deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-7xvc-v44j-46fh
Package: geokit-rails (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'), CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 2.5.0
Patched in: 2.5.0

Summary: geokit-rails Command Injection vulnerability

Details:
Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_location' cookie. This issue can be exploited remotely via a malicious cookie value.

**Note:**

 An attacker can use this vulnerability to execute commands on the host system.
GitHub Security Advisory: GHSA-639h-86hw-qcjq
Package: decidim (RUBYGEMS)
Severity: HIGH (CVSS 7.1)
CWE: CWE-284: Improper Access Control, CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: >= 0.27.0, < 0.27.4
Patched in: 0.27.4

Summary: Decidim has broken access control in templates

Details:
### Impact

The `templates` module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys.
GitHub Security Advisory: GHSA-639h-86hw-qcjq
Package: decidim-templates (RUBYGEMS)
Severity: HIGH (CVSS 7.1)
CWE: CWE-284: Improper Access Control, CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: >= 0.27.0, < 0.27.4
Patched in: 0.27.4

Summary: Decidim has broken access control in templates

Details:
### Impact

The `templates` module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys.
GitHub Security Advisory: GHSA-639h-86hw-qcjq
Package: decidim-templates (RUBYGEMS)
Severity: HIGH (CVSS 7.1)
CWE: CWE-284: Improper Access Control, CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: >= 0.23.2, < 0.26.8
Patched in: 0.26.8

Summary: Decidim has broken access control in templates

Details:
### Impact

The `templates` module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys.
GitHub Security Advisory: GHSA-639h-86hw-qcjq
Package: decidim (RUBYGEMS)
Severity: HIGH (CVSS 7.1)
CWE: CWE-284: Improper Access Control, CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: >= 0.23.2, < 0.26.8
Patched in: 0.26.8

Summary: Decidim has broken access control in templates

Details:
### Impact

The `templates` module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys.
GitHub Security Advisory: GHSA-3qc2-v3hp-6cv8
Package: sidekiq (RUBYGEMS)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-345: Insufficient Verification of Data Authenticity, CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 6.5.10
Patched in: 6.5.10

Summary: sidekiq Denial of Service vulnerability

Details:
Versions of the package sidekiq before 7.1.3 and 6.5.10 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker can exploit this vulnerability by manipulating the localStorage value which will cause excessive polling requests.
GitHub Security Advisory: GHSA-3qc2-v3hp-6cv8
Package: sidekiq (RUBYGEMS)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-345: Insufficient Verification of Data Authenticity, CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 7.0.0, < 7.1.3
Patched in: 7.1.3

Summary: sidekiq Denial of Service vulnerability

Details:
Versions of the package sidekiq before 7.1.3 and 6.5.10 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker can exploit this vulnerability by manipulating the localStorage value which will cause excessive polling requests.
GitHub Security Advisory: GHSA-gpqq-952q-5327
Package: jquery-ui-rails (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 7.0.0
Patched in: 7.0.0

Summary: XSS in the `of` option of the `.position()` util in jquery-ui

Details:
### Impact
Accepting the value of the `of` option of the [`.position()`](https://api.jqueryui.com/position/) util from untrusted sources may execute untrusted code. For example, invoking the following code:
```js
$( "#element" ).position( {
	my: "left top",
	at: "right bottom",
	of: "<img onerror='doEvilThing()' src='/404' />",
	collision: "none"
} );
```
will call the `doEvilThing()` function.

### Patches
The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector.

### Workarounds
A workaround is to not accept the value of the `of` option from untrusted sources.

### For more information
If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery UI repo](https://github.com/jquery/jquery-ui/issues). If you don't find an answer, open a new issue.
GitHub Security Advisory: GHSA-pg8v-g4xq-hww9
Package: rails-html-sanitizer (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.4.3
Patched in: 1.4.3

Summary: Rails::Html::Sanitizer vulnerable to Cross-site Scripting

Details:
Versions of Rails::Html::Sanitizer prior to version 1.4.3 are vulnerable to XSS with certain configurations of Rails::Html::Sanitizer which  allows an attacker to inject content when the application developer has overridden the sanitizer's allowed tags to allow both `select` and `style` elements. Code is only impacted if allowed tags are being overridden. 

This may be done via application configuration: ```ruby# In config/application.rbconfig.action_view.sanitized_allowed_tags = ["select", "style"]```

see https://guides.rubyonrails.org/configuring.html#configuring-action-view

Or it may be done with a `:tags` option to the Action View helper `sanitize`: ```<%= sanitize @comment.body, tags: ["select", "style"] %>``` 

see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitize 

It may also be done with Rails::Html::SafeListSanitizer directly: 
```ruby# class-level optionRails::Html::SafeListSanitizer.allowed_tags = ["select", "style"]```  or with
```ruby# instance-level optionRails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["select", "style"])```

All users overriding the allowed tags by any of the above mechanisms to include both "select" and "style" are recommended to upgrade immediately. A workaround for this issue can be applied by removing either `select` or `style` from the overridden allowed tags.
GitHub Security Advisory: GHSA-jmm9-2p29-vh2w
Package: activerecord (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 3.0.0, < 3.0.4
Patched in: 3.0.4

Summary: activerecord vulnerable to SQL Injection

Details:
Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.
GitHub Security Advisory: GHSA-mhpp-875w-9cpv
Package: jquery-rails (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-674: Uncontrolled Recursion
Vulnerable versions: = 3.0.0-rc.1
Patched in: 3.0.0

Summary: Denial of Service in jquery

Details:
Affected versions of `jquery` use a lowercasing logic on attribute names. When given a boolean attribute with a name that contains uppercase characters, `jquery` enters into an infinite recursion loop, exceeding the call stack limit, and resulting in a denial of service condition.


## Recommendation

Update to version 3.0.0 or later.
GitHub Security Advisory: GHSA-9jfq-54vc-9rr2
Package: foreman (RUBYGEMS)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: <= 3.8.0
Patched in: unpatched

Summary: Foreman Transpilation Enables OS Command Injection

Details:
A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations in templates, possibly resulting in arbitrary command execution on the underlying operating system.
GitHub Security Advisory: GHSA-g8q2-24jh-5hpc
Package: jquery-ui-rails (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: < 6.0.0
Patched in: 6.0.0

Summary: High severity vulnerability that affects jquery-ui

Details:
Withdrawn, accidental duplicate publish.

Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.
GitHub Security Advisory: GHSA-gxr4-xjj5-5px2
Package: jquery-rails (RUBYGEMS)
Severity: MODERATE (CVSS 6.9)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 4.4.0
Patched in: 4.4.0

Summary: Potential XSS vulnerability in jQuery

Details:
### Impact
Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code.

### Patches
This problem is patched in jQuery 3.5.0.

### Workarounds
To workaround the issue without upgrading, adding the following to your code:

```js
jQuery.htmlPrefilter = function( html ) {
	return html;
};
```

You need to use at least jQuery 1.12/2.2 or newer to be able to apply this workaround.

### References
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
https://jquery.com/upgrade-guide/3.5/

### For more information
If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.
GitHub Security Advisory: GHSA-579v-mp3v-rrw5
Package: jquery-rails (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.0.16
Patched in: 1.0.16

Summary: jQuery vulnerable to Cross-Site Scripting (XSS)

Details:
Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.
GitHub Security Advisory: GHSA-j7qv-pgf6-hvh4
Package: jquery-ui-rails (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 7.0.0
Patched in: 7.0.0

Summary: XSS in `*Text` options of the Datepicker widget in jquery-ui

Details:
### Impact
Accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
```js
$( "#datepicker" ).datepicker( {
	showButtonPanel: true,
	showOn: "both",
	closeText: "<script>doEvilThing( 'closeText XSS' )</script>",
	currentText: "<script>doEvilThing( 'currentText XSS' )</script>",
	prevText: "<script>doEvilThing( 'prevText XSS' )</script>",
	nextText: "<script>doEvilThing( 'nextText XSS' )</script>",
	buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>",
	appendText: "<script>doEvilThing( 'appendText XSS' )</script>",
} );
```
will call `doEvilThing` with 6 different parameters coming from all `*Text` options.

### Patches
The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML.

### Workarounds
A workaround is to not accept the value of the `*Text` options from untrusted sources.

### For more information
If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery UI repo](https://github.com/jquery/jquery-ui/issues). If you don't find an answer, open a new issue.
GitHub Security Advisory: GHSA-9gj3-hwp5-pmwc
Package: jquery-ui-rails (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 7.0.0
Patched in: 7.0.0

Summary: XSS in the `altField` option of the Datepicker widget in jquery-ui

Details:
### Impact
Accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
```js
$( "#datepicker" ).datepicker( {
	altField: "<img onerror='doEvilThing()' src='/404' />",
} );
```
will call the `doEvilThing` function.

### Patches
The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector.

### Workarounds
A workaround is to not accept the value of the `altField` option from untrusted sources.

### For more information
If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery UI repo](https://github.com/jquery/jquery-ui/issues). If you don't find an answer, open a new issue.
GitHub Security Advisory: GHSA-qqxp-xp9v-vvx6
Package: jquery-ui-rails (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 4.0.0
Patched in: 4.0.0

Summary: jquery-ui Tooltip widget vulnerable to XSS

Details:
Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.
GitHub Security Advisory: GHSA-wcm2-9c89-wmfm
Package: jquery-ui-rails (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 4.0.0
Patched in: 4.0.0

Summary: Cross-site Scripting in jquery-ui

Details:
Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.
GitHub Security Advisory: GHSA-hpcf-8vf9-q4gj
Package: jquery-ui-rails (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 6.0.0
Patched in: 6.0.0

Summary: jQuery-UI vulnerable to Cross-site Scripting in dialog closeText

Details:
Affected versions of `jquery-ui` are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the `closeText` parameter in the `dialog` function. 

jQuery-UI is a library for manipulating UI elements via jQuery.

Version 1.11.4 has a cross site scripting (XSS) vulnerability in the `closeText` parameter of the `dialog`  function.  If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.


## Recommendation

Upgrade to jQuery-UI 1.12.0 or later.
GitHub Security Advisory: GHSA-257q-pv89-v3xv
Package: jquery-rails (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 4.4.0
Patched in: 4.4.0

Summary: Duplicate Advisory: jQuery Cross Site Scripting vulnerability

Details:
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of [GHSA-jpcq-cgw6-v4j6](https://github.com/advisories/GHSA-jpcq-cgw6-v4j6). This link is maintained to preserve external references.

## Original Description

Cross Site Scripting vulnerability in jQuery v.2.2.0 until v.3.5.0 allows a remote attacker to execute arbitrary code via the `<options>` element.
GitHub Security Advisory: GHSA-rmxg-73gg-4p98
Package: jquery-rails (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 4.2.0
Patched in: 4.2.0

Summary: Cross-Site Scripting (XSS) in jquery

Details:
Affected versions of `jquery` interpret `text/javascript` responses from cross-origin ajax requests, and automatically execute the contents in `jQuery.globalEval`, even when the ajax request doesn't contain the `dataType` option.


## Recommendation

Update to version 3.0.0 or later.
GitHub Security Advisory: GHSA-wv67-q8rr-grjp
Package: jquery-rails (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 3.4.0
Patched in: 3.4.0

Summary: Duplicate Advisory: Prototype Pollution in jquery

Details:
## Duplicate Advisory
This advisory is a duplicate of [GHSA-6c3j-c64m-qhgq](https://github.com/advisories/GHSA-6c3j-c64m-qhgq). This link is maintained to preserve external references.

## Original Description
Versions of `jquery`  prior to 3.4.0 are vulnerable to Prototype Pollution. The extend() method allows an attacker to modify the prototype for `Object` causing changes in properties that will exist on all objects.

## Recommendation
Upgrade to version 3.4.0 or later.
GitHub Security Advisory: GHSA-jpcq-cgw6-v4j6
Package: jquery-rails (RUBYGEMS)
Severity: MODERATE (CVSS 6.9)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 4.4.0
Patched in: 4.4.0

Summary: Potential XSS vulnerability in jQuery

Details:
### Impact
Passing HTML containing `<option>` elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code.

### Patches
This problem is patched in jQuery 3.5.0.

### Workarounds
To workaround this issue without upgrading, use [DOMPurify](https://github.com/cure53/DOMPurify) with its `SAFE_FOR_JQUERY` option to sanitize the HTML string before passing it to a jQuery method.

### References
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

### For more information
If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.
GitHub Security Advisory: GHSA-m7r6-43v2-49vf
Package: mongrel (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 1.1.0, < 1.1.3
Patched in: 1.1.3

Summary: Mongrel vulnerable to directory traversal via double-encoded sequences

Details:
Directory traversal vulnerability in DirHandler (lib/mongrel/handlers.rb) in Mongrel 1.0.4 (1.0.3 and prior are not affected) and 1.1.x before 1.1.3 allows remote attackers to read arbitrary files via an HTTP request containing double-encoded sequences (`.%252e`).
GitHub Security Advisory: GHSA-m7r6-43v2-49vf
Package: mongrel (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: = 1.0.4
Patched in: 1.0.5

Summary: Mongrel vulnerable to directory traversal via double-encoded sequences

Details:
Directory traversal vulnerability in DirHandler (lib/mongrel/handlers.rb) in Mongrel 1.0.4 (1.0.3 and prior are not affected) and 1.1.x before 1.1.3 allows remote attackers to read arbitrary files via an HTTP request containing double-encoded sequences (`.%252e`).
GitHub Security Advisory: GHSA-23c2-gwp5-pxw9
Package: globalid (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 0.2.1, < 1.0.1
Patched in: 1.0.1

Summary: ReDoS based DoS vulnerability in GlobalID

Details:
There is a ReDoS based DoS vulnerability in the GlobalID gem. This vulnerability has been assigned the CVE identifier CVE-2023-22799.

Versions Affected: >= 0.2.1 Not affected: NOTAFFECTED Fixed Versions: 1.0.1
Impact

There is a possible DoS vulnerability in the model name parsing section of the GlobalID gem. Carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases

The FIXED releases are available at the normal locations.
Workarounds

There are no feasible workarounds for this issue.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    1-0-model-name-redos.patch - Patch for 1.0 series
GitHub Security Advisory: GHSA-5x79-w82f-gw8w
Package: rails-html-sanitizer (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: < 1.4.4
Patched in: 1.4.4

Summary: Inefficient Regular Expression Complexity in rails-html-sanitizer

Details:
## Summary

Certain configurations of rails-html-sanitizer `< 1.4.4` use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption.


## Mitigation

Upgrade to rails-html-sanitizer `>= 1.4.4`.


## Severity

The maintainers have evaluated this as [High Severity 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).


## References

- [CWE - CWE-1333: Inefficient Regular Expression Complexity (4.9)](https://cwe.mitre.org/data/definitions/1333.html)
- https://hackerone.com/reports/1684163


## Credit

This vulnerability was responsibly reported by @ooooooo-q (https://github.com/ooooooo-q).
GitHub Security Advisory: GHSA-3x8r-x6xp-q4vm
Package: loofah (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-674: Uncontrolled Recursion
Vulnerable versions: >= 2.2.0, < 2.19.1
Patched in: 2.19.1

Summary: Uncontrolled Recursion in Loofah

Details:
## Summary

Loofah `>= 2.2.0, < 2.19.1` uses recursion for sanitizing `CDATA` sections, making it susceptible to stack exhaustion and raising a `SystemStackError` exception.  This may lead to a denial of service through CPU resource consumption.


## Mitigation

Upgrade to Loofah `>= 2.19.1`.

Users who are unable to upgrade may be able to mitigate this vulnerability by limiting the length of the strings that are sanitized.


## Severity

The Loofah maintainers have evaluated this as [High Severity 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).


## References

- [CWE - CWE-674: Uncontrolled Recursion (4.9)](https://cwe.mitre.org/data/definitions/674.html)