deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-9phm-9p8f-hw5m
Package: nitro (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: < 3.0.260429-beta
Patched in: 3.0.260429-beta

Summary: Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules

Details:
A redirect route rule like:

```ts
routeRules: {
  "/legacy/**": { redirect: "/**" }
}
```

is intended to rewrite paths within the same host. Before the patch, an attacker could turn the rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. Example exploit:

```
GET /legacy//evil.com
```

Nitro stripped `/legacy` from the matched pathname and joined the remainder against the rule's target. The remainder was `//evil.com`, which the join preserved verbatim, so Nitro responded with `Location: //evil.com`. Browsers resolve `//evil.com` as a protocol-relative URL against the current scheme, sending the user to `https://evil.com`. 

### Are you affected?

Users may be affected if **all** of the following are true:

1. Their project uses Nitro's `routeRules` with a `redirect` entry.
2. The target uses a `/**` wildcard suffix to forward sub-paths (e.g. `redirect: "/**"`, `redirect: "/new/**"`, `proxy: { to: "http://upstream/**" }`).
3. The `redirect` rule is _not_ handled natively at the CDN layer. The `vercel`, `netlify`, `cloudflare-pages`, and `edgeone` presets translate `routeRules.redirect` into platform config (`vercel.json`, `_redirects`, EdgeOne v3 config) and serve the redirect at the edge — those deployments bypass the Nitro runtime entirely and are not affected. Every other preset executes the redirect through the Nitro runtime and can be vulnerable.

## Impact

Open redirect from any host serving Nitro with a wildcard `redirect` rule. The redirect target is fully attacker-controlled, the URL looks legitimate (it starts with the victim's domain), and the browser silently follows it.

## Patched versions

Upgrade to one of:

- [2.13.4](https://github.com/nitrojs/nitro/releases/tag/v2.13.4) or later (or upgrade lockfile with latest ufo 1.6.4+)
- [3.0.260429-beta](https://github.com/nitrojs/nitro/releases/tag/v3.0.260429-beta) or later (https://github.com/nitrojs/nitro/pull/4236)

The fix has two parts:

1. `ufo` is bumped to `^1.6.4` ([unjs/ufo@5cd9e67](https://github.com/unjs/ufo/commit/5cd9e676711af3f4e4b5398ddf6ca8d52c1c7e1f)), which collapses any run of leading slashes to a single `/` inside `withoutBase`. This covers the typical `"/scope/**"` rule.
2. The Nitro runtime additionally collapses leading `//` before joining when the rule path itself is `/**` (in rare case which case `withoutBase` is never called and the raw pathname flows straight into `joinURL("", …)`).
GitHub Security Advisory: GHSA-394x-274p-mqc6
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.1)
CWE: CWE-269: Improper Privilege Management
Vulnerable versions: < 2026.3.28
Patched in: 2026.3.28

Summary: Duplicate Advisory: OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-767m-xrhc-fxm7. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.28 contains a privilege escalation vulnerability allowing authenticated operators with write permissions to access admin-class Telegram configuration and cron persistence settings via the send endpoint. Attackers with operator.write credentials can exploit insufficient access controls to reach sensitive administrative functionality and modify persistence mechanisms.
GitHub Security Advisory: GHSA-h4hv-92pp-pcjg
Package: cyberchef (NPM)
Severity: HIGH (CVSS 7.2)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 11.0.0
Patched in: 11.0.0

Summary: CyberChef has a Cross-site Scripting issue

Details:
GCHQ CyberChef before 11.0.0 allows XSS via Show Base64 offsets, as demonstrated by the /#recipe=Show_Base64_offsets('%3Cscript substring.
GitHub Security Advisory: GHSA-qp56-gp47-jwj3
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 2026.2.6, <= 2026.3.24
Patched in: 2026.3.28

Summary: Duplicate Advisory: OpenClaw: Feishu extension resolveUploadInput bypasses file-system sandbox and allows arbitrary file reads via upload_image

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-qf48-qfv4-jjm9. This link is maintained to preserve external references.

### Original Description
OpenClaw versions 2026.2.6 through 2026.3.24 contain a path traversal vulnerability in the Feishu extension resolveUploadInput function that bypasses file-system sandbox restrictions. Attackers can exploit improper path resolution during upload_image operations to read arbitrary files outside configured localRoots boundaries.
GitHub Security Advisory: GHSA-r67j-r569-jrwp
Package: thrift (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-674: Uncontrolled Recursion
Vulnerable versions: < 0.23.0
Patched in: 0.23.0

Summary: Apache Thrift Node.js bindings vulnerable to Uncontrolled Recursion

Details:
Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.
GitHub Security Advisory: GHSA-r2jq-4h3x-rfj6
Package: @dadigua/hyperchat (NPM)
Severity: MODERATE (CVSS 7.3)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 2.0.0-alpha.63
Patched in: unpatched

Summary: BigSweetPotatoStudio HyperChat has a Server-Side Request Forgery issue

Details:
A vulnerability was identified in BigSweetPotatoStudio HyperChat up to 2.0.0-alpha.63. Affected by this issue is the function fetch of the file packages/core/src/http/aiProxyMiddleware.mts of the component AI Proxy Middleware. Such manipulation of the argument baseurl leads to server-side request forgery. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
GitHub Security Advisory: GHSA-8pf2-vj79-4wxg
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')
Vulnerable versions: < 2026.3.31
Patched in: 2026.3.31

Summary: Duplicate Advisory: OpenClaw: MSTeams thread history bypasses sender allowlist via Graph API

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-chfm-xgc4-47rj. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability in MS Teams thread history fetched via Graph API. Attackers can retrieve thread messages that should be filtered by sender allowlists, bypassing message filtering restrictions.
GitHub Security Advisory: GHSA-5mh4-3rv3-fpcf
Package: openclaw (NPM)
Severity: HIGH (CVSS 6.5)
CWE: CWE-668: Exposure of Resource to Wrong Sphere
Vulnerable versions: < 2026.3.31
Patched in: 2026.3.31

Summary: Duplicate Advisory: OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-cg7q-fg22-4g98. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.31 contains insufficient environment variable sanitization in host exec operations, failing to filter package, registry, Docker, compiler, and TLS override variables. Attackers can exploit this by injecting malicious environment variables to override critical system configurations and compromise host execution integrity.
GitHub Security Advisory: GHSA-5799-3xg7-rfrv
Package: openclaw (NPM)
Severity: HIGH (CVSS 8.1)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: < 2026.3.31
Patched in: 2026.3.31

Summary: Duplicate Advisory: OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-fv94-qvg8-xqpw. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.31 contains a symlink following vulnerability in SSH sandbox tar upload that allows remote attackers to write arbitrary files. Attackers can exploit this by uploading tar archives containing symlinks to escape the sandbox and overwrite files on the remote host.
GitHub Security Advisory: GHSA-f5fm-9jmp-c88r
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.8)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: < 2026.4.2
Patched in: 2026.4.2

Summary: Duplicate Advisory: OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-fh32-73r9-rgh5. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.4.2 fails to normalize trailing-dot localhost hosts in remote CDP discovery responses, allowing bypass of loopback protections. Attackers can craft hostile discovery responses returning localhost. to retarget authenticated browser control toward localhost endpoints and expose browser state.
GitHub Security Advisory: GHSA-8p33-q827-ghj5
Package: dssrf (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-791: Incomplete Filtering of Special Elements
Vulnerable versions: < 1.3.0
Patched in: 1.3.0

Summary: dssrf: every IPv6 category bypasses is_url_safe

Details:
A vulnerability in dssrf allows an attacker to bypass its SSRF protections by supplying one of the following IPv6 addresses, resulting in a successful SSRF. This contradicts dssrf documentation, which incorrectly claims that IPv6 is disabled entirely. See below:

```rust
Input	Category
http://[::1]/	IPv6 loopback
http://[fc00::1]/	IPv6 ULA
http://[fe80::1]/	IPv6 link-local
http://[::ffff:127.0.0.1]/	IPv4-mapped loopback
http://[::ffff:169.254.169.254]/	IPv4-mapped IMDS
http://[::ffff:100.64.0.1]/	IPv4-mapped CGNAT
http://[64:ff9b::7f00:1]/	NAT64 well-known prefix
http://[64:ff9b:1::1]/	NAT64 local-use (RFC 8215)
http://[5f00::1]/	SRv6 SID (RFC 9602)
http://[3fff::1]/	IPv6 documentation (RFC 9637)
http://[fec0::1]/	IPv6 site-local (deprecated, RFC 3879)
http://[::127.0.0.1]/	IPv4-compatible IPv6
```

### POC

```bash
mkdir dssrf-poc && cd dssrf-poc
npm init -y >/dev/null
npm install dssrf@^1.0.2
cat > audit.js <<'EOF'
const dssrf = require('dssrf');
const cases = [
  ['http://[::1]/',                         'IPv6 loopback'],
  ['http://[fc00::1]/',                     'IPv6 ULA'],
  ['http://[fe80::1]/',                     'IPv6 link-local'],
  ['http://[::ffff:127.0.0.1]/',            'IPv4-mapped loopback'],
  ['http://[::ffff:169.254.169.254]/',      'IPv4-mapped IMDS'],
  ['http://[64:ff9b::7f00:1]/',             'NAT64 well-known + 127.0.0.1'],
  ['http://[64:ff9b:1::1]/',                'NAT64 local-use (RFC 8215)'],
  ['http://[5f00::1]/',                     'SRv6 SID (RFC 9602)'],
  ['http://[fec0::1]/',                     'IPv6 site-local deprecated'],
  ['http://127.0.0.1/',                     'IPv4 loopback (control)'],
  ['http://10.0.0.1/',                      'IPv4 RFC1918 (control)'],
  ['http://8.8.8.8/',                       'PUBLIC IPv4 (control)'],
];
(async () => {
  for (const [url, label] of cases) {
    const safe = await dssrf.is_url_safe(url);
    console.log(`${safe ? '✓ALLOW' : '·block'}  ${url.padEnd(40)}  ${label}`);
  }
})();
EOF
node audit.js
```

### Credit
dssrf thanks <brmenna@gmail.com> for reporting this issue responsibly.

### Update
Users should immediately update to dssrf 1.3.0.

### Lessons Learned
As seen both in the past and today, many advisories and CVE bypasses leverage IPv6. IPv6 remains the weakest link, as it is rarely configured correctly and seldom tested. In this case, while IPv4 was properly blocked, the corresponding IPv6 blocking logic was completely broken and never actually worked.,
GitHub Security Advisory: GHSA-8qjv-jj2q-x832
Package: auth0-js (NPM)
Severity: HIGH (CVSS 7.1)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 8.11.0, <= 9.32.0
Patched in: 10.0.0

Summary: Auth.js SDK has Improper Permission Checking

Details:
### Description
Under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided.

### Am I Affected?
Users are affected if they meet each of the following preconditions:
- Applications built using Auth0.js version between 8.11.0 and 9.32.0
- The application’s access control relies on rules defined in Auth0 Actions.


### Affected product and versions
auth0.js SDK v8.11.0 to v9.32.0

### Resolution
Upgrade auth0/auth0.js to v10.0.0 or greater.

### Acknowledgements
Okta would like to thank Quan Le (@aleister1102) for their discovery and responsible disclosure.
GitHub Security Advisory: GHSA-84hm-wfh8-c5pg
Package: sse-channel (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
Vulnerable versions: <= 4.0.0
Patched in: 4.0.1

Summary: sse-channel: SSE Injection via unsanitized event fields

Details:
### Impact

Implementations that allows user-provided values to be passed to `event`, `retry` or `id` fields would be susceptible to event spoofing, where an attacker could inject arbitrary messages into the stream.

- **Event Spoofing:** Attacker can inject arbitrary SSE events into the stream
- **Client-side Manipulation:** Injected events can trigger unintended behavior in frontend JavaScript EventSource listeners
- **Data Integrity:** Consumers of the SSE stream cannot distinguish injected events from legitimate ones

### Patches
Patch available in v4.0.1.

### Workarounds
Do not allow user data to control `event`, `retry` or `id` fields, and if you must - sanitize the input before passing it to `sse-channel`, stripping any newlines. 

### Resources

https://github.com/rexxars/sse-channel/issues/42
GitHub Security Advisory: GHSA-wpg9-53fq-2r8h
Package: mongoose (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: >= 9.0.0, <= 9.1.5
Patched in: 9.1.6

Summary: Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection

Details:
### Impact

This vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the `$nor` operator.

When sanitizeFilter is enabled, Mongoose wraps query operators in `$eq` to neutralize them. However, prior to the fix, `$nor` was not included in the set of logical operators that are recursively sanitized. Because `$nor` accepts an array (like `$and` and `$or`), and arrays do not trigger `hasDollarKeys()`, malicious operators such as `$ne`, `$gt`, or `$regex` could be injected inside a `$nor` clause without being sanitized.

This may lead to:

- Authentication bypass
- Unauthorized data access
- Data exfiltration

**Affected users:**

Applications that:

- Explicitly enable sanitizeFilter
- Pass unsanitized user-controlled input directly into query methods (e.g., `Model.findOne(req.body)`) and rely on `sanitizeFilter` to strip out query selectors

Applications that validate input schemas, whitelist fields, or avoid passing raw request bodies into queries are not affected. For example, `Model.findOne({ user: req.body.user, pwd: req.body.pwd })` is not affected.

### Patches

Patches have been released for all supported Mongoose release lines:

- `^6.13.9`
- `^7.8.9`
- `^8.22.1`
- `^9.1.6`   

### Workarounds

Delete `$nor` keys, use an additional schema validation library, or write middleware to strip out `$nor` from query filters.

### Resources

sanitizeFilter documentation: https://mongoosejs.com/docs/api/mongoose.html#Mongoose.prototype.sanitizeFilter()

Original blog post on sanitizeFilter: https://thecodebarbarian.com/whats-new-in-mongoose-6-sanitizefilter.html
GitHub Security Advisory: GHSA-wpg9-53fq-2r8h
Package: mongoose (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: >= 8.0.0, <= 8.22.0
Patched in: 8.22.1

Summary: Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection

Details:
### Impact

This vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the `$nor` operator.

When sanitizeFilter is enabled, Mongoose wraps query operators in `$eq` to neutralize them. However, prior to the fix, `$nor` was not included in the set of logical operators that are recursively sanitized. Because `$nor` accepts an array (like `$and` and `$or`), and arrays do not trigger `hasDollarKeys()`, malicious operators such as `$ne`, `$gt`, or `$regex` could be injected inside a `$nor` clause without being sanitized.

This may lead to:

- Authentication bypass
- Unauthorized data access
- Data exfiltration

**Affected users:**

Applications that:

- Explicitly enable sanitizeFilter
- Pass unsanitized user-controlled input directly into query methods (e.g., `Model.findOne(req.body)`) and rely on `sanitizeFilter` to strip out query selectors

Applications that validate input schemas, whitelist fields, or avoid passing raw request bodies into queries are not affected. For example, `Model.findOne({ user: req.body.user, pwd: req.body.pwd })` is not affected.

### Patches

Patches have been released for all supported Mongoose release lines:

- `^6.13.9`
- `^7.8.9`
- `^8.22.1`
- `^9.1.6`   

### Workarounds

Delete `$nor` keys, use an additional schema validation library, or write middleware to strip out `$nor` from query filters.

### Resources

sanitizeFilter documentation: https://mongoosejs.com/docs/api/mongoose.html#Mongoose.prototype.sanitizeFilter()

Original blog post on sanitizeFilter: https://thecodebarbarian.com/whats-new-in-mongoose-6-sanitizefilter.html
GitHub Security Advisory: GHSA-wpg9-53fq-2r8h
Package: mongoose (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: >= 7.0.0, <= 7.8.8
Patched in: 7.8.9

Summary: Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection

Details:
### Impact

This vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the `$nor` operator.

When sanitizeFilter is enabled, Mongoose wraps query operators in `$eq` to neutralize them. However, prior to the fix, `$nor` was not included in the set of logical operators that are recursively sanitized. Because `$nor` accepts an array (like `$and` and `$or`), and arrays do not trigger `hasDollarKeys()`, malicious operators such as `$ne`, `$gt`, or `$regex` could be injected inside a `$nor` clause without being sanitized.

This may lead to:

- Authentication bypass
- Unauthorized data access
- Data exfiltration

**Affected users:**

Applications that:

- Explicitly enable sanitizeFilter
- Pass unsanitized user-controlled input directly into query methods (e.g., `Model.findOne(req.body)`) and rely on `sanitizeFilter` to strip out query selectors

Applications that validate input schemas, whitelist fields, or avoid passing raw request bodies into queries are not affected. For example, `Model.findOne({ user: req.body.user, pwd: req.body.pwd })` is not affected.

### Patches

Patches have been released for all supported Mongoose release lines:

- `^6.13.9`
- `^7.8.9`
- `^8.22.1`
- `^9.1.6`   

### Workarounds

Delete `$nor` keys, use an additional schema validation library, or write middleware to strip out `$nor` from query filters.

### Resources

sanitizeFilter documentation: https://mongoosejs.com/docs/api/mongoose.html#Mongoose.prototype.sanitizeFilter()

Original blog post on sanitizeFilter: https://thecodebarbarian.com/whats-new-in-mongoose-6-sanitizefilter.html
GitHub Security Advisory: GHSA-wpg9-53fq-2r8h
Package: mongoose (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: < 6.13.9
Patched in: 6.13.9

Summary: Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection

Details:
### Impact

This vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the `$nor` operator.

When sanitizeFilter is enabled, Mongoose wraps query operators in `$eq` to neutralize them. However, prior to the fix, `$nor` was not included in the set of logical operators that are recursively sanitized. Because `$nor` accepts an array (like `$and` and `$or`), and arrays do not trigger `hasDollarKeys()`, malicious operators such as `$ne`, `$gt`, or `$regex` could be injected inside a `$nor` clause without being sanitized.

This may lead to:

- Authentication bypass
- Unauthorized data access
- Data exfiltration

**Affected users:**

Applications that:

- Explicitly enable sanitizeFilter
- Pass unsanitized user-controlled input directly into query methods (e.g., `Model.findOne(req.body)`) and rely on `sanitizeFilter` to strip out query selectors

Applications that validate input schemas, whitelist fields, or avoid passing raw request bodies into queries are not affected. For example, `Model.findOne({ user: req.body.user, pwd: req.body.pwd })` is not affected.

### Patches

Patches have been released for all supported Mongoose release lines:

- `^6.13.9`
- `^7.8.9`
- `^8.22.1`
- `^9.1.6`   

### Workarounds

Delete `$nor` keys, use an additional schema validation library, or write middleware to strip out `$nor` from query filters.

### Resources

sanitizeFilter documentation: https://mongoosejs.com/docs/api/mongoose.html#Mongoose.prototype.sanitizeFilter()

Original blog post on sanitizeFilter: https://thecodebarbarian.com/whats-new-in-mongoose-6-sanitizefilter.html