CWE-1023

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "backpack/crud"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.8.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "backpack/crud"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.0.38"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54181"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1023",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-20T18:38:50Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe Blade template for the `color` column type (`src/resources/views/crud/columns/color.blade.php`) has its escaped/unescaped rendering branches inverted relative to every other column template in the library. Because `$column[\u0027escaped\u0027]` defaults to `true`, values stored in color columns are rendered **unescaped by default**, enabling Stored XSS if column values are not validated before storage.\n\n## Details\n\nAll other column templates in `src/resources/views/crud/columns/` follow the convention:\n- `$column[\u0027escaped\u0027] == true` \u2192 `{{ $column[\u0027text\u0027] }}` (HTML-escaped)\n- `$column[\u0027escaped\u0027] == false` \u2192 `{!! $column[\u0027text\u0027] !!}` (raw)\n\nThe `color` template has these branches swapped. An attacker who can write an arbitrary string to a `color`-typed column can inject JavaScript that executes in the browser of any user who views the list \u2014 including administrators \u2014 with access to their session cookies and CSRF tokens.\n\n## Impact\n\nStored XSS with scope change (attacker context runs in victim\u0027s browser). Highest-risk target is an administrator viewing the list view. Exploitability requires the ability to write an unsanitized value into a `color`-typed column.\n\n## Patches\n\nFixed in **6.8.14** and **7.0.38** by correcting the branch order in `color.blade.php`. See PR #5992.\n\n## Workarounds\n\nValidate stored color values against a strict CSS color grammar (e.g. `/^#[0-9a-fA-F]{3,6}$/`) at the model layer before data reaches the view.\n\n## Credits\n\nReported by Vishal Shukla ([@shukla304](https://github.com/shukla304)) via sechub.dev.",
  "id": "GHSA-mmg4-322v-6jvc",
  "modified": "2026-08-20T18:38:50Z",
  "published": "2026-08-20T18:38:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-mmg4-322v-6jvc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Laravel-Backpack/CRUD"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Laravel Backpack CRUD: Stored XSS in the color column \u2014 the `@if($column[\u0027escaped\u0027])` branches are inverted"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "cakephp/queue"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.1.10"
            },
            {
              "fixed": "2.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54713"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1023"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-27T17:03:56Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "### Impact\n\nFor jobs with `shouldBeUnique = true` the queue plugin will generate a \u0027unique identifier\u0027 based on the job class, method and parameters. If user data is supplied, a malicious user could create collisions, resulting in legitimate jobs being dropped.\n\n### Patches\nUpgrade to 2.3.1\n\n### Workarounds\n\nYou can disable `shouldBeUnique` and handle idempotency in application code.",
  "id": "GHSA-r5pm-vrc5-3m73",
  "modified": "2026-08-27T17:03:57Z",
  "published": "2026-08-27T17:03:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cakephp/queue/security/advisories/GHSA-r5pm-vrc5-3m73"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cakephp/queue/pull/188"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cakephp/queue/commit/13890591e248acc8824becb24ba1939fa061bd34"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cakephp/queue"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cakephp/queue/releases/tag/2.3.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "cakephp/queue\u0027s Incomplete Comparison in getUniqueId vulnerable to collisions"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-55333"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1023"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-14T17:15:46Z",
    "severity": "MODERATE"
  },
  "details": "Incomplete comparison with missing factors in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.",
  "id": "GHSA-vm86-55h3-w686",
  "modified": "2025-10-14T18:30:30Z",
  "published": "2025-10-14T18:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55333"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55333"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-53839"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1023"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-12T22:16:55Z",
    "severity": "MODERATE"
  },
  "details": "OpenClaw before 2026.5.7 contains a hostname validation vulnerability in retry endpoint checks that allows matching hostname prefixes instead of exact hostnames. Attackers can exploit this by crafting a hostname prefix resembling a trusted host to send authentication material to untrusted endpoints.",
  "id": "GHSA-wcpv-6hg7-mfcc",
  "modified": "2026-06-13T00:34:33Z",
  "published": "2026-06-13T00:34:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-77q5-rr5v-x43q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53839"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/openclaw-hostname-prefix-matching-bypass-in-trusted-retry-endpoint-validation"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/html-sanitizer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.1.0"
            },
            {
              "fixed": "6.4.41"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/html-sanitizer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.4.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/html-sanitizer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/symfony"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.1.0"
            },
            {
              "fixed": "6.4.41"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/symfony"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.4.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/symfony"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-48761"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1023",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-15T16:46:53Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Description\n\n`Symfony\\Component\\HtmlSanitizer\\Visitor\\AttributeSanitizer\\UrlAttributeSanitizer::getSupportedAttributes()` enumerates the attribute names whose values are scrubbed through `UrlSanitizer::sanitize()` (scheme and host allow-lists, `javascript:` rejection, BiDi check, etc.). The list is `[\u0027src\u0027, \u0027href\u0027, \u0027lowsrc\u0027, \u0027background\u0027, \u0027ping\u0027, \u0027action\u0027, \u0027formaction\u0027, \u0027poster\u0027, \u0027cite\u0027]`. Other URL-bearing attributes are absent: `\u003cobject data=\u2026\u003e`, `\u003capplet codebase=\u2026\u003e`, `\u003capplet archive=\u2026\u003e` and `\u003cobject archive=\u2026\u003e`, `\u003ciframe longdesc=\u2026\u003e` and `\u003cimg longdesc=\u2026\u003e`. When an integrator opts these elements/attributes in via `allowElement(\u0027object\u0027, [\u0027data\u0027])`, `allowElement(\u0027applet\u0027, [\u0027codebase\u0027])`, etc., or via `allowAttribute()`, no URL sanitization runs: `data=\"javascript:alert(1)\"` and similar payloads ship through unchanged into the output, enabling stored XSS.\n\n`\u003cmeta http-equiv=\"refresh\" content=\"0; url=\u2026\"\u003e` is the same class of bug routed differently: the URL is embedded inside a multi-field `content` attribute that the per-attribute sanitizer cannot detect from the attribute name alone. Integrators who enable `\u003cmeta\u003e` with the `content` attribute (e.g. via `allowStaticElements()`) see `content=\"0; url=javascript:alert(1)\"` pass through, producing a refresh-driven navigation to a `javascript:` URL.\n\nDefault configurations are not affected: `\u003cobject\u003e`, `\u003capplet\u003e` and `\u003ciframe\u003e` are not in `W3CReference::BODY_ELEMENTS` and `\u003cmeta\u003e` requires an explicit opt-in to `\u003chead\u003e` context. The vulnerability surface is integrators who explicitly allow any of those elements together with the listed URL-bearing attributes.\n\n### Resolution\n\n`UrlAttributeSanitizer` now also routes `data`, `codebase`, `archive` and `longdesc` through `UrlSanitizer::sanitize()`. A new `MetaRefreshAttributeSanitizer` registered as a default attribute sanitizer detects the `\u003cdelay\u003e; url=\u003curl\u003e` syntax inside `\u003cmeta content\u003e`, sanitizes the embedded URL, and drops the attribute if the URL is rejected; non-refresh meta `content` values are passed through unchanged.\n\nThe patches for this issue are available [here](https://github.com/symfony/symfony/commit/069a70f9f26e61e9de3b7f9a864a86ed24b36bd0) for branch 6.4 (and forward-ported to 7.4, 8.0 and 8.1).\n\n### Credits\n\nSymfony would like to thank Scott Arciszewski (Trail of Bits) for reporting the issue and Nicolas Grekas for providing the fix.",
  "id": "GHSA-x5qj-865h-mgvm",
  "modified": "2026-06-15T16:46:53Z",
  "published": "2026-06-15T16:46:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/symfony/symfony/security/advisories/GHSA-x5qj-865h-mgvm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/symfony/symfony/commit/069a70f9f26e61e9de3b7f9a864a86ed24b36bd0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/html-sanitizer/CVE-2026-48761.yaml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-48761.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/symfony/symfony"
    },
    {
      "type": "WEB",
      "url": "https://symfony.com/cve-2026-48761"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-24255"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1023"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-04T18:16:50Z",
    "severity": "HIGH"
  },
  "details": "NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash collision by submitting images that share an identical pixel byte sequence but have different dimensions. A successful exploit of this vulnerability might lead to data tampering.",
  "id": "GHSA-xm83-6w9c-39px",
  "modified": "2026-08-04T18:31:29Z",
  "published": "2026-08-04T18:31:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24255"
    },
    {
      "type": "WEB",
      "url": "https://github.com/NVIDIA/product-security/tree/main/2026/5842"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24255"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}