deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-6qvv-pj99-48qm
Package: @adonisjs/http-server (NPM)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: < 7.8.1
Patched in: 7.8.1

Summary: @adonisjs/http-server has an Open Redirect vulnerability

Details:
### Impact

The `response.redirect().back()` method in `@adonisjs/http-server` is vulnerable to open redirects. The method reads the `Referer` header from the incoming HTTP request and redirects to that URL without validating the host. An attacker who can influence the `Referer` header (for example, by linking a user through an attacker-controlled page before a form submission) can cause the application to redirect users to a malicious external site.

This affects all AdonisJS applications that use `response.redirect().back()` or `response.redirect('back')`.

The vulnerability is classified as CWE-601: URL Redirection to Untrusted Site ('Open Redirect').

### Patches

This has been fixed in `@adonisjs/http-server` version **8.2.0**. The `back()` method now validates the `Referer` header's host against the request's own `Host` header. Referrers from unrecognized hosts are rejected and the redirect falls back to `/` (or a developer-provided fallback URL).

Applications that operate across multiple domains can configure additional trusted hosts via the `redirect.allowedHosts` option in `config/app.ts`.

Users should upgrade to `@adonisjs/http-server@^8.2.0` (or `@adonisjs/core@^7.4.0` if using the core meta-package).

### Workarounds

If upgrading is not immediately possible, avoid using `response.redirect().back()` in routes that are reachable by unauthenticated users or from pages that accept external traffic. Instead, redirect to a known safe path explicitly using `response.redirect().toPath('/dashboard')`.

### References

- [CWE-601: URL Redirection to Untrusted Site](https://cwe.mitre.org/data/definitions/601.html)
- [OWASP: Unvalidated Redirects and Forwards](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)
GitHub Security Advisory: GHSA-6qvv-pj99-48qm
Package: @adonisjs/http-server (NPM)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 8.0.0-next.0, < 8.2.0
Patched in: 8.2.0

Summary: @adonisjs/http-server has an Open Redirect vulnerability

Details:
### Impact

The `response.redirect().back()` method in `@adonisjs/http-server` is vulnerable to open redirects. The method reads the `Referer` header from the incoming HTTP request and redirects to that URL without validating the host. An attacker who can influence the `Referer` header (for example, by linking a user through an attacker-controlled page before a form submission) can cause the application to redirect users to a malicious external site.

This affects all AdonisJS applications that use `response.redirect().back()` or `response.redirect('back')`.

The vulnerability is classified as CWE-601: URL Redirection to Untrusted Site ('Open Redirect').

### Patches

This has been fixed in `@adonisjs/http-server` version **8.2.0**. The `back()` method now validates the `Referer` header's host against the request's own `Host` header. Referrers from unrecognized hosts are rejected and the redirect falls back to `/` (or a developer-provided fallback URL).

Applications that operate across multiple domains can configure additional trusted hosts via the `redirect.allowedHosts` option in `config/app.ts`.

Users should upgrade to `@adonisjs/http-server@^8.2.0` (or `@adonisjs/core@^7.4.0` if using the core meta-package).

### Workarounds

If upgrading is not immediately possible, avoid using `response.redirect().back()` in routes that are reachable by unauthenticated users or from pages that accept external traffic. Instead, redirect to a known safe path explicitly using `response.redirect().toPath('/dashboard')`.

### References

- [CWE-601: URL Redirection to Untrusted Site](https://cwe.mitre.org/data/definitions/601.html)
- [OWASP: Unvalidated Redirects and Forwards](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)
GitHub Security Advisory: GHSA-jvff-x2qm-6286
Package: mathjs (NPM)
Severity: HIGH (CVSS 8.8)
CWE: CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Vulnerable versions: >= 13.1.0, < 15.2.0
Patched in: 15.2.0

Summary: mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes

Details:
### Impact
This security vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser.

### Patches
The issue was introduced in mathjs `v13.1.0`, and patched in mathjs `v15.2.0`.

### Workarounds
There is no workaround without upgrading to `v15.2.0`.

### References
You can find out more via the commit fixing this issue: https://github.com/josdejong/mathjs/commit/24d5ee7e25e85d49619b09122f055db4139bc057 (part of PR https://github.com/josdejong/mathjs/pull/3656).
GitHub Security Advisory: GHSA-r4q5-vmmm-2653
Package: follow-redirects (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: <= 1.15.11
Patched in: 1.16.0

Summary: follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets

Details:
## Summary

When an HTTP request follows a cross-domain redirect (301/302/307/308), `follow-redirects` only strips `authorization`, `proxy-authorization`, and `cookie` headers (matched by regex at index.js:469-476). Any custom authentication header (e.g., `X-API-Key`, `X-Auth-Token`, `Api-Key`, `Token`) is forwarded verbatim to the redirect target.

Since `follow-redirects` is the redirect-handling dependency for **axios** (105K+ stars), this vulnerability affects the entire axios ecosystem.

## Affected Code

`index.js`, lines 469-476:

```javascript
if (redirectUrl.protocol !== currentUrlParts.protocol &&
   redirectUrl.protocol !== "https:" ||
   redirectUrl.host !== currentHost &&
   !isSubdomain(redirectUrl.host, currentHost)) {
  removeMatchingHeaders(/^(?:(?:proxy-)?authorization|cookie)$/i, this._options.headers);
}
```

The regex only matches `authorization`, `proxy-authorization`, and `cookie`. Custom headers like `X-API-Key` are not matched.

## Attack Scenario

1. App uses axios with custom auth header: `headers: { 'X-API-Key': 'sk-live-secret123' }`
2. Server returns `302 Location: https://evil.com/steal`
3. follow-redirects sends `X-[CREDENTIAL_REDACTED]` to `evil.com`
4. Attacker captures the API key

## Impact

Any custom auth header set via axios leaks on cross-domain redirect. Extremely common pattern. Affects all axios users in Node.js.

## Suggested Fix

Add a `sensitiveHeaders` option that users can extend, or strip ALL non-standard headers on cross-domain redirect.

## Disclosure

Source code review, manually verified. Found 2026-03-20.
GitHub Security Advisory: GHSA-hpwf-8g29-85qm
Package: @nestjs/microservices (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-674: Uncontrolled Recursion, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: <= 11.1.18
Patched in: 11.1.19

Summary: Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)

Details:
### Impact
Attacker sends many small, valid JSON messages in one TCP frame
 → handleData() recurses once per message; buffer shrinks each call
 → maxBufferSize is never reached; call stack overflows instead
 → A ~47 KB payload is sufficient to trigger RangeError

### Patches

Fixed in `@nestjs/microservices@11.1.19`

### References

Discovered by https://github.com/hwpark6804-gif
GitHub Security Advisory: GHSA-p4h8-56qp-hpgv
Package: @aiondadotcom/mcp-ssh (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Vulnerable versions: < 1.3.5
Patched in: 1.3.5

Summary: SSH/SCP option injection allowing local RCE in @aiondadotcom/mcp-ssh

Details:
## Impact

A crafted `hostAlias` argument such as `-oProxyCommand=...` was passed to `ssh`/`scp` without an argument terminator. SSH interprets arguments starting with `-` as options regardless of position, so the option-injection caused SSH to execute the attacker-supplied `ProxyCommand` **locally** on the machine running the MCP server — before any network connection. This bypassed the documented protection of `# @password:` annotations and exposed local SSH keys, browser cookies, other MCP server credentials, and anything else readable by the server process.

A second local-RCE vector existed on Windows: `spawn(..., { shell: true })` was used so that `ssh.exe`/`scp.exe` could be found via `PATH`. With `shell: true`, every argument is re-parsed by `cmd.exe`, so shell metacharacters (`&`, `|`, `^`, `>`, `"`, `;`, …) in `hostAlias`, `command`, `localPath` or `remotePath` would have been interpreted by `cmd.exe` and could have triggered arbitrary local command execution on Windows.

The MCP server runs locally over STDIO, but the LLM driving it is not trusted: its tool arguments can be steered by **prompt injection** from any untrusted text the LLM ingests (web pages, e-mails, repository files, output of other MCP servers). The attack does not require a malicious user — only that the LLM ingests attacker-controlled text at any point during the session.

## Patches

Fixed in **1.3.5**.

- Add `--` argument terminator to all `ssh`/`scp` invocations.
- Strict whitelist for `hostAlias` (rejects leading `-` and shell metacharacters).
- Known-host check: every `hostAlias` must be defined in `~/.ssh/config` (including `Include` directives) or present in `~/.ssh/known_hosts`.
- Resolve `ssh.exe`/`scp.exe` to absolute paths and use `shell: false` everywhere on Windows.

## Workarounds

None. Upgrade to 1.3.5.

## Credit

Reported by Pico (@piiiico) as part of an MCP server security audit.
GitHub Security Advisory: GHSA-qm9p-f9j5-w83w
Package: @parcel/reporter-dev-server (NPM)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-346: Origin Validation Error
Vulnerable versions: >= 1.6.1, <= 2.16.3
Patched in: 2.16.4

Summary: Parcel has an Origin Validation Error vulnerability

Details:
parcel versions 1.6.1 and above have an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development server and read the response to steal source code when developers visit them. Version 2.16.4 supports a `--no-cors` option which disables CORS headers in the dev server.
GitHub Security Advisory: GHSA-gxr4-xjj5-5px2
Package: jquery (NPM)
Severity: MODERATE (CVSS 6.9)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 1.12.0, < 3.5.0
Patched in: 3.5.0

Summary: Potential XSS vulnerability in jQuery

Details:
### Impact
Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code.

### Patches
This problem is patched in jQuery 3.5.0.

### Workarounds
To workaround the issue without upgrading, adding the following to your code:

```js
jQuery.htmlPrefilter = function( html ) {
	return html;
};
```

You need to use at least jQuery 1.12/2.2 or newer to be able to apply this workaround.

### References
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
https://jquery.com/upgrade-guide/3.5/

### For more information
If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.
GitHub Security Advisory: GHSA-52vj-fvrv-7q82
Package: openclaw (NPM)
Severity: LOW (CVSS 5.6)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 2026.1.29
Patched in: 2026.1.29

Summary: OpenClaw vulnerable to SSRF in src/agents/tools/web-fetch.ts

Details:
A weakness has been identified in OpenClaw up to 2026.1.26. Affected by this issue is some unknown functionality of the file src/agents/tools/web-fetch.ts of the component assertPublicHostname Handler. Executing a manipulation can lead to server-side request forgery. The attack can be executed remotely. This attack is characterized by high complexity. The exploitation is known to be difficult. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2026.1.29 can resolve this issue. This patch is called b623557a2ec7e271bda003eb3ac33fbb2e218505. Upgrading the affected component is advised.
GitHub Security Advisory: GHSA-x7mm-9vvv-64w8
Package: unhead (NPM)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.0.0-beta.5, <= 3.0.0
Patched in: 3.0.1

Summary: unhead: Streaming SSR `streamKey` injected into inline script without identifier validation

Details:
### Summary

`createStreamableHead({ streamKey })` interpolated its `streamKey` argument directly into the streaming SSR bootstrap and suspense-chunk inline scripts without identifier validation or escaping. If an application forwards untrusted data into that configuration value, the rendered scripts become a script-injection sink.

### Details

`streamKey` was embedded into JavaScript source via dot notation in two public helpers:

* `createBootstrapScript()` returned `<script>window.${streamKey}={...}</script>`
* `renderSSRHeadSuspenseChunk()` returned `window.${streamKey}.push(...)`

No escaping, quoting, or identifier validation was applied before these strings were embedded into HTML. A `streamKey` such as `__unhead__;globalThis.PWNED=1;//` broke out of the intended property access and injected arbitrary JavaScript into the page. The JSON escaping used for streamed head entries did not protect `streamKey` because `streamKey` was inserted as raw code rather than as serialized data.

### Impact

`streamKey` is a developer-chosen configuration value rather than a data field — the intended usage is a hardcoded identifier-shaped constant (default `__unhead__`). Exploitation therefore requires an application to explicitly route untrusted input into a configuration sink, which is not a documented or recommended pattern. We have no reports of any downstream project sourcing `streamKey` from request data.

Applications using the default `streamKey`, or any hardcoded custom key, are **not affected**.

### PoC

```ts
import { createStreamableHead, renderSSRHeadShell } from 'unhead/stream/server'

const { head } = createStreamableHead({
  streamKey: '__unhead__;globalThis.PWNED=1;//',
})

const html = renderSSRHeadShell(
  head,
  '<!doctype html><html><head></head><body></body></html>',
)

// <!doctype html><html><head><script>window.__unhead__;globalThis.PWNED=1;//={_q:[],push(e){this._q.push(e)}}</script>…
```

### Patch

Fixed on `main` in [`64b5ac0`](https://github.com/unjs/unhead/commit/64b5ac0aa30cc256ea6677ce3dc4f132f81b2ff6). The fix will ship in the next patch release of `unhead`.

`streamKey` is now validated against a conservative ASCII JavaScript-identifier pattern (`/^[$_a-z][$\w]*$/i`) at every sink — `createStreamableHead`, `createBootstrapScript`, and the internal stream-key resolver. Invalid values throw immediately instead of being emitted into script output.

### Workarounds

Do not pass untrusted data into `createStreamableHead({ streamKey })` or `createBootstrapScript(key)`. If per-tenant keys are required, whitelist them against an identifier-safe pattern before constructing the head instance.

### Credit

Thanks to @Jvr2022 for the report.
GitHub Security Advisory: GHSA-8f24-v5vv-gm5j
Package: next-intl (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: < 4.9.1
Patched in: 4.9.1

Summary: next-intl has an open redirect vulnerability

Details:
### Impact

Applications using the `next-intl` middleware with `localePrefix: 'as-needed'` could construct URLs where path handling and the WHATWG URL parser resolved a relative redirect target to another host (e.g. scheme-relative `//` or control characters stripped by the URL parser), so the middleware could redirect the browser off-site while the user still started from a trusted app URL.

### Patches

The problem has been patched, please update to [`next-intl@4.9.1`](https://github.com/amannn/next-intl/releases/tag/v4.9.1).

### Credits

Many thanks to [Joni Liljeblad](https://github.com/joniumGit) from [Oura](https://ouraring.com) for responsibly disclosing the vulnerability and for suggesting the fix.
GitHub Security Advisory: GHSA-75hx-xj24-mqrw
Package: n8n-mcp (NPM)
Severity: HIGH (CVSS 8.2)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: <= 2.47.5
Patched in: 2.47.6

Summary: n8n-mcp has unauthenticated session termination and information disclosure in HTTP transport

Details:
### Summary

Several HTTP transport endpoints in n8n-mcp lacked proper authentication, and the health check endpoint exposed sensitive operational metadata without credentials.

### Impact

An unauthenticated attacker with network access to the n8n-mcp HTTP server could disrupt active MCP sessions and gather information useful for further attacks.

### Patches

Fixed in **v2.47.6**. All MCP session endpoints now require Bearer authentication. The health check endpoint has been reduced to a minimal liveness response.

### Workarounds

If you cannot upgrade immediately:

- **Restrict network access** to the HTTP server using firewall rules, reverse proxy IP allowlists, or a VPN so that only trusted clients can reach it.
- **Use stdio mode** (`MCP_MODE=stdio`) instead of HTTP mode. The stdio transport does not expose any HTTP endpoints and is unaffected by this vulnerability.

Upgrading to v2.47.6 is still strongly recommended.

### Credit

Reported by @yotampe-pluto.
GitHub Security Advisory: GHSA-8h8f-7cxm-m38j
Package: openclaw (NPM)
Severity: MODERATE (CVSS 7.6)
CWE: CWE-184: Incomplete List of Disallowed Inputs
Vulnerable versions: < 2026.3.22
Patched in: 2026.3.22

Summary: Duplicate Advisory: OpenClaw: Windows media loaders accepted remote-host file URLs before local path validation

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-h3x4-hc5v-v2gm. This link is maintained to preserve external references.

### Original Description
OpenClaw versions prior to commit b57b680 contain an approval bypass vulnerability due to inconsistent environment variable normalization between approval and execution paths, allowing attackers to inject attacker-controlled environment variables into execution without approval system validation. Attackers can exploit differing normalization logic to discard non-portable keys during approval processing while accepting them at execution time, bypassing operator review and potentially influencing runtime behavior including execution of attacker-controlled binaries.
GitHub Security Advisory: GHSA-8fgx-wgvr-pcx8
Package: js-video-url-parser (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: <= 0.5.1
Patched in: unpatched

Summary: Zod jsVideoUrlParser vulnerable to ReDoS in util.js

Details:
A weakness has been identified in Zod jsVideoUrlParser up to 0.5.1. The impacted element is the function getTime in the library lib/util.js. This manipulation of the argument timestamp causes inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
GitHub Security Advisory: GHSA-mf5g-6r6f-ghhm
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts, CWE-521: Weak Password Requirements
Vulnerable versions: < 2026.3.28
Patched in: 2026.3.28

Summary: OpenClaw: Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Webhook Token

Details:
## Summary

Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Weak Webhook Token

## Affected Packages / Versions

- Package: `openclaw`
- Affected versions: `<= 2026.3.24`
- First patched version: `2026.3.25`
- Latest published npm version at verification time: `2026.3.24`

## Details

Synology Chat webhook auth previously rejected invalid tokens without throttling repeated guesses, allowing brute-force attempts against weak webhook secrets. Commit `0b4d07337467f4d40a0cc1ced83d45ceaec0863c` adds repeated-guess throttling before auth failure responses.

Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `0b4d07337467f4d40a0cc1ced83d45ceaec0863c`.

## Fix Commit(s)

- `0b4d07337467f4d40a0cc1ced83d45ceaec0863c`
GitHub Security Advisory: GHSA-59xc-5v89-r7pr
Package: openclaw (NPM)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: < 2026.3.28
Patched in: 2026.3.28

Summary: Duplicate Advisory: OpenClaw: Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Webhook Token

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-mf5g-6r6f-ghhm. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.25 contains a pre-authentication rate-limit bypass vulnerability in webhook token validation that allows attackers to brute-force weak webhook secrets. The vulnerability exists because invalid webhook tokens are rejected without throttling repeated authentication attempts, enabling attackers to guess weak tokens through rapid successive requests.
GitHub Security Advisory: GHSA-pg8g-f2hf-x82m
Package: openclaw (NPM)
Severity: HIGH (CVSS 6.5)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: < 2026.4.8
Patched in: 2026.4.8

Summary: Duplicate Advisory: OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-qx8j-g322-qj6m. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.31 (patched in 2026.4.8) contains a request body replay vulnerability in fetchWithSsrFGuard that allows unsafe request bodies to be resent across cross-origin redirects. Attackers can exploit this by triggering redirects to exfiltrate sensitive request data or headers to unintended origins.
GitHub Security Advisory: GHSA-3h52-cx59-c456
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 2026.3.28
Patched in: 2026.3.28

Summary: OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation

Details:
## Summary

Feishu webhook reads and parses unauthenticated request bodies before signature validation

## Affected Packages / Versions

- Package: `openclaw`
- Affected versions: `<= 2026.3.24`
- First patched version: `2026.3.25`
- Latest published npm version at verification time: `2026.3.24`

## Details

Feishu webhook handling previously parsed JSON before signature validation, which let unauthenticated callers force full JSON parsing work before rejection. Commit `5e8cb22176e9235e224be0bc530699261eb60e53` reads the raw request body, validates the signature first, and only then parses JSON.

Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `5e8cb22176e9235e224be0bc530699261eb60e53`.

## Fix Commit(s)

- `5e8cb22176e9235e224be0bc530699261eb60e53`