Aikido-Security

**Name of the Vulnerable Software and Affected Versions** Open WebUI versions prior to 0.9.6 **Description** The chat message listener in the chat page's window message listener processes `input:prompt` and `action:submit` messages without enforcing same-origin restrictions. This allows an external site to set prompt text and trigger the `submitPrompt()` function in an authenticated victim session. An attacker can use a cross-origin page to auto-post messages, resulting in unauthorized requests to the 'POST /api/v1/chats/new' and 'POST /api/chat/completions' endpoints. This enables cross-site forced actions and the execution of models or tools under the victim's privileges without their consent. **Recommendations** Update to version 0.9.6.

Name of the Vulnerable Software and Affected Versions hoppscotch versions prior to 2026.3.0 Description hoppscotch, an open source API development ecosystem, contains an open redirect flaw. This flaw can result in the theft of tokens, potentially allowing an attacker to compromise user accounts by signing in as the victim. Recommendations Update hoppscotch to version 2026.3.0 or later.

Name of the Vulnerable Software and Affected Versions hoppscotch versions prior to 2026.3.0 Description hoppscotch, an open source API development ecosystem, contains a stored Cross-Site Scripting (XSS) issue that could potentially lead to Cross-Site Request Forgery (CSRF). Recommendations Update to version 2026.3.0 or later.

**Name of the Vulnerable Software and Affected Versions** Storybook versions prior to 7.6.23 Storybook versions prior to 8.6.17 Storybook versions prior to 9.1.19 Storybook versions prior to 10.2.10 **Description** Storybook’s dev server WebSocket functionality, used for creating and updating stories, is susceptible to WebSocket hijacking. This issue impacts the dev server only and does not affect production builds. Exploitation requires a developer to visit a malicious website while running the local Storybook dev server. The WebSocket connection lacks origin validation, allowing a malicious site to send WebSocket messages to the local instance without user interaction. If the Storybook dev server is publicly exposed, an unauthenticated attacker can directly send WebSocket messages. The WebSocket message handlers for creating and saving stories are vulnerable to injection through unsanitized input in the `componentFilePath` field, potentially leading to persistent Cross-Site Scripting (XSS) or Remote Code Execution (RCE). **Recommendations** Update Storybook to version 7.6.23 or later. Update Storybook to version 8.6.17 or later. Update Storybook to version 9.1.19 or later. Update Storybook to version 10.2.10 or later.

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 2.10.1 n8n versions prior to 2.9.3 n8n versions prior to 1.123.22 **Description** n8n is a workflow automation platform susceptible to arbitrary script injection. An authenticated user with permission to create or modify workflows could inject malicious scripts into pages rendered by the n8n application through various nodes, including the Form Trigger node, Chat Trigger node, Send & Wait node, Webhook Node, and Chat Node. These injected scripts execute in the browser of any user visiting the affected page, potentially leading to session hijacking and account takeover. **Recommendations** Upgrade to n8n version 2.10.1 or later. Upgrade to n8n version 2.9.3 or later. Upgrade to n8n version 1.123.22 or later. If upgrading is not immediately possible, limit workflow creation and editing permissions to fully trusted users only. If upgrading is not immediately possible, disable the Webhook node by adding `n8n-nodes-base.webhook` to the `NODES EXCLUDE` environment variable.

**Name of the Vulnerable Software and Affected Versions** Astro versions prior to 9.5.4 **Description** Astro, a web framework, is affected by a Server-Side Request Forgery (SSRF) issue in versions prior to 9.5.4. Server-Side Rendered pages returning an error with a prerendered custom error page (such as `404.astro` or `500.astro`) are susceptible. If the `Host:` header is manipulated to point to an attacker's server, it can be fetched when requesting a resource like `/500.html`, allowing redirection to any internal URL and enabling the attacker to read the response body from the initial request. An attacker can access the application without `Host:` header validation, potentially by discovering the origin IP address behind a proxy, and fetch their own server to redirect to internal IP addresses. This allows access to cloud metadata IPs and interaction with services within the internal network or localhost. The issue requires direct access to the server without any intervening proxies. **Recommendations** Update to Astro version 9.5.4 or later.

**Name of the Vulnerable Software and Affected Versions** Langfuse versions 3.146.0 and below **Description** Langfuse is an open source large language model engineering platform. The `/api/public/slack/install` endpoint initiates Slack OAuth using a `projectId` provided by the client without authentication or authorization. The `projectId` is preserved throughout the OAuth flow, and the callback stores installations based on this untrusted metadata. This allows an attacker to bind their Slack workspace to any project and potentially receive changes to prompts stored in Langfuse Prompt Management. An attacker can replace existing Prompt Slack Automation integrations or pre-register a malicious one, though the latter requires an authenticated user to unknowingly configure it despite visible workspace and channel indicators in the UI. **Recommendations** Update to version 3.147.0 or later.