deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-mcwh-c9pg-xw43
Package: org.apache.kafka:kafka_2.8.2 (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 3.4.0
Patched in: unpatched

Summary: Apache Kafka Deserialization of Untrusted Data vulnerability

Details:
In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource.


Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" is disabled by default in in Apache Kafka 3.9.1/4.0.0
GitHub Security Advisory: GHSA-mcwh-c9pg-xw43
Package: org.apache.kafka:kafka_2.8.0 (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 3.4.0
Patched in: unpatched

Summary: Apache Kafka Deserialization of Untrusted Data vulnerability

Details:
In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource.


Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" is disabled by default in in Apache Kafka 3.9.1/4.0.0
GitHub Security Advisory: GHSA-mcwh-c9pg-xw43
Package: org.apache.kafka:kafka_2.13 (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 3.4.0
Patched in: 3.4.0

Summary: Apache Kafka Deserialization of Untrusted Data vulnerability

Details:
In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource.


Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" is disabled by default in in Apache Kafka 3.9.1/4.0.0
GitHub Security Advisory: GHSA-mcwh-c9pg-xw43
Package: org.apache.kafka:kafka_2.12 (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 3.4.0
Patched in: 3.4.0

Summary: Apache Kafka Deserialization of Untrusted Data vulnerability

Details:
In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource.


Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" is disabled by default in in Apache Kafka 3.9.1/4.0.0
GitHub Security Advisory: GHSA-mcwh-c9pg-xw43
Package: org.apache.kafka:kafka_2.11 (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 3.4.0
Patched in: unpatched

Summary: Apache Kafka Deserialization of Untrusted Data vulnerability

Details:
In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource.


Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" is disabled by default in in Apache Kafka 3.9.1/4.0.0
GitHub Security Advisory: GHSA-mcwh-c9pg-xw43
Package: org.apache.kafka:kafka_2.10 (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 3.4.0
Patched in: unpatched

Summary: Apache Kafka Deserialization of Untrusted Data vulnerability

Details:
In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource.


Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" is disabled by default in in Apache Kafka 3.9.1/4.0.0
GitHub Security Advisory: GHSA-8xqm-6fj2-hfgf
Package: tech.powerjob:powerjob-common (MAVEN)
Severity: MODERATE (CVSS 6.3)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 5.1.2
Patched in: unpatched

Summary:  PowerJob has a server-side request forgery vulnerability in PingPongUtils.java

Details:
A vulnerability was identified in PowerJob up to 5.1.2. This vulnerability affects the function checkConnectivity of the file src/main/java/tech/powerjob/common/utils/net/PingPongUtils.java of the component Network Request Handler. The manipulation of the argument targetIp/targetPort leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
GitHub Security Advisory: GHSA-j5gq-897m-2rff
Package: com.okta.sdk:okta-sdk-root (MAVEN)
Severity: HIGH (CVSS 8.4)
CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Vulnerable versions: >= 11.0.0, <= 20.0.0
Patched in: 20.0.1

Summary: Race condition in the Okta Java SDK

Details:
### Description
In the Okta Java SDK, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response.


### Affected product and versions
You may be affected if you meet the following preconditions:
- Using the Okta Java SDK between versions 11.0.0 and 20.0.0, and
- Implementing a multithreaded application with the ApiClient class where the response status code is used in access control flows

### Resolution
Upgrade Okta/okta-sdk-java to versions 21.0.0  or greater.
GitHub Security Advisory: GHSA-qhr6-6cgv-6638
Package: com.okta.sdk:okta-sdk-root (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-401: Missing Release of Memory after Effective Lifetime
Vulnerable versions: >= 21.0.0, <= 24.0.0
Patched in: 24.0.1

Summary: Improper Memory Cleanup in the Okta Java SDK

Details:
### Description
In the Okta Java SDK, specific multithreaded implementations may encounter memory issues as threads are not properly cleaned up after requests are completed. Over time, this can degrade performance and availability in long-running applications and may result in a denial-of-service condition under sustained load.

### Affected product and versions
You may be affected by this vulnerability if you meet the following preconditions:
- Using the Okta Java SDK between versions 21.0.0 and 24.0.0, and
- Implementing a long-running application using the ApiClient in a multi-threaded manner.

### Resolution
Upgrade Okta/okta-sdk-java to versions 24.0.1 or greater. 

### Acknowledgement
Okta would like to thank Andrew Pikler (pyckle) for their discovery and responsible disclosure.
GitHub Security Advisory: GHSA-3fm2-hx3h-xm4v
Package: com.datapipe.jenkins.plugins:hashicorp-vault-plugin (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-282: Improper Ownership Management
Vulnerable versions: <= 371
Patched in: unpatched

Summary: Jenkins HashiCorp Vault Plugin exposes system-scoped Vault credentials

Details:
Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to.
GitHub Security Advisory: GHSA-qxh4-j39m-qfx4
Package: org.jenkinsci.plugins:pipeline-reporter-by-redpen (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 1.054
Patched in: unpatched

Summary: Jenkins Redpen - Pipeline Reporter for Jira Plugin has a path traversal vulnerability

Details:
Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workspace directory while uploading artifacts to Jira, allowing attackers with Item/Configure permission to retrieve files present on the Jenkins controller workspace directory.
GitHub Security Advisory: GHSA-v3f3-rf6r-43x5
Package: io.jenkins.plugins:coverage (MAVEN)
Severity: HIGH (CVSS 8.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.3056
Patched in: 2.3056

Summary: Jenkins Coverage Plugin has a stored cross-site scripting (XSS) vulnerability

Details:
Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a `javascript:` scheme URL as identifier by configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability.
GitHub Security Advisory: GHSA-hxjg-2jvf-h3rx
Package: org.jenkins-ci.main:jenkins-core (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-312: Cleartext Storage of Sensitive Information
Vulnerable versions: < 2.528.3
Patched in: 2.528.3

Summary: Jenkins's build authorization token is stored and displayed in plain text

Details:
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
GitHub Security Advisory: GHSA-hxjg-2jvf-h3rx
Package: org.jenkins-ci.main:jenkins-core (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-312: Cleartext Storage of Sensitive Information
Vulnerable versions: >= 2.529, < 2.541
Patched in: 2.541

Summary: Jenkins's build authorization token is stored and displayed in plain text

Details:
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
GitHub Security Advisory: GHSA-6837-qgrc-x5p6
Package: org.jenkins-ci.main:jenkins-core (MAVEN)
Severity: LOW (CVSS 3.5)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: < 2.528.3
Patched in: 2.528.3

Summary: Jenkins has a CSRF vulnerability on the login form

Details:
A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account.
GitHub Security Advisory: GHSA-6837-qgrc-x5p6
Package: org.jenkins-ci.main:jenkins-core (MAVEN)
Severity: LOW (CVSS 3.5)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 2.529, < 2.541
Patched in: 2.541

Summary: Jenkins has a CSRF vulnerability on the login form

Details:
A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account.
GitHub Security Advisory: GHSA-v8hg-m323-jvjq
Package: org.jenkins-ci.plugins:git-client (MAVEN)
Severity: MODERATE (CVSS 5.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 6.4.1
Patched in: 6.4.1

Summary: Jenkins Git client Plugin has an OS command injection vulnerability on agents in Git client Plugin

Details:
Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers able to control the workspace directory name to inject arbitrary OS commands.
GitHub Security Advisory: GHSA-fxj7-6v9w-xc76
Package: org.jenkins-ci.main:jenkins-core (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-312: Cleartext Storage of Sensitive Information
Vulnerable versions: < 2.528.3
Patched in: 2.528.3

Summary: Jenkins's build authorization token is stored and displayed in plain text

Details:
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
GitHub Security Advisory: GHSA-fxj7-6v9w-xc76
Package: org.jenkins-ci.main:jenkins-core (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-312: Cleartext Storage of Sensitive Information
Vulnerable versions: >= 2.529, < 2.541
Patched in: 2.541

Summary: Jenkins's build authorization token is stored and displayed in plain text

Details:
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
GitHub Security Advisory: GHSA-p3f5-98cv-562j
Package: org.jenkins-ci.main:jenkins-core (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 2.528.3
Patched in: 2.528.3

Summary: Jenkins is missing a permission check on password fields

Details:
A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views.
GitHub Security Advisory: GHSA-p3f5-98cv-562j
Package: org.jenkins-ci.main:jenkins-core (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 2.529, < 2.541
Patched in: 2.541

Summary: Jenkins is missing a permission check on password fields

Details:
A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views.
GitHub Security Advisory: GHSA-9p56-p6mw-w8qc
Package: org.jenkins-ci.main:cli (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-404: Improper Resource Shutdown or Release
Vulnerable versions: < 2.528.3
Patched in: 2.528.3

Summary: Jenkins has a Denial of service vulnerability in HTTP-based CLI

Details:
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.
GitHub Security Advisory: GHSA-9p56-p6mw-w8qc
Package: org.jenkins-ci.main:jenkins-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-404: Improper Resource Shutdown or Release
Vulnerable versions: < 2.528.3
Patched in: 2.528.3

Summary: Jenkins has a Denial of service vulnerability in HTTP-based CLI

Details:
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.
GitHub Security Advisory: GHSA-9p56-p6mw-w8qc
Package: org.jenkins-ci.main:cli (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-404: Improper Resource Shutdown or Release
Vulnerable versions: >= 2.529, < 2.541
Patched in: 2.541

Summary: Jenkins has a Denial of service vulnerability in HTTP-based CLI

Details:
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.
GitHub Security Advisory: GHSA-9p56-p6mw-w8qc
Package: org.jenkins-ci.main:jenkins-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-404: Improper Resource Shutdown or Release
Vulnerable versions: >= 2.529, < 2.541
Patched in: 2.541

Summary: Jenkins has a Denial of service vulnerability in HTTP-based CLI

Details:
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.
GitHub Security Advisory: GHSA-rg58-xhh7-mqjw
Package: org.apache.struts:struts2-core (MAVEN)
Severity: HIGH (CVSS 8.2)
CWE: CWE-459: Incomplete Cleanup
Vulnerable versions: >= 7.0.0, < 7.1.1
Patched in: 7.1.1

Summary: Apache Struts has a Denial of Service vulnerability

Details:
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.

This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3.

Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.
GitHub Security Advisory: GHSA-rg58-xhh7-mqjw
Package: org.apache.struts:struts2-core (MAVEN)
Severity: HIGH (CVSS 8.2)
CWE: CWE-459: Incomplete Cleanup
Vulnerable versions: >= 2.0.0, < 6.8.0
Patched in: 6.8.0

Summary: Apache Struts has a Denial of Service vulnerability

Details:
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.

This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3.

Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.
GitHub Security Advisory: GHSA-9xc6-c2rm-f27p
Package: org.xwiki.rendering:xwiki-rendering-xml (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection'), CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Vulnerable versions: >= 17.5.0-rc-1, < 17.6.0-rc-1
Patched in: 17.6.0-rc-1

Summary: XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection

Details:
### Impact
Any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as content of HTML macros with insufficient escaping, and it is thus possible to close the HTML macro and inject script macros that are executed with programming rights. To demonstrate, the content `{{html}}{{/html {{/html}}}}` can be inserted into any field of the user profile that supports wiki syntax like the "About" field. If this leads to the display of raw HTML, the instance is vulnerable.

### Patches
This problem has been patched by extending the escaping introduced by [XRENDERING-693](https://jira.xwiki.org/browse/XRENDERING-693) to also cover closing HTML macros that have spaces after the macro name in XWiki 16.10.10, 17.4.3 and 17.6.0RC1. A [similar fix](https://github.com/xwiki/xwiki-platform/commit/12b780ccd5bca5fc8f74f46648d7e02fa04fbc11) has been applied in `org.xwiki.platform:xwiki-platform-oldcore` as an extra safety net, see [XWIKI-23378](https://jira.xwiki.org/browse/XWIKI-23378). At this point, we're not aware that this extra safety net would be required for security.

The patch also fixes the injection of opening HTML macro syntaxes, e.g., with `{{html}}{{html{{/html}}}}` which disrupts the rendering of the user profile but for which we haven't found any further security impact apart from the disruption of the UI.

### Workarounds
We're not aware of any workarounds except for upgrading the affected module to a version with a fix.
GitHub Security Advisory: GHSA-9xc6-c2rm-f27p
Package: org.xwiki.rendering:xwiki-rendering-xml (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection'), CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Vulnerable versions: >= 17.0.0-rc-1, < 17.4.3
Patched in: 17.4.3

Summary: XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection

Details:
### Impact
Any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as content of HTML macros with insufficient escaping, and it is thus possible to close the HTML macro and inject script macros that are executed with programming rights. To demonstrate, the content `{{html}}{{/html {{/html}}}}` can be inserted into any field of the user profile that supports wiki syntax like the "About" field. If this leads to the display of raw HTML, the instance is vulnerable.

### Patches
This problem has been patched by extending the escaping introduced by [XRENDERING-693](https://jira.xwiki.org/browse/XRENDERING-693) to also cover closing HTML macros that have spaces after the macro name in XWiki 16.10.10, 17.4.3 and 17.6.0RC1. A [similar fix](https://github.com/xwiki/xwiki-platform/commit/12b780ccd5bca5fc8f74f46648d7e02fa04fbc11) has been applied in `org.xwiki.platform:xwiki-platform-oldcore` as an extra safety net, see [XWIKI-23378](https://jira.xwiki.org/browse/XWIKI-23378). At this point, we're not aware that this extra safety net would be required for security.

The patch also fixes the injection of opening HTML macro syntaxes, e.g., with `{{html}}{{html{{/html}}}}` which disrupts the rendering of the user profile but for which we haven't found any further security impact apart from the disruption of the UI.

### Workarounds
We're not aware of any workarounds except for upgrading the affected module to a version with a fix.