Alcls01111

**Name of the Vulnerable Software and Affected Versions** axios versions 0.28.0 and later **Description** Uncontrolled recursion exists in the `formDataToJSON` function when processing `FormData` field names containing deeply nested bracket segments. An attacker can provide `FormData` with field names containing thousands of nested brackets to exhaust the JavaScript call stack, triggering a `RangeError`. This leads to request failure or process termination in applications that do not handle the exception, resulting in a denial of service. This issue affects the `axios.formToJSON(formData)` API, the `formToJSON` import, the `lib/helpers/formDataToJSON.js` file, and the default `transformRequest` when `FormData` is sent with an `application/json` content type. The vulnerability is triggered via the `buildPath()` function, which recursively processes path segments without enforcing a maximum depth. **Recommendations** For axios versions 0.28.0 and later, validate `FormData` field names to reject keys whose nesting depth exceeds the expected schema before calling `formToJSON()` or sending `FormData` with `Content-Type: application/json`. For axios requests carrying untrusted `FormData`, avoid setting `Content-Type: application/json` to bypass the `formDataToJSON()` process. As a temporary mitigation, implement error handling to catch the resulting `RangeError` to prevent full process termination.

**Name of the Vulnerable Software and Affected Versions** Deno versions prior to 2.8.1 **Description** When the `fetch()` function is called, the runtime validates the destination hostname against `--deny-net` rules but fails to re-verify the IP addresses that the hostname resolves to. This allows an attacker-controlled script to use a specially crafted domain name that passes the initial hostname check but resolves to a denied IP address, effectively bypassing network isolation rules. This can lead to unauthorized access to blocked hosts, such as `localhost` or internal services, particularly when running untrusted or third-party code. **Recommendations** Update to version 2.8.1. As a temporary mitigation, avoid granting `--allow-net` to untrusted code that relies on `--deny-net` restrictions for security.

**Name of the Vulnerable Software and Affected Versions** Deno versions prior to 2.8.1 **Description** When opening a WebSocket connection, the runtime validates the destination hostname against `--deny-net` rules but fails to re-verify the IP addresses the hostname resolves to. This allows an attacker-controlled script to use a specially crafted domain name that passes the hostname check but resolves to a denied IP, bypassing network isolation rules. This can lead to unauthorized connections to hosts the user intended to block, such as `localhost` or internal services, potentially via a malicious or compromised dependency. **Recommendations** Update to version 2.8.1. Avoid granting `--allow-net` to untrusted code that relies on `--deny-net` restrictions for security if an immediate update is not possible.

**Name of the Vulnerable Software and Affected Versions** Nuxt versions prior to 4.4.7 Nuxt versions prior to 3.21.7 **Description** A cross-site scripting issue exists in the NoScript component, which writes slot content to innerHTML without proper escaping. This allows attackers to inject malicious scripts via untrusted data in NoScript slots, such as `route.query` parameters. These scripts execute in the document context when the noscript tag is implicitly closed by script tags. **Recommendations** Update to version 4.4.7 or later. Update to version 3.21.7 or later.

**Name of the Vulnerable Software and Affected Versions** Nuxt versions 3.x prior to 3.21.7 Nuxt versions 4.0.0 through 4.4.6 **Description** The `reloadNuxtApp()` function accepts protocol-relative paths, such as //evil.com. These paths bypass the script-protocol check and resolve to a cross-origin URL based on the current page protocol. This allows attackers to inject paths that redirect users to attacker-controlled hosts, which can be used for phishing and the theft of OAuth authorization codes. **Recommendations** Update Nuxt versions 3.x to 3.21.7. Update Nuxt versions 4.x to 4.4.7. As a temporary workaround, restrict the use of the `reloadNuxtApp()` function until the updates are applied.

**Name of the Vulnerable Software and Affected Versions** Nuxt versions 3.x prior to 3.21.7 Nuxt versions 4.0.0 through 4.4.6 **Description** Nuxt fails to validate script-capable URLs in the `navigateTo` open option, which allows for client-side script execution. When user-controlled input is passed to `navigateTo`, attackers can provide `javascript:` URLs through the `open` parameter to execute arbitrary scripts within the application's origin. **Recommendations** Update versions 3.x to 3.21.7 or later. Update versions 4.0.0 through 4.4.6 to 4.4.7 or later.

**Name of the Vulnerable Software and Affected Versions** Nuxt versions prior to 4.4.7 Nuxt versions prior to 3.21.7 **Description** When running the development server on Linux, the vite-node IPC (Inter-Process Communication) server binds to an abstract-namespace Unix socket without permission restrictions. This allows local users to enumerate and connect to the socket. Unprivileged co-resident users can exploit the unprotected module request handler to read arbitrary files, such as `.env` and SSH keys, through the SSR (Server-Side Rendering) plugin pipeline. Production builds are not affected because the IPC server only operates during development. **Recommendations** Update to version 4.4.7 or later. Update to version 3.21.7 or later.

**Name of the Vulnerable Software and Affected Versions** Nuxt versions prior to 4.4.7 Nuxt versions prior to 3.21.7 **Description** Nuxt contains three security issues related to client-navigation URL handling via the `navigateTo()` and `reloadNuxtApp()` functions. First, a server-side open redirect exists in `navigateTo()` where path-normalization bypasses, such as using `/..//evil.com` or `/.//evil.com`, allow attackers to circumvent external-host checks. This results in the browser resolving the redirect to an attacker-controlled host via the Location header or meta-refresh, potentially enabling phishing and OAuth authorization-code theft. Second, a client-side script execution issue exists in `navigateTo()` when the `open` option is used. The handler fails to apply script-protocol checks, allowing targets like `javascript:...` to execute in the application's origin, leading to reflected Cross-Site Scripting (XSS), which is the execution of malicious scripts in a victim's browser. Third, an open redirect exists in `reloadNuxtApp()` via the `path` variable. Protocol-relative paths like `//evil.com` bypass protocol checks and are assigned to `window.location.href`, causing a cross-origin redirect. **Recommendations** Update to version 4.4.7 or later. Update to version 3.21.7 or later. As a temporary mitigation for open redirects, validate redirect targets before passing them to `navigateTo()` or `reloadNuxtApp({ path })` by rejecting any input where the pathname starts with `//` or by using a known allow-list of paths. As a temporary mitigation for script execution, reject any user-controlled URL whose protocol is not in an allow-list (such as `http:` and `https:`) before passing it to `navigateTo({ open: ... })`.

**Name of the Vulnerable Software and Affected Versions** Dokploy versions prior to 0.29.2 **Description** An authenticated user can execute arbitrary OS commands on the host system through the Docker file upload functionality. The issue occurs because the `destinationPath` parameter is not properly sanitized and is directly interpolated into a shell command string. By using shell metacharacters such as ; or ", an attacker can escape the intended `docker cp` command. **Recommendations** Update to version 0.29.2 or later. As a temporary workaround, restrict access to the Docker file upload functionality for untrusted authenticated users.