares wit
s of a server by sending a substantial number (100,000s to millions) of such requests. Those who use any middlewares with aiohttp.web should upgrade to version 3.10.11 to receive a patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/aio-libs/aiohttp/security/advisories/GHSA-27mf-ghqm-j3j8 - https://github.com/aio-libs/aiohttp/commit/bc15db61615079d1b6327ba42c682f758fa96936
CVE ID: CVE-2024-52304 State: PUBLISHED Published: 2024-11-18T20:12:48.612Z Last Updated: 2025-11-03T20:45:25.646Z Vendors: aio-libs Products: aiohttp Problem Types: CWE-444 Description: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixe
may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/aio-libs/aiohttp/security/advisories/GHSA-8495-4g3g-x7pr - https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71
CVE ID: CVE-2024-52305 State: PUBLISHED Published: 2024-11-13T15:20:20.679Z Last Updated: 2024-11-13T19:25:30.116Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: unopim Products: unopim Problem Types: CWE-616, CWE-692 Description: UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. A vulnerability exists in the Create User process, allowing the creation of a new admin account with an option to upload a profile image. An attacker can upload a malicious SVG file containing an embedded script. When the profile image is accessed, the embedded script executes, leading to the potential theft of session cookies. Thi
When the profile image is accessed, the embedded script executes, leading to the potential theft of session cookies. This vulnerability is fixed in 0.1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/unopim/unopim/security/advisories/GHSA-cgr4-c233-h733 - https://github.com/unopim/unopim/commit/9a0da7a0892c60f58df2351b5a9498dcb4cb8b7a
CVE ID: CVE-2024-52306 State: PUBLISHED Published: 2024-11-13T15:15:38.301Z Last Updated: 2024-11-13T20:01:56.693Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Laravel-Backpack Products: FileManager Problem Types: CWE-502 Description: FileManager provides a Backpack admin interface for files and folder. Prior to 3.0.9, deserialization of untrusted data from the mimes parameter could lead to remote code execution. This vulnerability is fixed in 3.0.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Laravel-Backpack/FileManager/security/advisories/GHSA-8237-957h-h2c2 - https://github.com/Laravel-Backpack/FileManager/commit/
l-Backpack/FileManager/security/advisories/GHSA-8237-957h-h2c2 - https://github.com/Laravel-Backpack/FileManager/commit/2830498b85e05fb3c92179053b4d7c4a0fdb880b
CVE ID: CVE-2024-52307 State: PUBLISHED Published: 2024-11-21T17:14:51.677Z Last Updated: 2024-11-27T16:03:20.897Z Vendors: goauthentik Products: authentik Problem Types: CWE-208 Description: authentik is an open-source identity provider. Due to the usage of a non-constant time comparison for the /-/metrics/ endpoint it was possible to brute-force the SECRET_KEY, which is used to authenticate the endpoint. The /-/metrics/ endpoint returns Prometheus metrics and is not intended to be accessed directly, as the Go proxy running in the authentik server container fetches data from this endpoint and serves it on a separate port (9300 by default), which can be scraped by Prometheus without being ex
om this endpoint and serves it on a separate port (9300 by default), which can be scraped by Prometheus without being exposed publicly. authentik 2024.8.5 and 2024.10.3 fix this issue. Since the /-/metrics/ endpoint is not intended to be accessed publicly, requests to the endpoint can be blocked by the reverse proxy/load balancer used in conjunction with authentik. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/goauthentik/authentik/security/advisories/GHSA-2xrw-5f2x-m56j - https://github.com/goauthentik/authentik/commit/5ea4580884f99369f0ccfe484c04cb03a66e65b8
CVE ID: CVE-2024-52308 State: PUBLISHED Published: 2024-11-14T22:55:38.693Z Last Updated: 2024-11-15T19:33:42.842Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: cli Products: cli Problem Types: CWE-77 Description: The GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH server when using `gh codespace ssh` or `gh codespace logs` commands. This has been patched in the cli v2.62.0. Developers connect to remote codespaces through an SSH server running within the devcontainer, which is generally provided through the [default devcontainer image]( https://docs.github.com/en/codespaces/setting-up-your-project-
erally provided through the [default devcontainer image]( https://docs.github.com/en/codespaces/setting-up-your-project-for-codespaces/adding-a-dev-container-... https://docs.github.com/en/codespaces/setting-up-your-project-for-codespaces/adding-a-dev-container-configuration/introduction-to-dev-containers#using-the-default-dev-container-configuration) . GitHub CLI [retrieves SSH connection details]( https://github.com/cli/cli/blob/30066b0042d0c5928d959e288144300cb28196c9/internal/codespaces/rpc/inv... https://github.com/cli/cli/blob/30066b0042d0c5928d959e288144300cb28196c9/internal/codespaces/rpc/invoker.go#L230-L244 ), such as remote username, which is used in [executing `ssh` commands]( ht
internal/codespaces/rpc/invoker.go#L230-L244 ), such as remote username, which is used in [executing `ssh` commands]( https://github.com/cli/cli/blob/e356c69a6f0125cfaac782c35acf77314f18908d/pkg/cmd/codespace/ssh.go#L2... https://github.com/cli/cli/blob/e356c69a6f0125cfaac782c35acf77314f18908d/pkg/cmd/codespace/ssh.go#L263 ) for `gh codespace ssh` or `gh codespace logs` commands. This exploit occurs when a malicious third-party devcontainer contains a modified SSH server that injects `ssh` arguments within the SSH connection details. `gh codespace ssh` and `gh codespace logs` commands could execute arbitrary code on the user's workstation if the remote username contains something like `-oPro