Understand vulnerabilities. Protect your applications.

Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name

Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient

odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values

ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix

A path traversal vulnerability on Windows allows clients communicating with an exposed Vite server to bypass redirect allowlist checks using backslashes. This can permit unauthorized reading of files outside the Vite root directory that the server process has access to.

ApostropheCMS: Private and Admin Content Existence Disclosed via doc/slugTaken Endpoint

A vulnerability in ApostropheCMS allows any authenticated user to enumerate slugs across the system via the doc/slugTaken endpoint, exposing the existence of private, draft, and administrative content.

ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

ApostropheCMS contains a stored cross-site scripting vulnerability where editor-controlled style field values in widgets are serialized into HTML wrapper attributes without escaping, allowing arbitrary script execution.

ApostropheCMS: Import API bypasses publication roles for protected content

A vulnerability in ApostropheCMS allows the import API to bypass publication roles, enabling users with edit-only permissions to create, replace, or delete published content without required publishing authority.

ApostropheCMS: Import archives can exhaust server storage and deny service

A vulnerability in ApostropheCMS allows authenticated users to exhaust server storage during archive extraction due to missing decompression quotas and failure cleanup, potentially causing a denial of service.

ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content

In @apostrophecms/import-export, the overrideDuplicates continuation accepts client-supplied replacement choices, allowing contributors to overwrite published content without publication authority.

ApostropheCMS: General public can access @apostrophecms/user objects via a relationship

A vulnerability in ApostropheCMS allows the general public to access user objects through relationships if templates expose them, as viewRole is not enforced for unauthenticated public users.

ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test

A substring check in ApostropheCMS import-export tar extraction fails to catch relative directory traversal paths, allowing authenticated users to crash the Node process.

ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users

A client-side prototype pollution vulnerability in ApostropheCMS allows attackers to execute arbitrary JavaScript in the context of an authenticated user session if the victim visits a crafted link, potentially leading to unauthorized data access and administrative compromise.

ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)

ApostropheCMS uploadfs with the Azure backend and SAS enabled inadvertently exposes container-level SAS tokens in public attachment links. This allows unauthenticated users to read, overwrite, delete, or list blobs stored in the container.

ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF

In @apostrophecms/ai-helper, an authenticated editor can supply a crafted Host header to control the server-side image fetch origin, enabling SSRF against internal hosts and ports.

ApostropheCMS: CAPTCHA response token not URL-encoded

ApostropheCMS packages interpolate user-supplied CAPTCHA tokens without URL encoding into outbound verification requests. Attackers can inject query parameters to cause verification failures and disrupt protected login and form workflows.

ApostropheCMS: Cross-domain session token in URL confers session takeover

ApostropheCMS exposes single-use session migration tokens in URL query parameters, allowing unauthorized clients that obtain the token to take over user sessions and inherit their privileges.

Appium: Symlink based Zip Slip in @appium/support ZIP extraction

A vulnerability in the ZIP extraction functionality of @appium/support allows arbitrary file writes via crafted symlinks pointing outside the extraction directory. An attacker supplying a malicious archive could overwrite files or potentially achieve code execution with the permissions of the running process.