Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ced to allow and disallow a variety of scenarios to avoid opening or executing files on the filesystem without unduly impacting HTTP URLs. No known workarounds are available other than upgrading. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cli/go-gh/security/advisories/GHSA-g9f5-x53j-h563 - https://github.com/cli/go-gh/commit/a08820a13f257d6c5b4cb86d37db559ec6d14577 - https://github.com/cli/go-gh/blob/61bf393cf4aeea6d00a6251390f5f67f5b67e727/pkg/browser/browser.go
CVE ID: CVE-2025-48939 State: PUBLISHED Published: 2025-07-03T16:26:31.304Z Last Updated: 2025-07-03T19:15:22.798Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:L) Vendors: AmauriC Products: tarteaucitron.js Problem Types: CWE-138 Description: tarteaucitron.js is a compliant and accessible cookie banner. Prior to version 1.22.0, a vulnerability was identified in tarteaucitron.js where document.currentScript was accessed without verifying that it referenced an actual <script> element. If an attacker injected an HTML element, it could clobber the document.currentScript property. This causes the script to resolve incorrectly to an element instead of the <script> tag, lea
ent.currentScript property. This causes the script to resolve incorrectly to an element instead of the <script> tag, leading to unexpected behavior or failure to load the script path correctly. This issue arises because in some browser environments, named DOM elements become properties on the global document object. An attacker with control over the HTML could exploit this to change the CDN domain of tarteaucitron. This issue has been patched in version 1.22.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-q43x-79jr-cq98 - https://github.com/AmauriC/tarteaucitron.js/commit/230a3b69d363837acfa895823d841e06
ity/advisories/GHSA-q43x-79jr-cq98 - https://github.com/AmauriC/tarteaucitron.js/commit/230a3b69d363837acfa895823d841e0608826ba3
CVE ID: CVE-2025-48940 State: PUBLISHED Published: 2025-06-02T15:52:36.740Z Last Updated: 2025-06-02T16:06:00.967Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: mybb Products: mybb Problem Types: CWE-22 Description: MyBB is free and open source forum software. Prior to version 1.8.39, the upgrade component does not validate user input properly, which allows attackers to perform local file inclusion (LFI) via a specially crafted parameter value. In order to exploit the vulnerability, the installer must be unlocked (no `install/lock` file present) and the upgrade script must be accessible (by re-installing the forum via access to `install/index.php`; when the
sent) and the upgrade script must be accessible (by re-installing the forum via access to `install/index.php`; when the forum has not yet been installed; or the attacker is authenticated as a forum administrator). MyBB 1.8.39 resolves this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mybb/mybb/security/advisories/GHSA-q4jv-xwjx-37cp - https://github.com/mybb/mybb/commit/6e6cfbd524d9101b51e1278ecf520479b64b0f00 - https://mybb.com/versions/1.8.39
CVE ID: CVE-2025-48941 State: PUBLISHED Published: 2025-06-02T15:58:49.498Z Last Updated: 2025-06-02T16:07:10.790Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: mybb Products: mybb Problem Types: CWE-1230 Description: MyBB is free and open source forum software. Prior to version 1.8.39, the search component does not validate permissions correctly, which allows attackers to determine the existence of hidden (draft, unapproved, or soft-deleted) threads containing specified text in the title. The visibility state (`mybb_threads.visible` integer column) of threads is not validated in internal search queries, whose result is used to output a general success or
ger column) of threads is not validated in internal search queries, whose result is used to output a general success or failure of the search. While MyBB validates permissions when displaying the final search results, a search operation that internally produces at least one result outputs a redirect response (as a HTTP redirect, or a success message page with delayed redirect, depending on configuration). On the other hand, a search operation that internally produces no results outputs a corresponding message in the response without a redirect. This allows a user to determine whether threads matching title search parameters exist, including draft threads (`visible` with a value of `-2`), sof
ne whether threads matching title search parameters exist, including draft threads (`visible` with a value of `-2`), soft-deleted threads (`visible` with a value of `-1`), and unapproved threads (`visible` with a value of `0`); in addition to displaying generally visible threads (`visible` with a value of `1`). This vulnerability does not affect other layers of permissions. In order to exploit the vulnerability, the user must have access to the search functionality, and general access to forums containing the thread(s). The vulnerability does not expose the message content of posts. MyBB 1.8.39 resolves this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gith
of posts. MyBB 1.8.39 resolves this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mybb/mybb/security/advisories/GHSA-f847-57xc-ffwr - https://github.com/mybb/mybb/commit/b8cc332a27e145c33effaccec90e23c103ae5193 - https://mybb.com/versions/1.8.39
CVE ID: CVE-2025-48942 State: PUBLISHED Published: 2025-05-30T18:33:40.488Z Last Updated: 2025-05-30T20:37:06.015Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: vllm-project Products: vllm Problem Types: CWE-248 Description: vLLM is an inference and serving engine for large language models (LLMs). In versions 0.8.0 up to but excluding 0.9.0, hitting the /v1/completions API with a invalid json_schema as a Guided Param kills the vllm server. This vulnerability is similar GHSA-9hcf-v7m4-6m2j/CVE-2025-48943, but for regex instead of a JSON schema. Version 0.9.0 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com
hema. Version 0.9.0 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vllm-project/vllm/security/advisories/GHSA-6qc9-v4r8-22xg - https://github.com/vllm-project/vllm/issues/17248 - https://github.com/vllm-project/vllm/pull/17623 - https://github.com/vllm-project/vllm/commit/08bf7840780980c7568c573c70a6a8db94fd45ff
CVE ID: CVE-2025-48943 State: PUBLISHED Published: 2025-05-30T18:36:01.519Z Last Updated: 2025-05-30T18:56:18.715Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: vllm-project Products: vllm Problem Types: CWE-248 Description: vLLM is an inference and serving engine for large language models (LLMs). Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service (ReDoS) that causes the vLLM server to crash if an invalid regex was provided while using structured output. This vulnerability is similar to GHSA-6qc9-v4r8-22xg/CVE-2025-48942, but for regex instead of a JSON schema. Version 0.9.0 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment:
t for regex instead of a JSON schema. Version 0.9.0 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vllm-project/vllm/security/advisories/GHSA-9hcf-v7m4-6m2j - https://github.com/vllm-project/vllm/issues/17313 - https://github.com/vllm-project/vllm/pull/17623 - https://github.com/vllm-project/vllm/commit/08bf7840780980c7568c573c70a6a8db94fd45ff
CVE ID: CVE-2025-48944 State: PUBLISHED Published: 2025-05-30T18:38:45.505Z Last Updated: 2025-05-30T18:56:56.406Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: vllm-project Products: vllm Problem Types: CWE-20 Description: vLLM is an inference and serving engine for large language models (LLMs). In version 0.8.0 up to but excluding 0.9.0, the vLLM backend used with the /v1/chat/completions OpenAPI endpoint fails to validate unexpected or malformed input in the "pattern" and "type" fields when the tools functionality is invoked. These inputs are not validated before being compiled or parsed, causing a crash of the inference worker with a single request. Th
uts are not validated before being compiled or parsed, causing a crash of the inference worker with a single request. The worker will remain down until it is restarted. Version 0.9.0 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vllm-project/vllm/security/advisories/GHSA-vrq3-r879-7m65 - https://github.com/vllm-project/vllm/pull/17623
CVE ID: CVE-2025-48945 State: PUBLISHED Published: 2025-06-20T19:14:27.403Z Last Updated: 2025-06-20T20:06:23.612Z Vendors: aio-libs Products: aiodns Problem Types: CWE-416 Description: pycares is a Python module which provides an interface to c-ares. c-ares is a C library that performs DNS requests and name resolutions asynchronously. Prior to version 4.9.0, pycares is vulnerable to a use-after-free condition that occurs when a Channel object is garbage collected while DNS queries are still pending. This results in a fatal Python error and interpreter crash. The vulnerability has been fixed in pycares 4.9.0 by implementing a safe channel destruction mechanism. Additional Analyst Notes: - CI
ity has been fixed in pycares 4.9.0 by implementing a safe channel destruction mechanism. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/saghul/pycares/security/advisories/GHSA-5qpg-rh4j-qp35 - https://github.com/saghul/pycares/security/advisories/GHSA-5qpg-rh4j-qp35 - https://github.com/aio-libs/aiodns/commit/f259a6e3650555157af53ac2b39f2ff545321d55 - https://github.com/saghul/pycares/commit/ebfd7d71eb8e74bc1057a361ea79a5906db510d4 - https://github.com/aio-libs/aiodns/releases/tag/v3.5.0 - https://github.com/saghul/pycares/releases/tag/v4.9.0
CVE ID: CVE-2025-48946 State: PUBLISHED Published: 2025-05-30T19:21:14.847Z Last Updated: 2025-05-30T20:43:37.178Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: open-quantum-safe Products: liboqs Problem Types: CWE-327 Description: liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. liboqs prior to version 0.13.0 supports the HQC algorithm, an algorithm with a theoretical design flaw which leads to large numbers of malformed ciphertexts sharing the same implicit rejection value. Currently, no concrete attack on the algorithm is known. However, prospective users of HQC must take extra care when us
Currently, no concrete attack on the algorithm is known. However, prospective users of HQC must take extra care when using the algorithm in protocols involving key derivation. In particular, HQC does not provide the same security guarantees as Kyber or ML-KEM. There is currently no patch for the HQC flaw available in liboqs, so HQC is disabled by default in liboqs starting from version 0.13.0. OQS will update its implementation after the HQC team releases an updated algorithm specification. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/open-quantum-safe/liboqs/security/advisories/GHSA-3rxw-4v8q-9gq5 - https://github.com/open-quantum-safe/liboqs/commit/a
/open-quantum-safe/liboqs/security/advisories/GHSA-3rxw-4v8q-9gq5 - https://github.com/open-quantum-safe/liboqs/commit/a7d698ca9c9d98990647459253183cbe29c550af - https://durumcrustulum.com/2024/02/24/how-to-hold-kems/#hqc - https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/Wiu4ZQo3fP80
CVE ID: CVE-2025-48947 State: PUBLISHED Published: 2025-06-04T20:14:44.369Z Last Updated: 2025-06-04T20:50:02.568Z Vendors: auth0 Products: nextjs-auth0 Problem Types: CWE-525 Description: The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In Auth0 Next.js SDK versions 4.0.1 through 4.6.0, `__session` cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers. Three preconditions must be met in order for someone to be affected by the vulnerability: Applications using the NextJS-Auth0 SDK, versions between 4.0.1 to 4.6.0, applications using CDN or edge caching that caches responses with the Set-Cookie header, and if
between 4.0.1 to 4.6.0, applications using CDN or edge caching that caches responses with the Set-Cookie header, and if the Cache-Control header is not properly set for sensitive responses. Users should upgrade auth0/nextjs-auth0 to v4.6.1 to receive a patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-f3fg-mf2q-fj3f
CVE ID: CVE-2025-48948 State: PUBLISHED Published: 2025-05-30T19:25:41.422Z Last Updated: 2025-05-30T20:44:14.912Z Vendors: navidrome Products: navidrome Problem Types: CWE-863 Description: Navidrome is an open source web-based music collection server and streamer. A permission verification flaw in versions prior to 0.56.0 allows any authenticated regular user to bypass authorization checks and perform administrator-only transcoding configuration operations, including creating, modifying, and deleting transcoding settings. In the threat model where administrators are trusted but regular users are not, this vulnerability represents a significant security risk when transcoding is enabled. Vers
d but regular users are not, this vulnerability represents a significant security risk when transcoding is enabled. Version 0.56.0 patches the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/navidrome/navidrome/security/advisories/GHSA-f238-rggp-82m3 - https://github.com/navidrome/navidrome/pull/4096 - https://github.com/navidrome/navidrome/commit/e5438552c63fecb6284e1b179dddae91ede869c8
CVE ID: CVE-2025-48949 State: PUBLISHED Published: 2025-05-30T19:40:51.355Z Last Updated: 2025-05-30T20:45:32.298Z Vendors: navidrome Products: navidrome Problem Types: CWE-89 Description: Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulnerability due to improper input validation on the `role` parameter within the API endpoint `/api/artist`. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information. Version 0.56.0 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
ation. Version 0.56.0 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/navidrome/navidrome/security/advisories/GHSA-5wgp-vjxm-3x2r - https://github.com/navidrome/navidrome/commit/b19d5f0d3e079639904cac95735228f445c798b6
CVE ID: CVE-2025-48950 State: PUBLISHED Published: 2025-06-03T18:16:09.060Z Last Updated: 2025-06-03T18:36:25.824Z Vendors: 1Panel-dev Products: MaxKB Problem Types: CWE-276 Description: MaxKB is an open-source AI assistant for enterprise. Prior to version 1.10.8-lts, Sandbox only restricts the execution permissions of binary files in common directories, such as `/bin,/usr/bin`, etc. Therefore, attackers can exploit some files with execution permissions in non blacklisted directories to carry out attacks. Version 1.10.8-lts fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-p2qq-x9j2-px8v - https://gi
ADP Vulnrichment: References: - https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-p2qq-x9j2-px8v - https://github.com/1Panel-dev/MaxKB/pull/3127 - https://github.com/1Panel-dev/MaxKB/commit/187e9c1e4ea1ebb6864c5bf61558c42f2fc6c005 - https://github.com/1Panel-dev/MaxKB/releases/tag/v1.10.8-lts
CVE ID: CVE-2025-48951 State: PUBLISHED Published: 2025-06-03T20:52:35.064Z Last Updated: 2025-06-04T20:32:18.609Z Vendors: auth0 Products: auth0-PHP Problem Types: CWE-502 Description: Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. Versions 8.0.0-BETA3 prior to 8.3.1 contain a vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Applications using the Auth0-PHP SDK are affected, as are applications using the Auth0/symfony, Auth0/laravel-auth0, or Auth0/wordpress SDKs, because those SDKsrely on
d, as are applications using the Auth0/symfony, Auth0/laravel-auth0, or Auth0/wordpress SDKs, because those SDKsrely on the Auth0-PHP SDK versions from 8.0.0-BETA3 until 8.14.0. Version 8.3.1 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/auth0/auth0-PHP/security/advisories/GHSA-v9m8-9xxp-q492 - https://github.com/auth0/laravel-auth0/security/advisories/GHSA-c42h-56wx-h85q - https://github.com/auth0/symfony/security/advisories/GHSA-98j6-67v3-mw34 - https://github.com/auth0/wordpress/security/advisories/GHSA-862m-5253-832r - https://github.com/auth0/auth0-PHP/commit/04b1f5daa8bdfebc5e740ec5ca0fb2df1648a715
CVE ID: CVE-2025-48952 State: PUBLISHED Published: 2025-07-04T22:12:54.601Z Last Updated: 2025-07-08T13:51:33.982Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: jokob-sk Products: NetAlertX Problem Types: CWE-697 Description: NetAlertX is a network, presence scanner, and alert framework. Prior to version 25.6.7, a vulnerability in the authentication logic allows users to bypass password verification using SHA-256 magic hashes, due to loose comparison in PHP. In vulnerable versions of the application, a password comparison is performed using the `==` operator at line 40 in front/index.php. This introduces a security issue where specially crafted "magic ha
sing the `==` operator at line 40 in front/index.php. This introduces a security issue where specially crafted "magic hash" values that evaluate to true in a loose comparison can bypass authentication. Because of the use of `==` instead of the strict `===`, different strings that begin with 0e and are followed by only digits can be interpreted as scientific notation (i.e., zero) and treated as equal. This issue falls under the Login Bypass vulnerability class. Users with certain "weird" passwords that produce magic hashes are particularly affected. Services relying on this logic are at risk of unauthorized access. Version 25.6.7 fixes the vulnerability. Additional Analyst Notes: - CISA ADP V
logic are at risk of unauthorized access. Version 25.6.7 fixes the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jokob-sk/NetAlertX/security/advisories/GHSA-4p4p-vq2v-9489
CVE ID: CVE-2025-48953 State: PUBLISHED Published: 2025-06-03T18:19:28.771Z Last Updated: 2025-06-03T18:31:44.345Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: umbraco Products: Umbraco-CMS Problem Types: CWE-434 Description: Umbraco is an ASP.NET content management system (CMS). Starting in version 14.0.0 and prior to versions 15.4.2 and 16.0.0, it's possible to upload a file that doesn't adhere with the configured allowable file extensions via a manipulated API request. The issue is patched in versions 15.4.2 and 16.0.0. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/umbraco/Umbrac
rounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-fr6r-p8hv-x3c4 - https://github.com/umbraco/Umbraco-CMS/commit/d920e93d1ee29dc3301697e444f53e8cd5db3cf9
CVE ID: CVE-2025-48954 State: PUBLISHED Published: 2025-06-25T14:02:46.515Z Last Updated: 2025-06-25T14:19:13.945Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: discourse Products: discourse Problem Types: CWE-79 Description: Discourse is an open-source discussion platform. Versions prior to 3.5.0.beta6 are vulnerable to cross-site scripting when the content security policy isn't enabled when using social logins. Version 3.5.0.beta6 patches the issue. As a workaround, have the content security policy enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-26p5-mjjh-wfcf
CVE ID: CVE-2025-48955 State: PUBLISHED Published: 2025-06-02T11:11:22.722Z Last Updated: 2025-06-02T16:47:02.156Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Erudika Products: para Problem Types: CWE-532 Description: Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 exposes both access and secret keys in logs without redaction. These credentials are later reused in variable assignments for persistence but do not require logging for debugging or system health purposes. Version 1.50.8 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
ystem health purposes. Version 1.50.8 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Erudika/para/security/advisories/GHSA-v75g-77vf-6jjq - https://github.com/Erudika/para/commit/1e8a89558542854bb0683ab234c4429ad93b0835
CVE ID: CVE-2025-48956 State: PUBLISHED Published: 2025-08-21T14:41:03.889Z Last Updated: 2025-08-21T15:02:09.023Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: vllm-project Products: vllm Problem Types: CWE-400 Description: vLLM is an inference and serving engine for large language models (LLMs). From 0.1.0 to before 0.10.1.1, a Denial of Service (DoS) vulnerability can be triggered by sending a single HTTP GET request with an extremely large header to an HTTP endpoint. This results in server memory exhaustion, potentially leading to a crash or unresponsiveness. The attack does not require authentication, making it exploitable by any remote user. This vulne
sh or unresponsiveness. The attack does not require authentication, making it exploitable by any remote user. This vulnerability is fixed in 0.10.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vllm-project/vllm/security/advisories/GHSA-rxc4-3w6r-4v47 - https://github.com/vllm-project/vllm/pull/23267 - https://github.com/vllm-project/vllm/commit/d8b736f913a59117803d6701521d2e4861701944
CVE ID: CVE-2025-48957 State: PUBLISHED Published: 2025-06-02T11:16:14.370Z Last Updated: 2025-06-23T18:03:57.703Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: AstrBotDevs Products: AstrBot Problem Types: CWE-23 Description: AstrBot is a large language model chatbot and development framework. A path traversal vulnerability present in versions 3.4.4 through 3.5.12 may lead to information disclosure, such as API keys for LLM providers, account passwords, and other sensitive data. The vulnerability has been addressed in Pull Request #1676 and is included in version 3.5.13. As a workaround, users can edit the `cmd_config.json` file to disable the dashboard feat
is included in version 3.5.13. As a workaround, users can edit the `cmd_config.json` file to disable the dashboard feature as a temporary workaround. However, it is strongly recommended to upgrade to version v3.5.13 or later to fully resolve this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/AstrBotDevs/AstrBot/security/advisories/GHSA-cq37-g2qp-3c2p - https://github.com/AstrBotDevs/AstrBot/issues/1675 - https://github.com/AstrBotDevs/AstrBot/pull/1676 - https://github.com/AstrBotDevs/AstrBot/commit/cceadf222c46813c7f41115b40d371e7eb91e492