Nanhang

A security flaw has been discovered in OpenAkita up to 1.27.12. This vulnerability affects unknown code of the file /api/upload of the component File Upload API. The manipulation of the argument File results in cross site scripting. The attack may be performed from remote. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

**Name of the Vulnerable Software and Affected Versions** Neovim versions prior to 0.12.3 **Description** A flaw in the View Branch component allows for command injection via the local host. The issue exists within the `M.read()` function located in the `runtime/lua/vim/secure.lua` file, where manipulating the `path` argument can lead to arbitrary command execution. **Recommendations** Apply patch f83e0dcaf8cf18de94828341b0a1a61a86c75baf to remediate the issue. As a temporary workaround, restrict or avoid the use of the `M.read()` function in `runtime/lua/vim/secure.lua` when handling untrusted `path` arguments.