Offset

**Name of the Vulnerable Software and Affected Versions** DOMPurify versions prior to 3.4.0 **Description** Function predicates provided via `ADD ATTR` or `ADD TAGS` to the `DOMPurify.sanitize()` function persist in the internal state `EXTRA ELEMENT HANDLING` across multiple calls on the same instance. If a subsequent call to the same instance provides `ADD ATTR` or `ADD TAGS` as an array instead of a function, the previous function handler is not cleared or overwritten. This allows the handler to continue approving attacker-controlled attributes or tags, potentially bypassing `FORBID TAGS` and allowing dangerous event-handler attributes to survive sanitization, which leads to cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites. **Recommendations** Update to version 3.4.0.

**Name of the Vulnerable Software and Affected Versions** Parse Server versions 9.0.0 through 9.10.0-alpha.3 Parse Server versions prior to 8.6.85 **Description** A schema disclosure issue exists when the GraphQL API is configured with `graphQLPublicIntrospection` set to `false`. Error messages generated during variable coercion continue to provide schema-derived suggestions, bypassing the introspection-hardening control. An unauthenticated user with the public application id can iteratively recover hidden schema identifiers, such as Parse class and field names and registered Cloud Code function names, by submitting queries or mutations with near-miss enum values or input-object field names. **Recommendations** Update to version 9.10.0-alpha.4 or later. Update to version 8.6.85 or later.

**Name of the Vulnerable Software and Affected Versions** Capgo versions prior to 12.128.2 **Description** An information disclosure issue exists in the unauthenticated '/private/sso/check-domain' endpoint. The endpoint returns internal `org id` and `provider id` values, allowing attackers to enumerate email domains to create mappings of domains to organization UUIDs and SSO provider identifiers for reconnaissance against tenants. **Recommendations** Update to version 12.128.2 or later. Restrict access to the '/private/sso/check-domain' endpoint to minimize the risk of information disclosure.

**Name of the Vulnerable Software and Affected Versions** Capgo versions prior to 12.128.2 **Description** An issue exists in the 'POST /private/admin stats' endpoint where the `limit` parameter is extracted from an unvalidated request body and inserted directly into Cloudflare Analytics Engine SQL queries using template literals. An attacker with platform admin credentials can use this to inject SQL fragments, allowing them to enumerate dataset schemas, extract analytics data, or cause a denial-of-service against the analytics backend. **Recommendations** Update to version 12.128.2 or later. Avoid using the `limit` parameter in the 'POST /private/admin stats' endpoint until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Mistune versions prior to 3.3.0 **Description** The `safe url` filter in `src/mistune/renderers/html.py` fails to block several legacy or chained URI schemes. While it restricts `javascript:`, `vbscript:`, `file:`, and `data:`, it allows schemes such as `feed:`, `view-source:`, `jar:`, `livescript:`, `mocha:`, `ms-its:`, `mk:`, and `res:` to be included in rendered `href` and `src` attributes. This could allow the execution of scripts in affected user agents. **Recommendations** Update to version 3.3.0.

**Name of the Vulnerable Software and Affected Versions** Mistune versions prior to 3.3.0 **Description** A Python Markdown parser with renderers and plugins contains an issue where a Markdown document with numerous repeated or distinct reference-link definitions triggers quadratic work within `src/mistune/block parser.py` and the `ref links` environment dictionary handling. This can lead to a denial of service through CPU exhaustion. **Recommendations** Update to version 3.3.0.

**Name of the Vulnerable Software and Affected Versions** Mistune versions prior to 3.3.0 **Description** The `toc` plugin and `TableOfContents` directive generate heading IDs using predictable `toc N` values instead of slugifying the heading text. This allows attacker-controlled content with `id="toc N"` to collide with generated anchors, which can redirect same-page navigation, CSS selectors, or JavaScript handlers. **Recommendations** Update to version 3.3.0.

**Name of the Vulnerable Software and Affected Versions** Mistune versions prior to 3.3.0 **Description** A denial of service issue exists in the default parsing process. Long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in `src/mistune/inline parser.py` because the parser scans forward for matching close markers from every potential opening run. **Recommendations** Update to version 3.3.0.

**Name of the Vulnerable Software and Affected Versions** LiquidJS versions prior to 10.27.1 **Description** The pop array filter at src/filters/array.ts allocates a full clone of its input array using `[...toArray(v)]` without calling `this.context.memoryLimit.use(...)`. This allows a template render, such as `{{ huge array | pop }}`, to allocate an O(N) clone of an attacker-influenced array that bypasses the configured `memoryLimit` budget. **Recommendations** Update to version 10.27.1.

**Name of the Vulnerable Software and Affected Versions** Craft CMS versions 4.0.0-RC1 through 4.17.14 Craft CMS versions 5.0.0-RC1 through 5.9.21 **Description** An issue exists in the `AssetsController::actionDeleteFolder()` function where the system only verifies the `deleteAssets:<volume-uid>` permission for the target folder. It fails to enforce the `deletePeerAssets:<volume-uid>` permission, despite the `Assets::deleteFoldersByIds()` function cascading the deletion to all descendant folders and assets regardless of the uploader's privileges. Consequently, a low-privilege user with folder-management rights on a shared volume can delete assets uploaded by other users, bypassing the peer-permission checks implemented in the `actionDeleteAsset` endpoint. **Recommendations** Update to version 4.17.15 Update to version 5.9.22

**Name of the Vulnerable Software and Affected Versions** Capgo versions prior to 12.128.2 **Description** A cross-domain Single Sign-On (SSO) account takeover issue exists in the 'provision-user' endpoint. The system fails to validate SSO provider domain authorization, allowing the merging of arbitrary victim accounts based on email matches. An attacker with enterprise organization administrator access and a malicious Identity Provider (IdP) can forge Security Assertion Markup Language (SAML) assertions—an XML-based standard for exchanging authentication and authorization data—containing victim email addresses to trigger an account merge and gain full access to victim accounts, organizations, and data. **Recommendations** Update to version 12.128.2 or later.

**Name of the Vulnerable Software and Affected Versions** @actual-app/sync-server versions prior to 26.6.0 **Description** An authorization asymmetry exists in the `@actual-app/sync-server` component of Actual. In OpenID multi-user deployments, the `GET /secret/:name` endpoint only verifies that a user has a valid session but fails to verify if the user has administrative privileges. In contrast, the sibling `POST /secret/` handler correctly enforces an admin check. This allows any authenticated non-admin (BASIC) user to probe the secrets store by observing the HTTP response codes (204 for configured, 404 for missing). Consequently, an attacker can enumerate which admin-managed bank-sync integrations are configured, including `simplefin accessKey`, `pluggyai clientSecret`, `pluggyai itemIds`, and `gocardless *` secrets. This disclosure is limited to the existence of the secrets and does not reveal their actual values. **Recommendations** Update @actual-app/sync-server to version 26.6.0.

**Name of the Vulnerable Software and Affected Versions** Actual versions prior to 26.6.0 **Description** Actual is a local-first personal finance tool that fails to neutralize formula-trigger characters when exporting data to CSV. The functions `exportToCSV()` and `exportQueryToCSV()` in `packages/loot-core/src/server/transactions/export/export-to-csv.ts` pass user-controlled strings from the `Payee`, `Notes`, `Account`, and `Category` variables to the `csv-stringify` library without a cast callback. Consequently, strings starting with `=`, `+`, `-`, `@`, tab, or carriage return are written verbatim into the CSV file. When a user opens the exported file in spreadsheet software such as Microsoft Excel, LibreOffice Calc, or Google Sheets, these strings are interpreted as formulas. This can lead to the exfiltration of sensitive transaction data (such as amounts, account names, and balances) to an attacker-controlled URL via functions like `=HYPERLINK`, `=WEBSERVICE`, or `=IMPORTXML`. Additionally, it allows attackers to manipulate displayed values in the spreadsheet or potentially achieve remote code execution on older versions of Excel through Dynamic Data Exchange (DDE). **Recommendations** Update Actual to version 26.6.0. As a temporary mitigation, avoid importing files from untrusted sources and restrict the use of the CSV export feature until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Budibase versions prior to 3.39.9 **Description** Budibase contains a mass assignment issue in the `externalTrigger()` function. The webhook trigger endpoint `/api/webhooks/trigger/:instance/:id` is publicly accessible and passes the full HTTP request body into automation execution parameters. An attacker can overwrite the internal `appId` property by including it in the POST body of the request. When automations are processed asynchronously, the worker executes the attacker-defined automation within the context of the victim's workspace. This allows an attacker with builder access to their own workspace to gain full read and write access to any other workspace's database on the same instance, provided they know the victim's workspace ID. Other overridable variables include `timeout`, `user`, and `metadata.automationChainCount`. **Recommendations** Update Budibase to version 3.39.9. As a temporary mitigation, restrict access to the `/api/webhooks/trigger/:instance/:id` endpoint to trusted sources only.

**Name of the Vulnerable Software and Affected Versions** @actual-app/cli versions prior to 26.6.0 **Description** The `@actual-app/cli` tool contains a CSV serialization issue in the `escapeCsv` function within `packages/cli/src/output.ts`. When the `--format csv` option is used, the serializer only handles standard RFC 4180 escaping for delimiters, quotes, and newlines, but fails to neutralize formula-injection prefixes such as `=`, `+`, `-`, `@`, `t`, and `r`. Any CLI command that streams object arrays containing user-controlled strings—including `transactions list`, `accounts list`, `payees list`, `categories list`, `tags list`, `category-groups list`, `rules list`, `schedules list`, and `query`—can emit cells that are automatically evaluated as formulas when opened in spreadsheet software like Excel, LibreOffice Calc, or Google Sheets. This can lead to arbitrary formula execution and data exfiltration of sensitive financial information from adjacent cells using functions like `=HYPERLINK(...)` or `=WEBSERVICE(...)`. **Recommendations** Update @actual-app/cli to version 26.6.0. As a temporary workaround, avoid using the `--format csv` option when exporting data that may contain untrusted or user-provided strings.

**Name of the Vulnerable Software and Affected Versions** AVideo versions prior to 27.1 **Description** Authenticated administrators can perform server-side request forgery (SSRF)—a flaw where a server is tricked into making requests to an unintended location—via the 'plugin/Live/test.php' endpoint. The issue occurs because the `statsURL` parameter lacks `isSSRFSafeURL()` validation, allowing requests to be sent to localhost, private IP ranges, and cloud metadata endpoints such as 169.254.169.254. This can be exploited to retrieve sensitive data, including internal service responses, network configuration details, and IAM credentials. **Recommendations** Update to a version later than 27.0. As a temporary workaround, restrict access to the 'plugin/Live/test.php' endpoint or avoid using the `statsURL` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Statamic versions prior to 5.73.23 Statamic versions prior to 6.20.0 **Description** An authenticated Control Panel user can view metadata and content for resources they lack permission to access. This includes entries, assets, users, roles, groups, and other configured resources. Depending on the resource, exposed information may include titles, custom field values, entry content, asset metadata, and the existence of users, roles, and groups. No data can be modified through this issue. **Recommendations** Update to version 5.73.23 Update to version 6.20.0

**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 1.5.115 **Description** An information disclosure issue exists in the MultiAgentLedger component. The system fails to enforce the uniqueness of agent IDs, allowing attackers to register agents with duplicate IDs. This flaw enables the sharing of ledger instances, which can expose sensitive data, including system prompts and conversation history between agents. **Recommendations** Update to version 1.5.115 or later.

**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 1.5.128 **Description** A cross-origin agent execution issue exists in the 'POST /agui' endpoint, allowing remote attackers to trigger arbitrary agent execution. The endpoint lacks authentication and utilizes hardcoded `Access-Control-Allow-Origin: *` headers. Combined with Starlette's Content-Type-agnostic JSON parsing, this allows attackers to bypass Cross-Origin Resource Sharing (CORS) preflight checks—a security mechanism that restricts how resources on a web page can be requested from another domain—via simple requests. This can lead to the exfiltration of sensitive agent responses, including environment data and tool execution results. **Recommendations** Update to version 1.5.128 or later.

**Name of the Vulnerable Software and Affected Versions** DOMPurify versions 3.0.0 through 3.4.8 **Description** The software fails to reset the retained Trusted Types policy when the `clearConfig()` function is called. Consequently, a DOMPurify instance reused across trust boundaries remains bound to a previously supplied `TRUSTED TYPES POLICY`. A subsequent caller requesting `RETURN TRUSTED TYPE` output receives a TrustedHTML object created by the previous, potentially unsafe policy instead of a clean default. This can result in script execution at a Trusted Types sink. Additionally, passing `TRUSTED TYPES POLICY: null` during a later call fails to clear the retained policy. **Recommendations** Update DOMPurify to version 3.4.9 or later.