Romain-Deperne

**Name of the Vulnerable Software and Affected Versions** Dokploy versions prior to 0.29.1 **Description** Dokploy is a self-hostable Platform as a Service (PaaS). A command injection issue exists in the `deleteRegistry()` function within the `packages/server/src/services/registry.ts` file. The application executes a docker logout command using the `registryUrl` variable without proper shell escaping, allowing for the execution of arbitrary commands when a crafted `registryUrl` is provided. **Recommendations** Update to a version later than 0.29.0. As a temporary workaround, restrict access to the registry deletion functionality until the update is applied.

**Name of the Vulnerable Software and Affected Versions** JupyterHub versions 4.1.0 through 5.4.4 **Description** XSRF protection inappropriately treated requests containing the `Sec-Fetch-Mode: no-cors` header as same-origin requests, allowing the bypass of XSRF checks. This affects HTTP form endpoints, such as '/hub/spawn' and '/hub/accept-share', while the JSON API remains unaffected. An attacker could trigger a server spawn or, if permitted to share server access, force a user to accept a share and gain access to the attacker's server. **Recommendations** Update to version 5.4.5. As a temporary mitigation, if using a reverse proxy, drop requests to JupyterHub that contain the `Sec-Fetch-Mode: no-cors` header.

**Name of the Vulnerable Software and Affected Versions** Dagster Core versions prior to 1.13.1 Dagster libraries versions prior to 0.29.1 **Description** DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers construct SQL WHERE clauses by interpolating dynamic partition key values into queries without escaping. A user with the `Add Dynamic Partitions` permission can create a partition key that injects arbitrary SQL, which executes against the target database backend using the I/O manager's credentials. This issue only affects deployments using dynamic partitions; pipelines using static or time-window partitions are not impacted. **Recommendations** Update Dagster Core to version 1.13.1. Update Dagster libraries to version 0.29.1.

**Name of the Vulnerable Software and Affected Versions** Chamilo LMS versions prior to 2.0.0-RC.3 **Description** The PENS (Package Exchange Notification Services) plugin endpoint ''public/plugin/Pens/pens.php'' is accessible without authentication. It accepts a user-controlled `package-url` parameter that the server fetches using curl without filtering private or internal IP addresses, enabling Server-Side Request Forgery (SSRF). SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unexpected destination. An attacker can use this to probe internal network services, access cloud metadata endpoints to steal IAM credentials and sensitive instance metadata, or trigger state-changing operations on internal services via the `receipt` and `alerts` callback parameters. **Recommendations** Update to version 2.0.0-RC.3.

**Name of the Vulnerable Software and Affected Versions** Chamilo LMS version 2.0-RC.2 **Description** The file 'public/main/inc/ajax/install.ajax.php' is accessible without authentication on fully installed instances because it lacks the inclusion of the global.inc.php file, which handles authentication and installation checks. The `test mailer` action accepts an arbitrary Symfony Mailer DSN string via POST data to connect to a specified SMTP server. This allows an unauthenticated attacker to perform Server-Side Request Forgery (SSRF), a technique where the server is induced to make requests to internal network resources, via the SMTP protocol. This can be used to turn the server into an open email relay for phishing and spam, or to disclose internal network topology and running services through error responses from failed connections. **Recommendations** Update version 2.0-RC.2 to version 2.0.0-RC.3.

Name of the Vulnerable Software and Affected Versions Plunk versions prior to 0.8.0 Description Plunk, an email platform built on AWS SES, had a CRLF header injection issue in the SESService.ts component. User-provided data for `from.name`, `subject`, custom header keys/values, and attachment filenames was directly included in raw MIME messages without proper sanitization. An authenticated API user could inject arbitrary email headers, such as Bcc or Reply-To, by embedding carriage return/line feed characters into these fields, potentially enabling silent email forwarding, reply redirection, or sender spoofing. Recommendations Update to version 0.8.0 or later.

**Name of the Vulnerable Software and Affected Versions** KubeAI versions prior to 0.23.2 **Description** The `ollamaStartupProbeScript()` function in KubeAI constructs a shell command string using `fmt.Sprintf` with unsanitized model URL components (`ref`, `modelParam`). This command is executed via `bash -c` as a Kubernetes startup probe. An attacker who can create or update `Model` custom resources can inject arbitrary shell commands that execute inside model server pods. The `parseModelURL()` function uses a regular expression that allows shell metacharacters in the `ref` component and does not sanitize the `modelParam` query parameter. This allows for command injection through the model URL or the `?model=` query parameter. Successful exploitation could lead to arbitrary command execution within the model server pods, potentially allowing for data exfiltration, compromise of the model serving infrastructure, and lateral movement within a multi-tenant Kubernetes cluster. **Recommendations** Replace the `bash -c` startup probe with either: 1. An exec probe that passes arguments as separate array elements, or 2. Validate and sanitize `u.ref` and `u.modelParam` to only allow alphanumeric characters, slashes, colons, dots, and hyphens before interpolating into the shell command.

**Name of the Vulnerable Software and Affected Versions** Graphiti versions prior to 0.28.2 **Description** Graphiti, a framework for building and querying temporal context graphs for AI agents, had a Cypher injection issue in shared search-filter construction for non-Kuzu backends. Attacker-controlled label values provided through `SearchFilters.node labels` were directly concatenated into Cypher label expressions without validation. In MCP deployments, this was exploitable through direct untrusted access to the Graphiti MCP server and through prompt injection against an LLM client that could be induced to call `search nodes` with attacker-controlled `entity types` values. The MCP server mapped `entity types` to `SearchFilters.node labels`, which then reached the vulnerable Cypher construction path. Affected backends included Neo4j, FalkorDB, and Neptune. Kuzu was not affected because it used parameterized label handling. Successful exploitation could allow arbitrary Cypher execution within the privileges of the configured graph database connection, potentially enabling unauthorized data access, modification, or deletion, and bypassing logical group isolation. The issue also involved a separate, narrower issue in fulltext search query construction for unvalidated `group ids`. **Recommendations** Upgrade to version 0.28.2 or later.