TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-c2g6-57fp-22wp
Summary: Malicious Package in fuffer-xor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:48:35Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-pjxp-f379-6284
Summary: Malicious Package in @fangrong/xoc
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-03T19:13:27Z

Version 1.0.6 of `@fangrong/xoc` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-8459-6rc9-8vf8
Summary: Path traversal in github.com/cloudflare/cfrpki/cmd/octorpki
Severity: LOW
CVSS score: 0
CWE: CWE-22
Published: 2022-02-14T22:52:15Z

### Impact

In the case that a malicious TAL file is parsed pointing to a repository that provides a malicious ROA file which octorpki downloads, it is possible to bypass the current directory traversal mitigation to allow writing outside of the current directory. 

### Patches

No patch release has been made
Vulnerability: GHSA-m658-p24x-p74r
Summary: TLS certificate validation error in Mellium
Aliases: CVE-2022-24968
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-295
Published: 2022-02-12T00:00:36Z

In Mellium mellium.im/xmpp through 0.21.0, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their control without causing TLS certificate verification to fail. This occurs because the wrong host name is selected during this verification.
Vulnerability: GHSA-5p67-cp9c-hqw4
Summary: Out-of-bounds write in ChakraCore
Aliases: CVE-2020-0848
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-07-28T18:57:19Z

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0768, CVE-2020-0823, CVE-2020-0825, CVE-2020-0826, CVE-2020-0827, CVE-2020-0828, CVE-2020-0829, CVE-2020-0830, CVE-2020-0831, CVE-2020-0832, CVE-2020-0833.
Vulnerability: GHSA-hw4r-xr38-hm8j
Summary: Downloads Resources over HTTP in unicode-json
Aliases: CVE-2016-10610
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:47:59Z

Affected versions of `unicode-json` insecurely downloads resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

Install version 2.0.0 or greater.
Vulnerability: GHSA-m72g-42q6-gvc2
Summary: Cross-site Scripting in LaraCMS
Aliases: CVE-2020-20129
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-10-04T20:13:11Z

LaraCMS contains a stored cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the content editor.
Vulnerability: GHSA-f4hh-xxqh-wgpq
Summary: Exposure of Sensitive Information to an Unauthorized Actor in LibreNMS
Aliases: CVE-2019-10667
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200
Published: 2019-10-11T18:43:20Z

An issue was discovered in LibreNMS through 1.47. Information disclosure can occur: an attacker can fingerprint the exact code version installed and disclose local file paths.
Vulnerability: GHSA-wvpv-ffcv-r6cw
Summary: Internal NCryptDecrypt method could be used externally from WindowsHello library.
Aliases: CVE-2020-11005
Severity: MODERATE
CVSS score: 5.1
CWE: CWE-288
Published: 2020-04-14T23:09:13Z

### Impact
Every user of the library before version 1.0.4.

### Patches
Patched in 1.0.4+.

### Workarounds
None.

### References
https://github.com/SeppPenner/WindowsHello/issues/3

### For more information
It this library is used to encrypt text and write the output to a txt file, another executable could be able to decrypt the text using the static method NCryptDecrypt from this same library  without the need to use Windows Hello Authentication again.
Vulnerability: GHSA-6gf2-pvqw-37ph
Summary: Log entry injection in Spring Framework
Aliases: CVE-2021-22060
Severity: MODERATE
CVSS score: 4.3
Published: 2022-01-12T23:04:06Z

In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.
Vulnerability: GHSA-9c22-pwxw-p6hx
Summary: Initializer reentrancy may lead to double initialization
Severity: LOW
CVSS score: 0
Published: 2021-12-14T21:47:33Z

### Impact

Initializer functions that are invoked separate from contract creation (the most prominent example being minimal proxies) may be reentered if they make an untrusted non-view external call.

Once an initializer has finished running it can never be re-executed. However, an exception put in place to support multiple inheritance made reentrancy possible in the scenario described above, breaking the expectation that there is a single execution.

Note that upgradeable proxies are commonly initialized together with contract creation, where reentrancy is not feasible, so the impact of this issue is believed to be minor.

### Patches

A fix is included in the version v4.4.1 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`.

### Workarounds

Avoid untrusted external calls during initialization.

### References
https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3006

### Credits

This issue was identified and reported by @chaitinblockchain through [our bug bounty on Immunefi](https://immunefi.com/bounty/openzeppelin/).

### For more information

If you have any questions or comments about this advisory, or need assistance executing the mitigation, email us at security@openzeppelin.com.
Vulnerability: GHSA-26j7-6w8w-7922
Summary: Division by zero in optimized pooling implementations in TFLite
Aliases: CVE-2021-29586
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:26:43Z

### Impact
Optimized pooling implementations in TFLite fail to check that the stride arguments are not 0 before calling [`ComputePaddingHeightWidth`](https://github.com/tensorflow/tensorflow/blob/3f24ccd932546416ec906a02ddd183b48a1d2c83/tensorflow/lite/kernels/pooling.cc#L90).

Since users can craft special models which will have `params->stride_{height,width}` be zero, this will result in a division by zero.
                          
### Patches
We have patched the issue in GitHub commit [5f7975d09eac0f10ed8a17dbb6f5964977725adc](https://github.com/tensorflow/tensorflow/commit/5f7975d09eac0f10ed8a17dbb6f5964977725adc).
      
The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
      
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-q8hg-pf8v-cxrv
Summary: Non-constant time comparison in UriSigner
Aliases: CVE-2019-18887
Severity: HIGH
CVSS score: 8.1
Published: 2022-03-26T00:22:49Z

When checking the signature of an URI (an ESI fragment URL for instance), the URISigner did not used a constant time string comparison function, resulting in a potential remote timing attack vulnerability.
Vulnerability: GHSA-wfwm-chj7-w59r
Summary: Moderate severity vulnerability that affects ox
Aliases: CVE-2017-16229
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-125
Published: 2018-03-05T18:29:32Z

In the Ox gem 2.8.1 for Ruby, the process crashes with a stack-based buffer over-read in the read_from_str function in sax_buf.c when a crafted input is supplied to sax_parse.
Vulnerability: GHSA-crfx-5phg-hmw9
Summary: Cross-Site Scripting in ids-enterprise
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2019-06-13T18:59:12Z

Versions of `ids-enterprise` prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). Script tags in the `soho-autocomplete` component are not properly encoded and may allow attackers to execute arbitrary JavaScript.


## Recommendation

Upgrade to version 4.18.2 or later
Vulnerability: GHSA-cwvc-87xq-pc5m
Summary: Out-of-bounds Write and Race Condition in metrics-util
Aliases: CVE-2021-45704
Severity: HIGH
CVSS score: 8.1
CWE: CWE-362, CWE-787
Published: 2022-01-06T22:08:43Z

An issue was discovered in the metrics-util crate before 0.7.0 for Rust. There is a data race and memory corruption because AtomicBucket<T> unconditionally implements the Send and Sync traits.
Vulnerability: GHSA-278g-rq84-9hmg
Summary: `CHECK`-fail in `MapStage`
Aliases: CVE-2021-37673
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-20
Published: 2021-08-25T14:41:36Z

### Impact
An attacker can trigger a denial of service via a `CHECK`-fail in `tf.raw_ops.MapStage`:

```python
import tensorflow as tf
  
tf.raw_ops.MapStage(
  key=tf.constant([], shape=[0, 0, 0, 0], dtype=tf.int64),
  indices=tf.constant((0), dtype=tf.int32),
  values=[tf.constant((0), dtype=tf.int32)],
  dtypes=[tf.int32,
  tf.int64],
  capacity=0,
  memory_limit=0,
  container='',
  shared_name='')
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/map_stage_op.cc#L513) does not check that the `key` input is a valid non-empty tensor.
  
### Patches
We have patched the issue in GitHub commit [d7de67733925de196ec8863a33445b73f9562d1d](https://github.com/tensorflow/tensorflow/commit/d7de67733925de196ec8863a33445b73f9562d1d).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security  guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-q674-xm3x-2926
Summary: Uncontrolled Resource Consumption in parse-link-header
Aliases: CVE-2021-23490
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2022-01-06T21:37:02Z

The package parse-link-header before 2.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the checkHeader function.
Vulnerability: GHSA-p2r2-h92r-w2mg
Summary: Directory Traversal in mfrserver
Aliases: CVE-2017-16213
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T18:11:03Z

Affected versions of `mfrserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-fmm9-3gv8-58f4
Summary: Improper Handling of Missing Values in kaml
Aliases: CVE-2021-39194
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-835, CWE-230
Published: 2021-09-07T23:08:40Z

### Impact
Attackers that could provide arbitrary YAML input to an application that uses kaml could cause the application to endlessly loop while parsing the input. This could result in resource starvation and denial of service. 

This only affects applications that use polymorphic serialization with the default tagged polymorphism style. Applications using the property polymorphism style are not affected.

YAML input for a polymorphic type that provided a tag but no value for the object would trigger the issue, for example:

```yaml
!<x>
```

The following is a sample application that demonstrates this issue:

```kotlin
import com.charleskorn.kaml.Yaml
import kotlinx.serialization.SerialName
import kotlinx.serialization.Serializable

@Serializable
private sealed class K {
    @Serializable
    @SerialName("x")
    data class X(
        val property: String? = null,
    ) : K()
}

const val s = """
!<x>
"""

fun main() {
    println("Started.")
    val result = Yaml.default.decodeFromString(K.serializer(), s)
    println("Finished, result is $result")
}
```

On vulnerable versions of kaml, the `decodeFromString()` operation hangs and never returns. 


### Patches
Version 0.35.3 or later contain the fix for this issue.
Vulnerability: GHSA-7rr7-rcjw-56vj
Summary: High severity vulnerability that affects activestorage
Aliases: CVE-2018-16477
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-200
Published: 2018-12-05T17:17:02Z

A bypass vulnerability in Active Storage >= 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the `content-disposition` and `content-type` parameters which can be used in with HTML files and have them executed inline. Additionally, if combined with other techniques such as cookie bombing and specially crafted AppCache manifests, an attacker can gain access to private signed URLs within a specific storage path.
Vulnerability: GHSA-gffv-5hr2-f9gj
Summary: Incorrect results in orion
Aliases: CVE-2018-20999
Severity: HIGH
CVSS score: 7.5
CWE: CWE-682
Published: 2021-08-25T20:43:18Z

An issue was discovered in the orion crate before 0.11.2 for Rust. reset() calls cause incorrect results.
Vulnerability: GHSA-pghf-347x-c2gj
Summary: SQL Injection via in django-debug-toolbar
Aliases: CVE-2021-30459
Severity: HIGH
CVSS score: 0
CWE: CWE-89
Published: 2021-04-16T19:53:28Z

### Impact
With Django Debug Toolbar attackers are able to execute SQL by changing the `raw_sql` input of the SQL explain, analyze or select forms and submitting the form.

**NOTE:** This is a high severity issue for anyone using the toolbar in a **production environment**.

Generally the Django Debug Toolbar team only maintains the latest version of django-debug-toolbar, but an exception was made because of the high severity of this issue.

### Patches
Please upgrade to one of the following versions, depending on the major version you're using:

- Version 1.x: [django-debug-toolbar 1.11.1](https://pypi.org/project/django-debug-toolbar/1.11.1/)
- Version 2.x: [django-debug-toolbar 2.2.1](https://pypi.org/project/django-debug-toolbar/2.2.1/)
- Version 3.x: [django-debug-toolbar 3.2.1](https://pypi.org/project/django-debug-toolbar/3.2.1/)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [django-debug-toolbar repo](https://github.com/jazzband/django-debug-toolbar/issues/new)  (Please NO SENSITIVE INFORMATION, send an email instead!)
* Email us at [security@jazzband.co](mailto:security@jazzband.co)
Vulnerability: GHSA-5x3v-2gxr-59m2
Summary: Directory traversal in Apache RocketMQ
Aliases: CVE-2019-17572
Severity: MODERATE
CVSS score: 0
CWE: CWE-22
Published: 2020-07-01T17:26:15Z

In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in brokers, which leads to a directory traversal vulnerability. Users of the affected versions should apply one of the following: Upgrade to Apache RocketMQ 4.6.1 or later.
Vulnerability: GHSA-9g8h-pjm4-q92p
Summary: Out-of-bounds Write in OpenCV.
Aliases: CVE-2018-5268
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-787
Published: 2021-10-12T22:23:41Z

In OpenCV 3.3.1 (corresponding with OpenCV-Python 3.3.1.11), a heap-based buffer overflow happens in cv::Jpeg2KDecoder::readComponent8u in modules/imgcodecs/src/grfmt_jpeg2000.cpp when parsing a crafted image file.
Vulnerability: GHSA-4fjv-pmhg-3rfg
Summary: Multiple cryptographic issues in Python oic
Aliases: CVE-2020-26244
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-325, CWE-347
Published: 2020-12-04T16:47:12Z

### Impact
* Client implementations using this library

### Issues
1) The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg.
2) JWA `none` algorithm was allowed in all flows.
3) `oic.consumer.Consumer.parse_authz` returns an unverified IdToken. The verification of the token was left to the discretion of the implementator.
4) `iat` claim was not checked for sanity (i.e. it could be in the future)

### Patches
1) IdToken signature is now always checked.
2) JWA `none` algorithm is now allowed only if using the `response_type` `code`
3) IdToken verification is now done automatically.
4) `iat` claim is now checked for sanity.
Vulnerability: GHSA-mx67-wv8x-hvv9
Summary: Deserialization of Untrusted Data in msgpack
Aliases: CVE-2021-23410
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2021-07-26T21:24:09Z

# Withdrawn

This advisory was withdrawn by its CNA (Snyk).

## Original advisory

All versions of package `msgpack` are vulnerable to Deserialization of Untrusted Data via the unpack function. This does not affect the similarly named package `@msgpack/msgpack`.
Vulnerability: GHSA-xhr8-mpwq-2rr2
Summary: Automatic named constructor discovery in Valinor
Severity: HIGH
CVSS score: 0
Published: 2022-04-01T13:39:45Z

## Design issue - automatic constructor discovery

The issue arises when upgrading from `cuyz/valinor:0.3.0` to a newer system on an existing application, which broke due to the wrong constructor being picked.

Still, a bigger security concern is problematic, and it is akin to https://github.com/rails/rails/issues/5228.

## Example exploit

Take following DTO example:

```php
final class UserDTO
{
    public function __construct(
        public int $id,
        public string $name
    ) {}
    public static function fromDb(
        PDO $connection,
        int $id
    ): self { /* ... code to fetch the DTO here ... */ }
}
```

There is nothing inherently unsafe about the above `UserDTO`, but when mixed with `cuyz/valinor:^0.5.0` ( specifically https://github.com/CuyZ/Valinor/commit/718d3c1bc2ea7d28b4b1f6c062addcd1dde8660b ), it is an explosive mix:

```php
// this could be coming from user input:
$maliciousPayload = [
    'connection' => [
      'dsn' => 'mysql:host=some-host;database=some-database',
      'username' => 'root',
      'password' => 'root',
      'options' => [
        // PDO::MYSQL_ATTR_INIT_COMMAND === 1002
        1002 => 'DROP DATABASE all-the-moneys'
      ]
    ],
    'id' => 123,
];

$treeMapper->map(
  UserDTO::class,
  $maliciousPayload
); // your DB is gone :D
```

The above payload is represented in PHP form, but may as well be input JSON, HTML or x-form-urlencoded.

## Mitigation

Version 0.7.0 contains a patch for this issue.

Automatic named constructor resolution should be disabled - only explicitly mapped named constructors should be used/discovered.
Vulnerability: GHSA-4q8f-5xxj-946r
Summary: Command Injection in addax
Severity: HIGH
CVSS score: 0
CWE: CWE-77
Published: 2020-09-03T02:40:51Z

Versions of `addax` prior to 1.1.0 are vulnerable to Command Injection. The package does not validate user input on the `presignPath` function which receives input directly from the API endpoint. Exploiting the vulnerability requires authentication. This may allow attackers to run arbitrary commands in the system.


## Recommendation

Upgrade to version 1.1.0 or later.
Vulnerability: GHSA-226w-6hhj-69hp
Summary: Malicious Package in cal_rd
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T19:06:52Z

Version 0.1.1 of `rc_cal` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-mm6g-mmq6-53ff
Summary: Path Traversal in SharpZipLib
Aliases: CVE-2021-32842
Severity: MODERATE
CVSS score: 4
CWE: CWE-22
Published: 2022-02-01T16:23:00Z

SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.0.0 and prior to version 1.3.3, a check was added if the destination file is under a destination directory. However, it is not enforced that `_baseDirectory` ends with slash. If the _baseDirectory is not slash terminated like `/home/user/dir` it is possible to create a file with a name thats begins as the destination directory one level up from the directory, i.e. `/home/user/dir.sh`. Because of the file name and destination directory constraints, the arbitrary file creation impact is limited and depends on the use case. Version 1.3.3 fixed this vulnerability.
Vulnerability: GHSA-3rmv-2pg5-xvqj
Summary: High severity vulnerability that affects org.springframework:spring-core
Aliases: CVE-2018-1275
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94, CWE-358
Published: 2018-10-17T20:28:00Z

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.
Vulnerability: GHSA-p225-pc2x-4jpm
Summary: Incorrect Authorization in keycloak
Aliases: CVE-2020-1725
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-668, CWE-863
Published: 2022-02-09T00:58:52Z

A flaw was found in keycloak before version 13.0.0. In some scenarios a user still has access to a resource after changing the role mappings in Keycloak and after expiration of the previous access token.
Vulnerability: GHSA-f6g6-54hm-fhxv
Summary: Data races in libsbc
Aliases: CVE-2020-36440
Severity: HIGH
CVSS score: 8.1
CWE: CWE-119, CWE-362
Published: 2021-08-25T20:59:02Z

Affected versions of this crate implements `Send` for `Decoder<R>` for any `R: Read`. This allows `Decoder<R>` to contain `R: !Send` and carry (move) it to another thread.

This can result in undefined behavior such as memory corruption from data race on `R`, or dropping `R = MutexGuard<_>` from a thread that didn't lock the mutex.

The flaw was corrected in commit a34d6e1 by adding trait bound `R: Send` to the `Send` impl for `Decoder<R>`.
Vulnerability: GHSA-cfwc-xjfp-44jg
Summary: Command Injection in gnuplot
Severity: CRITICAL
CVSS score: 0
CWE: CWE-77
Published: 2020-09-04T17:19:48Z

All versions of `gnuplot` are vulnerable to Command Injection. The package fails to sanitize plot titles, which may allow attackers to execute arbitrary code in the system if the title value is supplied by a user. The following proof-of-concept creates a `testing` file in the current directory:

```
var gnuplot = require('gnuplot');

const title = '"\nset title system("touch testing")\n#';

gnuplot()
.set('term png')
.set('output "out.png"')
.set(`title "${title}"`)
.set('xrange [-10:10]')
.set('yrange [-2:2]')
.set('zeroaxis')
.plot('(x/4)**2, sin(x), 1/x')
.end();
```


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-xcf7-cj8q-pcjm
Summary: XSS vulnerability in Author URL of themes in Mautic
Aliases: CVE-2018-11198
Severity: LOW
CVSS score: 0
CWE: CWE-79
Published: 2021-01-19T21:16:14Z

### Impact
An XSS vulnerability was discovered in Mautic 2.13.1 in the Author URL of themes.

### Patches
Update to 2.14 or later

### Workarounds
None

### References
https://github.com/mautic/mautic/releases/tag/2.14.0

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Vulnerability: GHSA-x8rq-rc7x-5fg5
Summary: uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF)
Aliases: CVE-2022-0086
Severity: HIGH
CVSS score: 8.2
CWE: CWE-918
Published: 2022-01-06T22:24:35Z

uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF) via IPv4-mapped IPv6 addresses.
Vulnerability: GHSA-mm7v-vpv8-xfc3
Summary: Double free in smallvec
Aliases: CVE-2019-15551
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-415
Published: 2021-08-25T20:44:59Z

An issue was discovered in the smallvec crate before 0.6.10 for Rust. There is a double free for certain grow attempts with the current capacity.
Vulnerability: GHSA-89px-ww3j-g2mm
Summary: 2FA bypass in Wagtail through new device path
Aliases: CVE-2019-16766
Severity: HIGH
CVSS score: 8.7
CWE: CWE-304, CWE-290
Published: 2019-11-29T17:05:59Z

## 2FA bypass through new device path

### Impact
If someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS.

### Patches
This problem has been patched in version 1.3.0.

### Workarounds
There is no workaround at the moment.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [github.com/labd/wagtail-2fa](https://github.com/labd/wagtail-2fa)
* Email us at [security@labdigital.nl](mailto:security@labdigital.nl)
Vulnerability: GHSA-hj69-c76v-86wr
Summary: Out-of-bounds Read in Pillow
Aliases: CVE-2020-5313
Severity: HIGH
CVSS score: 7.1
CWE: CWE-125
Published: 2020-04-01T16:36:00Z

libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.
Vulnerability: GHSA-v585-23hc-c647
Summary: Unsafe Deserialization in jackson-databind
Aliases: CVE-2020-36186
Severity: HIGH
CVSS score: 8.1
CWE: CWE-502
Published: 2021-11-19T20:13:06Z

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.
Vulnerability: GHSA-5jfw-35xp-5m42
Summary: Buffer length underflow in LoginPacket causing unchecked exceptions to be thrown
Severity: HIGH
CVSS score: 7.5
CWE: CWE-124
Published: 2022-04-05T17:53:22Z

### Impact
`LoginPacket` uses `BinaryStream->getLInt()` to read the lengths of JSON payloads it wants to decode. Unfortunately, `BinaryStream->getLInt()` returns a signed integer, meaning that a malicious client can craft a packet with a large uint32 value for payload buffer size (which would be interpreted as a negative signed int32), causing `BinaryStream->get()` to throw an exception.

In the context of PocketMine-MP, this leads to a server crash when the vulnerability is exploited.

### Patches
e3fce7632b94e83fd6a518a87dcaf6a11681c4ac

### Workarounds
This can be worked around by registering a custom `LoginPacket` implementation into `PacketPool` which overrides [this code](https://github.com/pmmp/BedrockProtocol/blob/47532c95ea37d5f0365b23f734d70d943ff95295/src/LoginPacket.php#L54) to patch it.

### For more information
* Email us at [team@pmmp.io](mailto:team@pmmp.io)
Vulnerability: GHSA-xcp8-hh74-f6mc
Summary: Moderate severity vulnerability that affects oslo.middleware
Aliases: CVE-2017-2592
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-532
Published: 2018-07-13T15:16:45Z

python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).
Vulnerability: GHSA-j52r-xc68-q8f4
Summary: Insufficiently Protected Credentials in Pivotal Reactor Netty
Aliases: CVE-2019-11284
Severity: HIGH
CVSS score: 8.6
CWE: CWE-522
Published: 2019-10-23T14:14:32Z

Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.
Vulnerability: GHSA-vcjj-xf2r-mwvc
Summary: XSS in knockout
Aliases: CVE-2019-14862
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2020-04-01T15:47:45Z

There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.
Vulnerability: GHSA-fmj5-wv96-r2ch
Summary: Moderate severity vulnerability that affects org.apache.httpcomponents:httpclient
Aliases: CVE-2015-5262
Severity: MODERATE
CVSS score: 0
Published: 2018-10-17T00:05:29Z

http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.
Vulnerability: GHSA-653m-r33x-39ff
Summary: Moderate severity vulnerability that affects geminabox
Aliases: CVE-2017-16792
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2017-11-29T23:20:14Z

Stored cross-site scripting (XSS) vulnerability in "geminabox" (Gem in a Box) before 0.13.10 allows attackers to inject arbitrary web script via the "homepage" value of a ".gemspec" file, related to views/gem.erb and views/index.erb.
Vulnerability: GHSA-57qf-82hh-2hmc
Summary: Cross-site Scripting in LiveHelperChat
Aliases: CVE-2022-0502
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-02-07T00:00:30Z

LiveHelperChat prior to version 3.93 is vulnerable to cross-site scripting.
Vulnerability: GHSA-8c9x-wfgj-v78w
Summary: Open Redirect in showdoc
Aliases: CVE-2021-4000
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-601
Published: 2021-12-16T15:31:58Z

showdoc is vulnerable to URL Redirection to Untrusted Site
Vulnerability: GHSA-7rjp-fgwj-47rw
Summary: Missing authentication in ShenYu
Aliases: CVE-2022-23945
Severity: HIGH
CVSS score: 7.5
CWE: CWE-862, CWE-306
Published: 2022-01-28T22:14:11Z

Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
Vulnerability: GHSA-7j34-xq9v-9mqg
Summary: Out-of-bounds write in ChakraCore
Aliases: CVE-2020-0827
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-07-28T18:56:52Z

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0768, CVE-2020-0823, CVE-2020-0825, CVE-2020-0826, CVE-2020-0828, CVE-2020-0829, CVE-2020-0830, CVE-2020-0831, CVE-2020-0832, CVE-2020-0833, CVE-2020-0848.
Vulnerability: GHSA-j3ch-vjph-8q6v
Summary: Command injection in Alluxio
Aliases: CVE-2022-23848
Severity: CRITICAL
CVSS score: 9.8
Published: 2022-02-21T00:00:19Z

In Alluxio before 2.7.3, the logserver does not validate the input stream. NOTE: this is not the same as the CVE-2021-44228 Log4j vulnerability.
Vulnerability: GHSA-4ppp-gpcr-7qf6
Summary: HTTP Request Smuggling: Content-Length Sent Twice in Waitress
Severity: CRITICAL
CVSS score: 0
CWE: CWE-444
Published: 2019-12-20T23:04:35Z

### Impact

Waitress would header fold a double `Content-Length` header and due to being unable to cast the now comma separated value to an integer would set the `Content-Length` to 0 internally.

So a request with:

```
Content-Length: 10
Content-Length: 10
```

would get transformed to:

```
Content-Length: 10, 10
```

Which would Waitress would then internally set to `Content-Lenght: 0`.

Waitress would then treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining.

### Patches

This issue is fixed in Waitress 1.4.0. This brings a range of changes to harden Waitress against potential HTTP request confusions, and may change the behaviour of Waitress behind non-conformist proxies. 

The Pylons Project recommends upgrading as soon as possible, while validating that the changes in Waitress don't cause any changes in behavior.

### Workarounds

Various reverse proxies may have protections against sending potentially bad HTTP requests to the backend, and or hardening against potential issues like this. If the reverse proxy doesn't use HTTP/1.1 for connecting to the backend issues are also somewhat mitigated, as HTTP pipelining does not exist in HTTP/1.0 and Waitress will close the connection after every single request (unless the Keep Alive header is explicitly sent... so this is not a fool proof security method).

### Issues/more security issues:

* open an issue at https://github.com/Pylons/waitress/issues (if not sensitive or security related)
* email the Pylons Security mailing list: pylons-project-security@googlegroups.com (if security related)
Vulnerability: GHSA-px4h-xg32-q955
Summary: ReDoS in normalize-url
Aliases: CVE-2021-33502
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-06-08T23:11:43Z

The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.
Vulnerability: GHSA-6x33-pw7p-hmpq
Summary: Denial of Service in http-proxy
Severity: HIGH
CVSS score: 0
Published: 2020-09-04T17:59:49Z

Versions of `http-proxy` prior to 1.18.1 are vulnerable to Denial of Service. An HTTP request with a long body triggers an `ERR_HTTP_HEADERS_SENT` unhandled exception that crashes the proxy server. This is only possible when the proxy server sets headers in the proxy request using the `proxyReq.setHeader` function.   

For a proxy server running on `http://localhost:3000`, the following curl request triggers the unhandled exception:  
```curl -XPOST http://localhost:3000 -d "$(python -c 'print("x"*1025)')"```


## Recommendation

Upgrade to version 1.18.1 or later
Vulnerability: GHSA-h4pc-gx2w-f2xv
Summary: Heap OOB read in TFLite
Aliases: CVE-2021-29606
Severity: HIGH
CVSS score: 7.1
CWE: CWE-125
Published: 2021-05-21T14:28:24Z

### Impact
A specially crafted TFLite model could trigger an OOB read on heap in the TFLite implementation of [`Split_V`](https://github.com/tensorflow/tensorflow/blob/c59c37e7b2d563967da813fa50fe20b21f4da683/tensorflow/lite/kernels/split_v.cc#L99):

```cc
const int input_size = SizeOfDimension(input, axis_value);
``` 

If `axis_value` is not a value between 0 and `NumDimensions(input)`, then the [`SizeOfDimension` function](https://github.com/tensorflow/tensorflow/blob/102b211d892f3abc14f845a72047809b39cc65ab/tensorflow/lite/kernels/kernel_util.h#L148-L150) will access data outside the bounds of the tensor shape array:

```cc
inline int SizeOfDimension(const TfLiteTensor* t, int dim) {
  return t->dims->data[dim];
}
```
  
### Patches 
We have patched the issue in GitHub commit [ae2daeb45abfe2c6dda539cf8d0d6f653d3ef412](https://github.com/tensorflow/tensorflow/commit/ae2daeb45abfe2c6dda539cf8d0d6f653d3ef412).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-35fr-h7jr-hh86
Summary: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') in Armeria
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-113, CWE-74
Published: 2019-12-06T18:55:47Z

Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting, which allows remote attackers to inject arbitrary HTTP headers via CRLF sequences when unsanitized data is used to populate the headers of an HTTP response.

### Impact

1. Cross-User Defacement
2. Cache Poisoning
3. Cross-Site Scripting (XSS)
4. Page Hijacking


### Root Cause

The root cause is due to the usage of Netty without the HTTP header validation.

https://github.com/line/armeria/blob/f0d870fde1088114070be31b67f7df0a21e835c6/core/src/main/java/com/linecorp/armeria/common/DefaultHttpHeaders.java#L23

### Patches

This vulnerability has been patched in 0.97.0.

### References

[CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')](https://cwe.mitre.org/data/definitions/113.html)
https://github.com/ratpack/ratpack/security/advisories/GHSA-mvqp-q37c-wf9j

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [GitHub](https://github.com/line/armeria/issues)
Vulnerability: GHSA-657v-jjf8-83gh
Summary: Malicious Package in jsmsha3
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T23:14:55Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-h8jc-jmrf-9h8f
Summary: Improper Authentication and Insecure Default Initialization of Resource in Argo API
Aliases: CVE-2020-8828
Severity: HIGH
CVSS score: 8.8
CWE: CWE-287, CWE-1188
Published: 2021-07-26T21:19:27Z

As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be kept secret and could wind up just about anywhere.
Vulnerability: GHSA-vpx7-vm66-qx8r
Summary: Path Traversal in github.com/unknwon/cae/zip
Aliases: CVE-2020-7664
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2021-05-18T20:31:06Z

The ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide.
Vulnerability: GHSA-h9vc-2p9g-63gp
Summary: Exposure of Sensitive Information to an Unauthorized Actor in pimcore
Aliases: CVE-2022-0565
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2022-02-15T00:02:47Z

Exposure of Sensitive Information to an Unauthorized Actor in Packagist pimcore/pimcore prior to 10.3.1.
Vulnerability: GHSA-4cfr-gjfx-fj3x
Summary: Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.
Aliases: CVE-2021-40324
Severity: HIGH
CVSS score: 0
CWE: CWE-434
Published: 2021-10-05T17:53:11Z

Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.
Vulnerability: GHSA-vm64-cfqx-3698
Summary: Code Injection in jsen
Aliases: CVE-2020-7777
Severity: HIGH
CVSS score: 7.2
CWE: CWE-94
Published: 2022-02-10T20:18:37Z

This affects all versions of package jsen. If an attacker can control the schema file, it could run arbitrary JavaScript code on the victim machine. In the module description and README file there is no mention about the risks of untrusted schema files, so I assume that this is applicable. In particular the required field of the schema is not properly sanitized. The resulting string that is build based on the schema definition is then passed to a Function.apply();, leading to an Arbitrary Code Execution.
Vulnerability: GHSA-g7p8-r2ch-4rmf
Summary: Malicious Atomix node queries expose sensitive information
Aliases: CVE-2020-35215
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-668
Published: 2021-12-17T20:41:45Z

An issue in Atomix v3.1.5 allows attackers to access sensitive information when a malicious Atomix node queries distributed variable primitives which contain the entire primitive lists that ONOS nodes use to share important states.
Vulnerability: GHSA-qxmr-qxh6-2cc9
Summary: ReDos vulnerability on guest checkout email validation
Aliases: CVE-2021-43805
Severity: HIGH
CVSS score: 7.5
CWE: CWE-1333
Published: 2021-12-07T22:01:47Z

### Impact
Denial of service vulnerability that could be exploited during a guest checkout. The regular expression used to validate a guest order's email was subject to exponential backtracking through a fragment like `a.a.`.

Before the patch, it can be reproduced in the console like this:

```ruby
irb(main)> Spree::EmailValidator::EMAIL_REGEXP.match "a@a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.@"
processing time: 54.293660s
=> nil
```

To reproduce in the browser, fill in the "Customer Email" field with that fake email address during a guest checkout. Before that, you should open the browser dev tools and change the `type` attribute for that field from `email` to `text`. After entering a fake address and pressing the "Save & Continue" button, the browser will take a long term to perform the request before showing an error message for the invalid address. Eventually, making the email string even longer could lead to the exhaustion of server resources.


### Patches
Versions 3.1.4, 3.0.4, and 2.11.13 have been patched to use a different regular expression.

There's an improbable chance that some orders in your system end up having associated an email address that is no longer valid. We've added a task to check precisely that:

```bash
bin/rails solidus:check_orders_with_invalid_email
```

The above will print information for every affected order if any.

### Workarounds

If a prompt upgrade is not an option, please, add the following to `config/application.rb`:

```ruby
config.after_initialize do
  Spree::EmailValidator.send(:remove_const, :EMAIL_REGEXP)
  Spree::EmailValidator::EMAIL_REGEXP = URI::MailTo::EMAIL_REGEXP
end
```

### References

- https://en.wikipedia.org/wiki/ReDoS
- https://snyk.io/blog/redos-and-catastrophic-backtracking/

### For more information
If you have any questions or comments about this advisory:
* Open an [issue](https://github.com/solidusio/solidus/issues) or a [discussion](https://github.com/solidusio/solidus/discussions) in Solidus.
* Email us at [security@solidus.io](mailto:security@soliidus.io)
* Contact the core team on [Slack](http://slack.solidus.io/)
Vulnerability: GHSA-j7xg-5549-jr3j
Summary: Improper Certificate Validation in OWASP ZAP
Aliases: CVE-2022-27820
Severity: MODERATE
CVSS score: 4
CWE: CWE-295
Published: 2022-03-25T00:00:34Z

OWASP Zed Attack Proxy (ZAP) through w2022-03-21 does not verify the TLS certificate chain of an HTTPS server.
Vulnerability: GHSA-hcw3-j74m-qc58
Summary: Incorrect Calculation in github.com/open-policy-agent/opa
Aliases: CVE-2022-23628
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-682
Published: 2022-02-09T22:17:37Z

### Impact

Under certain conditions, pretty-printing an AST that contains synthetic nodes could change the logic of some statements by reordering array literals. Example of policies impacted are those that parse and compare web paths, see the example below.

**All of these** three conditions have to be met to create an adverse effect:

1. An AST of Rego had to be **created programmatically** such that it ends up containing terms without a location (such as wildcard variables).
2. The AST had to be **pretty-printed** using the `github.com/open-policy-agent/opa/format` package.
3. The result of the pretty-printing had to be **parsed and evaluated again** via an OPA instance using the bundles, or the Golang packages.

If any of these three conditions are not met, you are not affected.

Notably, all three would be true if using **optimized bundles**, i.e. bundles created with `opa build -O=1` or higher.
In that case, the optimizer would fulfil condition (1.), the result of that would be pretty-printed when writing the bundle to disk, fulfilling (2.). When the bundle was then used, we'd satisfy (3.).

#### Example
For example, the process outlined above could turn 
this rule
```rego
hello {
	["foo", _] = split(input.resource, "/")
}
```

into
```rego
hello {
	[_, "foo"] = split(input.resource, "/")
}
```

with an input of
```rego
{
    "resource": "foo/bar"
}
```

the result would change from
```rego
{
    "hello": true
}
```
to (no default value of hello)
```rego
{}
```

The severity was determined to be *moderate* because the conditions are quite particular. Please note that its only the OPA bundle build process thats affected. An OPA sidecar of version 0.36.0 with an optimized bundle built by OPA 0.32.1 would not face this bug.

### Patches

Fixed in version 0.37.2.

### Workarounds

- Disabling optimization when creating bundles.

### References

- Introduced in https://github.com/open-policy-agent/opa/pull/3851
- Backported for the 0.33.1 patch release: https://github.com/open-policy-agent/opa/commit/bfd984ddf93ef2c4963a08d4fdadae0bcf1a3717
- Fixed by https://github.com/open-policy-agent/opa/commit/932e4ffc37a590ace79e9b75ca4340288c220239 and https://github.com/open-policy-agent/opa/commit/2bd8edab9e10e2dc9cf76ae8335ced0c224f3055

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [Community Discussions](https://github.com/open-policy-agent/community/discussions/categories/opa-and-rego)
* Ask in Slack: https://slack.openpolicyagent.org/
Vulnerability: GHSA-4hjg-cx88-g9f9
Summary: Data races in futures-intrusive
Aliases: CVE-2020-35915
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-362
Published: 2021-08-25T20:49:58Z

An issue was discovered in the futures-intrusive crate before 0.4.0 for Rust. GenericMutexGuard allows cross-thread data races of non-Sync types.
Vulnerability: GHSA-7vxc-chqj-h83g
Summary: showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-4168
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-352
Published: 2022-01-06T22:02:18Z

showdoc is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-xp9c-82x8-7f67
Summary: Prototype Pollution in Node-Red
Aliases: CVE-2021-21297
Severity: HIGH
CVSS score: 7.7
CWE: CWE-1321, CWE-915
Published: 2021-02-26T16:31:05Z

### Impact

Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in the admin API. A badly formed request can modify the prototype of the default JavaScript Object with the potential to affect the default behaviour of the Node-RED runtime.

### Patches

The vulnerability is patched in the 1.2.8 release.

### Workarounds

A workaround is to ensure only authorised users are able to access the editor url.

### For more information
If you have any questions or comments about this advisory:
* Email us at [team@nodered.org](mailto:team@nodered.org)

### Acknowledgements

Thanks to the Tencent Woodpecker Security Team for disclosing this vulnerability.