Katriel Moses

**Name of the Vulnerable Software and Affected Versions** SuperPlane versions prior to 0.27.0 **Description** An issue exists in the `CanvasService` gRPC handlers where broken object-level authorization allows authenticated users with viewer-level access in one organization to access resources of other organizations. This occurs when arbitrary canvas or queue UUIDs are supplied without organization scoping. This flaw enables attackers to read cross-tenant execution history and event payloads containing sensitive secrets, write queue items and canvas events into victim organizations, delete arbitrary canvases, and disrupt automation workflows across tenant boundaries. **Recommendations** Update SuperPlane to version 0.27.0 or later.

**Name of the Vulnerable Software and Affected Versions** SuperPlane versions prior to 0.30.0 **Description** An SMTP header injection issue exists where unauthenticated attackers can inject arbitrary SMTP headers by including CRLF (Carriage Return Line Feed) sequences in the event payload title field delivered via webhook. By manipulating the unsanitized title field passed to the SMTP DATA command, attackers can add Bcc recipients for content exfiltration, forge the From address to bypass SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) checks, or inject Content-Type and MIME boundary headers to corrupt message bodies for phishing purposes. **Recommendations** Update SuperPlane to version 0.30.0 or later.

**Name of the Vulnerable Software and Affected Versions** Milkdown versions prior to 7.21.3 **Description** A stored cross-site scripting issue exists in the `@milkdown/preset-commonmark` and `@milkdown/components` packages. Attackers with document write access can execute arbitrary JavaScript in the browser context of users who open the document or click a rendered link. This occurs because the `parseMarkdown` runner stores raw URL values from the remark AST as `href` mark attributes without validating the URL scheme. Additionally, a call to `DOMPurify.sanitize()` in `edit-view.ts` fails to sanitize bare URL strings, treating them as text nodes and allowing `javascript:` payloads to persist in the link-tooltip preview component and read-only mode anchor elements. **Recommendations** Update to version 7.21.3 or later.

**Name of the Vulnerable Software and Affected Versions** Milkdown versions prior to 7.21.3 **Description** A DOM cross-site scripting issue exists in the `@milkdown/plugin-emoji` package. Unauthenticated attackers can execute arbitrary JavaScript in the host application origin by tricking a victim into pasting attacker-controlled content. The `parseDOM.getAttrs` handler stores the raw `innerHTML` of pasted `span` elements containing `data-type="emoji"` without sanitization. Subsequently, the `toMarkdown` runner assigns this unsanitized value directly to a live DOM element's `innerHTML`, which bypasses the DOMPurify sanitization used in the `toDOM` path and triggers payload execution during every markdown serialization cycle. **Recommendations** Update to version 7.21.3 or later.

**Name of the Vulnerable Software and Affected Versions** QueryWeaver (affected versions not specified) **Description** An authentication bypass allows unauthenticated attackers to obtain valid session tokens for existing accounts. By submitting a signup request with a known victim email address, the server uses a Cypher MERGE operation to unconditionally create and link a new token to the matching Identity before verifying if the email is already associated with an account. This results in the server returning an authenticated session token for the victim without requiring credentials or user interaction. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** urwid (affected versions not specified) **Description** The web display backend in `urwid/display/web.py` uses Python's Mersenne Twister PRNG to generate web session identifiers `urwid id` within the `Screen.start()` function. Because this PRNG is not cryptographically secure, an attacker observing approximately 334 session IDs, such as those found in the `X-Urwid-ID` HTTP response header, can reconstruct the internal state and predict all past and future session IDs. Additionally, these identifiers are used as filenames for FIFOs created in the world-listable `/tmp` directory, allowing any local user to enumerate active session tokens. A valid session ID enables an attacker to read the victim's terminal screen via the polling endpoint, inject keystrokes—potentially leading to OS-level code execution if a shell is running—or crash the session by flooding the FIFO. **Recommendations** Update urwid to the release containing fix commit 24acd12. As a temporary mitigation, restrict access to the web display backend or avoid using it if not strictly necessary.

**Name of the Vulnerable Software and Affected Versions** Hermes WebUI versions prior to 0.51.788 **Description** An unauthenticated remote code execution issue allows remote attackers to execute arbitrary shell commands. This is achieved by accessing embedded terminal API endpoints without credentials through four sequential HTTP requests to create a session, attach a PTY shell, and write commands via the terminal input endpoint. This results in full command execution with the privileges of the server process user. **Recommendations** Update Hermes WebUI to version 0.51.788 or later.

**Name of the Vulnerable Software and Affected Versions** WebP Server Go versions prior to 0.14.5 **Description** An issue on Windows allows unauthenticated attackers to read files outside the configured `IMG PATH` directory. This occurs because the `path.Clean()` sanitization in `handler/router.go` is bypassed when requests contain percent-encoded backslashes (%5C). The flaw stems from a discrepancy where Go performs path normalization using only forward slashes, while Windows file system APIs treat both backslashes and forward slashes as equivalent, enabling access to arbitrary files on the host filesystem accessible to the server process. **Recommendations** Update to version 0.14.5 or later.

**Name of the Vulnerable Software and Affected Versions** Perry versions prior to 0.5.1166 **Description** An issue in the JWT validation process allows remote attackers to bypass token expiration. This occurs because the `verify decode` helper within the stdlib JWT verification path unconditionally sets `validate exp` to `false`. Consequently, attackers with a previously issued bearer token can use expired tokens in any `jwt.verify()` call to maintain authenticated access indefinitely, bypassing session expiration mechanisms such as administrative revocation or user logout. **Recommendations** Update to version 0.5.1166 or later.

**Name of the Vulnerable Software and Affected Versions** KanaDojo (affected versions not specified) **Description** A command injection issue exists where an attacker with pull request access can execute arbitrary shell commands. This occurs when shell metacharacters are inserted into the `version` or `changes` fields of the 'patchNotesData.json' file. These fields are interpolated without sanitization into a `child process.execSync()` function call within the 'release.yml' workflow. A malicious pull request, once merged, can trigger the GitHub Actions runner, granting the attacker contents write permissions and access to the `GITHUB TOKEN`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Perry versions prior to 0.5.1159 **Description** A path traversal issue exists where a malicious build server can write arbitrary content to any location writable by the running process. This occurs when unsanitized path components are supplied in the `artifact name` field of ArtifactReady WebSocket messages. Attackers who control the server URL can deliver traversal payloads through the `artifact name` or `download path` fields, leading to the overwriting of sensitive files or the exposure of arbitrary local files to a location accessible by the attacker. **Recommendations** Update to version 0.5.1159 or later.

**Name of the Vulnerable Software and Affected Versions** KanaDojo versions prior to 0.1.18 **Description** A sandbox escape allows remote code execution with full GitHub Actions runner privileges, including access to the `AUTOMATION PR TOKEN` variable. The issue occurs in the issue-auto-respond.yml workflow due to the explicit passing of the global `require()` function into a Node.js `vm.runInNewContext()` sandbox context. An attacker can exploit this by submitting a pull request that modifies `messages.cjs` to import arbitrary Node.js modules, thereby bypassing sandbox restrictions. **Recommendations** Update to version 0.1.18 or later.

**Name of the Vulnerable Software and Affected Versions** kafka-python versions prior to 2.3.2 **Description** A denial-of-service issue exists in the SCRAM authentication handling. A malicious or machine-in-the-middle broker can freeze the client event loop by providing an excessively large iteration count. In the `scram.py` file, the `ScramClient.process server first message()` function passes the broker-controlled SCRAM iteration count directly to `hashlib.pbkdf2 hmac()` without validation. This blocks producer sends, consumer polls, admin operations, and heartbeats, potentially leading to consumer group eviction and repeated reconnect failures. **Recommendations** Update to version 2.3.2 or later.

**Name of the Vulnerable Software and Affected Versions** kafka-python versions prior to 2.3.2 **Description** A denial-of-service issue exists in the protocol parser. A malicious broker or machine-in-the-middle attacker can exhaust memory or hang connections by sending a crafted 4-byte frame length value that lacks bounds validation. By sending this value through the `receive bytes()` function, an attacker can trigger a multi-gigabyte memory allocation or an uncaught `ValueError`. This leaves the connection in a broken state, causing requests to hang and consumers to stop heartbeating until a restart occurs. **Recommendations** Update to version 2.3.2 or later.

**Name of the Vulnerable Software and Affected Versions** Medplum versions prior to 5.1.14 **Description** An issue in the subscription worker allows authenticated users to perform unauthorized internal network requests. By creating FHIR Subscription resources with arbitrary endpoint URLs, attackers can target internal addresses such as cloud instance metadata services, internal databases, or container orchestration endpoints. This can lead to the exfiltration of IAM credentials and patient health records through the POST body, which contains full FHIR resource payloads. Server-Side Request Forgery (SSRF) is a flaw where an attacker can force a server to make requests to an unintended location. **Recommendations** Update to version 5.1.14 or later.

**Name of the Vulnerable Software and Affected Versions** Claude HUD versions 0.0.0 through 0.0.12 **Description** The software constructs OSC 8 terminal hyperlink escape sequences using raw `cwd` and `branchUrl` values without stripping control characters or encoding embedded values. This allows attackers to inject arbitrary ANSI codes into terminal sessions by embedding ESC+backslash sequences in the current working directory or branch URL. Potential impacts include text color changes, forged prompts, OSC 52 clipboard writes, or triggering outbound HTTP requests to attacker-controlled remotes when hyperlinks are clicked. **Recommendations** Update to the version containing commit 234d9aa. As a temporary workaround, avoid using directories or branch URLs containing control characters in the `cwd` and `branchUrl` variables.

**Name of the Vulnerable Software and Affected Versions** Claude HUD versions 0.0.0 through 0.0.12 **Description** Local attackers can execute arbitrary commands on Windows systems by manipulating the `COMSPEC` environment variable. By setting `COMSPEC` to an arbitrary binary path before the software performs its version check, the `execFile()` function executes the attacker-supplied executable with cmd.exe arguments, leading to arbitrary code execution. **Recommendations** Update to the version containing commit 234d9aa.

**Name of the Vulnerable Software and Affected Versions** Claude HUD versions 0.0.0 through 0.0.12 **Description** A path traversal issue allows attackers to read arbitrary files by providing an unvalidated `transcript path` value via stdin JSON. This enables access to any file readable by the process. Additionally, file metadata is written to a persistent cache file with insufficient permissions, which creates a forensic record of the accessed paths that remains after the process exits. **Recommendations** Update to the version containing commit 234d9aa.

**Name of the Vulnerable Software and Affected Versions** Quark Drive versions prior to 0.8.5 **Description** A mass assignment issue exists in the "POST /update" endpoint. Authenticated attackers can overwrite administrator credentials by submitting an arbitrary webui object to the `config data` dictionary. This is possible due to insufficient deny-list filtering, which allows the permanent replacement of stored login credentials. Consequently, legitimate administrators may be locked out, and attackers can gain persistent access to all configured tasks, cloud tokens, and notification services. **Recommendations** Update to version 0.8.5 or later.

**Name of the Vulnerable Software and Affected Versions** Quark Drive versions prior to 0.8.5 **Description** A stored cross-site scripting issue exists in the System Configuration page. The template renders `push config` key names using the Vue.js `v-html` directive without proper escaping. Authenticated attackers can inject HTML or JavaScript payloads as key names via the "POST /update" endpoint. These payloads are saved to disk and executed in the browsers of all authenticated users who visit the System Configuration tab, potentially leading to session cookie exfiltration and unauthorized authenticated actions. **Recommendations** Update to version 0.8.5 or later.