deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-62556
Published: 2025-12-09
Description: Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-822
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62556
CVE: CVE-2025-62557
Published: 2025-12-09
Description: Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62557
CVE: CVE-2025-62558
Published: 2025-12-09
Description: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62558
CVE: CVE-2025-62559
Published: 2025-12-09
Description: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62559
CVE: CVE-2025-62560
Published: 2025-12-09
Description: Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-126, CWE-822
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62560
CVE: CVE-2025-62561
Published: 2025-12-09
Description: Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-822
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62561
CVE: CVE-2025-62562
Published: 2025-12-09
Description: Use after free in Microsoft Office Outlook allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62562
CVE: CVE-2025-62563
Published: 2025-12-09
Description: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62563
CVE: CVE-2025-62564
Published: 2025-12-09
Description: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62564
CVE: CVE-2025-62565
Published: 2025-12-09
Description: Use after free in Windows Shell allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.3 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62565
CVE: CVE-2025-62567
Published: 2025-12-09
Description: Integer underflow (wrap or wraparound) in Windows Hyper-V allows an authorized attacker to deny service over a network.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-191
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62567
CVE: CVE-2025-62569
Published: 2025-12-09
Description: Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62569
CVE: CVE-2025-62570
Published: 2025-12-09
Description: Improper access control in Windows Camera Frame Server Monitor allows an authorized attacker to disclose information locally.
CVSS Score: 7.1 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62570
CVE: CVE-2025-62571
Published: 2025-12-09
Description: Improper input validation in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62571
CVE: CVE-2025-62572
Published: 2025-12-09
Description: Out-of-bounds read in Application Information Services allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62572
CVE: CVE-2025-62573
Published: 2025-12-09
Description: Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416, CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62573
CVE: CVE-2025-62631
Published: 2025-12-09
Description: An insufficient session expiration vulnerability [CWE-613] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to maintain access to network resources via an active SSLVPN session not terminated after a user's password change under particular conditions outside of the attacker's control
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-613
References: https://fortiguard.fortinet.com/psirt/FG-IR-25-411
CVE: CVE-2025-64085
Published: 2025-12-09
Description: A NULL pointer dereference vulnerability in the importDataObject() function of PDF-XChange Editor v10.7.3.401 allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://jeroscope.com/advisories/2025/jero-2025-012/; https://www.pdf-xchange.com/
CVE: CVE-2025-64086
Published: 2025-12-09
Description: A NULL pointer dereference vulnerability in the util.readFileIntoStream component of PDF-XChange Editor v10.7.3.401 allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://jeroscope.com/advisories/2025/jero-2025-011/; https://www.pdf-xchange.com/
CVE: CVE-2025-64153
Published: 2025-12-09
Description: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.6.0 through 7.6.3, FortiExtender 7.4.0 through 7.4.7, FortiExtender 7.2 all versions, FortiExtender 7.0 all versions may allow an authenticated attacker to execute unauthorized code or commands via a specific HTTP request.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://fortiguard.fortinet.com/psirt/FG-IR-25-739
CVE: CVE-2025-64156
Published: 2025-12-09
Description: An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7, FortiVoice 6.4 all versions, FortiVoice 6.0 all versions may allow an authenticated privileged attacker to execute unauthorized code or commands via crafted requests
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://fortiguard.fortinet.com/psirt/FG-IR-25-362
CVE: CVE-2025-64447
Published: 2025-12-09
Description: A reliance on cookies without validation and integrity checking vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an unauthenticated attacker to execute arbitrary operations on the system via crafted HTTP or HTTPS request via forged cookies, requiring prior knowledge of the FortiWeb serial number.
CVSS Score: 8.1 (HIGH)
CWE: CWE-565
References: https://fortiguard.fortinet.com/psirt/FG-IR-25-945
CVE: CVE-2025-64471
Published: 2025-12-09
Description: A use of password hash instead of password for authentication vulnerability [CWE-836] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an unauthenticated attacker to use the hash in place of the password to authenticate via crafted HTTP/HTTPS requests
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-836
References: https://fortiguard.fortinet.com/psirt/FG-IR-25-984
CVE: CVE-2025-64658
Published: 2025-12-09
Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64658
CVE: CVE-2025-64661
Published: 2025-12-09
Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64661
CVE: CVE-2025-64666
Published: 2025-12-09
Description: Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64666
CVE: CVE-2025-64667
Published: 2025-12-09
Description: User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-451
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64667
CVE: CVE-2025-64670
Published: 2025-12-09
Description: Exposure of sensitive information to an unauthorized actor in Microsoft Graphics Component allows an authorized attacker to disclose information over a network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64670
CVE: CVE-2025-64671
Published: 2025-12-09
Description: Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to execute code locally.
CVSS Score: 8.4 (HIGH)
CWE: CWE-77
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64671
CVE: CVE-2025-64672
Published: 2025-12-09
Description: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64672
CVE: CVE-2025-64673
Published: 2025-12-09
Description: Improper access control in Storvsp.sys Driver allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64673
CVE: CVE-2025-64678
Published: 2025-12-09
Description: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64678
CVE: CVE-2025-64679
Published: 2025-12-09
Description: Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64679
CVE: CVE-2025-64680
Published: 2025-12-09
Description: Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64680
CVE: CVE-2025-64783
Published: 2025-12-09
Description: DNG SDK versions 1.7.0 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://helpx.adobe.com/security/products/dng-sdk/apsb25-118.html
CVE: CVE-2025-64784
Published: 2025-12-09
Description: DNG SDK versions 1.7.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to memory exposure or application denial of service. An attacker could leverage this vulnerability to disclose sensitive memory information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.1 (HIGH)
CWE: CWE-122
References: https://helpx.adobe.com/security/products/dng-sdk/apsb25-118.html
CVE: CVE-2025-64893
Published: 2025-12-09
Description: DNG SDK versions 1.7.0 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure or application denial of service. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/dng-sdk/apsb25-118.html
CVE: CVE-2025-64894
Published: 2025-12-09
Description: DNG SDK versions 1.7.0 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could lead to application denial-of-service. An attacker could exploit this issue to cause the application to crash or become unresponsive. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://helpx.adobe.com/security/products/dng-sdk/apsb25-118.html
CVE: CVE-2025-65594
Published: 2025-12-09
Description: OpenSIS 9.2 and below is vulnerable to Incorrect Access Control in Student.php, which allows an authenticated low-privilege user to perform unauthorized database write operations relating to the data of other users.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: http://opensis.com; https://gitlab.com/tsuretettee/cve-2025-65594
CVE: CVE-2025-11531
Published: 2025-12-09
Description: HP System Event Utility and Omen Gaming Hub might allow execution of 
certain files outside of their restricted paths. This
               potential vulnerability was remediated with HP System 
Event Utility version 3.2.12 and Omen Gaming Hub version 
1101.2511.101.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://support.hp.com/us-en/document/ish_13[PII_REDACTED]7555-16/hpsbgn04079
CVE: CVE-2025-14334
Published: 2025-12-09
Description: A flaw has been found in itsourcecode Student Management System 1.0. Affected is an unknown function of the file /new_adviser.php. Executing manipulation of the argument Name can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ltranquility/CVE/issues/19; https://itsourcecode.com/; https://vuldb.com/?ctiid.335159
CVE: CVE-2025-14335
Published: 2025-12-09
Description: A vulnerability has been found in itsourcecode Student Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /new_school_year.php. The manipulation of the argument sy leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/ltranquility/CVE/issues/20; https://itsourcecode.com/; https://vuldb.com/?ctiid.335160
CVE: CVE-2025-14336
Published: 2025-12-09
Description: A vulnerability was found in itsourcecode Student Management System 1.0. Affected by this issue is some unknown functionality of the file /promote.php. The manipulation of the argument sy results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/ltranquility/CVE/issues/21; https://itsourcecode.com/; https://vuldb.com/?ctiid.335161
CVE: CVE-2025-65300
Published: 2025-12-09
Description: A stored Cross-Site Scripting (XSS) vulnerability exists in the Coohom SaaS Platform feVersion=[PII_REDACTED]97 (2025-10-28) in the Account Settings module, where unsanitized user input in Address fields (City, State, Country/Region) is rendered back to the page. Attackers can inject arbitrary JavaScript code, which executes when the affected profile page is viewed. This can lead to session hijacking, cookie theft, or arbitrary script execution in the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/garux-sec/ec9a6b6e7e4b617b7245ec18252a6377; https://www.coohom.com/pub/saas/settings/account; https://gist.github.com/garux-sec/ec9a6b6e7e4b617b7245ec18252a6377
CVE: CVE-2025-65572
Published: 2025-12-09
Description: Cross Site Scripting (XSS) vulnerability in AllskyTeam AllSky v2024.12.06_06 allows remote attackers to execute arbitrary code via the (1) config, (2) filename, or (3) extratext parameter to allskySettings.php. When the page is reloaded or when user visits allskySettings.php, the showMessages() function in status_messages.php will print out the error messages and execute the script injected by the attacker.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gh0stmezh.wordpress.com/2025/12/04/cve-2025-65572/; https://github.com/AllskyTeam/allsky; https://github.com/AllskyTeam/allsky/blob/master/html/includes/allskySettings.php
CVE: CVE-2025-65573
Published: 2025-12-09
Description: Cross Site Request Forgery (CSRF) vulnerability in AllskyTeam AllSky v2024.12.06_06 allows remote attackers to cause a denial of service via function handle_interface_POST_and_status.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://gh0stmezh.wordpress.com/2025/12/05/cve-2025-65573/; https://github.com/AllskyTeam/allsky; https://github.com/AllskyTeam/allsky/blob/master/html/includes/dashboard_LAN.php
CVE: CVE-2025-65882
Published: 2025-12-09
Description: An issue was discovered in openmptcprouter thru 0.64 in file common/package/utils/sys-upgrade-helper/src/tools/sysupgrade.c in function create_xor_ipad_opad allowing attackers to potentially write arbitrary files or execute arbitrary commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://openmptcprouter.com; https://gist.github.com/AradCohen/939ee50d60c4d2bd555a364615a5ab9c; https://github.com/Ysurac/openmptcprouter/commit/09393d1c41a227bea7d5b85c0a06221b1302b25f
CVE: CVE-2025-9612
Published: 2025-12-09
Description: An issue was discovered in the PCI Express (PCIe) Integrity and Data Encryption (IDE) specification, where insufficient guidance on Transaction Layer Packet (TLP) ordering and tag uniqueness may allow encrypted packets to be replayed or reordered without detection. This can enable local or physical attackers on the PCIe bus to violate data integrity protections.
CVSS Score: 5.1 (MEDIUM)
References: https://pcisig.com/PCIeIDEStandardVulnerabilities; https://pcisig.com/specifications; https://kb.cert.org/vuls/id/404544
CVE: CVE-2025-9613
Published: 2025-12-09
Description: A vulnerability was discovered in the PCI Express (PCIe) Integrity and Data Encryption (IDE) specification, where insufficient guidance on tag reuse after completion timeouts may allow multiple outstanding Non-Posted Requests to share the same tag. This tag aliasing condition can result in completions being delivered to the wrong security context, potentially compromising data integrity and confidentiality.
CVSS Score: 6.5 (MEDIUM)
References: https://pcisig.com/PCIeIDEStandardVulnerabilities; https://pcisig.com/specifications
CVE: CVE-2025-9614
Published: 2025-12-09
Description: An issue was discovered in the PCI Express (PCIe) Integrity and Data Encryption (IDE) specification, where insufficient guidance on re-keying and stream flushing during device rebinding may allow stale write transactions from a previous security context to be processed in a new one. This can lead to unintended data access across trusted domains, compromising confidentiality and integrity.
CVSS Score: 6.5 (MEDIUM)
References: https://pcisig.com/PCIeIDEStandardVulnerabilities; https://pcisig.com/specifications
CVE: CVE-2025-14337
Published: 2025-12-09
Description: A vulnerability was determined in itsourcecode Student Management System 1.0. This affects an unknown part of the file /new_grade.php. This manipulation of the argument grade causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ltranquility/CVE/issues/22; https://itsourcecode.com/; https://vuldb.com/?ctiid.335162
CVE: CVE-2025-64113
Published: 2025-12-09
Description: Emby Server is a user-installable home media server. Versions below 4.9.1.81 allow an attacker to gain full administrative access to an Emby Server (for Emby Server administration, not at the OS level). Other than network access, no specific preconditions need to be fulfilled for a server to be vulnerable. This issue is fixed in version 4.9.1.81.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-640
References: https://github.com/EmbySupport/Emby.Security/security/advisories/GHSA-95fv-5gfj-2r84
CVE: CVE-2025-65741
Published: 2025-12-09
Description: Sublime Text 3 Build 3208 or prior for MacOS is vulnerable to Dylib Injection. An attacker could compile a .dylib file and force the execution of this library in the context of the Sublime Text application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-427
References: https://github.com/sublimehq/sublime_text; https://github.com/vinicius-batistella/CVE-2025-65741/; https://www.sublimetext.com/3
CVE: CVE-2025-66214
Published: 2025-12-09
Description: Ladybug adds message-based debugging, unit, system, and regression testing to Java applications. Versions prior to 3.0-20[PII_REDACTED]28 contain the APIs /iaf/ladybug/api/report/{storage} and /iaf/ladybug/api/report/upload, which allow uploading gzip-compressed XML files with user-controllable content. The system deserializes these XML files, enabling attackers to achieve Remote Code Execution (RCE) by submitting carefully crafted XML payloads and thereby gain access to the target server. This issue is fixed in version 3.0-20[PII_REDACTED]28.
CVSS Score: 7.0 (HIGH)
CWE: CWE-502
References: https://github.com/wearefrank/ladybug/security/advisories/GHSA-f9fh-r3cv-398f; https://github.com/wearefrank/ladybug/security/advisories/GHSA-f9fh-r3cv-398f
CVE: CVE-2025-66456
Published: 2025-12-09
Description: Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in `mergeDeep` after merging results of two standard schema validations with the same key. Due to the ordering of merging, there must be an any type that is set as a standalone guard, to allow for the `__proto__ prop` to be merged. When combined with GHSA-8vch-m3f4-q8jf this allows for a full RCE by an attacker. This issue is fixed in version 1.4.17. To workaround, remove the `__proto__ key` from body.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://github.com/elysiajs/elysia/commit/26935bf76ebc43b4a43d48b173fc853de43bb51e; https://github.com/elysiajs/elysia/commit/3af978663e437dccc6c1a2a3aff4b74e1574849e; https://github.com/elysiajs/elysia/pull/1564
CVE: CVE-2025-66457
Published: 2025-12-09
Description: Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.17 and below are subject to arbitrary code execution from cookie config. When dynamic cookies are enabled (e.g. there  an existing cookie schema), the cookie config is injected into the compiled route without first being sanitised. Availability of this exploit is generally low, but when combined with GHSA-hxj9-33pp-j2cc, it allows for a full RCE chain. An attack requires write access to either the Elysia app's source code (in which case the vulnerability is meaningless) or write access to the cookie config (perhaps where it is assumed to be provisioned by the environment). This issue is fixed in version 1.4.18.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/elysiajs/elysia/commit/26935bf76ebc43b4a43d48b173fc853de43bb51e; https://github.com/elysiajs/elysia/commit/3af978663e437dccc6c1a2a3aff4b74e1574849e; https://github.com/elysiajs/elysia/pull/1564