https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 20:46:54 +0000 https://cve.radiocsirt.org/vuln/cve-2024-53382 <p><strong>Affected:</strong> PrismJS Prism</p> <p>Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.</p> <p><strong>Affected:</strong> PrismJS Prism</p> <p>Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.</p> https://cve.radiocsirt.org/vuln/cve-2024-53382 https://cve.radiocsirt.org/vuln/ghsa-c7w3-x93f-qmm8 <p><strong>Affected:</strong> npm: nodemailer</p> <p>### Summary When a custom `envelope` object is passed to `sendMail()` with a `size` property containing CRLF characters (`\r\n`), the value is concatenated directly into the SMTP `MAIL FROM` command without sanitization. This allows injection of arbitrary SMTP commands, including `RCPT TO` — silently adding attacker-controlled recipients to outgoing emails.</p> <p>### Details In `lib/smtp-connection/index.js` (lines 1161-1162), the `envelope.size` value is concatenated into the SMTP `MAIL FROM` command without any CRLF sanitization:</p> <p>```javascript if (this._envelope.size &amp;&amp; this._supportedExtensions.includes(&#39;SIZE&#39;)) { args.push(&#39;SIZE=&#39; + this._envelope.size); } ```</p> <p>This contrasts with other envelope parameters in the same function that ARE properly sanitized: - **Addresses** (`from`, `to`): validated for `[\r\n&lt;&gt;]` at lines 1107-1127 - **DSN parameters** (`dsn.ret`, `dsn.envid`, `dsn.orcpt`): encoded via `encodeXText()` at lines 1167-1183</p> <p>The `size` property reaches this code path through `MimeNode.setEnvelope()` in `lib/mime-node/index.js` (lines 854-858), which copies all non-standard envelope properties verbatim:</p> <p>```javascript const standardFields = [&#39;to&#39;, &#39;cc&#39;, &#39;bcc&#39;, &#39;from&#39;]; Object.keys(envelope).forEach(key =&gt; { if (!standardFields.includes(key)) { this._envelope[key] = envelope[key]; } }); ```</p> <p>Since `_sendCommand()` writes the command string followed by `\r\n` to the raw TCP socket, a CRLF in the `size` value terminates the `MAIL FROM` command and…</p> <p><strong>Affected:</strong> npm: nodemailer</p> <p>### Summary When a custom `envelope` object is passed to `sendMail()` with a `size` property containing CRLF characters (`\r\n`), the value is concatenated directly into the SMTP `MAIL FROM` command without sanitization. This allows injection of arbitrary SMTP commands, including `RCPT TO` — silently adding attacker-controlled recipients to outgoing emails.</p> <p>### Details In `lib/smtp-connection/index.js` (lines 1161-1162), the `envelope.size` value is concatenated into the SMTP `MAIL FROM` command without any CRLF sanitization:</p> <p>```javascript if (this._envelope.size &amp;&amp; this._supportedExtensions.includes(&#39;SIZE&#39;)) { args.push(&#39;SIZE=&#39; + this._envelope.size); } ```</p> <p>This contrasts with other envelope parameters in the same function that ARE properly sanitized: - **Addresses** (`from`, `to`): validated for `[\r\n&lt;&gt;]` at lines 1107-1127 - **DSN parameters** (`dsn.ret`, `dsn.envid`, `dsn.orcpt`): encoded via `encodeXText()` at lines 1167-1183</p> <p>The `size` property reaches this code path through `MimeNode.setEnvelope()` in `lib/mime-node/index.js` (lines 854-858), which copies all non-standard envelope properties verbatim:</p> <p>```javascript const standardFields = [&#39;to&#39;, &#39;cc&#39;, &#39;bcc&#39;, &#39;from&#39;]; Object.keys(envelope).forEach(key =&gt; { if (!standardFields.includes(key)) { this._envelope[key] = envelope[key]; } }); ```</p> <p>Since `_sendCommand()` writes the command string followed by `\r\n` to the raw TCP socket, a CRLF in the `size` value terminates the `MAIL FROM` command and…</p> https://cve.radiocsirt.org/vuln/ghsa-c7w3-x93f-qmm8