TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-m57c-4vvx-gjgq
Summary: Format string vulnerabilities in pancurses
Aliases: CVE-2019-15546
Severity: HIGH
CVSS score: 7.5
CWE: CWE-134
Published: 2021-08-25T20:58:27Z

An issue was discovered in the pancurses crate through 0.16.1 for Rust. printw and mvprintw have format string vulnerabilities.
Vulnerability: GHSA-894g-6j7q-2hx6
Summary: Cross site scripting in flask-admin
Aliases: CVE-2018-16516
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-12-19T19:23:52Z

helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL.
Vulnerability: GHSA-c38m-7h53-g9v4
Summary: Path traversal in Apache James
Aliases: CVE-2021-40525
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-22
Published: 2022-01-21T23:36:47Z

Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any file. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade. Distributed and Cassandra based products are also not impacted.
Vulnerability: GHSA-whww-v56c-cgv2
Summary: Deserialization of Untrusted Data in Apache Dubbo
Aliases: CVE-2020-1948
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2022-02-10T22:39:17Z

This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More details can be found below.
Vulnerability: GHSA-6x45-86q6-rcmr
Summary: Gyazo allows local users to write arbitrary files
Aliases: CVE-2014-4994
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-20
Published: 2018-01-22T23:17:39Z

lib/gyazo/client.rb in the gyazo gem 1.0.0 for Ruby allows local users to write to arbitrary files via a symlink attack on a temporary file, related to time-based filenames.
Vulnerability: GHSA-hvr8-466p-75rh
Summary: Integer overflow discovered in Pillow 
Aliases: CVE-2016-4009
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-119
Published: 2018-07-24T20:15:48Z

Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, which triggers a heap-based buffer overflow.
Vulnerability: GHSA-hxhj-hp9m-qwc4
Summary: Moderate severity vulnerability that affects private_address_check
Aliases: CVE-2017-0904
Severity: MODERATE
CVSS score: 0
CWE: CWE-242
Published: 2017-11-29T23:21:05Z

The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security measures, such as when used to blacklist private network addresses to prevent server-side request forgery.
Vulnerability: GHSA-h65f-jvqw-m9fj
Summary: Infinite Loop in Apache Xerces Java
Aliases: CVE-2022-23437
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-91
Published: 2022-01-27T16:13:07Z

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.
Vulnerability: GHSA-hxhm-3vj9-6cqh
Summary: Downloads Resources over HTTP in apk-parser2
Aliases: CVE-2016-10632
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2018-09-18T13:49:31Z

Affected versions of `apk-parser2` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `apk-parser2`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not been updated since 2014.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-6879-xr95-5gf4
Summary: Malicious Package in malicious-do-not-install
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T17:20:15Z

All versions of `malicious-do-not-install` contain malicious code. The package copies the contents of `/etc/passwd` and `/etc/shadow` to files in the local `/tmp/` folder.


## Recommendation

Remove the package from your environment and rotate affected credentials.
Vulnerability: GHSA-9w7h-3wwh-6m5q
Summary: Cross-site Scripting in Microweber
Aliases: CVE-2022-1439
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-79
Published: 2022-04-23T00:03:02Z

Microweber prior to 1.2.15 is vulnerable to reflected cross-site scripting on demo.microweber.org/demo/module/. This allows the execution of arbitrary JavaScript as the attacked user.
Vulnerability: GHSA-5cf4-jqwp-584g
Summary: Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main
Aliases: CVE-2018-11767
Severity: HIGH
CVSS score: 7.4
CWE: CWE-269
Published: 2019-03-25T16:17:32Z

In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system uses non-default groups mapping mechanisms.
Vulnerability: GHSA-pvrc-hg3f-58r6
Summary: Heap OOB access in `Dilation2DBackpropInput`
Aliases: CVE-2021-29566
Severity: LOW
CVSS score: 2.5
CWE: CWE-787
Published: 2021-05-21T14:25:13Z

### Impact
An attacker can write outside the bounds of heap allocated arrays by passing invalid arguments to `tf.raw_ops.Dilation2DBackpropInput`:

```python
import tensorflow as tf
    
input_tensor = tf.constant([1.1] * 81, shape=[3, 3, 3, 3], dtype=tf.float32)
filter = tf.constant([], shape=[0, 0, 3], dtype=tf.float32)
out_backprop = tf.constant([1.1] * 1062, shape=[3, 2, 59, 3], dtype=tf.float32)

tf.raw_ops.Dilation2DBackpropInput(
  input=input_tensor, filter=filter, out_backprop=out_backprop, 
  strides=[1, 40, 1, 1], rates=[1, 56, 56, 1], padding='VALID')
```

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/afd954e65f15aea4d438d0a219136fc4a63a573d/tensorflow/core/kernels/dilation_ops.cc#L321-L322) does not validate before writing to the output array.
  
```cc               
in_backprop(b, h_in_max, w_in_max, d) += out_backprop(b, h_out, w_out, d);
```                 
    
The values for `h_out` and `w_out` are guaranteed to be in range for `out_backprop` (as they are loop indices bounded by the size of the array). However, there are no similar guarantees relating `h_in_max`/`w_in_max` and `in_backprop`.

### Patches
We have patched the issue in GitHub commit [3f6fe4dfef6f57e768260b48166c27d148f3015f](https://github.com/tensorflow/tensorflow/commit/3f6fe4dfef6f57e768260b48166c27d148f3015f).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-w8xh-93qh-35vw
Summary: Unrestricted Upload of File with Dangerous Type in Payload
Aliases: CVE-2022-27952
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-434
Published: 2022-04-13T00:00:22Z

An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file.
Vulnerability: GHSA-m8fm-mv5w-33pv
Summary: Command Injection in psnode
Aliases: CVE-2021-23375
Severity: HIGH
CVSS score: 7.3
CWE: CWE-77
Published: 2021-05-06T15:52:59Z

This affects all current versions of package psnode. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
Vulnerability: GHSA-m8pw-h8qj-rgj9
Summary: Downloads Resources over HTTP in ipip-coffee
Aliases: CVE-2016-10673
Severity: MODERATE
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:44:24Z

Affected versions of `ipip-coffee` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. This could impact the integrity and availability of the data being used to make geolocation decisions by an application.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-629c-j867-3v45
Summary: Malicious Package in bitcoisnj-lib
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-04T16:41:04Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-xpv2-8ppj-79hh
Summary: Expression injection in AviatorScript
Aliases: CVE-2021-41862
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-74
Published: 2021-10-04T20:14:31Z

AviatorScript through 5.2.7 allows code execution via an expression that is encoded with Byte Code Engineering Library (BCEL).
Vulnerability: GHSA-8rf6-w2mx-4xjh
Summary: TODO
Aliases: CVE-2019-15149
Severity: CRITICAL
CVSS score: 0
Published: 2019-08-19T23:45:47Z

** DISPUTED ** core.py in Mitogen before 0.2.8 has a typo that drops the unidirectional-routing protection mechanism in the case of a child that is initiated by another child. The Ansible extension is unaffected. NOTE: the vendor disputes this issue because it is exploitable only in conjunction with hypothetical other factors, i.e., an affected use case within a library caller, and a bug in the message receiver policy code that led to reliance on this extra protection mechanism.
Vulnerability: GHSA-gcvv-gq92-x94r
Summary: Authenticated server-side request forgery in file upload via URL.
Aliases: CVE-2021-37711
Severity: HIGH
CVSS score: 8.8
CWE: CWE-918
Published: 2021-08-23T19:42:49Z

### Impact
Authenticated server-side request forgery in file upload via URL.

### Patches
We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Vulnerability: GHSA-rggq-f2wf-m6cp
Summary: Malicious Package in jajajejejiji
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T18:31:08Z

All versions of `jajajejejiji` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-hv4w-jhcj-6wfw
Summary: Cross-Site Scripting in snekserve
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-03T20:34:23Z

All versions of `snekserve` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-4p24-vmcr-4gqj
Summary: XSS vulnerability that affects bootstrap
Aliases: CVE-2016-10735
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-01-17T13:57:27Z

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute. Note that this is a different vulnerability than CVE-2018-14041.

See https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/ for more info.
Vulnerability: GHSA-9x52-887g-fhc2
Summary: Out of bounds read in Tensorflow
Aliases: CVE-2022-23594
Severity: HIGH
CVSS score: 8.8
CWE: CWE-125
Published: 2022-02-09T23:32:41Z

### Impact
The [TFG dialect of TensorFlow (MLIR)](https://github.com/tensorflow/tensorflow/tree/274df9b02330b790aa8de1cee164b70f72b9b244/tensorflow/core/ir/importexport) makes several assumptions about the incoming `GraphDef` before converting it to the MLIR-based dialect.

If an attacker changes the `SavedModel` format on disk to invalidate these assumptions and the `GraphDef` is then converted to MLIR-based IR then they can cause a crash in the Python interpreter. Under certain scenarios, heap OOB read/writes are possible.
    
These issues have been discovered via fuzzing and it is possible that more weaknesses exist. We will patch them as they are discovered.
        
### Patches
We have patched the issue in multiple GitHub commits and these will be included in TensorFlow 2.8.0 and TensorFlow 2.7.1, as both are affected.
      
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-qpxp-5j56-gg3x
Summary: Improper Input Validation in Zendesk Samlr
Aliases: CVE-2018-20857
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2019-07-31T04:22:03Z

Zendesk Samlr before 2.6.2 allows an XML nodes comment attack such as a name_id node with user@example.com followed by <!---->. and then the attacker's domain name.
Vulnerability: GHSA-qmgf-fp85-55gr
Summary: Malicious Package in bitcionjs
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-04T15:40:34Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-gw4j-4229-q4px
Summary: Server-Side Request Forgery in Apache Dubbo
Aliases: CVE-2021-25640
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-918
Published: 2022-03-18T17:56:45Z

In Apache Dubbo prior to 2.6.9 and 2.7.10, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability.
Vulnerability: GHSA-j28q-p8ww-cp87
Summary: Prototype Pollution in merge-deep2.
Aliases: CVE-2021-23700
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-1321
Published: 2021-12-16T14:33:09Z

All versions of package merge-deep2 are vulnerable to Prototype Pollution via the mergeDeep() function.
Vulnerability: GHSA-3crr-9vmg-864v
Summary: Moderate severity vulnerability that affects activerecord
Aliases: CVE-2013-1854
Severity: MODERATE
CVSS score: 0
CWE: CWE-20
Published: 2017-10-24T18:33:37Z

The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a where method.
Vulnerability: GHSA-c383-q5vf-hx55
Summary: Integer Overflow or Wraparound in Microweber
Aliases: CVE-2022-0913
Severity: HIGH
CVSS score: 7.5
CWE: CWE-190
Published: 2022-03-12T00:00:36Z

Microweber prior to 1.2.12 is vulnerable to Integer Overflow or Wraparound.
Vulnerability: GHSA-vwcg-7xqw-qcxw
Summary: Heap Overflow in PyMiniRacer
Aliases: CVE-2020-25489
Severity: MODERATE
CVSS score: 0
CWE: CWE-119
Published: 2020-09-18T18:03:59Z

A heap overflow in Sqreen PyMiniRacer (aka Python Mini Racer) before 0.3.0 allows remote attackers to potentially exploit heap corruption.

More details on https://blog.sqreen.com/vulnerability-disclosure-finding-a-vulnerability-in-sqreens-php-agent-and-how-we-fixed-it/.
Vulnerability: GHSA-8549-p68h-m9mc
Summary: Malicious Package in buffdr-xor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T21:46:21Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-fh74-hm69-rqjw
Summary: procfs race condition with a shared volume mount
Aliases: CVE-2019-19921
Severity: MODERATE
CVSS score: 5
CWE: CWE-362
Published: 2021-05-27T18:41:17Z

### Impact
By crafting a malicious root filesystem (with `/proc` being a symlink to a directory which was inside a volume shared with another running container), an attacker in control of both containers can trick `runc` into not correctly configuring the container&amp;amp;amp;amp;#39;s security labels and not correctly masking paths inside `/proc` which contain potentially-sensitive information about the host (or even allow for direct attacks against the host).

In order to exploit this bug, an untrusted user must be able to spawn custom containers with custom mount configurations (such that a volume is shared between two containers). It should be noted that we consider this to be a fairly high level of access for an untrusted user -- and we do not recommend allowing completely untrusted users to have such degrees of access without further restrictions.

### Patches
This vulnerability has been fixed in `1.0.0-rc10`. It should be noted that the current fix is effectively a hot-fix, and there are known ways for it to be worked around (such as making the entire root filesystem a shared volume controlled by another container). We recommend that users review their access policies to ensure that untrusted users do not have such high levels of controls over container mount configuration.

### Workarounds
If you are not providing the ability for untrusted users to configure mountpoints for `runc` (or through a higher-level tool such as `docker run -v`) then you are not vulnerable to this issue. This exploit requires fairly complicated levels of access (which are available for some public clouds but are not necessarily available for all deployments).

Additionally, it appears as though it is not possible to exploit this vulnerability through Docker (due to the order of mounts Docker generates). However you should not depend on this, as it may be possible to work around this roadblock.

### Credits
This vulnerability was discovered by Cure53, as part of a third-party security audit.

### For more information
If you have any questions or comments about this advisory:
* [Open an issue](https://github.com/opencontainers/runc/issues/new).
* Email us at [dev@opencontainers.org](mailto:dev@opencontainers.org), or [security@opencontainers.org](mailto:security@opencontainers.org) if you think you&amp;amp;amp;amp;#39;ve found a security bug.
Vulnerability: GHSA-xm28-fw2x-fqv2
Summary: Denial of Service in foreman
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2019-05-31T23:08:14Z

All versions of `foreman` are vulnerable to Regular Expression Denial of Service when requests to it are made with a specially crafted path.


## Recommendation

Upgrade to version 3.0.1.
Vulnerability: GHSA-68wv-rjrm-576p
Summary: Low severity vulnerability that affects apache-airflow
Aliases: CVE-2017-17835
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2019-01-25T16:19:14Z

In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow.
Vulnerability: GHSA-w4v7-hwx7-9929
Summary: Cross-site Scripting in tempura
Aliases: CVE-2021-23784
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-11-08T17:50:10Z

This affects the package tempura before 0.4.0. If the input to the esc function is of type object (i.e an array) it is returned without being escaped/sanitized, leading to a potential Cross-Site Scripting vulnerability.
Vulnerability: GHSA-7xfq-xh6v-4mrm
Summary: Malicious Package in json-serializer
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-01T20:27:53Z

Version 2.0.10 of `json-serializer` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 2.0.10 of this module is found installed you will want to replace it with a version before or after 2.0.10. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-p9pc-299p-vxgp
Summary: Prototype Pollution in yargs-parser
Aliases: CVE-2020-7608
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-915
Published: 2020-09-04T18:00:54Z

Affected versions of `yargs-parser` are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects.  
Parsing the argument `--foo.__proto__.bar baz'` adds a `bar` property with value `baz` to all objects. This is only exploitable if attackers have control over the arguments being passed to `yargs-parser`.



## Recommendation

Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.
Vulnerability: GHSA-84fv-prrc-5ggr
Summary: Route Validation Bypass in call
Aliases: CVE-2016-10543
Severity: MODERATE
CVSS score: 0
CWE: CWE-20
Published: 2019-02-18T23:40:04Z

Affected versions of `call` do not validate empty parameters, which may result in a bypass of route validation rules. 

## Proof of Concept

Routing Scheme:
```
/api/{param}/{param2}/details
```
Triggering Request Path:
```
/api///
```


## Recommendation

Update to version 3.0.2 or later.
Vulnerability: GHSA-x7gm-rfgv-w973
Summary: Potential DoS with NumberFilter conversion to integer values.
Aliases: CVE-2020-15225
Severity: HIGH
CVSS score: 7.5
CWE: CWE-681
Published: 2020-09-28T19:05:29Z

### Impact

Automatically generated `NumberFilter` instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. 

### Patches

Version 2.4.0+ applies a `MaxValueValidator` with a a default `limit_value` of 1e50 to the form field used by `NumberFilter` instances. 

In addition, `NumberFilter` implements the new `get_max_validator()` which should return a configured validator instance to customise the limit, or else `None` to disable the additional validation. 

### Workarounds

Users may manually apply an equivalent validator if they are not able to upgrade.  

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the django-filter repo](https://github.com/carltongibson/django-filter)

Thanks to Marcin Waraksa for the report.
Vulnerability: GHSA-gpvr-g6gh-9mc2
Summary: No Charset in Content-Type Header in express
Aliases: CVE-2014-6393
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-10-23T17:22:54Z

Vulnerable versions of express do not specify a charset field in the content-type header while displaying 400 level response messages. The lack of enforcing user's browser to set correct charset, could be leveraged by an attacker to perform a cross-site scripting attack, using non-standard encodings, like UTF-7.


## Recommendation

For express 3.x, update express to version 3.11 or later.
For express 4.x, update express to version 4.5 or later.
Vulnerability: GHSA-3m93-m4q6-mc6v
Summary: Inclusion of Sensitive Information in Log Files and Improper Output Neutralization for Logs in Ansible
Aliases: CVE-2019-14864
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-532
Published: 2020-02-26T19:54:31Z

Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.
Vulnerability: GHSA-6677-83pp-f862
Summary: Cross-Site Scripting in @nuxt/devalue
Aliases: CVE-2019-13506
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-07-16T00:42:02Z

Versions of `@nuxt/devalue` prior to 1.2.3 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization attacker may inject arbitrary JavaScript code through object keys.


## Recommendation

Upgrade to version 1.2.3 or later.
Vulnerability: GHSA-9vc2-p34x-jhxh
Summary: Moderate severity vulnerability that affects rack
Severity: MODERATE
CVSS score: 0
Published: 2018-09-17T21:56:30Z

Withdrawn, accidental duplicate publish.

lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.
Vulnerability: GHSA-6f84-42vf-ppwp
Summary: Division by 0 in `QuantizedMul`
Aliases: CVE-2021-29528
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:22:02Z

### Impact
An attacker can trigger a division by 0 in `tf.raw_ops.QuantizedMul`:

```python
import tensorflow as tf

x = tf.zeros([4, 1], dtype=tf.quint8)
y = tf.constant([], dtype=tf.quint8)
min_x = tf.constant(0.0)
max_x = tf.constant(0.0010000000474974513)
min_y = tf.constant(0.0)
max_y = tf.constant(0.0010000000474974513)

tf.raw_ops.QuantizedMul(x=x, y=y, min_x=min_x, max_x=max_x, min_y=min_y, max_y=max_y)
```                            

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/55900e961ed4a23b438392024912154a2c2f5e85/tensorflow/core/kernels/quantized_mul_op.cc#L188-L198) does a division by a quantity that is controlled by the caller:

```cc
template <class T, class Toutput>
void VectorTensorMultiply(const T* vector_data, int32 vector_offset,
                          int64 vector_num_elements, const T* tensor_data,
                          int32 tensor_offset, int64 tensor_num_elements,
                          Toutput* output) {
  for (int i = 0; i < tensor_num_elements; ++i) {
    const int64 vector_i = i % vector_num_elements;
    ...
  }
}
```

### Patches
We have patched the issue in GitHub commit [a1b11d2fdd1e51bfe18bb1ede804f60abfa92da6](https://github.com/tensorflow/tensorflow/commit/a1b11d2fdd1e51bfe18bb1ede804f60abfa92da6).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-m4fq-xh7w-jhfm
Summary: Malicious Package in crytpo-js
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T19:39:46Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-vjfr-p6hp-jqqw
Summary: Command Injection in ungit
Aliases: CVE-2015-4130
Severity: CRITICAL
CVSS score: 0
CWE: CWE-77
Published: 2020-08-31T23:00:10Z

Versions of `ungit` prior to 0.9.0 are affected by a command injection vulnerability in the `url` parameter.


## Recommendation

Update version 0.9.0 or later.
Vulnerability: GHSA-gm25-fpmr-43fj
Summary: Moderate severity vulnerability that affects rails
Aliases: CVE-2007-3227
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2017-10-24T18:33:38Z

Cross-site scripting (XSS) vulnerability in the to_json (ActiveRecord::Base#to_json) function in Ruby on Rails before edge 9606 allows remote attackers to inject arbitrary web script via the input values.
Vulnerability: GHSA-chp4-rv79-68j3
Summary: Apache serialization mechanism does not have a list of classes allowed for serialization/deserialization
Aliases: CVE-2018-1295
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2018-10-16T20:53:44Z

In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a specially prepared form of a serialized object to one of the deserialization endpoints of some Ignite components - discovery SPI, Ignite persistence, Memcached endpoint, socket steamer.
Vulnerability: GHSA-xfrc-7mj2-5xh9
Summary: Undefined Behavior in zencashjs
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-03T17:14:51Z

Versions of `zencashjs` prior to 1.2.0 may cause loss of funds when used with cryptocurrency wallets. The package relies on a string comparison of the first two characters of a Horizen address to determine the destination address type of a transaction (P2PKH or P2SH). Due to the base58 address prefixes chosen in Horizen there exists the possibility of a clash of address prefixes for testnet P2PKH and mainnet P2SH addresses, testnet P2PKH addresses start with “zt” while a subset of mainnet P2SH addresses can also start with “zt”. The package interprets transactions sent to a “zt” P2SH address on mainnet as P2PKH transactions erroneously. Any funds sent to a mainnet P2SH multisignature address starting with “zt” will be sent to the wrong address and be lost.


## Recommendation

Upgrade to version 1.2.0 or later.
Vulnerability: GHSA-8crv-49fr-2h6j
Summary: Moderate severity vulnerability that affects org.springframework.security:spring-security-core and org.springframework:spring-core
Aliases: CVE-2016-5007
Severity: HIGH
CVSS score: 7.5
CWE: CWE-285
Published: 2018-10-17T20:30:12Z

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.
Vulnerability: GHSA-hg78-4f6x-99wq
Summary: Moderate severity vulnerability that affects rack
Aliases: CVE-2018-16470
Severity: MODERATE
CVSS score: 0
CWE: CWE-400
Published: 2018-11-15T15:58:58Z

There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests can cause the multipart parser to enter a pathological state, causing the parser to use CPU resources disproportionate to the request size.
Vulnerability: GHSA-f5g8-5qq7-938w
Summary: Out-of-bounds Read
Aliases: CVE-2020-35653
Severity: HIGH
CVSS score: 7.1
CWE: CWE-125
Published: 2021-03-18T19:55:41Z

In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.
Vulnerability: GHSA-fv3h-8x5j-pvgq
Summary: XSS in python-markdown2
Aliases: CVE-2020-11888
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2020-04-22T20:59:50Z

python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \w+ match succeeds. For example, an attack might use elementname@ or elementname- with an onclick attribute.
Vulnerability: GHSA-6gv9-7q4g-pmvm
Summary: Persistent XSS in customer module in Shopware
Severity: LOW
CVSS score: 0
CWE: CWE-79
Published: 2020-11-13T15:47:36Z

### Impact
Persistent XSS in customer  module

### Patches

We recommend updating to the current version 5.6.9. You can get the update to 5.6.9 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

### References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-11-2020
Vulnerability: GHSA-mf6w-45cf-qhmp
Summary: Git-fastclone passes user modifiable strings directly to a shell command
Aliases: CVE-2015-8969
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77
Published: 2018-08-15T20:04:44Z

git-fastclone before 1.0.5 passes user modifiable strings directly to a shell command. An attacker can execute malicious commands by modifying the strings that are passed as arguments to "cd " and "git clone " commands in the library.
Vulnerability: GHSA-q86f-fmqf-qrf6
Summary: Moderate severity vulnerability that affects mail
Aliases: CVE-2015-9097
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-93
Published: 2017-10-24T18:33:36Z

The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring.
Vulnerability: GHSA-wgvj-6v57-wjh3
Summary: Malicious Package in bowee
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T21:30:14Z

Version 1.8.4 of `bowee` contained malicious code as a preinstall script. The package downloaded a file from a remote server, executed it and opened a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-mw35-24gh-f82w
Summary: High severity vulnerability that affects keycloak-connect and keycloak-js
Aliases: CVE-2017-7474
Severity: HIGH
CVSS score: 0
CWE: CWE-253
Published: 2017-11-15T20:41:51Z

It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly.  An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks.
Vulnerability: GHSA-4qw8-pgpr-p9mq
Summary: Bash command injection in Apache Zeppelin
Aliases: CVE-2019-10095
Severity: HIGH
CVSS score: 9.8
CWE: CWE-77, CWE-78
Published: 2021-09-07T22:56:43Z

bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spark interpreter settings. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.
Vulnerability: GHSA-3q55-66g3-p8xq
Summary: Cross-site Scripting in microweber
Aliases: CVE-2022-0926
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-79
Published: 2022-03-13T00:00:54Z

File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.
Vulnerability: GHSA-v726-3vg9-cp34
Summary: Missing Authorization in FastReport
Aliases: CVE-2020-27998
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-862
Published: 2021-08-02T17:28:16Z

An issue was discovered in FastReport before 2020.4.0. It lacks a ScriptSecurity feature and therefore may mishandle (for example) GetType, typeof, TypeOf, DllImport, LoadLibrary, and GetProcAddress.
Vulnerability: GHSA-5p98-wpc9-g498
Summary: Server-Side Request Forgery in html-pdf-chrome
Severity: HIGH
CVSS score: 0
CWE: CWE-918
Published: 2020-09-04T15:21:32Z

All versions of `html-pdf-chrome` are vulnerable to Server-Side Request Forgery (SSRF). The package executes HTTP requests if the parsed HTML contains external references to resources, such as `<iframe src="http://localhost" height="800px" width="800px"></iframe>`. This allows attackers to access resources through HTTP that are accessible to the server, including private resources in the hosting environment.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-w754-gq8r-pf5f
Summary: High severity vulnerability that affects mini_magick
Aliases: CVE-2013-2616
Severity: HIGH
CVSS score: 0
CWE: CWE-94
Published: 2017-10-24T18:33:37Z

lib/mini_magick.rb in the MiniMagick Gem 1.3.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
Vulnerability: GHSA-4mv7-cq75-3qjm
Summary: Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15
Aliases: CVE-2015-7940
Severity: MODERATE
CVSS score: 0
CWE: CWE-200
Published: 2018-10-17T16:27:50Z

The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."
Vulnerability: GHSA-9f8c-f7h4-xghf
Summary: Remote code execution in ChakraCore
Aliases: CVE-2020-1057
Severity: HIGH
CVSS score: 8.1
CWE: CWE-119, CWE-787
Published: 2021-08-02T17:28:53Z

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-1172, CVE-2020-1180.
Vulnerability: GHSA-m2r3-8492-vx59
Summary: Denial of Service (DoS) in mongo-express
Aliases: CVE-2021-23372
Severity: MODERATE
CVSS score: 4.4
CWE: CWE-754
Published: 2021-10-06T17:47:46Z

All versions of package mongo-express are vulnerable to Denial of Service (DoS) when exporting an empty collection as CSV, due to an unhandled exception, leading to a crash.
Vulnerability: GHSA-fxwf-4rqh-v8g3
Summary: Insecure defaults due to CORS misconfiguration in socket.io
Aliases: CVE-2020-28481
Severity: MODERATE
CVSS score: 0
CWE: CWE-453, CWE-346
Published: 2021-01-20T21:22:37Z

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.
Vulnerability: GHSA-jff2-qjw8-5476
Summary: Command Injection Vulnerability in systeminformation
Aliases: CVE-2021-21388
Severity: HIGH
CVSS score: 8.9
CWE: CWE-77, CWE-78
Published: 2021-04-06T17:30:14Z

### Impact
command injection vulnerability

### Patches
Problem was fixed with a parameter check. Please upgrade to version >= 5.6.4

### Workarounds
If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
Vulnerability: GHSA-cvpc-8phh-8f45
Summary: Out of bounds access in tensorflow-lite
Aliases: CVE-2020-15211
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-787, CWE-125
Published: 2020-09-25T18:28:49Z

### Impact
In TensorFlow Lite, saved models in the flatbuffer format use a double indexing scheme: a model has a set of subgraphs, each subgraph has a set of operators and each operator has a set of input/output tensors. The flatbuffer format uses indices for the tensors, indexing into an array of tensors that is owned by the subgraph. This results in a pattern of double array indexing when trying to get the data of each tensor:https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/kernel_util.cc#L36

However, some operators can have some tensors be optional. To handle this scenario, the flatbuffer model uses a negative `-1` value as index for these tensors:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/c/common.h#L82

This results in special casing during validation at model loading time: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/core/subgraph.cc#L566-L580

Unfortunately, this means that the `-1` index is a valid tensor index for any operator, including those that don't expect optional inputs and including for output tensors. Thus, this allows writing and reading from outside the bounds of heap allocated arrays, although only at a specific offset from the start of these arrays.

This results in both read and write gadgets, albeit very limited in scope.

### Patches
We have patched the issue in several commits (46d5b0852, 00302787b7, e11f5558, cd31fd0ce, 1970c21, and fff2c83). We will release patch releases for all versions between 1.15 and 2.3.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

### Workarounds
A potential workaround would be to add a custom `Verifier` to the model loading code to ensure that only operators which accept optional inputs use the `-1` special value and only for the tensors that they expect to be optional. Since this allow-list type approach is erro-prone, we advise upgrading to the patched code.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-5955-9wpr-37jh
Summary: Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization
Aliases: CVE-2021-37713
Severity: HIGH
CVSS score: 8.2
CWE: CWE-22
Published: 2021-08-31T16:05:05Z

### Impact

Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution

node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain `..` path portions, and resolving the sanitized paths against the extraction target directory.

This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as `C:some\path`.  If the drive letter does not match the extraction target, for example `D:\extraction\dir`, then the result of `path.resolve(extractionDirectory, entryPath)` would resolve against the current working directory on the `C:` drive, rather than the extraction target directory.

Additionally, a `..` portion of the path could occur immediately after the drive letter, such as `C:../foo`, and was not properly sanitized by the logic that checked for `..` within the normalized and split portions of the path.

This only affects users of `node-tar` on Windows systems.

### Patches

4.4.18 || 5.0.10 || 6.1.9

### Workarounds

There is no reasonable way to work around this issue without performing the same path normalization procedures that node-tar now does.

Users are encouraged to upgrade to the latest patched versions of node-tar, rather than attempt to sanitize paths themselves.

### Fix

The fixed versions strip path roots from all paths prior to being resolved against the extraction target folder, even if such paths are not "absolute".

Additionally, a path starting with a drive letter and then two dots, like `c:../`, would bypass the check for `..` path portions.  This is checked properly in the patched versions.

Finally, a defense in depth check is added, such that if the `entry.absolute` is outside of the extraction taret, and we are not in preservePaths:true mode, a warning is raised on that entry, and it is skipped.  Currently, it is believed that this check is redundant, but it did catch some oversights in development.
Vulnerability: GHSA-mx43-r985-5h4m
Summary: Open redirect vulnerability in Sourcegraph
Aliases: CVE-2020-12283
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2021-12-20T18:12:47Z

### Impact

An open redirect vulnerability that allows users to be targeted for phishing attacks has been found in Sourcegraph instances configured with OAuth, OpenID, or SAML authentication enabled. Users targeted by these phishing attacks could have their authentication tokens silently harvested by an attacker.

### Resolution

Sourcegraph v3.14.4 and v3.15.1 have been released which resolve the vulnerability. ([associated change](https://github.com/sourcegraph/sourcegraph/pull/10167))

### Workarounds

Disabling OAuth, OpenID and/or SAML sign-in options until upgraded to the patched versions will secure Sourcegraph / workaround the issue.

### Timeline

- Apr 23, 8 AM PST: GitHub Security Lab reported the issue to Sourcegraph.
- Apr 23, 11 PM PST: A Sourcegraph engineer proposed a resolution for the vulnerability. https://github.com/sourcegraph/sourcegraph/pull/10167
- Apr 24, 3 AM PST: The proposed resolution was reviewed, approved, and merged.
- Apr 28, 2 PM PST: Patch releases for 3.14.4 and 3.15.1 were published.
- Apr 29, 10 PM PST: Mitre publicly disclosed [CVE-2020-12283](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12283).
- Apr 30, 11 AM PST: Sourcegraph issued a GitHub security advisory and notified all affected users.

### References

- [Mitre: CVE-2020-12283](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12283)
- [GitHub Security Lab: GHSL-2020-085](https://securitylab.github.com/advisories/GHSL-2020-085-sourcegraph)
- [detectify's blog post on open redirect vulnerabilities
](https://blog.detectify.com/2019/05/16/the-real-impact-of-an-open-redirect/)

### For more information

If you have any questions or comments about this advisory, please contact us at [support@sourcegraph.com](mailto:support@sourcegraph.com) and include `CVE-2020-12283` in the title.
Vulnerability: GHSA-98f7-p5rc-jx67
Summary: Cross-Site Scripting in materialize-css
Aliases: CVE-2019-11002
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-04-09T19:44:40Z

All versions of `materialize-css` are vulnerable to Cross-Site Scripting. The `tooltip` component does not sufficiently sanitize user input, allowing an attacker to execute arbitrary JavaScript code if the malicious input is rendered by a user.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.