Rtvkiz

**Name of the Vulnerable Software and Affected Versions** fast-jwt (affected versions not specified) **Description** The fast-jwt library contains an incomplete fix for a JWT algorithm confusion issue. The public key matcher regex in fast-jwt/src/crypto.js uses a leading anchor that can be bypassed by whitespace in the key string, re-enabling the JWT algorithm confusion attack that the original fix (CVE-2023-48223) intended to address. Specifically, the `publicKeyPemMatcher` regex requires a match at the beginning of the string, but this requirement is defeated by any leading whitespace. This allows an attacker to sign an HS256 token using the public key as the HMAC secret, effectively bypassing authentication. Leading whitespace in PEM key strings is common in real-world deployments, such as those involving PostgreSQL/MySQL text columns, YAML multiline strings, environment variables, and copy-pasted configurations. The vulnerability occurs when the server uses the RS256 algorithm with a public key containing leading whitespace and calls the verify function without explicitly specifying the algorithm. The attacker needs knowledge of the server's RSA public key to exploit this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Deno versions 2.7.0 through 2.7.1 **Description** Deno is a JavaScript, TypeScript, and WebAssembly runtime. A command injection issue exists in the node:child process polyfill when used in shell: true mode. The two-stage argument sanitization process in `transformDenoShellCommand` (ext/node/polyfills/internal/child process.ts) incorrectly prioritizes double quotes over single quotes when handling arguments containing a `$VAR` pattern. This allows backtick command substitution in POSIX sh, enabling the execution of injected commands. An attacker controlling arguments passed to `spawnSync` or `spawn` with shell: true can execute arbitrary operating system commands, bypassing Deno's permission system. The vulnerable component is the `node:child process` polyfill. The vulnerable function is `transformDenoShellCommand`. The issue arises because arguments containing a `$VAR` pattern are wrapped in double quotes instead of single quotes, allowing command substitution. **Recommendations** Avoid passing user-controlled input as arguments to `spawn` or `spawnSync` with `shell: true`. Use `shell: false` instead. If using `shell: true` is unavoidable, thoroughly validate and sanitize all inputs before passing them to the affected functions.

**Name of the Vulnerable Software and Affected Versions** Mailpit versions prior to 1.29.2 **Description** Mailpit is an email testing tool and API for developers. A Server-Side Request Forgery (SSRF) issue exists in the Link Check API. This allows unauthenticated remote attackers to map internal networks and enumerate cloud resources. The vulnerable API endpoint is `/api/v1/message/{ID}/link-check`. The vulnerability allows attackers to perform internal port scanning. **Recommendations** Update Mailpit to version 1.29.2 or later.