rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: MP4Box is a component of GPAC-2.0.0, which is a widely-used third-party package on RPM Fusion. When MP4Box tries to parse a MP4 file, it calls the function `diST_box_read()` to read from video. In this function, it allocates a buffer `str` with fixed length. However, content read from `bs` is controllable by user, so is the length, which causes a buffer overflow.
Vulnerability ID: CVE-2022-1441
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/gpac/gpac
Published: 2022-04-25
File: src/isomedia/box_code_3gpp.c
Commit message: fixed #2175
Commit author: jeanlf

Vulnerable version (before fix):
 void diST_box_del(GF_Box *s)  GF_Err diST_box_read(GF_Box *s, GF_BitStream *bs) { 	u32 i; 	char str[1024]; 	GF_DIMSScriptTypesBox *p = (GF_DIMSScriptTypesBox *)s;  	i=0; 	str[0]=0; 	while (1) { 		str[i] = gf_bs_read_u8(bs); 		if (!str[i]) break; 		i++; 	} 	ISOM_DECREASE_SIZE(p, i);  	p->content_script_types = gf_strdup(str); 	return GF_OK; } 

Fixed version (after fix):
 void diST_box_del(GF_Box *s)  GF_Err diST_box_read(GF_Box *s, GF_BitStream *bs) { 	GF_DIMSScriptTypesBox *p = (GF_DIMSScriptTypesBox *)s;  	p->content_script_types = gf_malloc(sizeof(char) * (s->size+1)); 	if (!p->content_script_types) return GF_OUT_OF_MEM; 	gf_bs_read_data(bs, p->content_script_types, s->size); 	p->content_script_types[s->size] = 0; 	return GF_OK; } 

Patch:
patch: @@ -1128,20 +1128,12 @@ void diST_box_del(GF_Box *s)
 
 GF_Err diST_box_read(GF_Box *s, GF_BitStream *bs)
 {
-	u32 i;
-	char str[1024];
 	GF_DIMSScriptTypesBox *p = (GF_DIMSScriptTypesBox *)s;
 
-	i=0;
-	str[0]=0;
-	while (1) {
-		str[i] = gf_bs_read_u8(bs);
-		if (!str[i]) break;
-		i++;
-	}
-	ISOM_DECREASE_SIZE(p, i);
-
-	p->content_script_types = gf_strdup(str);
+	p->content_script_types = gf_malloc(sizeof(char) * (s->size+1));
+	if (!p->content_script_types) return GF_OUT_OF_MEM;
+	gf_bs_read_data(bs, p->content_script_types, s->size);
+	p->content_script_types[s->size] = 0;
 	return GF_OK;
 }
path: src/isomedia/box_code_3gpp.c
Vulnerability: heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.7.0. This vulnerability is capable of inducing denial of service.
Vulnerability ID: CVE-2022-1444
CWE: CWE-416
Severity score: 2.9
Project: https://github.com/radareorg/radare2
Published: 2022-04-23
File: libr/util/new_rbtree.c
Commit message: Redo minor cleanup in new_rbtree
Commit author: condret

Vulnerable version (before fix):
 R_API bool r_crbtree_insert(RRBTree *tree, void *data, RRBComparator cmp, void * 	r_return_val_if_fail (tree && data && cmp, false); 	bool inserted = false;  	if (tree->root == NULL) { 		tree->root = _node_new (data, NULL); 		if (tree->root == NULL) { 			return false; 		} 		inserted = true;

Fixed version (after fix):
 R_API bool r_crbtree_insert(RRBTree *tree, void *data, RRBComparator cmp, void * 	r_return_val_if_fail (tree && data && cmp, false); 	bool inserted = false;  	if (!tree->root) { 		tree->root = _node_new (data, NULL); 		if (!tree->root) { 			return false; 		} 		inserted = true;

Patch:
patch: @@ -138,9 +138,9 @@ R_API bool r_crbtree_insert(RRBTree *tree, void *data, RRBComparator cmp, void *
 	r_return_val_if_fail (tree && data && cmp, false);
 	bool inserted = false;
 
-	if (tree->root == NULL) {
+	if (!tree->root) {
 		tree->root = _node_new (data, NULL);
-		if (tree->root == NULL) {
+		if (!tree->root) {
 			return false;
 		}
 		inserted = true;
path: libr/util/new_rbtree.c
Vulnerability: Out-of-bounds Read in r_bin_java_bootstrap_methods_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end 2f the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. More details see [CWE-125: Out-of-bounds read](https://cwe.mitre.org/data/definitions/125.html).
Vulnerability ID: CVE-2022-1452
CWE: CWE-125
Severity score: 4.9
Project: https://github.com/radareorg/radare2
Published: 2022-04-24
File: shlr/java/class.c
Commit message: Fix oobread in java parser ##crash

* Reported by @bet4it via @huntrdev
* BountyID c8f4c2de-7d96-4ad4-857a-c099effca2d6
* Reproducer: bootstrap.class
Commit author: pancake

Vulnerable version (before fix):
 R_API RBinJavaAttrInfo *r_bin_java_bootstrap_methods_attr_new(RBinJavaObj *bin, 	offset += 6; 	if (attr) { 		attr->type = R_BIN_JAVA_ATTR_TYPE_BOOTSTRAP_METHODS_ATTR; 		attr->info.bootstrap_methods_attr.num_bootstrap_methods = R_BIN_JAVA_USHORT (buffer, offset); 		offset += 2; 		attr->info.bootstrap_methods_attr.bootstrap_methods = r_list_newf (r_bin_java_bootstrap_method_free);

Fixed version (after fix):
 R_API RBinJavaAttrInfo *r_bin_java_bootstrap_methods_attr_new(RBinJavaObj *bin, 	offset += 6; 	if (attr) { 		attr->type = R_BIN_JAVA_ATTR_TYPE_BOOTSTRAP_METHODS_ATTR; 		if (offset + 8 > sz)  { 			free (attr); 			return NULL; 		} 		attr->info.bootstrap_methods_attr.num_bootstrap_methods = R_BIN_JAVA_USHORT (buffer, offset); 		offset += 2; 		attr->info.bootstrap_methods_attr.bootstrap_methods = r_list_newf (r_bin_java_bootstrap_method_free);

Patch:
patch: @@ -6933,6 +6933,10 @@ R_API RBinJavaAttrInfo *r_bin_java_bootstrap_methods_attr_new(RBinJavaObj *bin,
 	offset += 6;
 	if (attr) {
 		attr->type = R_BIN_JAVA_ATTR_TYPE_BOOTSTRAP_METHODS_ATTR;
+		if (offset + 8 > sz)  {
+			free (attr);
+			return NULL;
+		}
 		attr->info.bootstrap_methods_attr.num_bootstrap_methods = R_BIN_JAVA_USHORT (buffer, offset);
 		offset += 2;
 		attr->info.bootstrap_methods_attr.bootstrap_methods = r_list_newf (r_bin_java_bootstrap_method_free);
path: shlr/java/class.c
Vulnerability: Stored XSS Leads To Session Hijacking in GitHub repository openemr/openemr prior to 6.1.0.1.
Vulnerability ID: CVE-2022-1458
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/openemr/openemr
Published: 2022-04-25
File: interface/super/manage_document_templates.php
Commit message: bug fix (#5047)
Commit author: Brady Miller

Vulnerable version (before fix):
       </form>       </div>       <script>       //dislpay file name         $(".custom-file-input").on("change", function() {         var fileName = $(this).val().split("\\").pop();         $(this).siblings(".custom-file-label").addClass("selected").html(fileName);         });         </script>    </body>

Fixed version (after fix):
       </form>       </div>       <script>       //display file name         $(".custom-file-input").on("change", function() {         var fileName = $(this).val().split("\\").pop();         $(this).siblings(".custom-file-label").addClass("selected").html(jsText(fileName));         });         </script>    </body>

Patch:
patch: @@ -221,10 +221,10 @@
       </form>
       </div>
       <script>
-      //dislpay file name
+      //display file name
         $(".custom-file-input").on("change", function() {
         var fileName = $(this).val().split("\\").pop();
-        $(this).siblings(".custom-file-label").addClass("selected").html(fileName);
+        $(this).siblings(".custom-file-label").addClass("selected").html(jsText(fileName));
         });
         </script>
    </body>
path: interface/super/manage_document_templates.php
Vulnerability: chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows attackers to cause a denial of service (crash) via a crafted input file. in GitHub repository hpjansson/chafa prior to 1.10.2. chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows attackers to cause a denial of service (crash) via a crafted input file.
Vulnerability ID: CVE-2022-1507
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/hpjansson/chafa
Published: 2022-04-27
File: libnsgif/libnsgif.c
Commit message: libnsgif: Fix null pointer deref on frameless GIF input

A crafted GIF file with no frame data could cause a null pointer
dereference leading to denial of service (crash). Reported by
@JieyongMa via huntr.dev.
Commit author: Hans Petter Jansson

Vulnerable version (before fix):
 gif_internal_decode_frame(gif_animation *gif,         unsigned int x, y, decode_y, burst_bytes;         register unsigned char colour;          /* Ensure this frame is supposed to be decoded */         if (gif->frames[frame].display == false) {                 return GIF_OK;

Fixed version (after fix):
 gif_internal_decode_frame(gif_animation *gif,         unsigned int x, y, decode_y, burst_bytes;         register unsigned char colour;          /* If the GIF has no frame data, frame holders will not be allocated in          * gif_initialise() */         if (gif->frames == NULL) {                 return GIF_INSUFFICIENT_DATA;         }          /* Ensure this frame is supposed to be decoded */         if (gif->frames[frame].display == false) {                 return GIF_OK;

Patch:
patch: @@ -595,6 +595,12 @@ gif_internal_decode_frame(gif_animation *gif,
         unsigned int x, y, decode_y, burst_bytes;
         register unsigned char colour;
 
+        /* If the GIF has no frame data, frame holders will not be allocated in
+         * gif_initialise() */
+        if (gif->frames == NULL) {
+                return GIF_INSUFFICIENT_DATA;
+        }
+
         /* Ensure this frame is supposed to be decoded */
         if (gif->frames[frame].display == false) {
                 return GIF_OK;
path: libnsgif/libnsgif.c
Vulnerability: Null pointer dereference in libr/bin/format/mach0/mach0.c in radareorg/radare2 in GitHub repository radareorg/radare2 prior to 5.7.0. It is likely to be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/476.html).
Vulnerability ID: CVE-2022-1649
CWE: CWE-787
Severity score: 2.9
Project: https://github.com/radareorg/radare2
Published: 2022-05-10
File: libr/bin/format/mach0/mach0.c
Commit message: Fix null deref in macho parser ##crash

* Reported by Han0nly via huntrdev
* BountyID: c07e4918-cf86-4d2e-8969-5fb63575b449
* Reproducer: machonull
Commit author: pancake

Vulnerable version (before fix):
 void MACH0_(iterate_chained_fixups)(struct MACH0_(obj_t) *bin, ut64 limit_start, 				if (page_idx >= bin->chained_starts[i]->page_count) { 					break; 				} 				ut16 page_start = bin->chained_starts[i]->page_start[page_idx]; 				if (page_start == DYLD_CHAINED_PTR_START_NONE) { 					continue;

Fixed version (after fix):
 void MACH0_(iterate_chained_fixups)(struct MACH0_(obj_t) *bin, ut64 limit_start, 				if (page_idx >= bin->chained_starts[i]->page_count) { 					break; 				} 				if (!bin->chained_starts[i]->page_start) { 					break; 				} 				ut16 page_start = bin->chained_starts[i]->page_start[page_idx]; 				if (page_start == DYLD_CHAINED_PTR_START_NONE) { 					continue;

Patch:
patch: @@ -4580,6 +4580,9 @@ void MACH0_(iterate_chained_fixups)(struct MACH0_(obj_t) *bin, ut64 limit_start,
 				if (page_idx >= bin->chained_starts[i]->page_count) {
 					break;
 				}
+				if (!bin->chained_starts[i]->page_start) {
+					break;
+				}
 				ut16 page_start = bin->chained_starts[i]->page_start[page_idx];
 				if (page_start == DYLD_CHAINED_PTR_START_NONE) {
 					continue;
path: libr/bin/format/mach0/mach0.c
Vulnerability: Authentication Bypass Using an Alternate Path or Channel in GitHub repository requarks/wiki prior to 2.5.281. User can get root user permissions
Vulnerability ID: CVE-2022-1681
CWE: CWE-287
Severity score: 10
Project: https://github.com/requarks/wiki
Published: 2022-05-12
File: server/graph/resolvers/group.js
Commit message: fix: prevent manage system assignment from manage groups permission
Commit author: NGPixel

Vulnerable version (before fix):
 module.exports = {         throw new gql.GraphQLError('You are not authorized to manage this group or assign these permissions.')       }        // Update group       await WIKI.models.groups.query().patch({         name: args.name,

Fixed version (after fix):
 module.exports = {         throw new gql.GraphQLError('You are not authorized to manage this group or assign these permissions.')       }        // Check assigned permissions for manage:groups       if (         WIKI.auth.checkExclusiveAccess(req.user, ['manage:groups'], ['manage:system']) &&         args.permissions.some(p => _.last(p.split(':')) === 'system')       ) {         throw new gql.GraphQLError('You are not authorized to manage this group or assign the manage:system permissions.')       }        // Update group       await WIKI.models.groups.query().patch({         name: args.name,

Patch:
patch: @@ -173,6 +173,14 @@ module.exports = {
         throw new gql.GraphQLError('You are not authorized to manage this group or assign these permissions.')
       }
 
+      // Check assigned permissions for manage:groups
+      if (
+        WIKI.auth.checkExclusiveAccess(req.user, ['manage:groups'], ['manage:system']) &&
+        args.permissions.some(p => _.last(p.split(':')) === 'system')
+      ) {
+        throw new gql.GraphQLError('You are not authorized to manage this group or assign the manage:system permissions.')
+      }
+
       // Update group
       await WIKI.models.groups.query().patch({
         name: args.name,
path: server/graph/resolvers/group.js
Vulnerability: Use After Free in GitHub repository gpac/gpac prior to v2.1.0-DEV.
Vulnerability ID: CVE-2022-1795
CWE: CWE-416
Severity score: 6.4
Project: https://github.com/gpac/gpac
Published: 2022-05-18
File: src/bifs/memory_decoder.c
Commit message: fixed #2194
Commit author: jeanlf

Vulnerable version (before fix):
 static GF_Err BM_ParseGlobalQuantizer(GF_BifsDecoder *codec, GF_BitStream *bs, G 	codec->scenegraph->global_qp = NULL;  	if (gf_node_get_tag(node) != TAG_MPEG4_QuantizationParameter) { 		gf_node_unregister(node, NULL); 		return GF_NON_COMPLIANT_BITSTREAM; 	}  static GF_Err BM_ParseGlobalQuantizer(GF_BifsDecoder *codec, GF_BitStream *bs, G 	codec->scenegraph->global_qp = node;  	/*register TWICE: once for the command, and for the scenegraph globalQP*/ 	node->sgprivate->num_instances = 2;  	com = gf_sg_command_new(codec->current_graph, GF_SG_GLOBAL_QUANTIZER); 	inf = gf_sg_command_field_new(com);

Fixed version (after fix):
 static GF_Err BM_ParseGlobalQuantizer(GF_BifsDecoder *codec, GF_BitStream *bs, G 	codec->scenegraph->global_qp = NULL;  	if (gf_node_get_tag(node) != TAG_MPEG4_QuantizationParameter) { 		//if node was just created (num_instances == 0), unregister 		//otherwise (USE node) don't do anything 		if (!node->sgprivate->num_instances) { 			node->sgprivate->num_instances = 1; 			gf_node_unregister(node, NULL); 		} 		return GF_NON_COMPLIANT_BITSTREAM; 	}  static GF_Err BM_ParseGlobalQuantizer(GF_BifsDecoder *codec, GF_BitStream *bs, G 	codec->scenegraph->global_qp = node;  	/*register TWICE: once for the command, and for the scenegraph globalQP*/ 	gf_node_unregister(node, NULL); 	gf_node_unregister(node, NULL);  	com = gf_sg_command_new(codec->current_graph, GF_SG_GLOBAL_QUANTIZER); 	inf = gf_sg_command_field_new(com);

Patch:
patch: @@ -178,7 +178,12 @@ static GF_Err BM_ParseGlobalQuantizer(GF_BifsDecoder *codec, GF_BitStream *bs, G
 	codec->scenegraph->global_qp = NULL;
 
 	if (gf_node_get_tag(node) != TAG_MPEG4_QuantizationParameter) {
-		gf_node_unregister(node, NULL);
+		//if node was just created (num_instances == 0), unregister
+		//otherwise (USE node) don't do anything
+		if (!node->sgprivate->num_instances) {
+			node->sgprivate->num_instances = 1;
+			gf_node_unregister(node, NULL);
+		}
 		return GF_NON_COMPLIANT_BITSTREAM;
 	}
 
@@ -188,7 +193,8 @@ static GF_Err BM_ParseGlobalQuantizer(GF_BifsDecoder *codec, GF_BitStream *bs, G
 	codec->scenegraph->global_qp = node;
 
 	/*register TWICE: once for the command, and for the scenegraph globalQP*/
-	node->sgprivate->num_instances = 2;
+	gf_node_unregister(node, NULL);
+	gf_node_unregister(node, NULL);
 
 	com = gf_sg_command_new(codec->current_graph, GF_SG_GLOBAL_QUANTIZER);
 	inf = gf_sg_command_field_new(com);
path: src/bifs/memory_decoder.c
Vulnerability: OS Command Injection in GitHub repository yogeshojha/rengine prior to 1.2.0.
Vulnerability ID: CVE-2022-1813
CWE: CWE-78
Severity score: 6.4
Project: https://github.com/yogeshojha/rengine
Published: 2022-05-22
File: web/reNgine/common_func.py
Commit message: Fix command injection issue on detect cms
Commit author: Yogesh Ojha

Vulnerable version (before fix):
 import tldextract import logging import shutil  from threading import Thread  def get_whois(ip_domain, save_db=False, fetch_from_db=True): def get_cms_details(url):     # this function will fetch cms details using cms_detector     response = {}     cms_detector_command = 'python3 /usr/src/github/CMSeeK/cmseek.py -u {} --random-agent --batch --follow-redirect'.format(url)     os.system(cms_detector_command)      response['status'] = False     response['message'] = 'Could not detect CMS!'

Fixed version (after fix):
 import tldextract import logging import shutil import subprocess  from threading import Thread  def get_whois(ip_domain, save_db=False, fetch_from_db=True): def get_cms_details(url):     # this function will fetch cms details using cms_detector     response = {}     cms_detector_command = 'python3 /usr/src/github/CMSeeK/cmseek.py --random-agent --batch --follow-redirect'     subprocess_splitted_command = cms_detector_command.split()     subprocess_splitted_command.append('-u')     subprocess_splitted_command.append(url)     process = subprocess.Popen(subprocess_splitted_command)     process.wait()      response['status'] = False     response['message'] = 'Could not detect CMS!'

Patch:
patch: @@ -6,6 +6,7 @@
 import tldextract
 import logging
 import shutil
+import subprocess
 
 from threading import Thread
 
@@ -668,8 +669,12 @@ def get_whois(ip_domain, save_db=False, fetch_from_db=True):
 def get_cms_details(url):
     # this function will fetch cms details using cms_detector
     response = {}
-    cms_detector_command = 'python3 /usr/src/github/CMSeeK/cmseek.py -u {} --random-agent --batch --follow-redirect'.format(url)
-    os.system(cms_detector_command)
+    cms_detector_command = 'python3 /usr/src/github/CMSeeK/cmseek.py --random-agent --batch --follow-redirect'
+    subprocess_splitted_command = cms_detector_command.split()
+    subprocess_splitted_command.append('-u')
+    subprocess_splitted_command.append(url)
+    process = subprocess.Popen(subprocess_splitted_command)
+    process.wait()
 
     response['status'] = False
     response['message'] = 'Could not detect CMS!'
path: web/reNgine/common_func.py
Vulnerability: SQL Injection in GitHub repository camptocamp/terraboard prior to 2.2.0.
Vulnerability ID: CVE-2022-1883
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/camptocamp/terraboard
Published: 2022-05-25
File: db/db.go
Commit message: fix(db): possible sql injection on /search endpoint
Commit author: hbollon

Vulnerable version (before fix):
 func (db *Database) SearchAttribute(query url.Values) (results []types.SearchRes 	}  	if v := query.Get("tf_version"); string(v) != "" { 		where = append(where, fmt.Sprintf("states.tf_version LIKE '%s'", fmt.Sprintf("%%%s%%", v))) 	}  	if v := query.Get("lineage_value"); string(v) != "" { 		where = append(where, fmt.Sprintf("lineages.value LIKE '%s'", fmt.Sprintf("%%%s%%", v))) 	}  	if len(where) > 0 {

Fixed version (after fix):
 func (db *Database) SearchAttribute(query url.Values) (results []types.SearchRes 	}  	if v := query.Get("tf_version"); string(v) != "" { 		where = append(where, "states.tf_version LIKE ?") 		params = append(params, fmt.Sprintf("%%%s%%", v)) 	}  	if v := query.Get("lineage_value"); string(v) != "" { 		where = append(where, "lineages.value LIKE ?") 		params = append(params, fmt.Sprintf("%%%s%%", v)) 	}  	if len(where) > 0 {

Patch:
patch: @@ -370,11 +370,13 @@ func (db *Database) SearchAttribute(query url.Values) (results []types.SearchRes
 	}
 
 	if v := query.Get("tf_version"); string(v) != "" {
-		where = append(where, fmt.Sprintf("states.tf_version LIKE '%s'", fmt.Sprintf("%%%s%%", v)))
+		where = append(where, "states.tf_version LIKE ?")
+		params = append(params, fmt.Sprintf("%%%s%%", v))
 	}
 
 	if v := query.Get("lineage_value"); string(v) != "" {
-		where = append(where, fmt.Sprintf("lineages.value LIKE '%s'", fmt.Sprintf("%%%s%%", v)))
+		where = append(where, "lineages.value LIKE ?")
+		params = append(params, fmt.Sprintf("%%%s%%", v))
 	}
 
 	if len(where) > 0 {
path: db/db.go
Vulnerability: Heap-based Buffer Overflow in GitHub repository hpjansson/chafa prior to 1.12.0.
Vulnerability ID: CVE-2022-2061
CWE: CWE-787
Severity score: 2.9
Project: https://github.com/hpjansson/chafa
Published: 2022-06-13
File: libnsgif/lzw.c
Commit message: libnsgif: fix oob in lzw_decode
Commit author: Sudhakar Verma

Vulnerable version (before fix):
 lzw_result lzw_decode(struct lzw_ctx *ctx, 		/* Code is invalid */ 		return LZW_BAD_CODE;  	} else if (code_new < current_entry) { 		/* Code is in table */ 		code_out = code_new;

Fixed version (after fix):
 lzw_result lzw_decode(struct lzw_ctx *ctx, 		/* Code is invalid */ 		return LZW_BAD_CODE;  	} else if (code_new >= 1 << LZW_CODE_MAX) { 		/* Don't access out of bound */ 		return LZW_BAD_CODE;  	} else if (code_new < current_entry) { 		/* Code is in table */ 		code_out = code_new;

Patch:
patch: @@ -329,6 +329,10 @@ lzw_result lzw_decode(struct lzw_ctx *ctx,
 		/* Code is invalid */
 		return LZW_BAD_CODE;
 
+	} else if (code_new >= 1 << LZW_CODE_MAX) {
+		/* Don't access out of bound */
+		return LZW_BAD_CODE;
+
 	} else if (code_new < current_entry) {
 		/* Code is in table */
 		code_out = code_new;
path: libnsgif/lzw.c
Vulnerability: WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.
Vulnerability ID: CVE-2022-21661
CWE: CWE-89
Severity score: 2.9
Project: https://github.com/WordPress/wordpress-develop
Published: 2022-01-06
File: src/wp-includes/class-wp-tax-query.php
Commit message: Query: Improve sanitization within `WP_Tax_Query`.

Merges [52454] to the 5.8 branch.
Props dd32, xknown, peterwilsoncc, ehtis.

git-svn-id: https://develop.svn.wordpress.org/branches/5.8@52459 602fd350-edb4-49c9-b593-d223f7449a82
Commit author: Jonathan Desrosiers

Vulnerable version (before fix):
 private function clean_query( &$query ) { 			return; 		}  		$query['terms'] = array_unique( (array) $query['terms'] );  		if ( is_taxonomy_hierarchical( $query['taxonomy'] ) && $query['include_children'] ) { 			$this->transform_query( $query, 'term_id' );

Fixed version (after fix):
 private function clean_query( &$query ) { 			return; 		}  		if ( 'slug' === $query['field'] || 'name' === $query['field'] ) { 			$query['terms'] = array_unique( (array) $query['terms'] ); 		} else { 			$query['terms'] = wp_parse_id_list( $query['terms'] ); 		}  		if ( is_taxonomy_hierarchical( $query['taxonomy'] ) && $query['include_children'] ) { 			$this->transform_query( $query, 'term_id' );

Patch:
patch: @@ -556,7 +556,11 @@ private function clean_query( &$query ) {
 			return;
 		}
 
-		$query['terms'] = array_unique( (array) $query['terms'] );
+		if ( 'slug' === $query['field'] || 'name' === $query['field'] ) {
+			$query['terms'] = array_unique( (array) $query['terms'] );
+		} else {
+			$query['terms'] = wp_parse_id_list( $query['terms'] );
+		}
 
 		if ( is_taxonomy_hierarchical( $query['taxonomy'] ) && $query['include_children'] ) {
 			$this->transform_query( $query, 'term_id' );
path: src/wp-includes/class-wp-tax-query.php