hitoshura25/cvefixes huggingface dataset:
CVE-2023-29017 (JavaScript, published 2023-04-06T20:15Z)
Description: value: vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors. A threat actor could bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.15 of vm2. There are no known workarounds.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-913 \u2014 Improper Control of Dynamically-Managed Code Resources
The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
Repository: https://github.com/patriksimek/vm2
Files changed:
lib/setup-sandbox.js
Commit message: Wrap host objects passes through prepareStackTrace


Vulnerable code:
					for (let i=0; i < sst.length; i++) {
						const cs = sst[i];
						if (typeof cs === 'object' && localReflectGetPrototypeOf(cs) === OriginalCallSite.prototype) {
							sst[i] = new CallSite(cs);

Fixed code:
				const sandboxSst = ensureThis(sst);
					if (sst === sandboxSst) {
						for (let i=0; i < sst.length; i++) {
							const cs = sst[i];
							if (typeof cs === 'object' && localReflectGetPrototypeOf(cs) === OriginalCallSite.prototype) {
								sst[i] = new CallSite(cs);
							}
						}
					} else {
						sst = [];
						for (let i=0; i < sandboxSst.length; i++) {
							const cs = sandboxSst[i];
							localReflectDefineProperty(sst, i, {
								__proto__: null,
								value: new CallSite(cs),
								enumerable: true,
								configurable: true,
								writable: true
							});
				} else {
					sst = sandboxSst;
CVE-2023-29199 (JSON, published 2023-04-14T19:15Z)
Description: value: There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass `handleException()` and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context. A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version `3.9.16` of `vm2`.

Severity: nan (CVSS v3 base score: 10)
Weakness: CWE-913 \u2014 Improper Control of Dynamically-Managed Code Resources
The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
Repository: https://github.com/patriksimek/vm2
Files changed:
CHANGELOG.md
lib/transformer.js
package.json
Commit message: Release 3.9.16


Vulnerable code:
						code: `catch($tmpname){try{throw ${INTERNAL_STATE_NAME}.handleException($tmpname);}`
						code: `}`
							code: `${name}=${INTERNAL_STATE_NAME}.handleException(${name});`
				code: INTERNAL_STATE_NAME + '.wrapWith('
				code: ')'
				code: INTERNAL_STATE_NAME + '.'
		ncode += code.substring(curr, change.pos) + change.code.replace(/\$tmpname/g, tmpname);
  "version": "3.9.15",

Fixed code:
v3.9.16 (2023-04-11)
--------------------
[fix] Security fix (see https://github.com/patriksimek/vm2/issues/516).

						coder: () => `catch(${tmpname}){try{throw(${tmpname}=${INTERNAL_STATE_NAME}.handleException(${tmpname}));}`
						coder: () => `}`
							coder: () => `${name}=${INTERNAL_STATE_NAME}.handleException(${name});`
				coder: () => INTERNAL_STATE_NAME + '.wrapWith('
				coder: () => ')'
				coder: () => INTERNAL_STATE_NAME + '.'
		ncode += code.substring(curr, change.pos) + change.coder();
  "version": "3.9.16",
CVE-2023-30547 (JavaScript, published 2023-04-17T22:15Z)
Description: value: vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside `handleException()` which can be used to escape the sandbox and run arbitrary code in host context. This vulnerability was patched in the release of version `3.9.17` of `vm2`. There are no known workarounds for this vulnerability. Users are advised to upgrade.
Severity: nan (CVSS v3 base score: 10)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/patriksimek/vm2
Files changed:
lib/setup-sandbox.js
Commit message: Handle host errors captured in Promises


Vulnerable code:
if (localPromise && !allowAsync) {
	overrideWithProxy(PromisePrototype, 'then', PromisePrototype.then, AsyncErrorHandler);
	// This seems not to work, and will produce
	// UnhandledPromiseRejectionWarning: TypeError: Method Promise.prototype.then called on incompatible receiver [object Object].
	// This is likely caused since the host.Promise.prototype.then cannot use the VM Proxy object.
	// Contextify.connect(host.Promise.prototype.then, Promise.prototype.then);
	if (PromisePrototype.finally) {
		overrideWithProxy(PromisePrototype, 'finally', PromisePrototype.finally, AsyncErrorHandler);
		// Contextify.connect(host.Promise.prototype.finally, Promise.prototype.finally);
	}
	if (Promise.prototype.catch) {
		overrideWithProxy(PromisePrototype, 'catch', PromisePrototype.catch, AsyncErrorHandler);
		// Contextify.connect(host.Promise.prototype.catch, Promise.prototype.catch);

Fixed code:
if (localPromise) {
	if (!allowAsync) {

		overrideWithProxy(PromisePrototype, 'then', PromisePrototype.then, AsyncErrorHandler);
		// This seems not to work, and will produce
		// UnhandledPromiseRejectionWarning: TypeError: Method Promise.prototype.then called on incompatible receiver [object Object].
		// This is likely caused since the host.Promise.prototype.then cannot use the VM Proxy object.
		// Contextify.connect(host.Promise.prototype.then, Promise.prototype.then);

	} else {

		overrideWithProxy(PromisePrototype, 'then', PromisePrototype.then, {
			__proto__: null,
			apply(target, thiz, args) {
				if (args.length > 1) {
					const onRejected = args[1];
					if (typeof onRejected === 'function') {
						args[1] = function wrapper(error) {
							error = ensureThis(error);
							return localReflectApply(onRejected, this, [error]);
						};
					}
				}
				return localReflectApply(target, thiz, args);
			}
		});
CVE-2023-30547 (JavaScript, published 2023-04-17T22:15Z)
Description: value: vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside `handleException()` which can be used to escape the sandbox and run arbitrary code in host context. This vulnerability was patched in the release of version `3.9.17` of `vm2`. There are no known workarounds for this vulnerability. Users are advised to upgrade.
Severity: nan (CVSS v3 base score: 10)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/patriksimek/vm2
Files changed:
lib/transformer.js
Commit message: Ensure every catch block is protected


Vulnerable code:
				if (param.type === 'ObjectPattern') {
						coder: () => `catch(${tmpname}){try{throw(${tmpname}=${INTERNAL_STATE_NAME}.handleException(${tmpname}));}`
				} else {
					const name = assertType(param, 'Identifier').name;
					const cBody = assertType(node.body, 'BlockStatement');
					if (cBody.body.length > 0) {
						insertions.push({
							__proto__: null,
							pos: cBody.body[0].start,
							order: TO_LEFT,
							coder: () => `${name}=${INTERNAL_STATE_NAME}.handleException(${name});`
						});
					}

Fixed code:
				if (param.type === 'Identifier') {
					const name = assertType(param, 'Identifier').name;
					const cBody = assertType(node.body, 'BlockStatement');
					if (cBody.body.length > 0) {
						insertions.push({
							__proto__: null,
							pos: cBody.body[0].start,
							order: TO_LEFT,
							coder: () => `${name}=${INTERNAL_STATE_NAME}.handleException(${name});`
						});
					}
				} else {
						coder: () => `catch(${tmpname}){${tmpname}=${INTERNAL_STATE_NAME}.handleException(${tmpname});try{throw ${tmpname};}`
CVE-2023-32313 (JavaScript, published 2023-05-15T20:15Z)
Description: value: vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node `inspect` method and edit options for `console.log`. As a result a threat actor can edit options for the `console.log` command. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. Users unable to upgrade may make the `inspect` method readonly with `vm.readonly(inspect)` after creating a vm.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/patriksimek/vm2
Files changed:
lib/vm.js
Commit message: Inspect method should be readonly


Vulnerable code:

Fixed code:
const {
	inspect
} = require('util');
		this.readonly(inspect);
CVE-2023-32314 (JavaScript, published 2023-05-15T20:15Z)
Description: value: vm2 is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 for versions up to and including 3.9.17. It abuses an unexpected creation of a host object based on the specification of `Proxy`. As a result a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 10)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/patriksimek/vm2
Files changed:
lib/setup-sandbox.js
Commit message: Ensure host array does not leak through proxy


Vulnerable code:

Fixed code:
	construct: localReflectConstruct,
function makeSafeHandlerArgs(args) {
	const sArgs = ensureThis(args);
	if (sArgs === args) return args;
	const a = [];
	for (let i=0; i < sArgs.length; i++) {
		localReflectDefineProperty(a, i, {
			__proto__: null,
			value: sArgs[i],
			enumerable: true,
			configurable: true,
			writable: true
		});
	}
	return a;
}

const makeSafeArgs = Object.freeze({
	__proto__: null,
	apply(target, thiz, args) {
		return localReflectApply(target, thiz, makeSafeHandlerArgs(args));
	},
	construct(target, args, newTarget) {
		return localReflectConstruct(target, makeSafeHandlerArgs(args), newTarget);
	}
});

const proxyHandlerHandler = Object.freeze({
	__proto__: null,
	get(target, name, receiver) {
		const value = target.handler[name];
		if (typeof value !== 'function') return value;
		return new LocalProxy(value, makeSafeArgs);
	}
});

function wrapProxyHandler(args) {
	if (args.length < 2) return args;
	const handler = args[1];
	args[1] = new LocalProxy({__proto__: null, handler}, proxyHandlerHandler);
	return args;
}

const proxyHandler = Object.freeze({
	__proto__: null,
	apply(target, thiz, args) {
		return localReflectApply(target, thiz, wrapProxyHandler(args));
	},
	construct(target, args, newTarget) {
		return localReflectConstruct(target, wrapProxyHandler(args), newTarget);
	}
});

const proxiedProxy = new LocalProxy(LocalProxy, proxyHandler);

overrideWithProxy(LocalProxy, 'revocable', LocalProxy.revocable, proxyHandler);

global.Proxy = proxiedProxy;
CVE-2021-39207 (Python, published 2021-09-10T23:15Z)
Description: value: parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable to YAML deserialization attack caused by unsafe loading which leads to Arbitary code execution. This security bug is patched by avoiding unsafe loader users should update to version above v1.1.0. If upgrading is not possible then users can change the Loader used to SafeLoader as a workaround. See commit 507d066ef432ea27d3e201da08009872a2f37725 for details.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/facebookresearch/ParlAI
Files changed:
parlai/chat_service/utils/config.py
Commit message: RCE Fixed (#3402)

Co-authored-by: Anon-Artist <61599526+Anon-Artist@users.noreply.github.com>
Co-authored-by: Jamie Slome <jamie@418sec.com>

Vulnerable code:
        cfg = yaml.load(f.read(), Loader=yaml.FullLoader)

Fixed code:
        cfg = yaml.load(f.read(), Loader=yaml.SafeLoader)
CVE-2021-39207 (Python, published 2021-09-10T23:15Z)
Description: value: parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable to YAML deserialization attack caused by unsafe loading which leads to Arbitary code execution. This security bug is patched by avoiding unsafe loader users should update to version above v1.1.0. If upgrading is not possible then users can change the Loader used to SafeLoader as a workaround. See commit 507d066ef432ea27d3e201da08009872a2f37725 for details.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/facebookresearch/ParlAI
Files changed:
parlai/crowdsourcing/tasks/model_chat/model_chat_blueprint.py
Commit message: Update model_chat_blueprint.py (#3429)



Vulnerable code:
            all_model_opts = yaml.load(f.read())
            model_opts = yaml.load(f.read())

Fixed code:
            all_model_opts = yaml.safe_load(f.read())
            model_opts = yaml.safe_load(f.read())
CVE-2022-21221 (Go, published 2022-03-17T12:15Z)
Description: value: The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. **Note:** This security issue impacts Windows users only.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/valyala/fasthttp
Files changed:
fs.go
server.go
Commit message: Warn about unsafe ServeFile usage (#1228)

See: https://github.com/valyala/fasthttp/issues/1226

Vulnerable code:

Fixed code:
//
// WARNING: do not pass any user supplied paths to this function!
// WARNING: if path is based on user input users will be able to request
// any file on your filesystem! Use fasthttp.FS with a sane Root instead.
//
// WARNING: do not pass any user supplied paths to this function!
// WARNING: if path is based on user input users will be able to request
// any file on your filesystem! Use fasthttp.FS with a sane Root instead.
//
// WARNING: do not pass any user supplied paths to this function!
// WARNING: if path is based on user input users will be able to request
// any file on your filesystem! Use fasthttp.FS with a sane Root instead.
//
// WARNING: do not pass any user supplied paths to this function!
// WARNING: if path is based on user input users will be able to request
// any file on your filesystem! Use fasthttp.FS with a sane Root instead.
//
// WARNING: do not pass any user supplied paths to this function!
// WARNING: if path is based on user input users will be able to request
// any file on your filesystem! Use fasthttp.FS with a sane Root instead.
//
// WARNING: do not pass any user supplied paths to this function!
// WARNING: if path is based on user input users will be able to request
// any file on your filesystem! Use fasthttp.FS with a sane Root instead.
CVE-2024-28184 (Python, published 2024-03-09T01:15Z)
Description: value: WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if `url_fetcher` is configured to prevent access to files and URLs. This vulnerability has been patched in version 61.2.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Kozea/WeasyPrint
Files changed:
weasyprint/html.py
weasyprint/pdf/__init__.py
weasyprint/pdf/anchors.py
Commit message: Use document’s url_fetcher for attachments

Also force HTML attachments to be detected as URLs so that url_fetcher is
always used.


Vulnerable code:
                attachment = Attachment(url=url, description=attachment_title)
                attachment = Attachment(attachment)
                pdf, Attachment(annot_target), compress)

Fixed code:
                attachment = Attachment(
                    url=url, description=attachment_title,
                    url_fetcher=html.url_fetcher)
                attachment = Attachment(
                    attachment, url_fetcher=document.url_fetcher)
            attachment = Attachment(
                url=annot_target, url_fetcher=document.url_fetcher)
                pdf, attachment, compress)
CVE-2017-14498 (PHP, published 2017-09-15T18:29Z)
Description: value: SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by (1) the Insert Media option in the content editor or (2) an admin/assets/add pathname, as demonstrated by the admin/pages/edit/EditorToolbar/MediaForm/field/AssetUploadField/upload URI, aka issue SS-2017-017.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/silverstripe/silverstripe-framework
Files changed:
filesystem/File.php
Commit message: [SS-2017-017] FIX SVG uploads disabled by default


Vulnerable code:
		'png','pps','ppt','pptx','potx','potm','ra','ram','rm','rtf','sit','sitx', 'svg', 'tar','tgz','tif','tiff',

Fixed code:
		'png','pps','ppt','pptx','potx','potm','ra','ram','rm','rtf','sit','sitx', 'tar','tgz','tif','tiff',
CVE-2023-22728 (PHP, published 2023-04-26T14:15Z)
Description: value: Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, the GridField print view incorrectly validates the permission of DataObjects potentially allowing a content author to view records they are not authorised to access. Users should upgrade to Silverstripe Framework 4.12.15 or above to address the issue.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/silverstripe/silverstripe-framework
Files changed:
src/Forms/GridField/GridFieldPrintButton.php
tests/php/Forms/GridField/GridFieldPrintButtonTest.php
tests/php/Forms/GridField/GridFieldPrintButtonTest/TestObject.php
Commit message: [CVE-2023-22728] Check canView before printing from GridField


Vulnerable code:
            $itemRow = new ArrayList();
            foreach ($printColumns as $field => $label) {
                $value = $gridFieldColumnsComponent
                    ? strip_tags($gridFieldColumnsComponent->getColumnContent($gridField, $item, $field))
                    : $gridField->getDataFieldValue($item, $field);
                $itemRow->push(new ArrayData([
                    "CellString" => $value,

            $itemRows->push(new ArrayData([
                "ItemRow" => $itemRow
            ]));
        $rows = $printData->ItemRows;
        $this->assertEquals(42, $rows->count());

Fixed code:
            if (!$item->hasMethod('canView') || $item->canView()) {
                $itemRow = new ArrayList();
                foreach ($printColumns as $field => $label) {
                    $value = $gridFieldColumnsComponent
                        ? strip_tags($gridFieldColumnsComponent->getColumnContent($gridField, $item, $field))
                        : $gridField->getDataFieldValue($item, $field);

                    $itemRow->push(new ArrayData([
                        "CellString" => $value,
                    ]));
                }
                $itemRows->push(new ArrayData([
                    "ItemRow" => $itemRow
    {
        $this->assertEquals(42, $this->getTestableRows()->count());
    }

    public function testCanViewIsRespected()
    {
        $orig = TestObject::$canView;
        TestObject::$canView = false;
        $this->assertEquals(0, $this->getTestableRows()->count());
        TestObject::$canView = $orig;
    }

    private function getTestableRows()
        return $printData->ItemRows;

    public static bool $canView = true;

    public function canView($member = null)
    {
        return static::$canView;
    }