Zac Sims

**Name of the Vulnerable Software and Affected Versions** librsvg versions prior to 2.56.3 **Description** The issue is related to a directory traversal problem in the URL decoder of librsvg. This problem can be exploited by local or remote attackers to disclose files on the local filesystem outside of the expected area. The vulnerability can be demonstrated by using a specific `href` attribute in an `xi:include` element, such as `href=".?../../../../../../../../../../etc/passwd"`. This allows attackers to access sensitive information. **Recommendations** For versions prior to 2.56.3, update to version 2.56.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the `xi:include` element or disabling the URL decoder in librsvg until a patch is available. Avoid using the `href` attribute in the `xi:include` element with untrusted input until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 110.0.5481.77 **Description** The issue is related to insufficient policy enforcement in DevTools, allowing a remote attacker to bypass same origin policy and proxy settings via a crafted HTML page. This can be exploited by a remote attacker to bypass existing security restrictions. The severity of this issue is classified as Low by Chromium. **Recommendations** For versions prior to 110.0.5481.77, update to version 110.0.5481.77 or later to resolve the issue. As a temporary workaround, consider restricting the use of DevTools to minimize the risk of exploitation.