deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-43250
Published: 2022-11-02
Description: Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_qpel_0_0_fallback_16 in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/strukturag/libde265/issues/346; https://lists.debian.org/debian-lts-announce/2023/01/msg00020.html; https://www.debian.org/security/2023/dsa-5346
CVE: CVE-2022-43252
Published: 2022-11-02
Description: Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_epel_16_fallback in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/strukturag/libde265/issues/347; https://lists.debian.org/debian-lts-announce/2023/01/msg00020.html; https://www.debian.org/security/2023/dsa-5346
CVE: CVE-2022-43253
Published: 2022-11-02
Description: Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_unweighted_pred_16_fallback in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/strukturag/libde265/issues/348; https://lists.debian.org/debian-lts-announce/2023/01/msg00020.html; https://www.debian.org/security/2023/dsa-5346
CVE: CVE-2022-43254
Published: 2022-11-02
Description: GPAC v2.1-DEV-rev368-gfd054169b-master was discovered to contain a memory leak via the component gf_list_new at utils/list.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://github.com/gpac/gpac/issues/2284; https://github.com/gpac/gpac/issues/2284
CVE: CVE-2022-43255
Published: 2022-11-02
Description: GPAC v2.1-DEV-rev368-gfd054169b-master was discovered to contain a memory leak via the component gf_odf_new_iod at odf/odf_code.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://github.com/gpac/gpac/issues/2285; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/2285
CVE: CVE-2022-43995
Published: 2022-11-02
Description: Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be triggered by arbitrary local users with access to Sudo by entering a password of seven characters or fewer. The impact could vary depending on the system libraries, compiler, and processor architecture.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=2139911; https://github.com/sudo-project/sudo/commit/bd209b9f16fcd1270c13db27ae3329c677d48050; https://news.ycombinator.com/item?id=33465707
CVE: CVE-2021-45446
Published: 2022-11-02
Description: A vulnerability in 

Hitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.2 and 
8.3.0.25 does not cascade the hidden property to the children of the Home folder.  This directory listing provides an attacker with the complete index of all the resources located 
inside the directory. 



CVSS Score: 5.0 (MEDIUM)
CWE: CWE-548, CWE-281
References: https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]501; https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]501
CVE: CVE-2021-45447
Published: 2022-11-02
Description: 
Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.2 and 
8.3.0.25 with the Data Lineage feature enabled transmits database passwords in clear text.  

The transmission of sensitive data in clear text allows unauthorized actors with access to the 
network to sniff and obtain sensitive information that can be later used to gain unauthorized 
access.



CVSS Score: 7.7 (HIGH)
CWE: CWE-319, CWE-319
References: https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]101; https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]101
CVE: CVE-2022-39381
Published: 2022-11-02
Description: Muhammara is a node module with c/cpp bindings to modify PDF with js for node or electron (based/replacement on/of galkhana/hummusjs). The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be appended to another. This issue has been patched in 2.6.0 for muhammara and not at all for hummus. As a workaround, do not process files from untrusted sources.
CVSS Score: 7.5 (HIGH)
CWE: CWE-690, CWE-476
References: https://github.com/galkahana/HummusJS/issues/293; https://github.com/julianhille/MuhammaraJS/issues/191; https://github.com/julianhille/MuhammaraJS/pull/194
CVE: CVE-2021-45448
Published: 2022-11-02
Description: Pentaho Business Analytics
 Server versions before 9.2.0.2 and 8.3.0.25 using the Pentaho 
Analyzer plugin exposes a service endpoint for templates which allows a 
user-supplied path to access resources that are out of bounds. 

The software uses external input to construct a pathname that is intended to identify a file or 
directory that is located underneath a restricted parent directory, but the software does not 
properly neutralize special elements within the pathname that can cause the pathname to 
resolve to a location that is outside of the restricted directory.  By using special elements such as 
".." and "/" separators, attackers can escape outside of the restricted 
location to access files or directories that are elsewhere on the 
system.




CVSS Score: 7.1 (HIGH)
CWE: CWE-22, CWE-22
References: https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]701; https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]701
CVE: CVE-2022-41551
Published: 2022-11-02
Description: Garage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /garage/editorder.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/Happyd99/bug_report/blob/main/vendors/mayuri_k/garage-management-system/SQLi-1.md; https://github.com/Happyd99/bug_report/blob/main/vendors/mayuri_k/garage-management-system/SQLi-1.md
CVE: CVE-2022-41716
Published: 2022-11-02
Description: Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D".
CVSS Score: 7.5 (HIGH)
References: https://go.dev/cl/446916; https://go.dev/issue/56284; https://groups.google.com/g/golang-announce/c/mbHY1UY3BaM/m/hSpmRzk-AgAJ
CVE: CVE-2022-39241
Published: 2022-11-02
Description: Discourse is a platform for community discussion. A malicious admin could use this vulnerability to perform port enumeration on the local host or other hosts on the internal network, as well as against hosts on the Internet. Latest `stable`, `beta`, and `test-passed` versions are now patched. As a workaround, self-hosters can use `DISCOURSE_BLOCKED_IP_BLOCKS` env var (which overrides `blocked_ip_blocks` setting) to stop webhooks from accessing private IPs.
CVSS Score: 7.6 (HIGH)
CWE: CWE-918, CWE-918
References: https://github.com/discourse/discourse/security/advisories/GHSA-rcc5-28r3-23rr; https://github.com/discourse/discourse/security/advisories/GHSA-rcc5-28r3-23rr
CVE: CVE-2022-39353
Published: 2022-11-02
Description: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a document that has more then 1 `childNode`.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-20, CWE-1288, CWE-20
References: https://github.com/jindw/xmldom/issues/150; https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883; https://lists.debian.org/debian-lts-announce/2023/01/msg00000.html
CVE: CVE-2022-39356
Published: 2022-11-02
Description: Discourse is a platform for community discussion. Users who receive an invitation link that is not scoped to a single email address can enter any non-admin user's email and gain access to their account when accepting the invitation. All users should upgrade to the latest version. A workaround is temporarily disabling invitations with `SiteSetting.max_invites_per_day = 0` or scope them to individual email addresses.
CVSS Score: 8.9 (HIGH)
CWE: CWE-285
References: https://github.com/discourse/discourse/pull/18817; https://github.com/discourse/discourse/security/advisories/GHSA-x8w7-rwmr-w278; https://github.com/discourse/discourse/pull/18817
CVE: CVE-2022-39378
Published: 2022-11-02
Description: Discourse is a platform for community discussion. Under certain conditions, a user badge may have been awarded based on a user's activity in a topic with restricted access. Before this vulnerability was disclosed, the topic title of the topic associated with the user badge may be viewed by any user. If there are sensitive information in the topic title, it will therefore have been exposed. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. There are currently no known workarounds available.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/discourse/discourse/security/advisories/GHSA-2gvq-27h6-4h5f; https://github.com/discourse/discourse/security/advisories/GHSA-2gvq-27h6-4h5f
CVE: CVE-2022-3575
Published: 2022-11-02
Description: Frauscher Sensortechnik GmbH FDS102 for FAdC R2 and FAdCi R2 v2.8.0 to v2.9.1 are vulnerable to malicious code upload without authentication by using the configuration upload function. This could lead to a complete compromise of the FDS102 device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.frauscher.com/en/psirt; https://www.frauscher.com/en/psirt
CVE: CVE-2022-43226
Published: 2022-11-02
Description: Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/?page=appointments/view_appointment.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/Happyd99/bug_report/blob/main/vendors/oretnom23/online-diagnostic-lab-management-system/SQLi-1.md; https://github.com/Happyd99/bug_report/blob/main/vendors/oretnom23/online-diagnostic-lab-management-system/SQLi-1.md
CVE: CVE-2022-43227
Published: 2022-11-02
Description: Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/admin/?page=appointments/view_appointment.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/Happyd99/bug_report/blob/main/vendors/oretnom23/online-diagnostic-lab-management-system/SQLi-2.md; https://github.com/Happyd99/bug_report/blob/main/vendors/oretnom23/online-diagnostic-lab-management-system/SQLi-2.md
CVE: CVE-2022-24936
Published: 2022-11-02
Description: Out-of-Bounds error in GBL parser in Silicon Labs Gecko Bootloader version 4.0.1 and earlier allows attacker to overwrite flash Sign key and OTA decryption key via malicious bootloader upgrade.
CVSS Score: 8.3 (HIGH)
CWE: CWE-119, CWE-787
References: https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000Gdop4QAB?operationContext=S1; https://github.com/SiliconLabs/gecko_sdk/blame/2e82050dc8823c9fe0e8908c1b2666fb83056230/platform/bootloader/core/btl_bootload.c; https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000Gdop4QAB?operationContext=S1
CVE: CVE-2020-36608
Published: 2022-11-02
Description: A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS. Affected by this issue is some unknown functionality of the file admin_organizer.js of the component Error Log Module. The manipulation leads to cross site scripting. The attack may be launched remotely. The name of the patch is dfd0afacb26c3682a847bea7b49ea440b63f3baa. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-212816.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/TribalSystems/Zenario/commit/dfd0afacb26c3682a847bea7b49ea440b63f3baa; https://vuldb.com/?id.212816; https://github.com/TribalSystems/Zenario/commit/dfd0afacb26c3682a847bea7b49ea440b63f3baa
CVE: CVE-2022-2904
Published: 2022-11-02
Description: A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions starting from 15.2 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 It was possible to exploit a vulnerability in the external status checks feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79, CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2904.json; https://gitlab.com/gitlab-org/gitlab/-/issues/367408; https://hackerone.com/reports/1628009
CVE: CVE-2022-3844
Published: 2022-11-02
Description: A vulnerability, which was classified as problematic, was found in Webmin 2.001. Affected is an unknown function of the file xterm/index.cgi. The manipulation leads to basic cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.003 is able to address this issue. The patch is identified as d3d33af3c0c3fd3a889c84e287a038b7a457d811. It is recommended to upgrade the affected component. VDB-212862 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-80, CWE-79
References: https://github.com/webmin/webmin/commit/d3d33af3c0c3fd3a889c84e287a038b7a457d811; https://github.com/webmin/webmin/releases/tag/2.003; https://vuldb.com/?ctiid.212862
CVE: CVE-2022-3845
Published: 2022-11-02
Description: A vulnerability has been found in phpipam and classified as problematic. Affected by this vulnerability is an unknown functionality of the file app/admin/import-export/import-load-data.php of the component Import Preview Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.5.0 is able to address this issue. The name of the patch is 22c797c[PII_REDACTED]fe7d31bccd3f1d4aeeb3bbc. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-212863.
CVSS Score: 2.4 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/phpipam/phpipam/commit/22c797c[PII_REDACTED]fe7d31bccd3f1d4aeeb3bbc; https://github.com/phpipam/phpipam/releases/tag/v1.5.0; https://vuldb.com/?id.212863
CVE: CVE-2022-43066
Published: 2022-11-02
Description: Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/Master.php?f=delete_message.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/wang1213884/bug_report/blob/main/vendors/oretnom23/online-diagnostic-lab-management-system/SQLi-2.md; https://github.com/wang1213884/bug_report/blob/main/vendors/oretnom23/online-diagnostic-lab-management-system/SQLi-2.md
CVE: CVE-2022-43068
Published: 2022-11-02
Description: Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_reservation.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/wang1213884/bug_report/blob/main/vendors/oretnom23/online-diagnostic-lab-management-system/SQLi-1.md; https://github.com/wang1213884/bug_report/blob/main/vendors/oretnom23/online-diagnostic-lab-management-system/SQLi-1.md
CVE: CVE-2022-3181
Published: 2022-11-02
Description: An Improper Input Validation vulnerability exists in Trihedral VTScada version 12.0.38 and prior. A specifically malformed HTTP request could cause the affected VTScada to crash. Both local area network (LAN)-only and internet facing systems are affected. 


CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-300-04; https://www.cisa.gov/uscert/ics/advisories/icsa-22-300-04
CVE: CVE-2022-24945
Published: 2022-11-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-44576
Published: 2022-11-02
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in AgentEasy Properties plugin <= 1.0.4 on WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/agenteasy-properties/wordpress-agenteasy-properties-plugin-1-0-4-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://wordpress.org/plugins/agenteasy-properties/; https://patchstack.com/database/vulnerability/agenteasy-properties/wordpress-agenteasy-properties-plugin-1-0-4-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-44586
Published: 2022-11-02
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) in Ayoub Media AM-HiLi plugin <= 1.0 on WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/am-hili-affiliate-manager-for-publishers/wordpress-am-hili-plugin-1-0-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://wordpress.org/plugins/am-hili-affiliate-manager-for-publishers/; https://patchstack.com/database/vulnerability/am-hili-affiliate-manager-for-publishers/wordpress-am-hili-plugin-1-0-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2021-46853
Published: 2022-11-03
Description: Alpine before 2.25 allows remote attackers to cause a denial of service (application crash) when LIST or LSUB is sent before STARTTLS.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-367
References: https://bugs.gentoo.org/807613; https://nostarttls.secvuln.info/; https://security.gentoo.org/glsa/202301-07
CVE: CVE-2022-44638
Published: 2022-11-03
Description: In libpixman in Pixman before 0.42.2, there is an out-of-bounds write (aka heap-based buffer overflow) in rasterize_edges_8 due to an integer overflow in pixman_sample_floor_y.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-190
References: http://packetstormsecurity.com/files/170121/pixman-pixman_sample_floor_y-Integer-Overflow.html; http://www.openwall.com/lists/oss-security/2022/11/05/1; https://gitlab.freedesktop.org/pixman/pixman/-/issues/63
CVE: CVE-2022-32287
Published: 2022-11-03
Description: A relative path traversal vulnerability in a FileUtil class used by the PEAR management component of Apache UIMA allows an attacker to create files outside the designated target directory using carefully crafted ZIP entry names. This issue affects Apache UIMA Apache UIMA version 3.3.0 and prior versions. Note that PEAR files should never be installed into an UIMA installation from untrusted sources because PEAR archives are executable plugins that will be able to perform any actions with the same privileges as the host Java Virtual Machine.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2022/11/03/4; https://lists.apache.org/thread/57vk0d79j94d0lk0vol8xn935yv1shdd; http://www.openwall.com/lists/oss-security/2022/11/03/4
CVE: CVE-2022-41435
Published: 2022-11-03
Description: OpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /system/sshkeys.js. This vulnerability allows attackers to execute arbitrary web scripts or HTML via crafted public key comments.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gist.github.com/librick/eacf19bcfc5ca964e0882b4ef9864bf5; https://github.com/openwrt/luci/commit/944b55738e7f9685865d5298248b7fbd7380749e; https://gist.github.com/librick/eacf19bcfc5ca964e0882b4ef9864bf5
CVE: CVE-2022-39234
Published: 2022-11-03
Description: GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Deleted/deactivated user could continue to use their account as long as its cookie is valid. This issue has been patched, please upgrade to version 10.0.4. There are currently no known workarounds.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-613, CWE-613
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-pgcx-mc58-3gmg; https://github.com/glpi-project/glpi/security/advisories/GHSA-pgcx-mc58-3gmg
CVE: CVE-2022-39262
Published: 2022-11-03
Description: GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package, GLPI administrator can define rich-text content to be displayed on login page. The displayed content is can contains malicious code that can be used to steal credentials. This issue has been patched, please upgrade to version 10.0.4.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-83, CWE-79
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-4x48-q2wr-cpg4; https://huntr.dev/bounties/54fc907e-6983-4c24-b249-1440aac1643c/; https://github.com/glpi-project/glpi/security/advisories/GHSA-4x48-q2wr-cpg4
CVE: CVE-2022-39276
Published: 2022-11-03
Description: GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Usage of RSS feeds or an external calendar in planning is subject to SSRF exploit. In case a remote script returns a redirect response, the redirect target URL is not checked against the URL allow list defined by administrator. This issue has been patched, please upgrade to 10.0.4. There are currently no known workarounds.
CVSS Score: 3.5 (LOW)
CWE: CWE-918, CWE-918
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-8vwg-7x42-7v6p; https://huntr.dev/bounties/7a88f92b-1ee2-4ca8-9cf8-05fcf6cfe73f/; https://github.com/glpi-project/glpi/security/advisories/GHSA-8vwg-7x42-7v6p
CVE: CVE-2022-39382
Published: 2022-11-03
Description: Keystone is a headless CMS for Node.js — built with GraphQL and React.`@keystone-6/core@3.0.0 || 3.0.1` users that use `NODE_ENV` to trigger security-sensitive functionality in their production builds are vulnerable to `NODE_ENV` being inlined to `"development"` for user code, irrespective of what your environment variables. If you do not use `NODE_ENV` in your user code to trigger security-sensitive functionality, you are not impacted by this vulnerability. Any dependencies that use `NODE_ENV` to trigger particular behaviors (optimizations, security or otherwise) should still respect your environment's configured `NODE_ENV` variable. The application's dependencies, as found in `node_modules` (including `@keystone-6/core`), are typically not compiled as part of this process, and thus should be unaffected. We have tested this assumption by verifying that `NODE_ENV=production yarn keystone start` still uses secure cookies when using `statelessSessions`. This vulnerability has been fixed in @keystone-6/core@3.0.2, regression tests have been added for this vulnerability in #8063.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74, CWE-74
References: https://github.com/keystonejs/keystone/pull/8031/; https://github.com/keystonejs/keystone/pull/8063; https://github.com/keystonejs/keystone/security/advisories/GHSA-25mx-2mxm-6343