GHSA-R9W3-G83Q-M6HQ

Vulnerability from github – Published: 2022-04-01 17:26 – Updated: 2022-04-13 16:28

Summary

Prototype Pollution in deepmerge-ts

Details

deepmerge-ts is used to merge 2 or more objects respecting type information. deepmerge-ts is vulnerable to Prototype Pollution via file deepmerge.ts, function defaultMergeRecords(). A fix was released in version 4.0.2. Currently, there is no known workaround.

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "deepmerge-ts"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-24802"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321",
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-04-01T17:26:03Z",
    "nvd_published_at": "2022-04-01T00:15:00Z",
    "severity": "HIGH"
  },
  "details": "deepmerge-ts is used to merge 2 or more objects respecting type information. deepmerge-ts is vulnerable to Prototype Pollution via file deepmerge.ts, function defaultMergeRecords(). A fix was released in version 4.0.2. Currently, there is no known workaround.",
  "id": "GHSA-r9w3-g83q-m6hq",
  "modified": "2022-04-13T16:28:10Z",
  "published": "2022-04-01T17:26:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/RebeccaStevens/deepmerge-ts/security/advisories/GHSA-r9w3-g83q-m6hq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24802"
    },
    {
      "type": "WEB",
      "url": "https://github.com/RebeccaStevens/deepmerge-ts/commit/b39f1a93d9e1c3541bd2fe159fd696a16dbe1c72"
    },
    {
      "type": "WEB",
      "url": "https://github.com/RebeccaStevens/deepmerge-ts/commit/d637db7e4fb2bfb113cb4bc1c85a125936d7081b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/RebeccaStevens/deepmerge-ts"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Prototype Pollution in deepmerge-ts"
}

GHSA-RF6F-7FWH-WJGH

Vulnerability from github – Published: 2026-03-19 17:43 – Updated: 2026-10-05 15:48

Summary

Prototype Pollution via parse() in NodeJS flatted

Details

Summary

The parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key "__proto__" returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the global prototype.

Root Cause

File: esm/index.js:29 (identical in cjs/index.js)

  const resolver = (input, lazy, parsed, $) => output => {
    for (let ke = keys(output), {length} = ke, y = 0; y < length; y++) {
      const k = ke[y];
      const value = output[k];    
      if (value instanceof Primitive) {
        const tmp = input[value];      // Bug is here

No validation that value is a safe numeric index input is built as a plain Array. JavaScript's property lookup on arrays traverses the prototype chain for non-numeric keys. The key "__proto__" resolves to Array.prototype, which:

has type "object" → passes the typeof tmp === object guard at line 30
is not in the parsed Set yet → passes the !parsed.has(tmp) guard.
The reference to Array.prototype is then enqueued in lazy and later unconditionally assigned to the output object.

Replication Steps

  const Flatted = require('flatted'); 
  const parsed = Flatted.parse('[{"x":"__proto__"}]');
  parsed.x.polluted = 'pwned';
  console.log([].polluted);  // Returns true

Impact An attacker can supply a crafted flatted string to parse() that causes the returned object to hold a live reference to Array.prototype, enabling any downstream code that writes to that property to pollute the global prototype chain, potentially causing denial of service or code execution.

Recommended solution Validate that the index string represents an integer within the bounds of input before accessing it:

// Before (vulnerable) const tmp = input[value];

// After (safe) const idx = +value; // coerce boxed String → number const tmp = (Number.isInteger(idx) && idx >= 0 && idx < input.length) ? input[idx] : undefined;

Severity

8.9 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.4.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "flatted"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.4.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33228"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321",
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-19T17:43:54Z",
    "nvd_published_at": "2026-03-20T23:16:46Z",
    "severity": "HIGH"
  },
  "details": "---\n  **Summary**\n\n  The parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index\n  keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it\n  with the key \"\\_\\_proto\\_\\_\" returns Array.prototype via the inherited getter. This object is then treated as a legitimate\n   parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype\n   to the consumer. Any code that subsequently writes to that property will pollute the global prototype.\n\n  ---\n  **Root Cause**\n\n  File: esm/index.js:29 (identical in cjs/index.js)\n```\n  const resolver = (input, lazy, parsed, $) =\u003e output =\u003e {\n    for (let ke = keys(output), {length} = ke, y = 0; y \u003c length; y++) {\n      const k = ke[y];\n      const value = output[k];    \n      if (value instanceof Primitive) {\n        const tmp = input[value];      // Bug is here\n```\n\nNo validation that value is a safe numeric index input is built as a plain Array. JavaScript\u0027s property lookup on arrays traverses the prototype chain for non-numeric  keys. The key \"\\_\\_proto\\_\\_\" resolves to Array.prototype, which:\n\n  - has type \"object\" \u2192 passes the typeof tmp === object guard at line 30\n  - is not in the parsed Set yet \u2192 passes the !parsed.has(tmp) guard.\n  - The reference to Array.prototype is then enqueued in lazy and later unconditionally assigned to the output object.\n  ---\n  **Replication Steps**\n```\n  const Flatted = require(\u0027flatted\u0027); \n  const parsed = Flatted.parse(\u0027[{\"x\":\"__proto__\"}]\u0027);\n  parsed.x.polluted = \u0027pwned\u0027;\n  console.log([].polluted);  // Returns true\n``` \n ---\n  **Impact**\n An attacker can supply a crafted flatted string to parse() that causes the returned object to hold a live reference to Array.prototype, enabling any downstream code that writes to that property to pollute the global prototype chain, potentially causing denial of service or code execution.\n\n  **Recommended solution**\n Validate that the index string represents an integer within the bounds of input before accessing it:\n\n  // Before (vulnerable)\n  const tmp = input[value];\n\n  // After (safe)\n  const idx = +value;  // coerce boxed String \u2192 number\n  const tmp = (Number.isInteger(idx) \u0026\u0026 idx \u003e= 0 \u0026\u0026 idx \u003c input.length)\n    ? input[idx]\n    : undefined;",
  "id": "GHSA-rf6f-7fwh-wjgh",
  "modified": "2026-10-05T15:48:46Z",
  "published": "2026-03-19T17:43:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WebReflection/flatted/security/advisories/GHSA-rf6f-7fwh-wjgh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33228"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WebReflection/flatted/commit/885ddcc33cf9657caf38c57c7be45ae1c5272802"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:13826"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:34342"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:9742"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-33228"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449872"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WebReflection/flatted"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WebReflection/flatted/releases/tag/v3.4.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Prototype Pollution via parse() in NodeJS flatted"
}

GHSA-RGVG-3WPC-H44P

Vulnerability from github – Published: 2026-06-22 23:20 – Updated: 2026-07-21 15:04

Summary

Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override

Details

Summary

The webhook trigger endpoint in Budibase is publicly accessible and passes the full HTTP request body into automation execution parameters. A mass assignment vulnerability in externalTrigger() allows an attacker to overwrite the internal appId property by including it in the webhook POST body. When the automation is processed asynchronously (the default path for webhooks without a collect step), the worker executes the attacker-defined automation in the context of the victim's workspace, granting full read/write access to the victim's database.

Details

The webhook trigger route is registered as a public endpoint with no authentication:

// packages/server/src/api/routes/webhook.ts:12
publicRoutes.post("/api/webhooks/trigger/:instance/:id", controller.trigger)

The controller passes the raw request body as fields alongside the server-derived appId:

// packages/server/src/api/controllers/webhook.ts:142-148
await triggers.externalTrigger(target, {
  fields: {
    ...ctx.request.body,  // attacker-controlled
    body: ctx.request.body,
  },
  appId: prodAppId,       // server-controlled
})

In externalTrigger(), for webhook-triggered automations, params.fields is spread back into params:

// packages/server/src/automations/triggers.ts:237-241
params = {
  ...params,          // appId: prodAppId (server-controlled)
  ...params.fields,   // appId: VICTIM_ID (attacker-controlled, overwrites above)
  fields: {},
}

Because params.fields is spread after params, any key in the attacker's body overwrites the corresponding property in params. An attacker including "appId": "app_VICTIM_WORKSPACE_ID" in the POST body overwrites the legitimate, server-derived appId.

The contaminated params become data.event and are queued asynchronously:

// packages/server/src/automations/triggers.ts:244,271
const data: AutomationData = { automation, event: params }
// ...
return quotas.addAction(() => automationQueue.add(data, JOB_OPTS))

The async worker uses job.data.event.appId to set the workspace context:

// packages/server/src/threads/automation.ts:917,929-930
const workspaceId = job.data.event.appId  // attacker-controlled
// ...
return await context.doInAutomationContext({
  workspaceId,  // victim's workspace
  automationId,
  task: async () => { /* automation steps run here */ }
})

The synchronous path (for webhooks with a collect step) correctly overwrites appId at triggers.ts:264:

data.event = {
  ...data.event,
  appId: context.getWorkspaceId(),  // server-controlled fix
  automation,
}

This proves the developers intended appId to be server-controlled but missed applying the same fix to the async path, which is the default for all webhooks without a collect step.

PoC

Prerequisites: Attacker has builder access to their own Budibase workspace and knows a victim workspace ID (format: app_<uuid>).

Step 1: Attacker creates an automation in their own workspace with a webhook trigger and data-exfiltration steps (e.g., Query Rows → Execute Script to send data externally).

Step 2: Attacker creates a webhook for that automation and notes the webhook URL:

POST /api/webhooks/trigger/<ATTACKER_INSTANCE>/<WEBHOOK_ID>

Step 3: Attacker triggers the webhook with the victim's workspace ID injected into the body:

curl -X POST https://budibase.example.com/api/webhooks/trigger/app_ATTACKER_ID/wh_WEBHOOK_ID \
  -H 'Content-Type: application/json' \
  -d '{"appId": "app_VICTIM_WORKSPACE_ID", "normalData": "test"}'

Expected result: The automation defined in the attacker's workspace executes in the context of the victim's workspace. All database operations (Query Rows, Create Row, Delete Row, Execute Script, etc.) operate on the victim's data.

Additional overridable fields via the same mechanism: - timeout (automation.ts:443-444): override automation execution timeout - user (automation.ts:413,435): set user context for automation steps - metadata.automationChainCount (automation.ts:293): bypass chain depth limits

Impact

An attacker with builder access to their own Budibase workspace can execute arbitrary automations (of their own design) in the context of any other workspace on the same Budibase instance, provided they know the victim's workspace ID. This enables:

Full data exfiltration: Query Rows steps read all tables in the victim's workspace
Data manipulation: Create Row, Update Row, Delete Row steps modify victim data
Arbitrary code execution in victim context: Execute Script steps run JavaScript with access to victim's environment variables and database
Cross-tenant boundary violation: In multi-tenant deployments (Budibase Cloud), the tenant ID is derived from the workspace ID, so the attack crosses tenant boundaries

The attack requires no authentication (the webhook endpoint is public) and leaves minimal audit trail since the automation execution is attributed to the attacker's automation definition but runs in the victim's context.

Recommended Fix

In packages/server/src/automations/triggers.ts, apply the same appId fix that exists in the synchronous path to the async path as well. The fix should ensure appId is always server-controlled before queuing:

// packages/server/src/automations/triggers.ts:244-272
const data: AutomationData = { automation, event: params }

// ... trigger filter check ...

+ // Ensure appId is always server-controlled, not user-supplied
+ data.event.appId = context.getWorkspaceId()

if (getResponses) {
  data.event = {
    ...data.event,
    appId: context.getWorkspaceId(),
    automation,
  }
  return quotas.addAction(() =>
    executeInThread({ data } as AutomationJob, { onProgress })
  )
} else {
  return quotas.addAction(() => automationQueue.add(data, JOB_OPTS))
}

Alternatively, use an allowlist approach for the webhook field spread to prevent any internal property from being overwritten:

// packages/server/src/automations/triggers.ts:237-241
const { appId, timeout, user, metadata, ...safeFields } = params.fields
params = {
  ...params,
  ...safeFields,
  fields: {},
}

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@budibase/server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.39.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54351"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-22T23:20:20Z",
    "nvd_published_at": "2026-06-26T21:16:35Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe webhook trigger endpoint in Budibase is publicly accessible and passes the full HTTP request body into automation execution parameters. A mass assignment vulnerability in `externalTrigger()` allows an attacker to overwrite the internal `appId` property by including it in the webhook POST body. When the automation is processed asynchronously (the default path for webhooks without a collect step), the worker executes the attacker-defined automation in the context of the victim\u0027s workspace, granting full read/write access to the victim\u0027s database.\n\n## Details\n\nThe webhook trigger route is registered as a public endpoint with no authentication:\n\n```typescript\n// packages/server/src/api/routes/webhook.ts:12\npublicRoutes.post(\"/api/webhooks/trigger/:instance/:id\", controller.trigger)\n```\n\nThe controller passes the raw request body as `fields` alongside the server-derived `appId`:\n\n```typescript\n// packages/server/src/api/controllers/webhook.ts:142-148\nawait triggers.externalTrigger(target, {\n  fields: {\n    ...ctx.request.body,  // attacker-controlled\n    body: ctx.request.body,\n  },\n  appId: prodAppId,       // server-controlled\n})\n```\n\nIn `externalTrigger()`, for webhook-triggered automations, `params.fields` is spread back into `params`:\n\n```typescript\n// packages/server/src/automations/triggers.ts:237-241\nparams = {\n  ...params,          // appId: prodAppId (server-controlled)\n  ...params.fields,   // appId: VICTIM_ID (attacker-controlled, overwrites above)\n  fields: {},\n}\n```\n\nBecause `params.fields` is spread **after** `params`, any key in the attacker\u0027s body overwrites the corresponding property in `params`. An attacker including `\"appId\": \"app_VICTIM_WORKSPACE_ID\"` in the POST body overwrites the legitimate, server-derived `appId`.\n\nThe contaminated params become `data.event` and are queued asynchronously:\n\n```typescript\n// packages/server/src/automations/triggers.ts:244,271\nconst data: AutomationData = { automation, event: params }\n// ...\nreturn quotas.addAction(() =\u003e automationQueue.add(data, JOB_OPTS))\n```\n\nThe async worker uses `job.data.event.appId` to set the workspace context:\n\n```typescript\n// packages/server/src/threads/automation.ts:917,929-930\nconst workspaceId = job.data.event.appId  // attacker-controlled\n// ...\nreturn await context.doInAutomationContext({\n  workspaceId,  // victim\u0027s workspace\n  automationId,\n  task: async () =\u003e { /* automation steps run here */ }\n})\n```\n\nThe synchronous path (for webhooks with a collect step) correctly overwrites `appId` at `triggers.ts:264`:\n```typescript\ndata.event = {\n  ...data.event,\n  appId: context.getWorkspaceId(),  // server-controlled fix\n  automation,\n}\n```\n\nThis proves the developers intended `appId` to be server-controlled but missed applying the same fix to the async path, which is the default for all webhooks without a collect step.\n\n## PoC\n\n**Prerequisites:** Attacker has builder access to their own Budibase workspace and knows a victim workspace ID (format: `app_\u003cuuid\u003e`).\n\n**Step 1:** Attacker creates an automation in their own workspace with a webhook trigger and data-exfiltration steps (e.g., Query Rows \u2192 Execute Script to send data externally).\n\n**Step 2:** Attacker creates a webhook for that automation and notes the webhook URL:\n```\nPOST /api/webhooks/trigger/\u003cATTACKER_INSTANCE\u003e/\u003cWEBHOOK_ID\u003e\n```\n\n**Step 3:** Attacker triggers the webhook with the victim\u0027s workspace ID injected into the body:\n\n```bash\ncurl -X POST https://budibase.example.com/api/webhooks/trigger/app_ATTACKER_ID/wh_WEBHOOK_ID \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -d \u0027{\"appId\": \"app_VICTIM_WORKSPACE_ID\", \"normalData\": \"test\"}\u0027\n```\n\n**Expected result:** The automation defined in the attacker\u0027s workspace executes in the context of the victim\u0027s workspace. All database operations (Query Rows, Create Row, Delete Row, Execute Script, etc.) operate on the victim\u0027s data.\n\n**Additional overridable fields via the same mechanism:**\n- `timeout` (`automation.ts:443-444`): override automation execution timeout\n- `user` (`automation.ts:413,435`): set user context for automation steps\n- `metadata.automationChainCount` (`automation.ts:293`): bypass chain depth limits\n\n## Impact\n\nAn attacker with builder access to their own Budibase workspace can execute arbitrary automations (of their own design) in the context of any other workspace on the same Budibase instance, provided they know the victim\u0027s workspace ID. This enables:\n\n- **Full data exfiltration**: Query Rows steps read all tables in the victim\u0027s workspace\n- **Data manipulation**: Create Row, Update Row, Delete Row steps modify victim data\n- **Arbitrary code execution in victim context**: Execute Script steps run JavaScript with access to victim\u0027s environment variables and database\n- **Cross-tenant boundary violation**: In multi-tenant deployments (Budibase Cloud), the tenant ID is derived from the workspace ID, so the attack crosses tenant boundaries\n\nThe attack requires no authentication (the webhook endpoint is public) and leaves minimal audit trail since the automation execution is attributed to the attacker\u0027s automation definition but runs in the victim\u0027s context.\n\n## Recommended Fix\n\nIn `packages/server/src/automations/triggers.ts`, apply the same `appId` fix that exists in the synchronous path to the async path as well. The fix should ensure `appId` is always server-controlled before queuing:\n\n```typescript\n// packages/server/src/automations/triggers.ts:244-272\nconst data: AutomationData = { automation, event: params }\n\n// ... trigger filter check ...\n\n+ // Ensure appId is always server-controlled, not user-supplied\n+ data.event.appId = context.getWorkspaceId()\n\nif (getResponses) {\n  data.event = {\n    ...data.event,\n    appId: context.getWorkspaceId(),\n    automation,\n  }\n  return quotas.addAction(() =\u003e\n    executeInThread({ data } as AutomationJob, { onProgress })\n  )\n} else {\n  return quotas.addAction(() =\u003e automationQueue.add(data, JOB_OPTS))\n}\n```\n\nAlternatively, use an allowlist approach for the webhook field spread to prevent any internal property from being overwritten:\n\n```typescript\n// packages/server/src/automations/triggers.ts:237-241\nconst { appId, timeout, user, metadata, ...safeFields } = params.fields\nparams = {\n  ...params,\n  ...safeFields,\n  fields: {},\n}\n```",
  "id": "GHSA-rgvg-3wpc-h44p",
  "modified": "2026-07-21T15:04:54Z",
  "published": "2026-06-22T23:20:20Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-rgvg-3wpc-h44p"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54351"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Budibase/budibase"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override"
}

GHSA-RJF2-J2R6-Q8GR

Vulnerability from github – Published: 2021-10-19 15:28 – Updated: 2021-10-19 14:18

Summary

Prototype Pollution in vm2

Details

This affects the package vm2 before 3.9.4. Prototype Pollution attack vector can lead to sandbox escape and execution of arbitrary code on the host machine.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "vm2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-23449"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321",
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-10-19T14:18:05Z",
    "nvd_published_at": "2021-10-18T17:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "This affects the package vm2 before 3.9.4. Prototype Pollution attack vector can lead to sandbox escape and execution of arbitrary code on the host machine.",
  "id": "GHSA-rjf2-j2r6-q8gr",
  "modified": "2021-10-19T14:18:05Z",
  "published": "2021-10-19T15:28:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23449"
    },
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/issues/363"
    },
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/commit/b4f6e2bd2c4a1ef52fc4483d8e35f28bc4481886"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/patriksimek/vm2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/releases/tag/3.9.4"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20211029-0010"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JS-VM2-1585918"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Prototype Pollution in vm2"
}

GHSA-RJMP-VJF2-QF4G

Vulnerability from github – Published: 2026-05-14 20:26 – Updated: 2026-05-15 23:55

Summary

Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation

Details

Mass Assignment in Feedback Creation Allows User ID Spoofing and Evaluation Data Manipulation

Summary

The POST /api/v1/evaluations/feedback endpoint in Open WebUI v0.9.2 is vulnerable to mass assignment via FeedbackForm, which uses model_config = ConfigDict(extra='allow'). Due to an insecure dictionary merge order in insert_new_feedback(), an authenticated attacker can inject a user_id field in the request body that overwrites the server-derived value, creating feedback records attributed to any arbitrary user. This corrupts the model evaluation leaderboard (Elo ratings) and enables identity spoofing.

Details

The vulnerability exists in two layers:

1. Model Layer — Insecure Dict Merge Order

File: backend/open_webui/models/feedbacks.py, lines 148–160

async def insert_new_feedback(
    self, user_id: str, form_data: FeedbackForm, db: Optional[AsyncSession] = None
) -> Optional[FeedbackModel]:
    async with get_async_db_context(db) as db:
        id = str(uuid.uuid4())
        feedback = FeedbackModel(
            **{
                'id': id,
                'user_id': user_id,       # ← Server-set from auth token
                'version': 0,
                **form_data.model_dump(),  # ← OVERWRITES 'id', 'user_id', 'version'
                'created_at': int(time.time()),
                'updated_at': int(time.time()),
            }
        )

In Python, when a dictionary literal contains duplicate keys, the last value wins. Since **form_data.model_dump() appears after 'user_id': user_id, any user_id field in the form data overwrites the authenticated user's ID.

2. Schema Layer — `extra='allow'` on Request Form

File: backend/open_webui/models/feedbacks.py, line 106

class FeedbackForm(BaseModel):
    type: str
    data: Optional[RatingData] = None
    meta: Optional[dict] = None
    snapshot: Optional[SnapshotData] = None
    model_config = ConfigDict(extra='allow')  # ← Accepts arbitrary extra fields

The extra='allow' config means Pydantic will accept and preserve any extra fields in the request body, including user_id, id, and version. These are then spread into the FeedbackModel constructor, overwriting server-set values.

Contrast with Secure Pattern

Other models in the same codebase use the correct ordering. For example, backend/open_webui/models/functions.py, line 120:

function = FunctionModel(**{
    **form_data.model_dump(),   # ← Spread FIRST
    'user_id': user_id,         # ← Server value AFTER → always wins
})

And ModelForm at backend/open_webui/models/models.py uses extra='ignore', which is the strictest approach.

Impact

1. User Identity Spoofing

An attacker can create feedback records attributed to any user by specifying their user_id. The admin export endpoint (GET /api/v1/evaluations/feedbacks/export) and admin list (GET /api/v1/evaluations/feedbacks/all) will show the spoofed user_id as the feedback author.

2. Model Evaluation Leaderboard Manipulation

The Elo rating system at backend/open_webui/routers/evaluations.py computes model rankings directly from feedback records. An attacker can inject fake rating feedback to: - Artificially inflate ratings for a specific model - Deflate ratings for competitor models - Make organizational model evaluation decisions unreliable

3. Record ID Control

By injecting a custom id, an attacker controls the UUID of the feedback record. While this won't overwrite existing records (primary key constraint), it enables predictable record IDs that could be useful in other attack chains.

PoC

import requests

BASE_URL = "http://localhost:8080"

# 1. Login as attacker
session = requests.Session()
login_resp = session.post(f"{BASE_URL}/api/v1/auths/signin", json={
    "email": "attacker@example.com",
    "password": "attackerpass"
})
token = login_resp.json()["token"]
headers = {"Authorization": f"Bearer {token}"}

# 2. Create feedback attributed to a different user (victim)
VICTIM_USER_ID = "12345678-aaaa-bbbb-cccc-000000000000"

resp = session.post(
    f"{BASE_URL}/api/v1/evaluations/feedback",
    headers=headers,
    json={
        "type": "rating",
        "data": {
            "model_id": "gpt-4o",
            "rating": 1,
            "sibling_model_ids": ["claude-3-opus"],
        },
        # Mass assignment: these extra fields are accepted due to extra='allow'
        # and overwrite server-set values due to dict merge order
        "user_id": VICTIM_USER_ID,  # Overwrites authenticated user ID
        "version": 999,             # Overwrites default version
    }
)

feedback = resp.json()
print(f"Feedback created with user_id: {feedback['user_id']}")
# Expected: attacker's own user_id
# Actual: VICTIM_USER_ID (12345678-aaaa-bbbb-cccc-000000000000)
assert feedback["user_id"] == VICTIM_USER_ID, "Mass assignment successful!"

Severity

CVSS 3.1: 5.4 (Medium) — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low (any authenticated user)
User Interaction: None
Impact: Integrity (feedback data falsification) + limited Availability (leaderboard reliability)

Suggested Remediation

Option 1: Fix dict merge order (minimal fix)

feedback = FeedbackModel(
    **{
        **form_data.model_dump(),   # Spread FIRST
        'id': id,                    # Server values AFTER (always win)
        'user_id': user_id,
        'version': 0,
        'created_at': int(time.time()),
        'updated_at': int(time.time()),
    }
)

Option 2: Remove `extra='allow'` from FeedbackForm (recommended)

class FeedbackForm(BaseModel):
    type: str
    data: Optional[RatingData] = None
    meta: Optional[dict] = None
    snapshot: Optional[SnapshotData] = None
    model_config = ConfigDict(extra='ignore')  # Reject unexpected fields

Option 3: Explicit field assignment (most secure)

feedback = FeedbackModel(
    id=str(uuid.uuid4()),
    user_id=user_id,
    version=0,
    type=form_data.type,
    data=form_data.data.model_dump() if form_data.data else {},
    meta=form_data.meta or {},
    snapshot=form_data.snapshot.model_dump() if form_data.snapshot else {},
    created_at=int(time.time()),
    updated_at=int(time.time()),
)

Affected Versions

v0.9.2 (current latest, confirmed vulnerable)
Likely all versions since feedback/evaluation feature was introduced

References

Prior advisory: "Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts" (patched in v0.9.0) — same root cause class, different endpoint

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45396"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-14T20:26:18Z",
    "nvd_published_at": "2026-05-15T21:16:37Z",
    "severity": "MODERATE"
  },
  "details": "# Mass Assignment in Feedback Creation Allows User ID Spoofing and Evaluation Data Manipulation\n\n## Summary\n\nThe `POST /api/v1/evaluations/feedback` endpoint in Open WebUI v0.9.2 is vulnerable to mass assignment via `FeedbackForm`, which uses `model_config = ConfigDict(extra=\u0027allow\u0027)`. Due to an insecure dictionary merge order in `insert_new_feedback()`, an authenticated attacker can inject a `user_id` field in the request body that overwrites the server-derived value, creating feedback records attributed to any arbitrary user. This corrupts the model evaluation leaderboard (Elo ratings) and enables identity spoofing.\n\n## Details\n\nThe vulnerability exists in two layers:\n\n### 1. Model Layer \u2014 Insecure Dict Merge Order\n\n**File:** `backend/open_webui/models/feedbacks.py`, lines 148\u2013160\n\n```python\nasync def insert_new_feedback(\n    self, user_id: str, form_data: FeedbackForm, db: Optional[AsyncSession] = None\n) -\u003e Optional[FeedbackModel]:\n    async with get_async_db_context(db) as db:\n        id = str(uuid.uuid4())\n        feedback = FeedbackModel(\n            **{\n                \u0027id\u0027: id,\n                \u0027user_id\u0027: user_id,       # \u2190 Server-set from auth token\n                \u0027version\u0027: 0,\n                **form_data.model_dump(),  # \u2190 OVERWRITES \u0027id\u0027, \u0027user_id\u0027, \u0027version\u0027\n                \u0027created_at\u0027: int(time.time()),\n                \u0027updated_at\u0027: int(time.time()),\n            }\n        )\n```\n\nIn Python, when a dictionary literal contains duplicate keys, the **last value wins**. Since `**form_data.model_dump()` appears after `\u0027user_id\u0027: user_id`, any `user_id` field in the form data overwrites the authenticated user\u0027s ID.\n\n### 2. Schema Layer \u2014 `extra=\u0027allow\u0027` on Request Form\n\n**File:** `backend/open_webui/models/feedbacks.py`, line 106\n\n```python\nclass FeedbackForm(BaseModel):\n    type: str\n    data: Optional[RatingData] = None\n    meta: Optional[dict] = None\n    snapshot: Optional[SnapshotData] = None\n    model_config = ConfigDict(extra=\u0027allow\u0027)  # \u2190 Accepts arbitrary extra fields\n```\n\nThe `extra=\u0027allow\u0027` config means Pydantic will accept and preserve any extra fields in the request body, including `user_id`, `id`, and `version`. These are then spread into the `FeedbackModel` constructor, overwriting server-set values.\n\n### Contrast with Secure Pattern\n\nOther models in the same codebase use the correct ordering. For example, `backend/open_webui/models/functions.py`, line 120:\n\n```python\nfunction = FunctionModel(**{\n    **form_data.model_dump(),   # \u2190 Spread FIRST\n    \u0027user_id\u0027: user_id,         # \u2190 Server value AFTER \u2192 always wins\n})\n```\n\nAnd `ModelForm` at `backend/open_webui/models/models.py` uses `extra=\u0027ignore\u0027`, which is the strictest approach.\n\n## Impact\n\n### 1. User Identity Spoofing\nAn attacker can create feedback records attributed to any user by specifying their `user_id`. The admin export endpoint (`GET /api/v1/evaluations/feedbacks/export`) and admin list (`GET /api/v1/evaluations/feedbacks/all`) will show the spoofed `user_id` as the feedback author.\n\n### 2. Model Evaluation Leaderboard Manipulation\nThe Elo rating system at `backend/open_webui/routers/evaluations.py` computes model rankings directly from feedback records. An attacker can inject fake rating feedback to:\n- Artificially inflate ratings for a specific model\n- Deflate ratings for competitor models\n- Make organizational model evaluation decisions unreliable\n\n### 3. Record ID Control\nBy injecting a custom `id`, an attacker controls the UUID of the feedback record. While this won\u0027t overwrite existing records (primary key constraint), it enables predictable record IDs that could be useful in other attack chains.\n\n## PoC\n\n```python\nimport requests\n\nBASE_URL = \"http://localhost:8080\"\n\n# 1. Login as attacker\nsession = requests.Session()\nlogin_resp = session.post(f\"{BASE_URL}/api/v1/auths/signin\", json={\n    \"email\": \"attacker@example.com\",\n    \"password\": \"attackerpass\"\n})\ntoken = login_resp.json()[\"token\"]\nheaders = {\"Authorization\": f\"Bearer {token}\"}\n\n# 2. Create feedback attributed to a different user (victim)\nVICTIM_USER_ID = \"12345678-aaaa-bbbb-cccc-000000000000\"\n\nresp = session.post(\n    f\"{BASE_URL}/api/v1/evaluations/feedback\",\n    headers=headers,\n    json={\n        \"type\": \"rating\",\n        \"data\": {\n            \"model_id\": \"gpt-4o\",\n            \"rating\": 1,\n            \"sibling_model_ids\": [\"claude-3-opus\"],\n        },\n        # Mass assignment: these extra fields are accepted due to extra=\u0027allow\u0027\n        # and overwrite server-set values due to dict merge order\n        \"user_id\": VICTIM_USER_ID,  # Overwrites authenticated user ID\n        \"version\": 999,             # Overwrites default version\n    }\n)\n\nfeedback = resp.json()\nprint(f\"Feedback created with user_id: {feedback[\u0027user_id\u0027]}\")\n# Expected: attacker\u0027s own user_id\n# Actual: VICTIM_USER_ID (12345678-aaaa-bbbb-cccc-000000000000)\nassert feedback[\"user_id\"] == VICTIM_USER_ID, \"Mass assignment successful!\"\n```\n\n## Severity\n\n**CVSS 3.1:** 5.4 (Medium) \u2014 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L`\n\n- **Attack Vector:** Network\n- **Attack Complexity:** Low\n- **Privileges Required:** Low (any authenticated user)\n- **User Interaction:** None\n- **Impact:** Integrity (feedback data falsification) + limited Availability (leaderboard reliability)\n\n## Suggested Remediation\n\n### Option 1: Fix dict merge order (minimal fix)\n```python\nfeedback = FeedbackModel(\n    **{\n        **form_data.model_dump(),   # Spread FIRST\n        \u0027id\u0027: id,                    # Server values AFTER (always win)\n        \u0027user_id\u0027: user_id,\n        \u0027version\u0027: 0,\n        \u0027created_at\u0027: int(time.time()),\n        \u0027updated_at\u0027: int(time.time()),\n    }\n)\n```\n\n### Option 2: Remove `extra=\u0027allow\u0027` from FeedbackForm (recommended)\n```python\nclass FeedbackForm(BaseModel):\n    type: str\n    data: Optional[RatingData] = None\n    meta: Optional[dict] = None\n    snapshot: Optional[SnapshotData] = None\n    model_config = ConfigDict(extra=\u0027ignore\u0027)  # Reject unexpected fields\n```\n\n### Option 3: Explicit field assignment (most secure)\n```python\nfeedback = FeedbackModel(\n    id=str(uuid.uuid4()),\n    user_id=user_id,\n    version=0,\n    type=form_data.type,\n    data=form_data.data.model_dump() if form_data.data else {},\n    meta=form_data.meta or {},\n    snapshot=form_data.snapshot.model_dump() if form_data.snapshot else {},\n    created_at=int(time.time()),\n    updated_at=int(time.time()),\n)\n```\n\n## Affected Versions\n\n- v0.9.2 (current latest, confirmed vulnerable)\n- Likely all versions since feedback/evaluation feature was introduced\n\n## References\n\n- Prior advisory: \"Mass Assignment via Pydantic extra=\u0027allow\u0027 Allows Creating Folders in Other Users\u0027 Accounts\" (patched in v0.9.0) \u2014 same root cause class, different endpoint",
  "id": "GHSA-rjmp-vjf2-qf4g",
  "modified": "2026-05-15T23:55:14Z",
  "published": "2026-05-14T20:26:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-rjmp-vjf2-qf4g"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45396"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/releases/tag/v0.9.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation"
}

GHSA-RP28-MVQ3-WF8J

Vulnerability from github – Published: 2025-03-14 15:32 – Updated: 2025-03-19 15:32

Summary

Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment

Details

A Privilege Escalation through a Mass Assignment exists in Camaleon CMS

When a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without any filtering.

Severity

9.4 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "camaleon_cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-2304"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-17T14:34:48Z",
    "nvd_published_at": "2025-03-14T13:15:41Z",
    "severity": "CRITICAL"
  },
  "details": "A Privilege Escalation through a Mass Assignment exists in Camaleon CMS\n\nWhen a user wishes to change his password, the \u0027updated_ajax\u0027 method of the UsersController is called. The vulnerability stems from the use of the dangerous permit!\u00a0method, which allows all parameters to pass through without any filtering.",
  "id": "GHSA-rp28-mvq3-wf8j",
  "modified": "2025-03-19T15:32:04Z",
  "published": "2025-03-14T15:32:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2304"
    },
    {
      "type": "WEB",
      "url": "https://github.com/owen2345/camaleon-cms/pull/1109"
    },
    {
      "type": "WEB",
      "url": "https://github.com/owen2345/camaleon-cms/commit/179fd6b1ecf258d3e214aebfa87ac4a322ea4db4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/owen2345/camaleon-cms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/owen2345/camaleon-cms/releases/tag/2.9.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/camaleon_cms/CVE-2025-2304.yml"
    },
    {
      "type": "WEB",
      "url": "https://www.tenable.com/security/research/tra-2025-09"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment"
}

GHSA-RP7V-4384-HFRP

Vulnerability from github – Published: 2026-04-24 16:37 – Updated: 2026-04-24 16:37

Summary

k8sGPT has Prompt Injection through its k8sGPT-Operator

Details

Summary

In the auto-remediation pipeline, object_to_execution.go was deserializing the AI-generated YAML directly into a Deployment object, but there was lack of validation from the original Deployment object.

Details

This issue was fixed after coordination with Alex Jones.

PoC

To minimize the impact, the PoC of this vulnerability wasn't released, but was shared with the maintainers.

Severity

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/k8sgpt-ai/k8sgpt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.4.32"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-502",
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-24T16:37:12Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nIn the auto-remediation pipeline, `object_to_execution.go` was deserializing the AI-generated YAML directly into a Deployment object, but there was lack of validation from the original Deployment object.\n\n### Details\nThis issue was fixed after coordination with Alex Jones.\n\n### PoC\nTo minimize the impact, the PoC of this vulnerability wasn\u0027t released, but was shared with the maintainers.",
  "id": "GHSA-rp7v-4384-hfrp",
  "modified": "2026-04-24T16:37:12Z",
  "published": "2026-04-24T16:37:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/k8sgpt-ai/k8sgpt/security/advisories/GHSA-rp7v-4384-hfrp"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/k8sgpt-ai/k8sgpt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "k8sGPT has Prompt Injection through its k8sGPT-Operator"
}

GHSA-RRQM-P222-8PH2

Vulnerability from github – Published: 2021-02-08 17:44 – Updated: 2022-05-26 19:58

Summary

Prototype Pollution in Dynamoose

Details

Impact

In Dynamoose versions 2.0.0-2.6.0 there was a prototype pollution vulnerability in the internal utility method lib/utils/object/set.ts. This method is used throughout the codebase for various operations throughout Dynamoose.

We have not seen any evidence of this vulnerability being exploited.

We do not believe this issue impacts v1.x.x since this method was added as part of the v2 rewrite. This vulnerability also impacts v2.x.x beta/alpha versions.

Patches

v2.7.0 includes a patch for this vulnerability.

Workarounds

We are unaware of any workarounds to patch this vulnerability other than upgrading to v2.7.0 or greater.

References

Patch commit hash: 324c62b4709204955931a187362f8999805b1d8e

For more information

If you have any questions or comments about this advisory:

Credit

GitHub CodeQL Code Scanning

Severity

7.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "dynamoose"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-21304"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321",
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-02-08T17:43:18Z",
    "nvd_published_at": "2021-02-08T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nIn Dynamoose versions 2.0.0-2.6.0 there was a prototype pollution vulnerability in the internal utility method [`lib/utils/object/set.ts`](https://github.com/dynamoose/dynamoose/blob/master/lib/utils/object/set.ts). This method is used throughout the codebase for various operations throughout Dynamoose.\n\nWe have not seen any evidence of this vulnerability being exploited.\n\nWe do not believe this issue impacts v1.x.x since this method was added as part of the v2 rewrite. This vulnerability also impacts v2.x.x beta/alpha versions.\n\n### Patches\n\nv2.7.0 includes a patch for this vulnerability.\n\n### Workarounds\n\nWe are unaware of any workarounds to patch this vulnerability other than upgrading to v2.7.0 or greater.\n\n### References\n\n- Patch commit hash: 324c62b4709204955931a187362f8999805b1d8e\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* [Contact me](https://charlie.fish/contact)\n* [Read our Security Policy](https://github.com/dynamoose/dynamoose/blob/master/SECURITY.md)\n\n### Credit\n\n- GitHub CodeQL Code Scanning",
  "id": "GHSA-rrqm-p222-8ph2",
  "modified": "2022-05-26T19:58:25Z",
  "published": "2021-02-08T17:44:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dynamoose/dynamoose/security/advisories/GHSA-rrqm-p222-8ph2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21304"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dynamoose/dynamoose/commit/324c62b4709204955931a187362f8999805b1d8e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dynamoose/dynamoose"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dynamoose/dynamoose/releases/tag/v2.7.0"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/package/dynamoose"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Prototype Pollution in Dynamoose"
}

GHSA-RV28-58VF-V4PV

Vulnerability from github – Published: 2022-05-13 01:22 – Updated: 2022-05-13 01:22

Details

An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted value in the sel_groups parameter that leads to authenticated object injection.

Severity

7.2 (High)


                  
                    CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2019-9058"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321",
      "CWE-915"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-03-26T17:29:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted value in the sel_groups parameter that leads to authenticated object injection.",
  "id": "GHSA-rv28-58vf-v4pv",
  "modified": "2022-05-13T01:22:59Z",
  "published": "2022-05-13T01:22:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9058"
    },
    {
      "type": "WEB",
      "url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
    },
    {
      "type": "WEB",
      "url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RXRV-835Q-V5MH

Vulnerability from github – Published: 2026-02-02 22:21 – Updated: 2026-10-05 15:34

Summary

locutus is vulnerable to Prototype Pollution

Details

Summary

A Prototype Pollution vulnerability exists in the the npm package locutus (>2.0.12). Despite a previous fix that attempted to mitigate Prototype Pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue was fixed in version 2.0.39.

Details

The vulnerability resides in line 77 to 79 of https://github.com/locutusjs/locutus/blob/main/src/php/strings/parse_str.js where includes() function is used to check whether user provided input contain forbidden strings.

PoC

Steps to reproduce

Install latest version of locutus using npm install or cloning from git
Run the following code snippet:

String.prototype.includes = () => false;      
console.log({}.polluted);
const locutus = require('locutus');
locutus.php.strings.parse_str('constructor[prototype][polluted]=yes');
console.log({}.polluted);  // prints yes -> indicating that the patch was bypassed and Prototype Pollution occurred

Expected behavior

Prototype Pollution should be prevented and {} should not gain new properties. This should be printed on the console:

undefined
undefined OR throw an Error

Actual behavior

Object.prototype is polluted This is printed on the console:

undefined 
yes

Impact

This is a Prototype Pollution vulnerability, which can have severe security implications depending on how locutus is used by downstream applications. Any application that processes attacker-controlled input using this locutus.php.strings.parse_str may be affected. It could potentially lead to the following problems: 1. Authentication bypass 2. Denial of service 3. Remote code execution (if polluted property is passed to sinks like eval or child_process)

Severity

9.4 (Critical)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "locutus"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.12"
            },
            {
              "fixed": "2.0.39"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25521"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321",
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-02T22:21:54Z",
    "nvd_published_at": "2026-02-04T22:15:59Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\nA Prototype Pollution vulnerability exists in the the npm package locutus (\u003e2.0.12). Despite a previous fix that attempted to mitigate Prototype Pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue was fixed in version 2.0.39.\n\n### Details\nThe vulnerability resides in line 77 to 79 of https://github.com/locutusjs/locutus/blob/main/src/php/strings/parse_str.js where includes() function is used to check whether user provided input contain forbidden strings.\n\n### PoC\n\n#### Steps to reproduce\n1. Install latest version of locutus using npm install or cloning from git\n2. Run the following code snippet:\n\n```javascript\nString.prototype.includes = () =\u003e false;      \nconsole.log({}.polluted);\nconst locutus = require(\u0027locutus\u0027);\nlocutus.php.strings.parse_str(\u0027constructor[prototype][polluted]=yes\u0027);\nconsole.log({}.polluted);  // prints yes -\u003e indicating that the patch was bypassed and Prototype Pollution occurred\n```\n\n#### Expected behavior\nPrototype Pollution should be prevented and {} should not gain new properties.\nThis should be printed on the console:\n```\nundefined\nundefined OR throw an Error\n```\n\n#### Actual behavior\nObject.prototype is polluted\nThis is printed on the console:\n```\nundefined \nyes\n```\n\n### Impact\nThis is a Prototype Pollution vulnerability, which can have severe security implications depending on how locutus is used by downstream applications. Any application that processes attacker-controlled input using this `locutus.php.strings.parse_str` may be affected. It could potentially lead to the following problems:\n1. Authentication bypass\n2. Denial of service\n3. Remote code execution (if polluted property is passed to sinks like eval or child_process)",
  "id": "GHSA-rxrv-835q-v5mh",
  "modified": "2026-10-05T15:34:16Z",
  "published": "2026-02-02T22:21:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/locutusjs/locutus/security/advisories/GHSA-rxrv-835q-v5mh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25521"
    },
    {
      "type": "WEB",
      "url": "https://github.com/locutusjs/locutus/commit/042af9ca7fde2ff599120783e720a17f335bb01c"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-25521"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436950"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/locutusjs/locutus"
    },
    {
      "type": "WEB",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25521.json"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "locutus is vulnerable to Prototype Pollution"
}

CWE-915

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Summary

Details

PoC

Impact

Recommended Fix

Mass Assignment in Feedback Creation Allows User ID Spoofing and Evaluation Data Manipulation

Summary

Details

1. Model Layer — Insecure Dict Merge Order

2. Schema Layer — extra='allow' on Request Form

Contrast with Secure Pattern

Impact

1. User Identity Spoofing

2. Model Evaluation Leaderboard Manipulation

3. Record ID Control

PoC

Severity

Suggested Remediation

Option 1: Fix dict merge order (minimal fix)

Option 2: Remove extra='allow' from FeedbackForm (recommended)

Option 3: Explicit field assignment (most secure)

Affected Versions

References

Summary

Details

PoC

Impact

Patches

Workarounds

References

For more information

Credit

Summary

Details

PoC

Steps to reproduce

Expected behavior

Actual behavior

Impact

Mitigation

Mitigation

Mitigation

Mitigation

2. Schema Layer — `extra='allow'` on Request Form

Option 2: Remove `extra='allow'` from FeedbackForm (recommended)