Dremig

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.123.64 n8n versions prior to 2.29.8 n8n versions prior to 2.30.1 **Description** A sanitizer bypass exists in the legacy expression evaluator's computed-member handler. An authenticated user with permissions to create or modify workflows can craft a malicious expression to bypass the sanitizer, leading to host-level code execution with the privileges of the n8n process. The legacy expression engine is the default in the affected versions. **Recommendations** Update to version 1.123.64 or later. Update to version 2.29.8 or later. Update to version 2.30.1 or later. Switch to the non-legacy expression engine by setting `N8N EXPRESSION ENGINE=vm`. Restrict instance access to fully trusted users only.

A weakness has been identified in antv layout 2.0.0. This impacts the function setNestedValue in the library lib/util/object.js. Executing a manipulation of the argument path can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

**Name of the Vulnerable Software and Affected Versions** primefaces primereact versions prior to 10.9.9 **Description** A weakness in the API component allows remote attackers to cause improperly controlled modification of object prototype attributes. This occurs through the manipulation of the `Field` argument within the `ObjectUtils.mutateFieldData()` function. This issue specifically affects products that are no longer supported by the maintainer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** tanstack db versions prior to 0.6.9 **Description** A remote attack is possible through the Alias Path Handler component. The `select()` function in the `src/query/compiler/select.ts` file allows for the improperly controlled modification of object prototype attributes, a condition known as prototype pollution. **Recommendations** Apply patch ac09b1177a100eafa85cba3cd09dd1f53f933ded to remediate the issue.

**Name of the Vulnerable Software and Affected Versions** apidevtools json-schema-ref-parser versions prior to 15.3.6 **Description** A weakness in the `Refs.set`/`Pointer.set` functions within the `lib/pointer.ts` library allows for the improperly controlled modification of object prototype attributes. This issue can be exploited remotely through manipulation of the affected functions. **Recommendations** Upgrade to version 15.3.6.

**Name of the Vulnerable Software and Affected Versions** enquirer versions prior to 2.4.2 **Description** A flaw in the Public Package API component allows remote attackers to perform prototype pollution. By manipulating the `question.name` argument within the `Enquirer.set()` function, an attacker can cause improperly controlled modification of object prototype attributes. Prototype pollution is a technique where an attacker modifies the base prototype of an object, potentially affecting all objects created from that prototype. **Recommendations** Update to version 2.4.2 or later. As a temporary mitigation, restrict or validate the input passed to the `question.name` argument in the `Enquirer.set()` function.

**Name of the Vulnerable Software and Affected Versions** christopherthielen check-peer-dependencies versions prior to 4.3.5 **Description** An OS command injection flaw exists in the `peerDependencies` component within the `dist/packageUtils.js` file. The issue resides in the `shelljs.exec()` function, which allows a remote attacker to execute arbitrary operating system commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the `shelljs.exec()` function in the `dist/packageUtils.js` file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** create-react-app versions prior to 5.0.2 **Description** On macOS, the `startBrowserProcess()` function within the `openBrowser.js` file of the `react-dev-utils` component allows for OS command injection. This issue enables remote exploitation through the manipulation of the specified function. **Recommendations** As a temporary workaround, restrict the use of the `startBrowserProcess()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: codeceptjs version 3.7.3 Description: codeceptjs version 3.7.3 contains a command injection issue in the `emptyFolder` function located in `lib/utils.js`. The `execSync` command directly concatenates the user-controlled `directoryPath` parameter without sanitization or escaping, potentially allowing attackers to execute arbitrary commands. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.