Arkark

**Name of the Vulnerable Software and Affected Versions:** pdfme versions 5.2.0 through 5.4.0 **Description:** The expression evaluation feature in pdfme contains critical vulnerabilities allowing sandbox escape, leading to Cross-Site Scripting (XSS) and prototype pollution attacks. Attackers can bypass the sandbox restrictions to execute arbitrary JavaScript code using methods like `Object.getOwnPropertyDescriptor` and `Object.getPrototypeOf`. The expression evaluator also allows access to prototype accessor methods (` lookupGetter `, ` lookupSetter `, ` defineGetter `, ` defineSetter `) which can be exploited with `Object.assign` to pollute the prototype chain. These vulnerabilities can allow attackers to execute arbitrary JavaScript code, steal sensitive information, modify application behavior, and potentially perform actions on behalf of users. **Recommendations:** pdfme versions prior to 5.4.1 are affected. Update to pdfme version 5.4.1 to resolve this issue.

**Name of the Vulnerable Software and Affected Versions** Radashi versions prior to 12.5.1 **Description** Radashi is a TypeScript utility toolkit. The set function within the Radashi library is vulnerable to prototype pollution. If an attacker can control parts of the path argument to the set function, they could potentially modify the prototype of all objects in the JavaScript runtime, leading to unexpected behavior, denial of service, or even remote code execution in some specific scenarios. **Recommendations** For versions prior to 12.5.1, update to version 12.5.1 or later to resolve the issue. As a temporary workaround, consider sanitizing the path argument provided to the set function to ensure that no part of the path string is ` proto `, `prototype`, or `constructor`.

Name of the Vulnerable Software and Affected Versions: zx versions prior to 8.3.2 Description: An attacker with control over environment variable values can inject unintended environment variables into `process.env`. This can lead to arbitrary command execution or unexpected behavior in applications that rely on environment variables for security-sensitive operations. Applications that process untrusted input and pass it through `dotenv.stringify` are particularly vulnerable. Recommendations: For versions prior to 8.3.2, update to version 8.3.2 to mitigate the vulnerability. If upgrading is not feasible, sanitize user-controlled environment variable values before passing them to `dotenv.stringify`. Specifically, avoid using `, `, and backticks in values, or enforce strict validation of environment variables before usage.

**Name of the Vulnerable Software and Affected Versions** Svelte versions prior to 4.2.19 **Description** A potential mXSS vulnerability exists in Svelte due to improper HTML escaping on server-side rendering. The issue arises when the final DOM tree rendered on browsers differs from what Svelte expects, allowing for XSS attacks. This can occur when injecting malicious content into an attribute within a `noscript` tag. The estimated number of potentially affected devices is not specified. **Recommendations** For versions prior to 4.2.19, upgrade to release version 4.2.19 to address the issue. As a temporary workaround, consider restricting the use of attributes within `noscript` tags to minimize the risk of exploitation. Avoid using user-inputted values for the `href` attribute in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Qwik versions prior to 1.6.0 @builder.io/qwik versions prior to 1.7.3 **Description** A potential mutation XSS vulnerability exists in Qwik due to improper HTML escaping on server-side rendering. This occurs because Qwik converts strings according to specific rules, which can cause the final DOM tree rendered on browsers to differ from what Qwik expects on server-side rendering. This discrepancy can be leveraged to perform XSS attacks, specifically a type known as mXSS (mutation XSS). The issue arises from the conversion rules found in the `render-ssr.ts` file, where attribute values and other characters are converted differently, potentially leading to security vulnerabilities. **Recommendations** For Qwik versions prior to 1.6.0, upgrade to version 1.6.0 or later to resolve the issue. For @builder.io/qwik versions prior to 1.7.3, upgrade to version 1.7.3 or later to resolve the issue. As a temporary workaround, consider restricting user input in the `href` parameter to minimize the risk of exploitation. Avoid using the `href` parameter in the affected component until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** aiohttp versions prior to 3.9.4 **Description** A XSS vulnerability exists on index pages for static file handling. This issue arises when using `web.static(..., show index=True)`, as the resulting index pages do not escape file names, making the server vulnerable to XSS attacks if users can upload files with arbitrary filenames to the static directory. Users who follow the recommendation of using a reverse proxy server, such as nginx, for serving static files are unaffected. **Recommendations** For versions prior to 3.9.4, update to version 3.9.4 or later to resolve the issue. As a temporary workaround, consider disabling the `show index` parameter if unable to upgrade.

**Name of the Vulnerable Software and Affected Versions** AWS SDK for PHP versions prior to 3.288.1 **Description** A URI path traversal issue exists in the AWS SDK for PHP, specifically within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot. This issue is possible due to the `buildEndpoint` method in the RestSerializer component relying on the Guzzle Psr7 UriResolver utility, which strips dot segments from the request path in accordance with RFC 3986. Under certain conditions, this could lead to an arbitrary object being accessed. **Recommendations** Upgrade to the AWS SDK for PHP version 3.288.1 or later, if you are on a version prior to 3.288.1. As a temporary workaround, consider restricting access to S3 object keys and/or prefixes containing a Unix double-dot until the issue is resolved. Additionally, be cautious when using the `buildEndpoint` method in the RestSerializer component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** vm2 versions 3.9.17 and lower **Description** The issue allows a threat actor to get a read-write reference to the node `inspect` method and edit options for `console.log`, resulting in the ability to edit options for the `console.log` command. This was possible due to a flaw in vm2, a sandbox that can run untrusted code with Node's built-in modules. **Recommendations** For versions 3.9.17 and lower, upgrade to version 3.9.18 or higher. As a temporary workaround for users unable to upgrade, make the `inspect` method readonly with `vm.readonly(inspect)` after creating a vm.

**Name of the Vulnerable Software and Affected Versions** vm2 versions up to and including 3.9.17 **Description** A sandbox escape issue exists in vm2, allowing a threat actor to bypass sandbox protections and gain remote code execution rights on the host. This is achieved by abusing an unexpected creation of a host object based on the specification of `Proxy`. The vulnerability can be exploited by a remote attacker to execute arbitrary code. **Recommendations** For versions up to and including 3.9.17, upgrade to version 3.9.18 or later to patch the vulnerability. As a temporary workaround, consider restricting access to the `Proxy` specification until a patch is applied. There are no known workarounds for this vulnerability. Users are advised to upgrade to a patched version to mitigate the risk.