Avivdon

**Name of the Vulnerable Software and Affected Versions** ToolJet versions prior to 3.20.180 **Description** The render preview deployment workflow interpolates the `github.event.comment.body` variable directly into a bash conditional within a run step. This allows a GitHub user with permission to comment on an open pull request to execute arbitrary shell commands on the CI runner and exfiltrate deployment secrets. **Recommendations** Update to version 3.20.180.

**Name of the Vulnerable Software and Affected Versions** coder versions prior to 2.29.7 coder versions prior to 2.30.2 **Description** A command injection issue exists in the `dotfiles` registry module where unsanitized user input is passed to shell commands. An attacker can provide a crafted `dotfiles uri` value containing shell command substitution, such as `$(...)`, to execute arbitrary code within a provisioned workspace. This issue is amplified by a `mode=auto` query parameter on the Create Workspace page, which allows the automatic creation of a workspace without user confirmation when combined with `param.*` URL parameters. This enables a one-click attack where an authenticated user clicking a malicious link triggers the creation of a workspace with attacker-controlled parameters, potentially exposing Git credentials, secrets, and workspace files. **Recommendations** Update coder to version 2.29.7 or later. Update coder to version 2.30.2 or later. Restrict the use of the `dotfiles uri` parameter to trusted values until the system is updated.

**Name of the Vulnerable Software and Affected Versions** CloudPirates Open Source Helm Charts versions prior to commit fcf9302 **Description** A GitHub Actions workflow in the `pull-request.yaml` file executes attacker-controlled code from fork pull requests within a privileged context. This allows for the exfiltration of repository secrets, such as Docker Hub credentials and tokens, without requiring approval from a maintainer. **Recommendations** Update to the version containing commit fcf9302.

**Name of the Vulnerable Software and Affected Versions** CloudPirates Open Source Helm Charts versions prior to commit fcf9302 **Description** A GitHub Actions workflow named 'generate-schema.yaml' exposes sensitive credentials, specifically a Personal Access Token and an SSH signing key, to code controlled by forks. This occurs due to unsafe checkout and credential handling practices. **Recommendations** Update to commit fcf9302 or a later version.

**Name of the Vulnerable Software and Affected Versions** Espressif Shared GitHub DangerJS versions prior to 1.0.1 **Description** The `entrypoint.sh` script invokes DangerJS from the caller's workspace after copying a fork's checkout into it. This creates an untrusted search path for binary and Node.js module resolution. Consequently, a fork pull request processed by a `pull request target` workflow can lead to the execution of arbitrary code supplied by the fork within the action container, replacing the action's intended code. **Recommendations** Update to version 1.0.1.

**Name of the Vulnerable Software and Affected Versions** Claude Code versions prior to 1.0.111 **Description** Claude Code is an agentic coding tool that contains a bug in the startup trust dialog implementation. This flaw allows for code injection, where the tool can be tricked into executing code contained within a project before the user has accepted the startup trust dialog. Successful exploitation requires a user to start the tool in an untrusted directory. **Recommendations** Update to version 1.0.111 or later.