Ngocnn97

**Name of the Vulnerable Software and Affected Versions** Prometheus versions 2.49.0 through 3.5.2 Prometheus versions 3.11.0 through 3.11.2 **Description** In the legacy web UI, which is enabled via the `--enable-feature=old-ui` command-line flag, the histogram heatmap chart view fails to escape label values when inserting them into the HTML for axis tick mark labels. This allows an attacker capable of injecting crafted metrics to execute JavaScript in the browser of any user viewing the metric in the heatmap chart UI. **Recommendations** Update to version 3.5.3. Update to version 3.11.3. As a temporary mitigation, disable the legacy web UI by removing the `--enable-feature=old-ui` flag.

**Name of the Vulnerable Software and Affected Versions** toeverything AFFiNE versions prior to 0.26.4 **Description** An authorization bypass exists in the Public Markdown Preview Endpoint. A remote attacker can manipulate the `allowDocPreview` function within the '/workspace/:workspaceId/:docId' endpoint to bypass authorization controls. **Recommendations** Update to a version later than 0.26.3. As a temporary workaround, restrict access to the '/workspace/:workspaceId/:docId' endpoint or disable the `allowDocPreview` function.

Name of the Vulnerable Software and Affected Versions DbGate versions up to 7.1.4 Description A server-side request forgery exists in the REST/GraphQL component. This issue occurs within the `apiServerUrl1` function located in the `packages/rest/src/openApiDriver.ts` file and can be triggered remotely. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions aandrew-me ytDownloader versions up to 3.20.2 Description Command injection occurs in the Compressor Feature within the `src/compressor.js` file. This issue is triggered through the `child process.exec()` function and can only be executed locally. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions aandrew-me ytDownloader versions up to 3.20.2 Description A cross-site scripting issue exists in the Error Details Panel component. Remote attackers can exploit this by manipulating the `createTextNode()` function. Recommendations As a temporary workaround, consider disabling the `createTextNode()` function in the Error Details Panel until a patch is available.

**Name of the Vulnerable Software and Affected Versions** DbGate versions prior to 7.1.5 **Description** A cross-site scripting issue exists in the SVG Icon String Handler component within the file `packages/web/src/icons/FontIcon.svelte`. Remote manipulation of the `applicationIcon` argument can lead to this issue. **Recommendations** Upgrade to version 7.1.5.

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.6.4 Description SiYuan is susceptible to remote code execution (RCE) via a stored cross-site scripting (XSS) vulnerability in table captions. The issue arises because table caption content is stored without proper escaping and later unescaped into rendered HTML, creating an XSS sink. The SiYuan Electron desktop client's renderer is configured with `nodeIntegration` enabled and `contextIsolation` disabled, allowing attacker-controlled JavaScript to execute with access to Node.js APIs. An attacker can import a crafted note into a synced workspace, and upon the victim syncing and opening the note, code execution can be achieved. The vulnerability is triggered by crafted table captions containing encoded HTML, such as `<img src=x onerror=...>`, which are rendered as live DOM elements. A payload like `require('child process').exec('calc')` can be used to execute commands on the victim's machine. Recommendations Update to version 3.6.4 or later.

**Name of the Vulnerable Software and Affected Versions** Notesnook versions prior to 3.3.17 **Description** A stored Cross-Site Scripting (XSS) issue exists in the mobile share and web clip flow. The problem occurs because metadata from a shared clip is concatenated into HTML without proper escaping and subsequently rendered using `innerHTML` within the mobile share editor WebView. An attacker can manipulate shared title metadata, such as Android/iOS share metadata (TITLE or SUBJECT) or link-preview title data, to inject malicious HTML. When a user opens the share flow and selects a Web clip, the injected payload is executed within the mobile editor WebView. **Recommendations** Update to version 3.3.17.

Name of the Vulnerable Software and Affected Versions DbGate versions 7.0.0 through 7.1.5 Description DbGate, a cross-platform database manager, contains a stored cross-site scripting (XSS) issue due to attacker-controlled SVG icon strings being rendered as raw HTML without proper sanitization. In the web UI, this allows script execution within another user's browser. In the Electron desktop application, this can lead to local code execution because Electron is configured with `nodeIntegration: true` and `contextIsolation: false`. The issue resides in the icon rendering path, specifically within the `FontIcon.svelte`, `apps.js`, `DatabaseAppObject.svelte`, and `AppObjectCore.svelte` components. An attacker can exploit this by creating or modifying an application definition to include a malicious `applicationIcon`. When another user views a matching database or application entry, the malicious code executes. The impact is more severe in the Electron desktop app due to the configuration allowing access to Node/Electron APIs. Recommendations DbGate versions 7.0.0 through 7.1.5 should be updated to version 7.1.5 or later.

**Name of the Vulnerable Software and Affected Versions** SiYuan versions prior to 3.6.2 **Description** SiYuan is a personal knowledge management system. A crafted block attribute value can bypass server-side attribute escaping when an HTML entity is mixed with raw special characters. An attacker can embed a malicious IAL value inside a `.sy` document, package it as a `.sy.zip`, and have the victim import it through the Import `.sy.zip` workflow. Once the note is opened, the malicious attribute breaks out of its original HTML context and injects an event handler, resulting in stored cross-site scripting (XSS). In the Electron desktop client, this XSS can lead to remote code execution because injected JavaScript runs with access to Node/Electron APIs. The issue involves manipulating block attributes and exploiting the interaction between HTML entities and special characters. **Recommendations** Update to version 3.6.2.

**Name of the Vulnerable Software and Affected Versions** SiYuan versions prior to 3.6.2 **Description** The publish service in SiYuan allows unauthenticated visitors to access bookmarked blocks from password-protected documents. This occurs because the `/api/bookmark/getBookmark` endpoint, when operating in publish/read-only mode, calls the `FilterBlocksByPublishAccess(nil, ...)` function. Passing `nil` as the context bypasses the password check, allowing access to content from protected documents if at least one block within those documents is bookmarked. The vulnerable code path resides within the `kernel/api/bookmark.go` file, specifically in the `getBookmark` function, and the `FilterBlocksByPublishAccess` function in `kernel/model/publish access.go`. The issue stems from treating a `nil` context as authorized, effectively bypassing the intended password enforcement. **Recommendations** Versions prior to 3.6.2: Upgrade to version 3.6.2 or later to resolve this issue.

**Name of the Vulnerable Software and Affected Versions** SiYuan versions prior to 3.6.2 **Description** SiYuan is a personal knowledge management system susceptible to a stored cross-site scripting (XSS) issue. An attacker can inject a malicious URL into an Attribute View `mAsse` field. When a victim opens the Gallery or Kanban view with “Cover From -> Asset Field” enabled, the malicious URL is executed. The vulnerable code accepts arbitrary `http(s)` URLs without extensions as images, stores the attacker-controlled string in `coverURL`, and injects it directly into an `<img src="...">` attribute without proper escaping. In the Electron desktop client, the injected JavaScript executes with `nodeIntegration` enabled and `contextIsolation` disabled, leading to arbitrary OS command execution under the victim’s account. The vulnerable flow involves the `IsPossiblyImage(assetPath)` function accepting unsafe image URLs and the direct insertion of `coverURL` into the HTML without escaping. A payload such as `https://example.com/" onerror="require('child process').exec('calc')` can be used to trigger the XSS. **Recommendations** Versions prior to 3.6.2 should be updated to version 3.6.2 or later.

**Name of the Vulnerable Software and Affected Versions** Notesnook versions prior to 3.3.11 **Description** Notesnook is a note-taking app with a cross-site scripting issue present in the note history comparison viewer on Web/Desktop platforms. This issue can lead to remote code execution in the desktop application. The issue occurs when an attacker-controlled note header is displayed using the `dangerouslySetInnerHTML` function without proper security measures. The desktop application's Electron configuration, with `nodeIntegration` set to true and `contextIsolation` set to false, allows for the escalation to remote code execution when combined with the full backup and restore feature. The vulnerable function is `dangerouslySetInnerHTML`. The vulnerable parameter is the note header. **Recommendations** Update Notesnook to version 3.3.11 or later.

Name of the Vulnerable Software and Affected Versions Notesnook versions prior to 3.3.11 (Web/Desktop) and prior to 3.3.17 (Android/iOS) Description Notesnook is a note-taking app. A stored cross-site scripting (XSS) issue in the Web Clipper rendering flow can be exploited to achieve remote code execution (RCE) in the desktop application. The root cause is the preservation of attacker-controlled attributes from the source page’s root element within web-clip HTML. When these clips are opened, Notesnook renders the HTML into a same-origin, unsandboxed iframe using `contentDocument.write(...)`. Event-handler attributes like `onload`, `onclick`, or `onmouseover` are then executed within the Notesnook origin. In the desktop app, this leads to RCE because Electron is configured with `nodeIntegration: true` and `contextIsolation: false`. Recommendations Update to version 3.3.11 for Web/Desktop. Update to version 3.3.17 for Android/iOS.