Common Weakness Enumeration

CWE-706

Allowed-with-Review

Use of Incorrectly-Resolved Name or Reference

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

196 vulnerabilities reference this CWE, most recent first.

GHSA-V26R-4C9C-H3J6

Vulnerability from github – Published: 2024-09-03 20:21 – Updated: 2024-09-04 17:18
VLAI
Summary
gix-path uses local config across repos when it is the highest scope
Details

Summary

gix-path executes git to find the path of a configuration file that belongs to the git installation itself, but mistakenly treats the local repository's configuration as system-wide if no higher scoped configuration is found. In rare cases, this causes a less trusted repository to be treated as more trusted, or leaks sensitive information from one repository to another, such as sending credentials to another repository's remote.

Details

In gix_path::env, the underlying implementation of the installation_config and installation_config_prefix functions calls git config -l --show-origin and parses the first line of the output to extract the path to the configuration file holding the configuration variable of highest scope:

https://github.com/Byron/gitoxide/blob/12251eb052df30105538fa831e641eea557f13d8/gix-path/src/env/git/mod.rs#L91

https://github.com/Byron/gitoxide/blob/12251eb052df30105538fa831e641eea557f13d8/gix-path/src/env/git/mod.rs#L112

While the configuration variable of highest scope is not usually in the local scope, there are practical situations where this occurs:

  • A configuration file truly associated with the installation is not present on all systems and can occasionally be empty. Likewise, there may be no variables in the global scope.
  • Configuration files associated with those higher scopes may be deliberately skipped by setting the GIT_CONFIG_SYSTEM and GIT_CONFIG_GLOBAL environment variables to /dev/null (or to NUL on Windows). This prevents gix-path from finding the path of configuration files for those scopes, while not preventing downstream components such as the function in gix-config from reporting a local path as being associated with the installation.
  • The GIT_CONFIG_NOSYSTEM environment variable can be used to disable configuration associated with the installation. (GIT_CONFIG_NOSYSTEM=1 is more powerful than GIT_CONFIG_SYSTEM=/dev/null on systems where an additional "unknown" scope is associated with the installation, as occurs on macOS with Apple Git.) This will cause the local scope to be the highest nonempty scope under even more situations, though in practice it is less dangerous because most, though possibly not all, downstream components would disregard the value.

A user may use either or both of the latter two techniques to turn off an undesired configuration or to create a more replicable environment. Such a user would expect that this results in a more controlled configuration.

Often, when located inside one repository, a user performs operations on that repository or that are not specific to any repository. In such use, local configuration is typically desired or at least acceptable, and mistaking it as coming from another scope is not typically harmful.

However, sometimes a user is in one repository and operates on another repository. A major case where this occurs is cloning one repository while located in another. This can be done in an ad-hoc fashion, including when cloning the repository outside of the one we are inside. It may also potentially be automated by an application for purposes such as submodule handling. Two kinds of problems are anticipated:

  • A less secure configuration may be set for a specific repository where it is judged acceptable, even though it would not be wanted for other repositories, such as to enable a protocol or set up debugging.
  • More likely, a configuration that supplies secrets for use in one repository's remote can be used to send those secrets to another repository's remote.

PoC

In this example, we send mock Authorization: Basic ... credentials meant for one repository's remote to another remote, by running gix while inside the first repository to clone the second repository.

These instructions are written for a Unix shell, but they will work in other shells, including in PowerShell on Windows if the method of setting environment variables is adapted and /dev/null is replaced with NUL. This procedure is likely to demonstrate the problem on all systems except macOS. This is due to the high-scoped "unknown" configuration that usually accompanies Apple Git, and reflects that gix-path is in practice much less vulnerable on macOS (though still potentially vulnerable).

  1. Install dummyhttp to serve as a local HTTP server for the demonstration.

  2. Obtain a build of gitoxide with the max feature set enabled. While this vulnerability affects other builds, this example requires max for http.extraHeader support.

Running cargo install gitoxide will install such a build though it may build against a patched version of gix-path. Cloning the repository (12251eb052df30105538fa831e641eea557f13d8 and earlier are affected) and building with cargo build or cargo install --path . are also sufficient. In contrast, installing from published binaries with binstall or quickinstall does not provide the max feature, as of this writing.

  1. Run: dummyhttp -i 127.0.0.1 -c 403 -v

  2. In a separate terminal, create a new local repository and set up a mock remote and http.extraHeader configuration:

sh git init myrepo cd myrepo git remote add origin http://127.0.0.1:8080/mygit.git git config --local http.extraHeader 'Authorization: Basic abcde'

  1. Make sure the testing setup is working by running gix fetch in the repository and checking that it fails in the expected way. In the terminal where that is run, a message should be shown indicating an HTTP 403 error. The more interesting output is in the terminal where dummyhttp is running, which should look like this:

text 2024-30-30 03:30:16 127.0.0.1:55689 GET /myrepo.git/info/refs?service=git-upload-pack HTTP/1.1 ┌─Incoming request │ GET /myrepo.git/info/refs?service=git-upload-pack HTTP/1.1 │ Accept: */* │ Authorization: Basic abcde │ Git-Protocol: version=2 │ Host: 127.0.0.1:8080 │ User-Agent: git/oxide-0.42.2 ┌─Outgoing response │ HTTP/1.1 403 Forbidden │ Content-Length: 9 │ Content-Type: text/plain; charset=utf-8 │ Date: Fri, 30 Aug 2024 03:30:16 -0400

Some details may differ, especially dates and times. But Authorization: Basic abcde should be shown.

  1. Now, in the terminal where you ran gix fetch, try cloning a separate repository:

sh gix clone http://127.0.0.1:8080/other.git

Check the output appended in the terminal where dummyhttp is running. This is to observe that Authorization: Basic abcde was rightly not sent.

Alternatively, if it does appear, then your system may be in one of the uncommon configurations that is vulnerable without further action.

  1. Now rerun that command, but with a modified environment, to cause gix-path to wrongly treat configuration from the local scope as being associated with the git installation:

sh env GIT_CONFIG_SYSTEM=/dev/null GIT_CONFIG_GLOBAL=/dev/null gix clone http://127.0.0.1:8080/other.git

Check the output appended in the terminal where dummyhttp is running. Observe that Authorization: Basic abcde was wrongly sent.

While this procedure uses the same remote host for both repositories, this is not a required element. If the second repository had a different, untrusted host, the extra header would still be sent.

Impact

It is believed to be very difficult to exploit this vulnerability deliberately, due to the need either to anticipate a situation in which higher-scoped configuration variables would be absent, or to arrange for this to happen. Although any operating system may be affected, users running Apple Git on macOS are much less likely to be affected.

In the example shown above, more secure general practices would avoid it: using a credential manager, or even using http.<url>.extraHeader with as specific a <url> as possible, rather than the more general http.extraHeader. Many scenarios are analogous: if each repository's configuration is as secure as possible for how the repository is used, and secrets are stored securely and separately, then the circumstances under which an unacceptably unsecure configuration is used, or under which a leak of credentials would occur, become unlikely.

Severity
2.5 (Low)
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
2.0 (Low)
CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "gix-path"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.10.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-45305"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-706"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-03T20:21:14Z",
    "nvd_published_at": "2024-09-02T18:15:36Z",
    "severity": "LOW"
  },
  "details": "### Summary\n\n`gix-path` executes `git` to find the path of a configuration file that belongs to the `git` installation itself, but mistakenly treats the local repository\u0027s configuration as system-wide if no higher scoped configuration is found. In rare cases, this causes a less trusted repository to be treated as more trusted, or leaks sensitive information from one repository to another, such as sending credentials to another repository\u0027s remote.\n\n### Details\n\nIn `gix_path::env`, the underlying implementation of the `installation_config` and `installation_config_prefix` functions calls `git config -l --show-origin` and parses the first line of the output to extract the path to the configuration file holding the configuration variable of highest [scope](https://git-scm.com/docs/git-config#SCOPES):\n\nhttps://github.com/Byron/gitoxide/blob/12251eb052df30105538fa831e641eea557f13d8/gix-path/src/env/git/mod.rs#L91\n\nhttps://github.com/Byron/gitoxide/blob/12251eb052df30105538fa831e641eea557f13d8/gix-path/src/env/git/mod.rs#L112\n\nWhile the configuration variable of highest scope is not usually in the local scope, there are practical situations where this occurs:\n\n- A configuration file truly associated with the installation is not present on all systems and can occasionally be empty. Likewise, there may be no variables in the global scope.\n- Configuration files associated with those higher scopes may be deliberately skipped by setting the `GIT_CONFIG_SYSTEM` and `GIT_CONFIG_GLOBAL` environment variables to `/dev/null` (or to `NUL` on Windows). This prevents `gix-path` from finding the path of configuration files for those scopes, while not preventing downstream components such as the function in `gix-config` from reporting a local path as being associated with the installation.\n- The `GIT_CONFIG_NOSYSTEM` environment variable can be used to disable configuration associated with the installation. (`GIT_CONFIG_NOSYSTEM=1` is more powerful than `GIT_CONFIG_SYSTEM=/dev/null` on systems where an additional \"unknown\" scope is associated with the installation, as occurs on macOS with Apple Git.) This will cause the local scope to be the highest nonempty scope under even more situations, though in practice it is less dangerous because most, though possibly not all, downstream components would disregard the value.\n\nA user may use either or both of the latter two techniques to turn off an undesired configuration or to create a more replicable environment. Such a user would expect that this results in a more controlled configuration.\n\nOften, when located inside one repository, a user performs operations on that repository or that are not specific to any repository. In such use, local configuration is typically desired or at least acceptable, and mistaking it as coming from another scope is not typically harmful.\n\nHowever, sometimes a user is in one repository and operates on another repository. A major case where this occurs is cloning one repository while located in another. This can be done in an ad-hoc fashion, including when cloning the repository outside of the one we are inside. It may also potentially be automated by an application for purposes such as submodule handling. Two kinds of problems are anticipated:\n\n- A less secure configuration may be set for a specific repository where it is judged acceptable, even though it would not be wanted for other repositories, such as to enable a protocol or set up debugging.\n- More likely, a configuration that supplies secrets for use in one repository\u0027s remote can be used to send those secrets to another repository\u0027s remote.\n\n### PoC\n\nIn this example, we send mock `Authorization: Basic ...` credentials meant for one repository\u0027s remote to another remote, by running `gix` while inside the first repository to clone the second repository.\n\nThese instructions are written for a Unix shell, but they will work in other shells, including in PowerShell on Windows if the method of setting environment variables is adapted and `/dev/null` is replaced with `NUL`. This procedure is likely to demonstrate the problem on all systems *except* macOS. This is due to the high-scoped \"unknown\" configuration that usually accompanies Apple Git, and reflects that gix-path is in practice much less vulnerable on macOS (though still potentially vulnerable).\n\n1. Install [`dummyhttp`](https://crates.io/crates/dummyhttp) to serve as a local HTTP server for the demonstration.\n\n2. Obtain a build of `gitoxide` with the `max` feature set enabled. While this vulnerability affects other builds, this example requires `max` for `http.extraHeader` support.\n\n   Running `cargo install gitoxide` will install such a build though it may build against a patched version of `gix-path`. Cloning the repository (12251eb052df30105538fa831e641eea557f13d8 and earlier are affected) and building with `cargo build` or `cargo install --path .` are also sufficient. In contrast, installing from published binaries with `binstall` or `quickinstall` does not provide the `max` feature, as of this writing.\n\n3. Run: `dummyhttp -i 127.0.0.1 -c 403 -v`\n\n4. In a separate terminal, create a new local repository and set up a mock remote and `http.extraHeader` configuration:\n\n   ```sh\n   git init myrepo\n   cd myrepo\n   git remote add origin http://127.0.0.1:8080/mygit.git\n   git config --local http.extraHeader \u0027Authorization: Basic abcde\u0027\n   ```\n\n5. Make sure the testing setup is working by running `gix fetch` in the repository and checking that it fails in the expected way. In the terminal where that is run, a message should be shown indicating an HTTP 403 error. The more interesting output is in the terminal where `dummyhttp` is running, which should look like this:\n\n   ```text\n   2024-30-30 03:30:16 127.0.0.1:55689 GET /myrepo.git/info/refs?service=git-upload-pack HTTP/1.1\n   \u250c\u2500Incoming request\n   \u2502 GET /myrepo.git/info/refs?service=git-upload-pack HTTP/1.1\n   \u2502 Accept: */*\n   \u2502 Authorization: Basic abcde\n   \u2502 Git-Protocol: version=2\n   \u2502 Host: 127.0.0.1:8080\n   \u2502 User-Agent: git/oxide-0.42.2\n   \u250c\u2500Outgoing response\n   \u2502 HTTP/1.1 403 Forbidden\n   \u2502 Content-Length: 9\n   \u2502 Content-Type: text/plain; charset=utf-8\n   \u2502 Date: Fri, 30 Aug 2024 03:30:16 -0400\n   ```\n\n   Some details may differ, especially dates and times. But `Authorization: Basic abcde` should be shown.\n\n6. Now, in the terminal where you ran `gix fetch`, try cloning a separate repository:\n\n   ```sh\n   gix clone http://127.0.0.1:8080/other.git\n   ```\n\n   Check the output appended in the terminal where `dummyhttp` is running. This is to observe that `Authorization: Basic abcde` was rightly *not* sent.\n\n   Alternatively, if it *does* appear, then your system may be in one of the uncommon configurations that is vulnerable without further action.\n\n7. Now rerun that command, but with a modified environment, to cause `gix-path` to wrongly treat configuration from the local scope as being associated with the `git` installation:\n\n   ```sh\n   env GIT_CONFIG_SYSTEM=/dev/null GIT_CONFIG_GLOBAL=/dev/null gix clone http://127.0.0.1:8080/other.git\n   ```\n\n   Check the output appended in the terminal where `dummyhttp` is running. Observe that `Authorization: Basic abcde` was wrongly sent.\n\nWhile this procedure uses the same remote host for both repositories, this is not a required element. If the second repository had a different, untrusted host, the extra header would still be sent.\n\n### Impact\n\nIt is believed to be very difficult to exploit this vulnerability deliberately, due to the need either to anticipate a situation in which higher-scoped configuration variables would be absent, or to arrange for this to happen. Although any operating system may be affected, users running Apple Git on macOS are much less likely to be affected.\n\nIn the example shown above, more secure general practices would avoid it: using a credential manager, or even using `http.\u003curl\u003e.extraHeader` with as specific a `\u003curl\u003e` as possible, rather than the more general `http.extraHeader`. Many scenarios are analogous: if each repository\u0027s configuration is as secure as possible for how the repository is used, and secrets are stored securely and separately, then the circumstances under which an unacceptably unsecure configuration is used, or under which a leak of credentials would occur, become unlikely.",
  "id": "GHSA-v26r-4c9c-h3j6",
  "modified": "2024-09-04T17:18:40Z",
  "published": "2024-09-03T20:21:14Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Byron/gitoxide/security/advisories/GHSA-v26r-4c9c-h3j6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45305"
    },
    {
      "type": "WEB",
      "url": "https://git-scm.com/docs/git-config#SCOPES"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Byron/gitoxide"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Byron/gitoxide/blob/12251eb052df30105538fa831e641eea557f13d8/gix-path/src/env/git/mod.rs#L112"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Byron/gitoxide/blob/12251eb052df30105538fa831e641eea557f13d8/gix-path/src/env/git/mod.rs#L91"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2024-0367.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "gix-path uses local config across repos when it is the highest scope"
}

GHSA-V784-FJJH-F8R4

Vulnerability from github – Published: 2024-08-05 19:49 – Updated: 2024-11-18 16:27
VLAI
Summary
Nuxt vulnerable to remote code execution via the browser when running the test locally
Details

Summary

Due to the insufficient validation of the path parameter in the NuxtTestComponentWrapper, an attacker can execute arbitrary JavaScript on the server side, which allows them to execute arbitrary commands.

Details

While running the test, a special component named NuxtTestComponentWrapper is available. https://github.com/nuxt/nuxt/blob/4779f5906fa4d3c784c2e2d6fe5a5c5f181faaec/packages/nuxt/src/app/components/nuxt-root.vue#L42-L43

This component loads the specified path as a component and renders it.

https://github.com/nuxt/nuxt/blob/4779f5906fa4d3c784c2e2d6fe5a5c5f181faaec/packages/nuxt/src/app/components/test-component-wrapper.ts#L9-L27

There is a validation for the path parameter to check whether the path traversal is performed, but this check is not sufficient.

https://github.com/nuxt/nuxt/blob/4779f5906fa4d3c784c2e2d6fe5a5c5f181faaec/packages/nuxt/src/app/components/test-component-wrapper.ts#L15-L19

Since import(...) uses query.path instead of the normalized path, a non-normalized URL can reach the import(...) function. For example, passing something like ./components/test normalizes path to /root/directory/components/test, but import(...) still receives ./components/test.

By using this behavior, it's possible to load arbitrary JavaScript by using the path like the following:

data:text/javascript;base64,Y29uc29sZS5sb2coMSk

Since resolve(...) resolves the filesystem path, not the URI, the above URI is treated as a relative path, but import(...) sees it as an absolute URI, and loads it as a JavaScript.

PoC

  1. Create a nuxt project and run it in the test mode:
npx nuxi@latest init test
cd test
TEST=true npm run dev
  1. Open the following URL:
http://localhost:3000/__nuxt_component_test__/?path=data%3Atext%2Fjavascript%3Bbase64%2CKGF3YWl0IGltcG9ydCgnZnMnKSkud3JpdGVGaWxlU3luYygnL3RtcC90ZXN0JywgKGF3YWl0IGltcG9ydCgnY2hpbGRfcHJvY2VzcycpKS5zcGF3blN5bmMoIndob2FtaSIpLnN0ZG91dCwgJ3V0Zi04Jyk
  1. Confirm that the output of whoami is written to /tmp/test

Demonstration video: https://www.youtube.com/watch?v=FI6mN8WbcE4

Impact

Users who open a malicious web page in the browser while running the test locally are affected by this vulnerability, which results in the remote code execution from the malicious web page. Since web pages can send requests to arbitrary addresses, a malicious web page can repeatedly try to exploit this vulnerability, which then triggers the exploit when the test server starts.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
9.2 (Critical)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "nuxt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.4.0"
            },
            {
              "fixed": "3.12.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-34344"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-706",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-08-05T19:49:45Z",
    "nvd_published_at": "2024-08-05T21:15:38Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\nDue to the insufficient validation of the `path` parameter in the NuxtTestComponentWrapper, an attacker can execute arbitrary JavaScript on the server side, which allows them to execute arbitrary commands.\n\n### Details\nWhile running the test, a special component named `NuxtTestComponentWrapper` is available.\nhttps://github.com/nuxt/nuxt/blob/4779f5906fa4d3c784c2e2d6fe5a5c5f181faaec/packages/nuxt/src/app/components/nuxt-root.vue#L42-L43\n\nThis component loads the specified path as a component and renders it.\n\nhttps://github.com/nuxt/nuxt/blob/4779f5906fa4d3c784c2e2d6fe5a5c5f181faaec/packages/nuxt/src/app/components/test-component-wrapper.ts#L9-L27\n\nThere is a validation for the `path` parameter to check whether the path traversal is performed, but this check is not sufficient.\n\nhttps://github.com/nuxt/nuxt/blob/4779f5906fa4d3c784c2e2d6fe5a5c5f181faaec/packages/nuxt/src/app/components/test-component-wrapper.ts#L15-L19\n\nSince `import(...)` uses `query.path` instead of the normalized `path`, a non-normalized URL can reach the `import(...)` function.\nFor example, passing something like `./components/test` normalizes `path` to `/root/directory/components/test`, but `import(...)` still receives `./components/test`.\n\nBy using this behavior, it\u0027s possible to load arbitrary JavaScript by using the path like the following:\n```\ndata:text/javascript;base64,Y29uc29sZS5sb2coMSk\n```\n\nSince `resolve(...)` resolves the filesystem path, not the URI, the above URI is treated as a relative path, but `import(...)` sees it as an absolute URI, and loads it as a JavaScript.\n\n### PoC\n1. Create a nuxt project and run it in the test mode:\n```\nnpx nuxi@latest init test\ncd test\nTEST=true npm run dev\n```\n2. Open the following URL:\n```\nhttp://localhost:3000/__nuxt_component_test__/?path=data%3Atext%2Fjavascript%3Bbase64%2CKGF3YWl0IGltcG9ydCgnZnMnKSkud3JpdGVGaWxlU3luYygnL3RtcC90ZXN0JywgKGF3YWl0IGltcG9ydCgnY2hpbGRfcHJvY2VzcycpKS5zcGF3blN5bmMoIndob2FtaSIpLnN0ZG91dCwgJ3V0Zi04Jyk\n```\n3. Confirm that the output of `whoami` is written to `/tmp/test`\n\nDemonstration video: https://www.youtube.com/watch?v=FI6mN8WbcE4\n\n### Impact\nUsers who open a malicious web page in the browser while running the test locally are affected by this vulnerability, which results in the remote code execution from the malicious web page.\nSince web pages can send requests to arbitrary addresses, a malicious web page can repeatedly try to exploit this vulnerability, which then triggers the exploit when the test server starts.",
  "id": "GHSA-v784-fjjh-f8r4",
  "modified": "2024-11-18T16:27:00Z",
  "published": "2024-08-05T19:49:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-v784-fjjh-f8r4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34344"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nuxt/nuxt"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nuxt/nuxt/blob/4779f5906fa4d3c784c2e2d6fe5a5c5f181faaec/packages/nuxt/src/app/components/test-component-wrapper.ts#L15-L19"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nuxt/nuxt/blob/4779f5906fa4d3c784c2e2d6fe5a5c5f181faaec/packages/nuxt/src/app/components/test-component-wrapper.ts#L9-L27"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Nuxt vulnerable to remote code execution via the browser when running the test locally"
}

GHSA-VCF9-G536-773C

Vulnerability from github – Published: 2025-01-17 00:30 – Updated: 2025-02-04 15:31
VLAI
Details

Zenitel AlphaWeb XE v11.2.3.10 was discovered to contain a local file inclusion vulnerability via the component amc_uploads.php.

Severity
4.9 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-57785"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-706"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-16T23:15:08Z",
    "severity": "MODERATE"
  },
  "details": "Zenitel AlphaWeb XE v11.2.3.10 was discovered to contain a local file inclusion vulnerability via the component amc_uploads.php.",
  "id": "GHSA-vcf9-g536-773c",
  "modified": "2025-02-04T15:31:35Z",
  "published": "2025-01-17T00:30:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57785"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/s4fv4n/56c326450dcb3ab808b5ce8242a11e30"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VH9M-J2CP-288G

Vulnerability from github – Published: 2026-08-25 21:31 – Updated: 2026-08-27 21:31
VLAI
Details

Incorrect reference resolution in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-79264"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-706"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-25T21:18:21Z",
    "severity": "MODERATE"
  },
  "details": "Incorrect reference resolution in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)",
  "id": "GHSA-vh9m-j2cp-288g",
  "modified": "2026-08-27T21:31:24Z",
  "published": "2026-08-25T21:31:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79264"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/507483993"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VPVM-3WQ2-2WVM

Vulnerability from github – Published: 2023-03-03 21:30 – Updated: 2024-12-06 15:31
VLAI
Summary
Opencontainers runc Incorrect Authorization vulnerability
Details

runc 1.0.0-rc95 through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.

Severity
7.0 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/opencontainers/runc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0-rc95"
            },
            {
              "fixed": "1.1.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-27561"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-706"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-03-03T22:43:16Z",
    "nvd_published_at": "2023-03-03T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "runc 1.0.0-rc95 through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to `libcontainer/rootfs_linux.go`. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.",
  "id": "GHSA-vpvm-3wq2-2wvm",
  "modified": "2024-12-06T15:31:17Z",
  "published": "2023-03-03T21:30:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27561"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opencontainers/runc/issues/2197#issuecomment-1437617334"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opencontainers/runc/issues/3751"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opencontainers/runc/pull/3785"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20241206-0004"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I6BF24VCZRFTYBTT3T7HDZUOTKOTNPLZ"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYVE3GB4OG3BNT5DLQHYO4M5SXX33AQ5"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNB2UEDIIJCRQW4WJLZOPQJZXCVSXMLD"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DHGVGGMKGZSJ7YO67TGGPFEHBYMS63VF"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ANUGDBJ7NBUMSUFZUSKU3ZMQYZ2Z3STN"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6BF24VCZRFTYBTT3T7HDZUOTKOTNPLZ"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FYVE3GB4OG3BNT5DLQHYO4M5SXX33AQ5"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNB2UEDIIJCRQW4WJLZOPQJZXCVSXMLD"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DHGVGGMKGZSJ7YO67TGGPFEHBYMS63VF"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ANUGDBJ7NBUMSUFZUSKU3ZMQYZ2Z3STN"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/03/msg00023.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opencontainers/runc/releases/tag/v1.1.5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/opencontainers/runc"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/LiveOverflow/c937820b688922eb127fb760ce06dab9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Opencontainers runc Incorrect Authorization vulnerability"
}

GHSA-VR35-42RR-C533

Vulnerability from github – Published: 2026-10-06 21:31 – Updated: 2026-10-06 21:31
VLAI
Details

Incorrect reference resolution in Offline in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-106230"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-706"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-06T19:17:49Z",
    "severity": "MODERATE"
  },
  "details": "Incorrect reference resolution in Offline in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)",
  "id": "GHSA-vr35-42rr-c533",
  "modified": "2026-10-06T21:31:43Z",
  "published": "2026-10-06T21:31:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106230"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/520507737"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VW88-V4W8-CWV4

Vulnerability from github – Published: 2025-05-16 18:31 – Updated: 2026-04-01 18:35
VLAI
Details

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Estatik Mortgage Calculator Estatik allows PHP Local File Inclusion. This issue affects Mortgage Calculator Estatik: from n/a through 2.0.12.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-48136"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-706",
      "CWE-98"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-16T16:15:45Z",
    "severity": "HIGH"
  },
  "details": "Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027) vulnerability in Estatik Mortgage Calculator Estatik allows PHP Local File Inclusion. This issue affects Mortgage Calculator Estatik: from n/a through 2.0.12.",
  "id": "GHSA-vw88-v4w8-cwv4",
  "modified": "2026-04-01T18:35:07Z",
  "published": "2025-05-16T18:31:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48136"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/estatik-mortgage-calculator/vulnerability/wordpress-mortgage-calculator-estatik-2-0-12-local-file-inclusion-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-W32V-C4GG-XC8P

Vulnerability from github – Published: 2022-05-24 17:16 – Updated: 2022-05-24 17:16
VLAI
Details

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-12278"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-706"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-04-27T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.",
  "id": "GHSA-w32v-c4gg-xc8p",
  "modified": "2022-05-24T17:16:36Z",
  "published": "2022-05-24T17:16:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/git/git/security/advisories/GHSA-5wph-8frv-58vj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12278"
    },
    {
      "type": "WEB",
      "url": "https://github.com/libgit2/libgit2/commit/3f7851eadca36a99627ad78cbe56a40d3776ed01"
    },
    {
      "type": "WEB",
      "url": "https://github.com/libgit2/libgit2/commit/e1832eb20a7089f6383cfce474f213157f5300cb"
    },
    {
      "type": "WEB",
      "url": "https://github.com/libgit2/libgit2/releases/tag/v0.28.4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/libgit2/libgit2/releases/tag/v0.99.0"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2022/03/msg00031.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00034.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-W727-595X-PC3R

Vulnerability from github – Published: 2026-05-14 20:17 – Updated: 2026-06-09 10:19
VLAI
Summary
pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad
Details

Summary

The fix for CVE-2026-33509 prevents setting storage_folder inside PKGDIR or userdir, but does NOT protect the Flask session directory (/tmp/pyLoad/flask). An authenticated attacker can set storage_folder to the session directory and download session files of other users via /files/get/, leading to account takeover.

Details

The fix in src/pyload/core/api/__init__.py:

directories = [PKGDIR, userdir]
if any(directories[0].startswith(d) for d in directories[1:]):
    return  # blocked

But the Flask session directory is:

session_storage_path = os.path.join(api.get_cachedir(), "flask")
# = /tmp/pyLoad/flask  ← NOT blocked by fix

Attack Chain

  1. Attacker (admin) sets storage_folder = /tmp/pyLoad/flask
  2. Fix does NOT block this — /tmp/pyLoad/flask not inside PKGDIR or userdir
  3. Attacker requests GET /files/get/<victim_session_filename>
  4. send_from_directory('/tmp/pyLoad/flask', session_file) serves victim's session
  5. Attacker uses stolen session → Account Takeover

PoC

POC

import os

PKGDIR = "/usr/lib/python3/dist-packages/pyload"
userdir = os.path.expanduser("~/.pyload")
session_dir = "/tmp/pyLoad/flask"

correct_case = lambda x: x
directories = [
    correct_case(os.path.join(os.path.realpath(d), ""))
    for d in [session_dir, PKGDIR, userdir]
]
blocked = any(directories[0].startswith(d) for d in directories[1:])

print(f"Fix blocks session_dir: {blocked}")
# Output: Fix blocks session_dir: False  ← BYPASS CONFIRMED

Impact

Authenticated admin can steal sessions of other users → Account Takeover.

Suggested Fix

blocked_dirs = [PKGDIR, userdir, api.get_cachedir()]
directories = [
    os.path.join(os.path.realpath(d), "")
    for d in [value] + blocked_dirs
]
if any(directories[0].startswith(d) for d in directories[1:]):
    return
Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pyload-ng"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.5.0b3.dev99"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45306"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-706"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-14T20:17:27Z",
    "nvd_published_at": "2026-05-28T18:16:34Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\nThe fix for CVE-2026-33509 prevents setting `storage_folder` inside `PKGDIR` or `userdir`, but does NOT protect the Flask session directory (`/tmp/pyLoad/flask`). An authenticated attacker can set `storage_folder` to the session directory and download session files of other users via `/files/get/`, leading to account takeover.\n\n## Details\n\nThe fix in `src/pyload/core/api/__init__.py`:\n\n```python\ndirectories = [PKGDIR, userdir]\nif any(directories[0].startswith(d) for d in directories[1:]):\n    return  # blocked\n```\n\nBut the Flask session directory is:\n```python\nsession_storage_path = os.path.join(api.get_cachedir(), \"flask\")\n# = /tmp/pyLoad/flask  \u2190 NOT blocked by fix\n```\n\n## Attack Chain\n\n1. Attacker (admin) sets `storage_folder = /tmp/pyLoad/flask`\n2. Fix does NOT block this \u2014 `/tmp/pyLoad/flask` not inside `PKGDIR` or `userdir`\n3. Attacker requests `GET /files/get/\u003cvictim_session_filename\u003e`\n4. `send_from_directory(\u0027/tmp/pyLoad/flask\u0027, session_file)` serves victim\u0027s session\n5. Attacker uses stolen session \u2192 **Account Takeover**\n\n## PoC\n\n\u003cimg width=\"592\" height=\"408\" alt=\"POC\" src=\"https://github.com/user-attachments/assets/936b9f56-325b-437d-9edd-e0d5bb995187\" /\u003e\n\n```python\nimport os\n\nPKGDIR = \"/usr/lib/python3/dist-packages/pyload\"\nuserdir = os.path.expanduser(\"~/.pyload\")\nsession_dir = \"/tmp/pyLoad/flask\"\n\ncorrect_case = lambda x: x\ndirectories = [\n    correct_case(os.path.join(os.path.realpath(d), \"\"))\n    for d in [session_dir, PKGDIR, userdir]\n]\nblocked = any(directories[0].startswith(d) for d in directories[1:])\n\nprint(f\"Fix blocks session_dir: {blocked}\")\n# Output: Fix blocks session_dir: False  \u2190 BYPASS CONFIRMED\n```\n\n## Impact\nAuthenticated admin can steal sessions of other users \u2192 Account Takeover.\n\n## Suggested Fix\n```python\nblocked_dirs = [PKGDIR, userdir, api.get_cachedir()]\ndirectories = [\n    os.path.join(os.path.realpath(d), \"\")\n    for d in [value] + blocked_dirs\n]\nif any(directories[0].startswith(d) for d in directories[1:]):\n    return\n```",
  "id": "GHSA-w727-595x-pc3r",
  "modified": "2026-06-09T10:19:36Z",
  "published": "2026-05-14T20:17:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pyload/pyload/security/advisories/GHSA-w727-595x-pc3r"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45306"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-r7mc-x6x7-cqxx"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pyload/pyload"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad"
}

GHSA-W87R-VG9Q-CRQM

Vulnerability from github – Published: 2025-11-20 18:31 – Updated: 2025-11-21 18:01
VLAI
Summary
zx Uses Incorrectly-Resolved Name or Reference
Details

When zx is invoked with --prefer-local=, the CLI creates a symlink named ./node_modules pointing to /node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (symlink path). The later cleanup routine removes what it received, which deletes the target directory itself. Result: zx can delete an external /node_modules outside the current working directory.

Severity
5.6 (Medium)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:U
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "zx"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.8.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-13437"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-706"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-11-21T18:01:32Z",
    "nvd_published_at": "2025-11-20T17:15:49Z",
    "severity": "MODERATE"
  },
  "details": "When zx is invoked with --prefer-local=\u003cpath\u003e, the CLI creates a symlink named ./node_modules pointing to \u003cpath\u003e/node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (symlink path). The later cleanup routine removes what it received, which deletes the target directory itself. Result: zx can delete an external \u003cpath\u003e/node_modules outside the current working directory.",
  "id": "GHSA-w87r-vg9q-crqm",
  "modified": "2025-11-21T18:01:32Z",
  "published": "2025-11-20T18:31:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13437"
    },
    {
      "type": "WEB",
      "url": "https://github.com/google/zx/issues/1348"
    },
    {
      "type": "WEB",
      "url": "https://github.com/google/zx/pull/1349"
    },
    {
      "type": "WEB",
      "url": "https://github.com/google/zx/pull/1355"
    },
    {
      "type": "WEB",
      "url": "https://github.com/google/zx/commit/9ef6d3c9962c4ba01e3fb8075855570c192b4681"
    },
    {
      "type": "WEB",
      "url": "https://github.com/google/zx/commit/a4d1bc2467f305f1c91d62506e215f307dc1fbeb"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/google/zx"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "zx Uses Incorrectly-Resolved Name or Reference"
}

No mitigation information available for this CWE.

CAPEC-159: Redirect Access to Libraries

An adversary exploits a weakness in the way an application searches for external libraries to manipulate the execution flow to point to an adversary supplied library or code base. This pattern of attack allows the adversary to compromise the application or server via the execution of unauthorized code. An application typically makes calls to functions that are a part of libraries external to the application. These libraries may be part of the operating system or they may be third party libraries. If an adversary can redirect an application's attempts to access these libraries to other libraries that the adversary supplies, the adversary will be able to force the targeted application to execute arbitrary code. This is especially dangerous if the targeted application has enhanced privileges. Access can be redirected through a number of techniques, including the use of symbolic links, search path modification, and relative path manipulation.

CAPEC-177: Create files with the same name as files protected with a higher classification

An attacker exploits file location algorithms in an operating system or application by creating a file with the same name as a protected or privileged file. The attacker could manipulate the system if the attacker-created file is trusted by the operating system or an application component that attempts to load the original file. Applications often load or include external files, such as libraries or configuration files. These files should be protected against malicious manipulation. However, if the application only uses the name of the file when locating it, an attacker may be able to create a file with the same name and place it in a directory that the application will search before the directory with the legitimate file is searched. Because the attackers' file is discovered first, it would be used by the target application. This attack can be extremely destructive if the referenced file is executable and/or is granted special privileges based solely on having a particular name.

CAPEC-48: Passing Local Filenames to Functions That Expect a URL

This attack relies on client side code to access local files and resources instead of URLs. When the client browser is expecting a URL string, but instead receives a request for a local file, that execution is likely to occur in the browser process space with the browser's authority to local files. The attacker can send the results of this request to the local files out to a site that they control. This attack may be used to steal sensitive authentication data (either local or remote), or to gain system profile information to launch further attacks.

CAPEC-641: DLL Side-Loading

An adversary places a malicious version of a Dynamic-Link Library (DLL) in the Windows Side-by-Side (WinSxS) directory to trick the operating system into loading this malicious DLL instead of a legitimate DLL. Programs specify the location of the DLLs to load via the use of WinSxS manifests or DLL redirection and if they aren't used then Windows searches in a predefined set of directories to locate the file. If the applications improperly specify a required DLL or WinSxS manifests aren't explicit about the characteristics of the DLL to be loaded, they can be vulnerable to side-loading.

← Back to the CWE list