Jamie Slome

**Name of the Vulnerable Software and Affected Versions** Poddycast versions prior to 0.8.1 **Description** The application does not clean the HTML characters of the podcast information obtained from the Feed, which allows the injection of HTML and JS code, resulting in cross-site scripting. As Poddycast is made with Electron, this cross-site scripting can be scaled to remote code execution, making it possible to execute commands on the machine where the application is running. **Recommendations** For versions prior to 0.8.1, update to version 0.8.1 to resolve the issue. As a temporary workaround, consider restricting the use of podcast information obtained from untrusted Feeds to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** object-path versions <= 0.11.4 **Description** A prototype pollution vulnerability has been found in the `set()` method of the `object-path` library. The vulnerability is limited to the `includeInheritedProps` mode, which has to be explicitly enabled by creating a new instance of `object-path` and setting the option `includeInheritedProps: true`, or by using the default `withInheritedProps` instance. Any usage of `set()` in versions < 0.11.0 is vulnerable. The issue is fixed in object-path version 0.11.5. **Recommendations** For versions <= 0.11.4, upgrade to version 0.11.5 to fix the issue. As a temporary workaround, do not use the `includeInheritedProps: true` options or the `withInheritedProps` instance if using a version >= 0.11.0.