deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-q6wc-xx4m-92fj
Package: @powersync/service-core (NPM)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-285: Improper Authorization
Vulnerable versions: = 1.20.0
Patched in: 1.20.1

Summary: PowerSync: Some sync filters ignored on 1.20.0 using `config.edition: 3`

Details:
### Impact

In version **1.20.0**, when using new sync streams with `config.edition: 3`, certain subquery filters were ignored when determining which data to sync to users.

Depending on the sync stream configuration, this could result in authenticated users syncing data that should have been restricted.

Only queries that gate synchronization using subqueries without partitioning the result set are affected.

Not affected:
 * Sync rules (bucket_definitions)
 * Sync streams using `config.edition: 2`
 * No data is exposed without authenticating

### Patches

The issue is **fixed in 1.20.1**. Restarting the service with the new version is sufficient - no reprocessing of sync streams is required.

Any data that users erroneously synced will be automatically removed from those devices when they connect again.

We have updated all affected PowerSync Cloud instances to the fixed version, and are reaching out to affected customers.

For self-hosted PowerSync instances, update to the latest version and restart.

### Affected queries

Subqueries used only to determine whether or not a table should be synced (without partitioning the data itself) are affected. Examples:

```sql
-- Goal: Sync a table only to admin users
-- 1.20.0: all authenticated users would sync this table
SELECT * FROM sensitive_table WHERE auth.user_id() IN (SELECT user_id FROM admins)
SELECT * FROM sensitive_table WHERE 1 IN (SELECT 1 FROM users WHERE id = auth.user_id() AND is_admin = TRUE)

-- Goal: Sync a table only if authorized
-- 1.20.0: all authenticated users would sync this table
SELECT * FROM sensitive_table WHERE 'sensitive_table' IN (SELECT table_name FROM synced_table WHERE "user" = auth.user_id())
SELECT * FROM sensitive_table WHERE 'sensitive_table' IN auth.parameter('allowed_tables')
```

Queries that partition data (for example `SELECT * FROM sensitive_table WHERE owner IN (SELECT id FROM users WHERE is_admin AND id = auth.user_id())`) are not affected by this issue.
GitHub Security Advisory: GHSA-6qh5-m6g3-xhq6
Package: parse-server (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-674: Uncontrolled Recursion
Vulnerable versions: < 8.6.56
Patched in: 8.6.56

Summary: Parse Server LiveQuery subscription query depth bypass

Details:
### Impact

Parse Server's LiveQuery component does not enforce the `requestComplexity.queryDepth` configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability.

Deployments are affected when the LiveQuery WebSocket endpoint is reachable by untrusted clients.

### Patches

The fix adds query condition depth validation to the LiveQuery subscription handler, enforcing the same `requestComplexity.queryDepth` limit that already protects REST API queries.

### Workarounds

There is no known workaround other than upgrading.
GitHub Security Advisory: GHSA-6qh5-m6g3-xhq6
Package: parse-server (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-674: Uncontrolled Recursion
Vulnerable versions: >= 9.0.0, < 9.6.0-alpha.45
Patched in: 9.6.0-alpha.45

Summary: Parse Server LiveQuery subscription query depth bypass

Details:
### Impact

Parse Server's LiveQuery component does not enforce the `requestComplexity.queryDepth` configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability.

Deployments are affected when the LiveQuery WebSocket endpoint is reachable by untrusted clients.

### Patches

The fix adds query condition depth validation to the LiveQuery subscription handler, enforcing the same `requestComplexity.queryDepth` limit that already protects REST API queries.

### Workarounds

There is no known workaround other than upgrading.
GitHub Security Advisory: GHSA-vggc-6pg2-xvp9
Package: vulnogram (NPM)
Severity: MODERATE (CVSS 6.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 1.0.0
Patched in: unpatched

Summary: Vulnogram contains a stored cross-site scripting vulnerability in comment hypertext handling

Details:
Vulnogram 1.0.0 contains a stored cross-site scripting vulnerability in comment hypertext handling that allows attackers to inject malicious scripts. Remote attackers can inject XSS payloads through comments to execute arbitrary JavaScript in victims' browsers.
GitHub Security Advisory: GHSA-9fjp-q3c4-6w3j
Package: parse-server (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-674: Uncontrolled Recursion
Vulnerable versions: < 8.6.55
Patched in: 8.6.55

Summary: Parse Server has a query condition depth bypass via pre-validation transform pipeline

Details:
### Impact

An attacker can send an unauthenticated HTTP request with a deeply nested query containing logical operators to permanently hang the Parse Server process. The server becomes completely unresponsive and must be manually restarted. This is a bypass of the fix for CVE-2026-32944.

### Patches

The query condition nesting depth is now validated before the query enters the transformation pipeline, preventing deeply nested structures from being recursively processed before the existing depth guard can fire.

### Workarounds

None.
GitHub Security Advisory: GHSA-9fjp-q3c4-6w3j
Package: parse-server (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-674: Uncontrolled Recursion
Vulnerable versions: >= 9.0.0, < 9.6.0-alpha.44
Patched in: 9.6.0-alpha.44

Summary: Parse Server has a query condition depth bypass via pre-validation transform pipeline

Details:
### Impact

An attacker can send an unauthenticated HTTP request with a deeply nested query containing logical operators to permanently hang the Parse Server process. The server becomes completely unresponsive and must be manually restarted. This is a bypass of the fix for CVE-2026-32944.

### Patches

The query condition nesting depth is now validated before the query enters the transformation pipeline, preventing deeply nested structures from being recursively processed before the existing depth guard can fire.

### Workarounds

None.
GitHub Security Advisory: GHSA-qpc3-fg4j-8hgm
Package: parse-server (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-203: Observable Discrepancy
Vulnerable versions: < 8.6.54
Patched in: 8.6.54

Summary: Parse Server has a protected field change detection oracle via LiveQuery watch parameter

Details:
### Impact

An attacker can subscribe to LiveQuery with a `watch` parameter targeting a protected field. Although the protected field value is properly stripped from event payloads, the presence or absence of update events reveals whether the protected field changed, creating a binary oracle. For boolean protected fields, the timing of change events is equivalent to knowing the field value.

### Patches

The `watch` parameter is now validated against protected fields at subscription time, mirroring the existing validation for the `where` clause. Subscriptions that include protected fields in `watch` are rejected with a permission error. Master key connections are exempt.

### Workarounds

None.
GitHub Security Advisory: GHSA-qpc3-fg4j-8hgm
Package: parse-server (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-203: Observable Discrepancy
Vulnerable versions: >= 9.0.0, < 9.6.0-alpha.43
Patched in: 9.6.0-alpha.43

Summary: Parse Server has a protected field change detection oracle via LiveQuery watch parameter

Details:
### Impact

An attacker can subscribe to LiveQuery with a `watch` parameter targeting a protected field. Although the protected field value is properly stripped from event payloads, the presence or absence of update events reveals whether the protected field changed, creating a binary oracle. For boolean protected fields, the timing of change events is equivalent to knowing the field value.

### Patches

The `watch` parameter is now validated against protected fields at subscription time, mirroring the existing validation for the `where` clause. Subscriptions that include protected fields in `watch` are rejected with a permission error. Master key connections are exempt.

### Workarounds

None.
GitHub Security Advisory: GHSA-fph2-r4qg-9576
Package: parse-server (NPM)
Severity: HIGH (CVSS 6.5)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 8.6.53
Patched in: 8.6.53

Summary: Parse Server's LiveQuery bypasses CLP pointer permission enforcement

Details:
### Impact

Parse Server's LiveQuery WebSocket interface does not enforce Class-Level Permission (CLP) pointer permissions (`readUserFields` and `pointerFields`). Any authenticated user can subscribe to LiveQuery events and receive real-time updates for all objects in classes protected by pointer permissions, regardless of whether the pointer fields on those objects point to the subscribing user. This bypasses the intended read access control, allowing unauthorized access to potentially sensitive data that is correctly restricted via the REST API.

### Patches

The LiveQuery server now enforces pointer permissions on each event. After the existing check passes (which defers pointer permissions by design), the fix checks whether any configured pointer field on the object points to the subscribing user. Events for objects that don't match are silently skipped, consistent with how ACL mismatches are handled.

### Workarounds

Use ACLs on individual objects to restrict read access instead of relying solely on CLP pointer permissions. ACLs are enforced by LiveQuery.
GitHub Security Advisory: GHSA-fph2-r4qg-9576
Package: parse-server (NPM)
Severity: HIGH (CVSS 6.5)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 9.0.0, < 9.6.0-alpha.42
Patched in: 9.6.0-alpha.42

Summary: Parse Server's LiveQuery bypasses CLP pointer permission enforcement

Details:
### Impact

Parse Server's LiveQuery WebSocket interface does not enforce Class-Level Permission (CLP) pointer permissions (`readUserFields` and `pointerFields`). Any authenticated user can subscribe to LiveQuery events and receive real-time updates for all objects in classes protected by pointer permissions, regardless of whether the pointer fields on those objects point to the subscribing user. This bypasses the intended read access control, allowing unauthorized access to potentially sensitive data that is correctly restricted via the REST API.

### Patches

The LiveQuery server now enforces pointer permissions on each event. After the existing check passes (which defers pointer permissions by design), the fix checks whether any configured pointer field on the object points to the subscribing user. Events for objects that don't match are silently skipped, consistent with how ACL mismatches are handled.

### Workarounds

Use ACLs on individual objects to restrict read access instead of relying solely on CLP pointer permissions. ACLs are enforced by LiveQuery.
GitHub Security Advisory: GHSA-7j2x-32w6-p43p
Package: @dicebear/converter (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-185: Incorrect Regular Expression
Vulnerable versions: <= 9.4.1
Patched in: 9.4.2

Summary: SVG Dimension Capping Bypass via XML Comment Injection in @dicebear/converter ensureSize()

Details:
## Summary

The `ensureSize()` function in `@dicebear/converter` used a regex-based approach to rewrite SVG `width`/`height` attributes, capping them at 2048px to prevent denial of service. This size capping could be bypassed by crafting SVG input that causes the regex to match a non-functional occurrence of `<svg` before the actual SVG root element. When the SVG is subsequently rendered via `@resvg/resvg-js` on the Node.js code path, it renders at the attacker-specified dimensions, potentially causing out-of-memory crashes.

## Details

The vulnerable function used `String.prototype.replace()` with a non-global regex to find and rewrite the first `<svg` tag's dimensions. Since the regex does not distinguish between `<svg` appearing inside non-element XML constructs and the actual SVG root element, a crafted input can cause the regex to match a decoy instead of the real element, leaving the actual SVG dimensions unclamped.

In the Node.js rendering path, `renderAsync` from `@resvg/resvg-js` was called without a `fitTo` constraint, so it would render at whatever dimensions the SVG element specified — potentially allocating gigabytes of memory.

The browser code path is **not** vulnerable because it uses the clamped `size` return value from `ensureSize()` to set `canvas.width` and `canvas.height` directly.

## Impact

Any application that passes untrusted or user-supplied SVG content through `@dicebear/converter`'s Node.js conversion functions (`toPng`, `toJpeg`, `toWebp`, `toAvif`) is vulnerable to denial of service via excessive memory allocation. Note that `@dicebear/converter` can be used independently of DiceBear's avatar generation — any SVG string can be passed to the conversion functions.

The impact is limited to availability — there is no data disclosure or integrity impact. The browser code path is not affected.

## Fix

The regex-based approach has been replaced with XML-aware processing using `fast-xml-parser` to correctly identify and modify the SVG root element's attributes. Additionally, a `fitTo` constraint has been added to the `renderAsync` call as defense-in-depth, ensuring the rendered output is always bounded regardless of SVG content.
GitHub Security Advisory: GHSA-7f6v-3gx7-27q8
Package: @orpc/openapi (NPM)
Severity: HIGH (CVSS 8.2)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 1.13.8
Patched in: 1.13.9

Summary: oRPC has Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify

Details:
A Stored Cross-Site Scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation.
In the packages/openapi/src/plugins/openapi-reference.ts file, the renderDocsHtml() function takes an OpenAPI spec object and embeds it directly into the HTML response using a template literal:

`<script id="spec" type="application/json">${JSON.stringify(spec)}</script>`

The JSON.stringify() function does not escape HTML characters like < or >. Therefore, if an attacker provides a string containing </script><script>..., the browser will prematurely close the application/json script block and execute the subsequent malicious script block.

Proof of Concept (PoC)

1. Create an API router with **orpc** and configure the OpenAPI plugin.
2. In the API specification, inject a malicious payload into a field like **description**:

```
{
info: {
title: "My API",
version: "1.0.0",
description: "</script><script>alert('XSS executed on ' + document.domain)</script>"
}
}
```

3. Generate and serve the documentation HTML.
4. When a developer or user navigates to the API documentation URL, the browser parses the HTML, breaks out of the JSON block, and immediately executes the **alert()** payload.

Impact

If an application generates its OpenAPI specifications dynamically based on user-controlled inputs (or if a rogue developer modifies the spec), it leads to Stored XSS. When an administrator or developer views the API docs, the script executes in their browser, potentially leading to session hijacking or unauthorized API calls on their behalf.

Remediation

Do not use raw **JSON.stringify()** to embed data directly into HTML templates. Instead, safely serialize the JSON by escaping HTML-sensitive characters (like **<** and **>**) or use a secure HTML serialization library (such as **serialize-javascript** or **devalue**) before embedding it into the **<script>** tag.

Disclosure & Credits

If this report is helpful, I kindly request that you publish this as a formal GitHub Security Advisory and assign me credit for the discovery. Thank you for maintaining this project!
GitHub Security Advisory: GHSA-x49q-fhhm-r9jf
Package: openclaw (NPM)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 2026.3.12
Patched in: 2026.3.12

Summary: Duplicate Advisory: OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-rqpp-rjj8-7wv8. This link is maintained to preserve external references.

### Original Description
OpenClaw versions prior to 2026.3.12 contain an authorization bypass vulnerability in the WebSocket connect path that allows shared-token or password-authenticated connections to self-declare elevated scopes without server-side binding. Attackers can exploit this logic flaw to present unauthorized scopes such as operator.admin and perform admin-only gateway operations.
GitHub Security Advisory: GHSA-whhv-gg5v-864r
Package: @builder.io/qwik-city (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
Vulnerable versions: < 1.19.2
Patched in: 1.19.2

Summary: Qwik City has array method pollution in FormData processing allows type confusion and DoS

Details:
**Summary**

Qwik City improperly inferred arrays from dotted form field names during `FormData` parsing. By submitting mixed array-index and object-property keys for the same path, an attacker could cause user-controlled properties to be written onto values that application code expected to be arrays.

**Description**

When processing `application/x-www-form-urlencoded` or `multipart/form-data` requests, Qwik City converted dotted field names such as `items.0` and `items.1` into nested structures. If a path was interpreted as an array, additional attacker-controlled keys on the same path, such as `items.toString`, `items.push`, `items.valueOf`, or `items.length`, could alter the resulting server-side value in unexpected ways.

Applications that assumed these parsed values were safe arrays could be affected. Depending on application behavior, this could lead to request handling failures, denial of service through malformed array state or oversized lengths, and type confusion in downstream code.

This issue affects form parsing in Qwik City request handling. It does not require authentication if the vulnerable route is publicly reachable.

**Impact**

An attacker can send crafted form submissions that cause parsed input to differ from the application’s expected shape. Possible outcomes include:
- Triggering runtime errors when application code calls array methods on attacker-influenced values
- Inflating array length or otherwise creating malformed structures that increase server work or memory use
- Causing type confusion in application logic that trusts parsed form data to be a normal array

There is no direct evidence that this issue enables confidentiality or integrity impact by itself; the primary risk is denial of service and application instability.

**Patched Versions**

Patched in 1.19.2.

**Workarounds**

Until patched, avoid trusting parsed form data to be a well-formed array when using dotted field names, and validate or normalize action input before using array methods or relying on array shape.
GitHub Security Advisory: GHSA-h36m-2vh5-x699
Package: openclaw (NPM)
Severity: MODERATE (CVSS 6.3)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: >= 2026.2.26, < 2026.3.1
Patched in: unpatched

Summary: Duplicate Advisory: ACPX Windows wrapper shell fallback allowed cwd injection in specific paths

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-6f6j-wx9w-ff4j. This link is maintained to preserve external references.

## Original Description
OpenClaw versions 2026.2.26 prior to 2026.3.1 on Windows contain a current working directory injection vulnerability in wrapper resolution for .cmd/.bat files that allows attackers to influence execution behavior through cwd manipulation. Remote attackers can exploit improper shell execution fallback mechanisms to achieve command execution integrity loss by controlling the current working directory during wrapper resolution.
GitHub Security Advisory: GHSA-jqpf-vj28-9v7r
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 2026.2.22, <= 2026.2.23
Patched in: unpatched

Summary: Duplicate Advisory: Synology Chat dmPolicy=allowlist failed open on empty allowedUserIds, allowing unauthorized agent dispatch

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-gw85-xp4q-5gp9. This link is maintained to preserve external references.

## Original Description
OpenClaw versions 2026.2.22 and 2026.2.23 contain an authorization bypass vulnerability in the synology-chat channel plugin where dmPolicy set to allowlist with empty allowedUserIds fails open. Attackers with Synology sender access can bypass authorization checks and trigger unauthorized agent dispatch and downstream tool actions.
GitHub Security Advisory: GHSA-x742-88jj-7hv9
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.1)
CWE: CWE-184: Incomplete List of Disallowed Inputs
Vulnerable versions: < 2026.2.23
Patched in: unpatched

Summary: Duplicate Advisory: allowlist exec-guard bypass via env -S

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-48wf-g7cp-gr3m. This link is maintained to preserve external references.

## Original Description
OpenClaw versions prior to 2026.2.23 contain an allowlist bypass vulnerability in system.run guardrails that allows authenticated operators to execute unintended commands. When /usr/bin/env is allowlisted, attackers can use env -S to bypass policy analysis and execute shell wrapper payloads at runtime.
GitHub Security Advisory: GHSA-r849-826x-wgqm
Package: openclaw (NPM)
Severity: LOW (CVSS 3.7)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.2.26
Patched in: unpatched

Summary: Duplicate Advisory: Signal group allowlist authorization bypass via DM pairing-store leakage

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-wm8r-w8pf-2v6w. This link is maintained to preserve external references.

## Original Description
OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where Signal group allowlist policy incorrectly accepts sender identities from DM pairing-store approvals. Attackers can exploit this boundary weakness by obtaining DM pairing approval to bypass group allowlist checks and gain unauthorized group access.
GitHub Security Advisory: GHSA-44c9-4rg5-qjgq
Package: openclaw (NPM)
Severity: MODERATE (CVSS 7.4)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 2026.3.1
Patched in: unpatched

Summary: Duplicate Advisory: web_search citation redirect SSRF via private-network-allowing policy

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-g99v-8hwm-g76g. This link is maintained to preserve external references.

## Original Description
OpenClaw versions prior to 2026.3.1 contain a server-side request forgery vulnerability in web_search citation redirect resolution that uses a private-network-allowing SSRF policy. An attacker who can influence citation redirect targets can trigger internal-network requests from the OpenClaw host to loopback, private, or internal destinations.