deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-1450
Published: 2024-03-21
Description: The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions up to, and including, 4.6.10 due to insufficient input sanitization and output escaping on user supplied attributes such as 'align'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-29109 appears to be a duplicate of this issue.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/shariff/tags/4.6.10/shariff.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3047668%40shariff&new=3047668%40shariff&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/00a3d8e3-17b1-488b-9c42-2479932c9bf7?source=cve
CVE: CVE-2024-1502
Published: 2024-03-21
Description: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the tutor_delete_announcement() function in all versions up to, and including, 2.6.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3049105%40tutor&new=3049105%40tutor&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/834c4ca9-7173-4c84-8287-9916ec72935d?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3049105%40tutor&new=3049105%40tutor&sfp_email=&sfph_mail=
CVE: CVE-2024-1503
Published: 2024-03-21
Description: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.1. This is due to missing or incorrect nonce validation on the erase_tutor_data() function. This makes it possible for unauthenticated attackers to deactivate the plugin and erase all data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This requires the "Erase upon uninstallation" option to be enabled.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Admin.php#L465; https://www.wordfence.com/threat-intel/vulnerabilities/id/050647a8-6743-46e4-b31c-0b5bd4a1007f?source=cve; https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Admin.php#L465
CVE: CVE-2024-1908
Published: 2024-03-21
Description: An Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed an attacker to use the Enterprise Actions GitHub Connect download token to fetch private repository data. An attacker would require an account on the server instance with non-default settings for GitHub Connect. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.16, 3.9.11, 3.10.8, and 3.11.6. This vulnerability was reported via the GitHub Bug Bounty program. 



CVSS Score: 6.3 (MEDIUM)
CWE: CWE-269
References: https://docs.github.com/en/enterprise-server@3.8/admin/release-notes/#3.8.16; https://docs.github.com/en/enterprise-server@3.9/admin/release-notes/#3.9.11; https://https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.8
CVE: CVE-2024-22352
Published: 2024-03-21
Description: IBM InfoSphere Information Server 11.7 stores potentially sensitive information in log files that could be read by a local user.  IBM X-Force ID:  280361.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/280361; https://www.ibm.com/support/pages/node/7117184; https://exchange.xforce.ibmcloud.com/vulnerabilities/280361
CVE: CVE-2024-24028
Published: 2024-03-21
Description: Server Side Request Forgery (SSRF) vulnerability in Likeshop before 2.5.7 allows attackers to view sensitive information via the avatar parameter in function UserLogic::updateWechatInfo.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-918
References: https://thanhlo.substack.com/p/khai-thac-lo-hong-cve-2024-24028; https://thanhlo.substack.com/p/khai-thac-lo-hong-cve-2024-24028
CVE: CVE-2024-24110
Published: 2024-03-21
Description: SQL Injection vulnerability in crmeb_java before v1.3.4 allows attackers to run arbitrary SQL commands via crafted GET request to the component /api/front/spread/people.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/crmeb/crmeb_java/issues/13; https://github.com/crmeb/crmeb_java/issues/13
CVE: CVE-2024-24520
Published: 2024-03-21
Description: An issue in Lepton CMS v.7.0.0 allows a local attacker to execute arbitrary code via the upgrade.php file in the languages place.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: http://lepton.com; https://github.com/capture0x/leptoncms; https://github.com/xF9979/LEPTON-CMS
CVE: CVE-2024-24813
Published: 2024-03-21
Description: Frappe is a full-stack web application framework. Prior to versions 14.64.0 and 15.0.0, SQL injection from a particular whitelisted method can result in access to data which the user doesn't have permission to access. Versions 14.64.0 and 15.0.0 contain a patch for this issue. No known workarounds are available.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/frappe/frappe/security/advisories/GHSA-fxfv-7gwx-54jh; https://github.com/frappe/frappe/security/advisories/GHSA-fxfv-7gwx-54jh
CVE: CVE-2024-24818
Published: 2024-03-21
Description: EspoCRM is an Open Source Customer Relationship Management software. An attacker can inject arbitrary IP or domain in "Password Change" page and redirect victim to malicious page that could lead to  credential stealing or another attack. This vulnerability is fixed in 8.1.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-610, CWE-601
References: https://github.com/espocrm/espocrm/commit/3babdfa3399e328fb1bd83a1b4ed03d509f4c8e7; https://github.com/espocrm/espocrm/security/advisories/GHSA-8gv6-8r33-fm7j; https://github.com/espocrm/espocrm/commit/3babdfa3399e328fb1bd83a1b4ed03d509f4c8e7
CVE: CVE-2024-25167
Published: 2024-03-21
Description: Cross Site Scripting vulnerability in eblog v1.0 allows a remote attacker to execute arbitrary code via a crafted script to the argument description parameter when submitting a comment on a post.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/biantaibao/eblog_xss/blob/main/report.md; https://github.com/biantaibao/eblog_xss/blob/main/report.md
CVE: CVE-2024-25239
Published: 2024-03-21
Description: SQL Injection vulnerability in Sourcecodester Employee Management System v1.0 allows attackers to run arbitrary SQL commands via crafted POST request to /emloyee_akpoly/Account/login.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://blu3ming.github.io/sourcecodester-employee-management-system-sql-injection/; https://blu3ming.github.io/sourcecodester-employee-management-system-sql-injection/
CVE: CVE-2024-25359
Published: 2024-03-21
Description: An issue in zuoxingdong lagom v.0.1.2 allows a local attacker to execute arbitrary code via the pickle_load function of the serialize.py file.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-94
References: https://github.com/bayuncao/vul-cve-10; https://github.com/bayuncao/vul-cve-10
CVE: CVE-2024-25811
Published: 2024-03-21
Description: An access control issue in Dreamer CMS v4.0.1 allows attackers to download backup files and leak sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://github.com/Fei123-design/vuln/blob/master/Dreamer%20CMS%20Unauthorized%20access%20vulnerability.md; https://github.com/Fei123-design/vuln/blob/master/Dreamer%20CMS%20Unauthorized%20access%20vulnerability.md
CVE: CVE-2024-26196
Published: 2024-03-21
Description: Microsoft Edge for Android (Chromium-based) Information Disclosure Vulnerability
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-259
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26196; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26196
CVE: CVE-2024-27094
Published: 2024-03-21
Description: OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encodes a `bytes` input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer. The vulnerability is fixed in 5.0.2 and 4.9.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/2d081f24cac1a867f6f73d512f2022e1fa987854; https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/723f8cab09cdae1aca9ec9cc1cfa040c2d4b06c1; https://github.com/OpenZeppelin/openzeppelin-contracts/commit/92224533b1263772b0774eec3134e132a3d7b2a6
CVE: CVE-2024-27105
Published: 2024-03-21
Description: Frappe is a full-stack web application framework. Prior to versions 14.66.3 and 15.16.0, file permission can be bypassed using certain endpoints, granting less privileged users permission to delete or clone a file. Versions 14.66.3 and 15.16.0 contain a patch for this issue. No known workarounds are available.
CVSS Score: 8.1 (HIGH)
CWE: CWE-863
References: https://github.com/frappe/frappe/security/advisories/GHSA-hq5v-q29v-7rcw; https://github.com/frappe/frappe/security/advisories/GHSA-hq5v-q29v-7rcw
CVE: CVE-2024-27290
Published: 2024-03-21
Description: Docassemble is an expert system for guided interviews and document assembly. Prior to 1.4.97, a user could type HTML into a field, including the field for the user's name, and then that HTML could be displayed on the screen as HTML. The vulnerability has been patched in version 1.4.97 of the master branch.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/jhpyle/docassemble/commit/4801ac7ff7c90df00ac[PII_REDACTED]0cdb6dea2aa; https://github.com/jhpyle/docassemble/security/advisories/GHSA-pcfx-g2j2-f6f6; https://github.com/jhpyle/docassemble/commit/4801ac7ff7c90df00ac[PII_REDACTED]0cdb6dea2aa
CVE: CVE-2024-27291
Published: 2024-03-21
Description: Docassemble is an expert system for guided interviews and document assembly. Prior to 1.4.97, it is possible to create a URL that acts as an open redirect. The vulnerability has been patched in version 1.4.97 of the master branch.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/jhpyle/docassemble/commit/4801ac7ff7c90df00ac[PII_REDACTED]0cdb6dea2aa; https://github.com/jhpyle/docassemble/security/advisories/GHSA-7wxf-r2qv-9xwr; https://github.com/jhpyle/docassemble/commit/4801ac7ff7c90df00ac[PII_REDACTED]0cdb6dea2aa
CVE: CVE-2024-27292
Published: 2024-03-21
Description: Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. The vulnerability has been patched in version 1.4.97 of the master branch.
CVSS Score: 7.5 (HIGH)
CWE: CWE-706
References: https://github.com/jhpyle/docassemble/commit/97f77dc486a26a22ba804765bfd7058aabd600c9; https://github.com/jhpyle/docassemble/security/advisories/GHSA-jq57-3w7p-vwvv; https://github.com/jhpyle/docassemble/commit/97f77dc486a26a22ba804765bfd7058aabd600c9
CVE: CVE-2024-27626
Published: 2024-03-21
Description: A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in Dotclear version 2.29. The flaw exists within the Search functionality of the Admin Panel.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/177239/Dotclear-2.29-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/177239/Dotclear-2.29-Cross-Site-Scripting.html
CVE: CVE-2024-27916
Published: 2024-03-21
Description: Minder is a software supply chain security platform. Prior to version 0.0.33, a Minder user can use the endpoints `GetRepositoryByName`, `DeleteRepositoryByName`, and `GetArtifactByName` to access any repository in the database, irrespective of who owns the repo and any permissions present. The database query checks by repo owner, repo name and provider name (which is always `github`). These query values are not distinct for the particular user - as long as the user has valid credentials and a provider, they can set the repo owner/name to any value they want and the server will return information on this repo. Version 0.0.33 contains a patch for this issue.
CVSS Score: 7.1 (HIGH)
CWE: CWE-285
References: https://github.com/stacklok/minder/blob/a115c8524fbd582b2b277eaadce024bebbded508/internal/controlplane/handlers_repositories.go#L277-L278; https://github.com/stacklok/minder/blob/main/internal/controlplane/handlers_repositories.go#L257-L299; https://github.com/stacklok/minder/commit/45750b4e9fb2de[PII_REDACTED]6e06c19e999bd2eb
CVE: CVE-2024-27918
Published: 2024-03-21
Description: Coder allows oragnizations to provision remote development environments via Terraform. Prior to versions 2.6.1, 2.7.3, and 2.8.4, a vulnerability in Coder's OIDC authentication could allow an attacker to bypass the `CODER_OIDC_EMAIL_DOMAIN` verification and create an account with an email not in the allowlist. Deployments are only affected if the OIDC provider allows users to create accounts on the provider. During OIDC registration, the user's email was improperly validated against the allowed `CODER_OIDC_EMAIL_DOMAIN`s. This could allow a user with a domain that only partially matched an allowed domain to successfully login or register. An attacker could register a domain name that exploited this vulnerability and register on a Coder instance with a public OIDC provider.

Coder instances with OIDC enabled and protected by the `CODER_OIDC_EMAIL_DOMAIN` configuration are affected. Coder instances using a private OIDC provider are not affected, as arbitrary users cannot register through a private OIDC provider without first having an account on the provider. Public OIDC providers are impacted. GitHub authentication and external authentication are not impacted. This vulnerability is remedied in versions 2.8.4, 2.7.3, and 2.6.1 All versions prior to these patches are affected by the vulnerability.*It is recommended that customers upgrade their deployments as soon as possible if they are utilizing OIDC authentication with the `CODER_OIDC_EMAIL_DOMAIN` setting.
CVSS Score: 8.2 (HIGH)
CWE: CWE-20
References: https://github.com/coder/coder/commit/1171ce7add017481d[PII_REDACTED]4209ac160ecb0; https://github.com/coder/coder/commit/2ba84911f8b02605e5958d5e4a2fe3979ec50b31; https://github.com/coder/coder/commit/2d37eb42e7db656e343fe1f36de5ab1a1a62f4fb
CVE: CVE-2024-27922
Published: 2024-03-21
Description: TOMP Bare Server implements the TompHTTP bare server. A vulnerability in versions prior to 2.0.2 relates to insecure handling of HTTP requests by the @tomphttp/bare-server-node package. This flaw potentially exposes the users of the package to manipulation of their web traffic. The impact may vary depending on the specific usage of the package but it can potentially affect any system where this package is in use. The problem has been patched in version 2.0.2. As of time of publication, no specific workaround strategies have been disclosed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-444
References: https://github.com/tomphttp/bare-server-node/security/advisories/GHSA-86fc-f9gr-v533; https://github.com/tomphttp/bare-server-node/security/advisories/GHSA-86fc-f9gr-v533
CVE: CVE-2024-27923
Published: 2024-03-21
Description: Grav is a content management system (CMS). Prior to version 1.7.43, users who may write a page may use the `frontmatter` feature due to insufficient permission validation and inadequate file name validation. This may lead to remote code execution. Version 1.7.43 fixes this issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287, CWE-434, CWE-434
References: https://github.com/getgrav/grav/commit/e3b0aa0c502aad251c1b79d1ee973dcd93711f07; https://github.com/getgrav/grav/security/advisories/GHSA-f6g2-h7qv-3m5v; https://github.com/getgrav/grav/commit/e3b0aa0c502aad251c1b79d1ee973dcd93711f07
CVE: CVE-2024-27926
Published: 2024-03-21
Description: RSSHub is an open source RSS feed generator. Starting in version 1.0.0-master.cbbd829 and prior to version 1.0.0-master.d8ca915, ahen the specially crafted image is supplied to the internal media proxy, it proxies the image without handling XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code. Users who access the deliberately constructed URL are affected. This vulnerability was fixed in version 1.0.0-master.d8ca915. No known workarounds are available.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/DIYgod/RSSHub/commit/4d3e5d79c1c17837e931b4cd253d2013b487aa87; https://github.com/DIYgod/RSSHub/security/advisories/GHSA-2wqw-hr4f-xrhh; https://github.com/DIYgod/RSSHub/commit/4d3e5d79c1c17837e931b4cd253d2013b487aa87
CVE: CVE-2024-27927
Published: 2024-03-21
Description: RSSHub is an open source RSS feed generator. Prior to version 1.0.0-master.a429472, RSSHub allows remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary targets and retrieve information in the internal network or conduct Denial-of-Service (DoS) attacks. The attacker can send malicious requests to a RSSHub server, to make the server send HTTP GET requests to arbitrary destinations and see partial responses. This may lead to leak the server IP address, which could be hidden behind a CDN; retrieving information in the internal network, e.g. which addresses/ports are accessible, the titles and meta descriptions of HTML pages; and denial of service amplification. The attacker could request the server to download some large files, or chain several SSRF requests in a single attacker request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://github.com/DIYgod/RSSHub/blob/172f6cfd2b69ea6affdbdedf61e6dde1671f3796/lib/routes/m4/index.js#L10-L14; https://github.com/DIYgod/RSSHub/blob/172f6cfd2b69ea6affdbdedf61e6dde1671f3796/lib/routes/zjol/paper.js#L7-L13; https://github.com/DIYgod/RSSHub/blob/5928c5db2472e101c2f5c3bafed77a2f72edd40a/lib/routes/mastodon/acct.js#L4-L7
CVE: CVE-2024-27932
Published: 2024-03-21
Description: Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.8.0 and prior to version 1.40.4, Deno improperly checks that an import specifier's hostname is equal to or a child of a token's hostname, which can cause tokens to be sent to servers they shouldn't be sent to. An auth token intended for `example[.]com` may be sent to `notexample[.]com`. Anyone who uses DENO_AUTH_TOKENS and imports potentially untrusted code is affected. Version 1.40.0 contains a patch for this issue
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-20
References: https://github.com/denoland/deno/blob/3f4639c330a31741b0efda2f93ebbb833f4f95bc/cli/auth_tokens.rs#L89; https://github.com/denoland/deno/commit/de23e3b60b066481cc390f459497d5bef42a899b; https://github.com/denoland/deno/security/advisories/GHSA-5frw-4rwq-xhcr
CVE: CVE-2024-27933
Published: 2024-03-21
Description: Deno is a JavaScript, TypeScript, and WebAssembly runtime. In version 1.39.0, use of raw file descriptors in `op_node_ipc_pipe()` leads to premature close of arbitrary file descriptors, allowing standard input to be re-opened as a different resource resulting in permission prompt bypass. Node child_process IPC relies on the JS side to pass the raw IPC file descriptor to `op_node_ipc_pipe()`, which returns a `IpcJsonStreamResource` ID associated with the file descriptor. On closing the resource, the raw file descriptor is closed together.

Use of raw file descriptors in `op_node_ipc_pipe()` leads to premature close of arbitrary file descriptors. This allow standard input (fd 0) to be closed and re-opened for a different resource, which allows a silent permission prompt bypass. This is exploitable by an attacker controlling the code executed inside a Deno runtime to obtain arbitrary code execution on the host machine regardless of permissions.

This bug is known to be exploitable. There is a working exploit that achieves arbitrary code execution by bypassing prompts from zero permissions, additionally abusing the fact that Cache API lacks filesystem permission checks. The attack can be conducted silently as stderr can also be closed, suppressing all prompt outputs.

Version 1.39.1 fixes the bug.

CVSS Score: 8.2 (HIGH)
CWE: CWE-863, CWE-863
References: https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L214; https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L220; https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L225
CVE: CVE-2024-27934
Published: 2024-03-21
Description: Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.36.2 and prior to version 1.40.3, use of inherently unsafe `*const c_void` and `ExternalPointer` leads to use-after-free access of the underlying structure, resulting in arbitrary code execution. Use of inherently unsafe `*const c_void` and `ExternalPointer` leads to use-after-free access of the underlying structure, which is exploitable by an attacker controlling the code executed inside a Deno runtime to obtain arbitrary code execution on the host machine regardless of permissions. This bug is known to be exploitable for both `*const c_void` and `ExternalPointer` implementations. Version 1.40.3 fixes this issue.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416, CWE-416
References: https://github.com/denoland/deno/security/advisories/GHSA-3j27-563v-28wf; https://github.com/denoland/deno/security/advisories/GHSA-3j27-563v-28wf
CVE: CVE-2024-27935
Published: 2024-03-21
Description: Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.35.1 and prior to version 1.36.3, a vulnerability in Deno's Node.js compatibility runtime allows for cross-session data contamination during simultaneous asynchronous reads from Node.js streams sourced from sockets or files. The issue arises from the re-use of a global buffer (BUF) in stream_wrap.ts used as a performance optimization to limit allocations during these asynchronous read operations. This can lead to data intended for one session being received by another session, potentially resulting in data corruption and unexpected behavior. This affects all users of Deno that use the node.js compatibility layer for network communication or other streams, including packages that may require node.js libraries indirectly. Version 1.36.3 contains a patch for this issue.

CVSS Score: 7.2 (HIGH)
CWE: CWE-488
References: https://github.com/denoland/deno/commit/3e9fb8aafd9834ebacd27734cea4310caaf794c6; https://github.com/denoland/deno/issues/20188; https://github.com/denoland/deno/security/advisories/GHSA-wrqv-pf6j-mqjp
CVE: CVE-2024-27936
Published: 2024-03-21
Description: Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Starting in version 1.32.1 and prior to version 1.41.0 of the deno library, maliciously crafted permission request can show the spoofed permission prompt by inserting a broken ANSI escape sequence into the request contents. Deno is stripping any ANSI escape sequences from the permission prompt, but permissions given to the program are based on the contents that contain the ANSI escape sequences. Any Deno program can spoof the content of the interactive permission prompt by inserting a broken ANSI code, which allows a malicious Deno program to display the wrong file path or program name to the user. Version 1.41.0 of the deno library contains a patch for the issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-150
References: https://github.com/denoland/deno/commit/78d430103a8f6931154ddbbe19d36f3b8630286d; https://github.com/denoland/deno/commit/7e6b[PII_REDACTED]0b55f1d08fb03ea8132781abc5; https://github.com/denoland/deno/security/advisories/GHSA-m4pq-fv2w-6hrw