Jiyong Yang

**Name of the Vulnerable Software and Affected Versions** Django versions 6.0 through 6.0.1 Django versions 5.2 through 5.2.10 Django versions 4.2 through 4.2.27 Django versions 5.0.x and earlier Django versions 4.1.x and earlier Django versions 3.2.x and earlier **Description** The `ASGIRequest` component is susceptible to a denial-of-service condition. A remote attacker can exploit this by sending a specially crafted request containing duplicate headers. **Recommendations** Update Django to version 6.0.2 or later. Update Django to version 5.2.11 or later. Update Django to version 4.2.28 or later.

**Name of the Vulnerable Software and Affected Versions** nvm versions 0.40.3 and below **Description** A command injection issue exists in nvm (Node Version Manager). The `nvm download()` function utilizes `eval` to execute `wget` commands. The `NVM AUTH HEADER` environment variable was not properly sanitized when used in the `wget` code path. An attacker capable of setting environment variables within a victim’s shell environment—for example, through malicious CI/CD configurations, compromised dotfiles, or Docker images—can inject arbitrary shell commands. These commands will execute when the victim runs nvm commands that initiate downloads, such as 'nvm install' or 'nvm ls-remote'. **Recommendations** Update nvm to a version newer than 0.40.3.