deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-xmrv-pmrh-hhx2
Package: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream (GO)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 1.7.8
Patched in: 1.7.8

Summary: Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder

Details:
**CVSSv3.1 Rating**: [Medium]
**CVSSv3.1 Score**: [5.9]
**CVSSv3.1 Vector String**: [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H]

## Summary and Impact
An issue exists in the the EventStream header decoder in AWS SDK for Go v2 in versions predating [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23). An actor can send a malformed EventStream response frame containing a crafted header value type byte outside the valid range, which can cause the host process to terminate.

Impacted versions: < [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23)

## Patches
This issue has been addressed in versions [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23) and above. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. 

## Workarounds
Not Applicable

## References
If you have any questions or comments about this advisory, we ask that you contact [AWS/Amazon] Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.
GitHub Security Advisory: GHSA-w6c6-c85g-mmv6
Package: github.com/sigstore/cosign (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-754: Improper Check for Unusual or Exceptional Conditions
Vulnerable versions: < 2.6.3
Patched in: 2.6.3

Summary: Cosign's verify-blob-attestation reports false positive when payload parsing fails

Details:
## Description

`cosign verify-blob-attestation` may erroneously report a "Verified OK" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely.

## Impact

When `cosign verify-blob-attestation` is used without `--check-claims` set to `true`, an attestation that has a valid signature but a malformed or unparsable payload would be incorrectly validated. Additionally, systems relying on `--type <predicate type>` to reject attestations with mismatched types would be lead to trust the unexpected attestation type.

## Patches

v3.0.6, v2.6.3

## Workarounds

Always set `--check-claims=true` for attestation verification.
GitHub Security Advisory: GHSA-w6c6-c85g-mmv6
Package: github.com/sigstore/cosign (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-754: Improper Check for Unusual or Exceptional Conditions
Vulnerable versions: >= 3.0.0, < 3.0.6
Patched in: 3.0.6

Summary: Cosign's verify-blob-attestation reports false positive when payload parsing fails

Details:
## Description

`cosign verify-blob-attestation` may erroneously report a "Verified OK" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely.

## Impact

When `cosign verify-blob-attestation` is used without `--check-claims` set to `true`, an attestation that has a valid signature but a malformed or unparsable payload would be incorrectly validated. Additionally, systems relying on `--type <predicate type>` to reject attestations with mismatched types would be lead to trust the unexpected attestation type.

## Patches

v3.0.6, v2.6.3

## Workarounds

Always set `--check-claims=true` for attestation verification.
GitHub Security Advisory: GHSA-6jwv-w5xf-7j27
Package: go.etcd.io/bbolt (GO)
Severity: MODERATE (CVSS 6.2)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: <= 1.4.3
Patched in: unpatched

Summary: Withdrawn Advisory: go.etcd.io/bbolt affected by index out-of-range vulnerability

Details:
### Withdrawn Advisory
This advisory has been withdrawn because its CVE Numbering Authority has determined this issue to be a false positive. This link is maintained to preserve external references.

### Original Description
Index out-of-range when encountering a branch page with zero elements in go.etcd.io/bbolt
GitHub Security Advisory: GHSA-5q48-q4fm-g3m6
Package: github.com/filebrowser/filebrowser/v2 (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 2.63.1
Patched in: 2.63.1

Summary: File Browser has an access rule bypass via HasPrefix without trailing separator in path matching

Details:
Hi,

The `Matches()` function in `rules/rules.go` uses `strings.HasPrefix()` without a trailing directory separator when matching paths against access rules. A rule for `/uploads` also matches `/uploads_backup/`, granting or denying access to unintended directories. Verified against v2.62.2 (commit 860c19d).

## Details

At `rules/rules.go:29-35`:

    func (r *Rule) Matches(path string) bool {
        if r.Regex {
            return r.Regexp.MatchString(path)
        }
        return strings.HasPrefix(path, r.Path)
    }

When a rule has `Path: "/uploads"`, any path starting with `/uploads` matches, including `/uploads_backup/secret.txt`. The regex variant at line 31 uses proper matching, but the non-regex path uses a prefix check without ensuring the match ends at a directory boundary.

The `Check()` function at `http/data.go:29-48` iterates all rules with last-match-wins semantics. No secondary validation exists beyond this prefix check.

## PoC

Admin configures: allow rule `Path: "/shared"` for a restricted user.

Filesystem contains:
- `/shared/` (intended to be accessible)
- `/shared_private/` (intended to be restricted)

User requests `/shared_private/secret.txt`:
- `strings.HasPrefix("/shared_private/secret.txt", "/shared")` returns true
- Allow rule applies
- Access granted to the unintended directory

## Impact

Authenticated users can access files in sibling directories that share a common prefix with an allowed directory, bypassing the admin's intended access configuration.

## Prior art

Prior advisories GHSA-4mh3-h929-w968 (path-based access control bypass) and GHSA-9f3r-2vgw-m8xp (path traversal in copy/rename) addressed related access control issues. This HasPrefix prefix-collision is a distinct, unreported variant.

## Suggested Fix

    func (r *Rule) Matches(path string) bool {
        if r.Regex {
            return r.Regexp.MatchString(path)
        }
        prefix := r.Path
        if prefix != "/" && !strings.HasSuffix(prefix, "/") {
            prefix += "/"
        }
        return path == r.Path || strings.HasPrefix(path, prefix)
    }

Koda Reef

---

**Update:** Fix submitted as PR #5889.
GitHub Security Advisory: GHSA-jwvj-g8pc-cx45
Package: github.com/openfga/openfga (GO)
Severity: MODERATE (CVSS 5.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 1.8.0, <= 1.13.1
Patched in: 1.14.0

Summary: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision

Details:
### Description

In OpenFGA, under specific conditions, BatchCheck calls with multiple checks sent for the same object, relation, and user combination can result in improper policy enforcement.

### Am I affected?

You are affected if you meet the following preconditions:
1. You execute **BatchCheck** operations which rely on context. 
2. Multiple checks are sent within a single BatchCheck operation for the same user/object/relation combination, each containing context.
3. The contexts between those checks differ in a specific way

### Fix
Upgrade to OpenFGA v1.14.0

### Acknowledgement
OpenFGA would like to thank @bugbunny-research for the discovery and detailed report.
GitHub Security Advisory: GHSA-378j-3jfj-8r9f
Package: github.com/ipld/go-ipld-prime (GO)
Severity: MODERATE (CVSS 6.2)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 0.22.0
Patched in: 0.22.0

Summary: go-ipld-prime: DAG-CBOR decoder unbounded memory allocation from CBOR headers

Details:
The DAG-CBOR decoder uses collection sizes declared in CBOR headers as Go preallocation hints for maps and lists. The decoder does not cap these size hints or account for their cost in its allocation budget, allowing small payloads to cause excessive memory allocation.

A CBOR map or list header can declare an arbitrarily large number of entries, causing the decoder to preallocate proportionally large backing structures before any entries are actually read. Because the allocation budget is only decremented as entries are decoded (not when sizes are declared), this cost is effectively invisible to the budget system. This is compounded by nesting: each level of a nested structure triggers its own unchecked preallocation while consuming minimal budget (one entry per parent level), so a payload under 100 bytes with 10 levels of nesting can cause over 9GB of allocation.

Schema-free decoding (i.e. using `basicnode.Prototype.Any`) allows arbitrary nesting depth. Schema-bound decoding limits nesting to the schema's structure, but any field typed as `Any` in the schema permits unconstrained nesting within that field.

The fix caps the preallocation size hint to 1024 entries and decrements the allocation budget when collection sizes are declared. The declared length is still used for entry-count validation, and collections grow dynamically as entries are decoded, so correctly-formed data is unaffected, even beyond the preallocation limit.
GitHub Security Advisory: GHSA-jfwg-rxf3-p7r9
Package: github.com/authorizerdev/authorizer (GO)
Severity: HIGH (CVSS 7.3)
CWE: CWE-209: Generation of Error Message Containing Sensitive Information, CWE-943: Improper Neutralization of Special Elements in Data Query Logic
Vulnerable versions: < 0.0.0[PII_REDACTED]5742-73679faa53cd
Patched in: 0.0.0[PII_REDACTED]5742-73679faa53cd

Summary: Authorizer: CQL/N1QL Injection in Cassandra and Couchbase Backends via fmt.Sprintf String Interpolation

Details:
## Vulnerability Details

**CWE:** CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

All 66+ CQL queries in `internal/storage/db/cassandradb/` use `fmt.Sprintf` to interpolate user-controlled values directly into CQL query strings without parameterization.

Unauthenticated endpoints (`signup`, `login`, `forgot_password`, `magic_link_login`) pass user input directly into CQL query strings.

**Note:** This advisory covers the Cassandra CQL injection only. The Couchbase N1QL injection is tracked in a separate advisory per CVE rule 4.2.11.

## Affected Code Pattern

```go
// Before (VULNERABLE) - e.g. cassandradb/user.go
query := fmt.Sprintf("SELECT ... FROM %s WHERE email = '%s'", table, email)
err := p.db.Query(query).Scan(...)
```

## Steps to Reproduce

1. Deploy Authorizer <= 2.0.0 with Cassandra backend
2. Send a signup request with a CQL injection payload in the email field:

```bash
curl -X POST http://localhost:8080/graphql \
  -H 'Content-Type: application/json' \
  -d '{"query":"mutation { signup(params: { email: \"test'\" }) { message } }"}'
```

3. The single quote breaks out of the CQL string literal, causing a CQL parse error that leaks internal schema information
4. Crafted payloads can manipulate query logic to bypass authentication or extract data

## Affected Files (10 Cassandra files)

| Package | File | Queries Fixed |
|---------|------|--------------|
| cassandradb | user.go | 7 |
| cassandradb | otp.go | 4 |
| cassandradb | session_token.go | 19 |
| cassandradb | verification_requests.go | 4 |
| cassandradb | authenticator.go | 3 |
| cassandradb | email_template.go | 5 |
| cassandradb | webhook.go | 5 |
| cassandradb | webhook_log.go | 2 |
| cassandradb | session.go | 1 |
| cassandradb | env.go | 2 |

## Impact

An unauthenticated attacker can inject arbitrary CQL operators through the email, phone, or token parameters on public-facing endpoints (signup, login, forgot_password, magic_link_login). This enables authentication bypass and data exfiltration from the Cassandra keyspace.

## Proposed Fix

Use parameterized queries:

```go
// After (FIXED)
query := fmt.Sprintf("SELECT ... FROM %s WHERE email = ?", table)
err := p.db.Query(query, email).Scan(...)
```

Fixed in https://github.com/authorizerdev/authorizer/pull/500 (merged 2026-03-27).
GitHub Security Advisory: GHSA-247x-7qw8-fp98
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 10.11.0-rc1, < 10.11.12
Patched in: 10.11.12

Summary: Mattermost doesn't rate limit login requests, allowing DoS

Details:
Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to rate limit login requests which allows unauthenticated remote attackers to cause denial of service (server crash and restart) via HTTP/2 single packet attack with 100+ parallel login requests.. Mattermost Advisory ID: MMSA-2025-00566
GitHub Security Advisory: GHSA-jjwv-57xh-xr6r
Package: github.com/gotenberg/gotenberg/v7 (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 7.10.2
Patched in: unpatched

Summary: Gotenberg has Chromium deny-list bypass via case-insensitive URL scheme (bypass of GHSA-rh2x-ccvw-q7r3)

Details:
### Impact

The fix introduced in version 8.1.0 for GHSA-rh2x-ccvw-q7r3 (CVE-2024-21527) can be bypassed using mixed-case or uppercase URL schemes.

The default `--chromium-deny-list` value is `^file:(?!//\/tmp/).*`. This regex is anchored to lowercase `file:` at the start. However, per RFC 3986 Section 3.1, URI schemes are case-insensitive. Chromium normalizes the scheme to lowercase before navigation, so a URL like `FILE:///etc/passwd` or `File:///etc/passwd` bypasses the deny-list check but still gets resolved by Chromium as `file:///etc/passwd`.

The root cause is in `pkg/gotenberg/filter.go` — the `FilterDeadline` function compiles the deny-list regex with `regexp2.MustCompile(denied.String(), 0)`, where `0` means no flags (case-sensitive). Since the regex pattern itself doesn't include a `(?i)` flag, matching is strictly case-sensitive.

This affects both the URL endpoint and HTML conversion (via iframes, link tags, etc.).

### Steps to Reproduce

1. Start Gotenberg with default settings:

```bash
docker run --rm -p 3000:3000 gotenberg/gotenberg:8.26.0 gotenberg
```

2. Read `/etc/passwd` via the URL endpoint using an uppercase scheme:

```bash
curl -X POST 'http://localhost:3000/forms/chromium/convert/url' \
  --form 'url=FILE:///etc/passwd' -o output.pdf
```

3. Open `output.pdf` — it contains the contents of `/etc/passwd`.

4. Alternatively, create an `index.html`:

```html
<iframe src="FILE:///etc/passwd" width="100%" height="100%"></iframe>
```

Then convert it:

```bash
curl -X POST 'http://localhost:3000/forms/chromium/convert/html' \
  -F 'files=@index.html' -o output.pdf
```

5. The resulting PDF contains `/etc/passwd` contents.

Mixed-case variants like `File:`, `fILE:`, `fiLE:` etc. all work as well.

### Root Cause

- `pkg/modules/chromium/chromium.go` defines the default deny-list as `^file:(?!//\/tmp/).*`
- `pkg/gotenberg/filter.go` compiles this with `regexp2.MustCompile(denied.String(), 0)` — flag `0` means case-sensitive
- `pkg/modules/chromium/events.go` uses `FilterDeadline` to check intercepted request URLs against the deny-list
- Chromium normalizes URL schemes to lowercase, so `FILE:///etc/passwd` becomes `file:///etc/passwd` after the deny-list check has already passed

### Suggested Fix

Change the default deny-list regex to use a case-insensitive flag:

```
(?i)^file:(?!//\/tmp/).*
```

Or apply case-insensitive matching in `FilterDeadline` when compiling the regex.

### Severity

This is effectively the same impact as CVE-2024-21527 — unauthenticated arbitrary file read from the Gotenberg container. An attacker can leak environment variables, configuration, credentials, and other sensitive data.
GitHub Security Advisory: GHSA-vph7-r229-qxpf
Package: github.com/mattermost/focalboard (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: <= 7.10.6
Patched in: unpatched

Summary: Focalboard doesn't validate file ownership when serving uploaded files

Details:
** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the content of the file. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued.
GitHub Security Advisory: GHSA-p32q-v29x-wq9r
Package: github.com/mattermost/focalboard (GO)
Severity: HIGH (CVSS 8.1)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: <= 7.10.6
Patched in: unpatched

Summary: Focalboard doesn't sanitize category IDs before incorporating them into dynamic SQL statements

Details:
** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to sanitize category IDs before incorporating them into dynamic SQL statements when reordering categories. An attacker can inject a malicious SQL payload into the category id field, which is stored in the database and later executed unsanitized when the category reorder API processes the stored value. This Second-Order SQL Injection (Time-Based Blind) allows an authenticated attacker to exfiltrate sensitive data including password hashes of other users. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued.
GitHub Security Advisory: GHSA-xq44-64rg-8g3h
Package: github.com/free5gc/amf (GO)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-404: Improper Resource Shutdown or Release
Vulnerable versions: < 1.4.3-0[PII_REDACTED]4636-52e9386401ce
Patched in: 1.4.3-0[PII_REDACTED]4636-52e9386401ce

Summary: Free5GC AMF is vulnerable to DoS through its HandleRegistrationComplete function

Details:
A weakness has been identified in Free5GC 4.1.0. Affected is the function HandleRegistrationComplete of the file internal/gmm/handler.go of the component AMF. Executing a manipulation can lead to denial of service. The attack may be performed from remote. This patch is called 52e9386401ce56ea773c5aa587d4cdf7d53da799. It is best practice to apply a patch to resolve this issue.
GitHub Security Advisory: GHSA-8x9r-hvwg-c55h
Package: github.com/coder/code-marketplace (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 1.2.3-0[PII_REDACTED]4705-988440dee05f
Patched in: 1.2.3-0[PII_REDACTED]4705-988440dee05f

Summary: Code Extension Marketplace: Zip Slip Path Traversal

Details:
# Zip Slip Path Traversal in coder/code-marketplace

## Summary

A Zip Slip (CWE-22) vulnerability in `coder/code-marketplace` ≤ v2.4.1 allowed a malicious VSIX file to write arbitrary files outside the extension directory. `ExtractZip` passed raw zip entry names to a callback that wrote files via `filepath.Join` with no boundary check; `filepath.Join` resolved `..` components but did not prevent the result from escaping the base path.


## Root Cause

`ExtractZip` passed the raw, attacker-controlled `zf.Name` to a caller-supplied callback:

```go
return false, fn(zf.Name, zr)  // zf.Name not sanitized
```

`AddExtension` constructed the output path with `filepath.Join` and no boundary check:

```go
path := filepath.Join(dir, name)              // zip loop
path := filepath.Join(dir, file.RelativePath) // extra files loop
```

`filepath.Clean` resolved `..` lexically but did not confine the result to `dir`:

```
filepath.Join("/srv/ext/pub/1.0", "../../../../etc/cron.d/evil")
  → "/etc/cron.d/evil"
```

## Attack Scenario

An authenticated user (any upload-capable role) would submit a VSIX containing path-traversal entries.

On extraction, files would land at attacker-chosen paths writable by the marketplace process, enabling persistence (cron/init injection), SSH key injection, `ld.so.preload` hijacking, or binary overwrite depending on process privileges.

## Fix

Addressed in https://github.com/coder/code-marketplace/releases/tag/v2.4.2

## Recognition
Coder would like to thank [Kandlaguduru Vamsi](https://www.linkedin.com/in/vamsi-k-5419632a9/) for responsibly disclosing this issue in accordance with https://coder.com/security/policy
GitHub Security Advisory: GHSA-mcv8-8m8x-48pg
Package: github.com/gohugoio/hugo (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 0.60.0, < 0.159.2
Patched in: 0.159.2

Summary: Hugo: Certain markdown links are not properly escaped

Details:
### Impact
Links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or have custom render hooks for links and images are not affected.

### Patches
Patched in  v0.159.2

### Workarounds
Create custom render hooks for links and images in a Hugo theme/project.
GitHub Security Advisory: GHSA-xpg8-3hhp-p7w8
Package: go.temporal.io/server (GO)
Severity: LOW (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: < 1.29.5
Patched in: 1.29.5

Summary: Temporal Server: attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster

Details:
A writer role user in an attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster. Exploitation requires the attacker to know or guess specific victim workflow ID(s) and, for signal operations, signal names. This was due to a bug introduced in Temporal Server v1.29.0 which inadvertently allowed an attacker to control the namespace name value instead of using the server's own trusted name value within the batch activity code. The batch activity validated the namespace ID but did not cross-check the namespace name against the worker's bound namespace, allowing the per-namespace worker's privileged credentials to operate on an arbitrary namespace. Exploitation requires a server configuration where internal components have cross-namespace authorization, such as deployment of the internal-frontend service or equivalent TLS-based authorization for internal identities.

This vulnerability also impacted Temporal Cloud when the attacker and victim namespaces were on the same cell, with the same preconditions as self-hosted clusters.