Skip to content

Commit 75eaf0c

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-46fp-8f5p-pf2m GHSA-677m-j7p3-52f9 GHSA-6g43-577r-wf4x GHSA-762r-27w2-q22j
1 parent 4705069 commit 75eaf0c

4 files changed

Lines changed: 294 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-46fp-8f5p-pf2m/GHSA-46fp-8f5p-pf2m.json‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-46fp-8f5p-pf2m",
4+
"modified": "2026-03-18T17:26:48Z",
5+
"published": "2026-03-18T17:26:48Z",
6+
"aliases": [],
7+
"summary": "Improper detection of disallowed URIs by Loofah `allowed_uri?`",
8+
"details": "## Summary\n\n`Loofah::HTML5::Scrub.allowed_uri?` does not correctly reject `javascript:` URIs when the scheme is split by HTML entity-encoded control characters such as `
` (carriage return), `
` (line feed), or `	` (tab).\n\n## Details\n\nThe `allowed_uri?` method strips literal control characters before decoding HTML entities. Payloads like `java
script:alert(1)` survive the control character strip, then `
` is decoded to a carriage return, producing `java\\rscript:alert(1)`.\n\nNote that the Loofah sanitizer's default `sanitize()` path is **not affected** because Nokogiri decodes HTML entities during parsing before Loofah evaluates the URI protocol. This issue only affects direct callers of the `allowed_uri?` string-level helper when passing HTML-encoded strings.\n\n## Impact\n\nApplications that call `Loofah::HTML5::Scrub.allowed_uri?` to validate user-controlled URLs and then render approved URLs into `href` or other browser-interpreted URI attributes may be vulnerable to cross-site scripting (XSS).\n\nThis only affects Loofah `2.25.0`.\n\n## Mitigation\n\nUpgrade to Loofah >= `2.25.1`.\n\n## Credit\n\nResponsibly reported by HackOne user `@smlee`.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "RubyGems",
19+
"name": "loofah"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "2.25.0"
27+
},
28+
{
29+
"fixed": "2.25.1"
30+
}
31+
]
32+
}
33+
],
34+
"versions": [
35+
"2.25.0"
36+
]
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/flavorjones/loofah/security/advisories/GHSA-46fp-8f5p-pf2m"
43+
},
44+
{
45+
"type": "PACKAGE",
46+
"url": "https://github.com/flavorjones/loofah"
47+
}
48+
],
49+
"database_specific": {
50+
"cwe_ids": [
51+
"CWE-79"
52+
],
53+
"severity": "LOW",
54+
"github_reviewed": true,
55+
"github_reviewed_at": "2026-03-18T17:26:48Z",
56+
"nvd_published_at": null
57+
}
58+
}

‎advisories/github-reviewed/2026/03/GHSA-677m-j7p3-52f9/GHSA-677m-j7p3-52f9.json‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-677m-j7p3-52f9",
4+
"modified": "2026-03-18T17:26:14Z",
5+
"published": "2026-03-18T17:26:14Z",
6+
"aliases": [
7+
"CVE-2026-33151"
8+
],
9+
"summary": "socket.io allows an unbounded number of binary attachments",
10+
"details": "### Impact\n\nA specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory.\n\n### Patches\n\n| Version range | Used by | Fixed version |\n|------------------|--------------------------------------------|---------------|\n| `>=4.0.0 <4.2.6` | `socket.io@4.x` and `socket.io-client@4.x` | `4.2.6` |\n| `>=3.4.0 <3.4.4` | `socket.io@2.x` | `3.4.4` |\n| `<3.3.5` | `socket.io-client@2.x` | `3.3.5` |\n\n### Workarounds\n\nThere is no known workaround except upgrading to a safe version.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Open a discussion [here](https://github.com/socketio/socket.io/discussions)",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "socket.io-parser"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "3.3.5"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "npm",
40+
"name": "socket.io-parser"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "3.4.0"
48+
},
49+
{
50+
"fixed": "3.4.4"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "npm",
59+
"name": "socket.io-parser"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "4.0.0"
67+
},
68+
{
69+
"fixed": "4.2.6"
70+
}
71+
]
72+
}
73+
]
74+
}
75+
],
76+
"references": [
77+
{
78+
"type": "WEB",
79+
"url": "https://github.com/socketio/socket.io/security/advisories/GHSA-677m-j7p3-52f9"
80+
},
81+
{
82+
"type": "WEB",
83+
"url": "https://github.com/socketio/socket.io/commit/719f9ebab0772ffb882bd614b387e585c1aa75d4"
84+
},
85+
{
86+
"type": "WEB",
87+
"url": "https://github.com/socketio/socket.io/commit/9d39f1f080510f036782f2177fac701cc041faaf"
88+
},
89+
{
90+
"type": "WEB",
91+
"url": "https://github.com/socketio/socket.io/commit/b25738c416c4e32fbff62ee182afa8f6d0dacf78"
92+
},
93+
{
94+
"type": "PACKAGE",
95+
"url": "https://github.com/socketio/socket.io"
96+
}
97+
],
98+
"database_specific": {
99+
"cwe_ids": [
100+
"CWE-754"
101+
],
102+
"severity": "HIGH",
103+
"github_reviewed": true,
104+
"github_reviewed_at": "2026-03-18T17:26:14Z",
105+
"nvd_published_at": null
106+
}
107+
}

‎advisories/github-reviewed/2026/03/GHSA-6g43-577r-wf4x/GHSA-6g43-577r-wf4x.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6g43-577r-wf4x",
4+
"modified": "2026-03-18T17:26:27Z",
5+
"published": "2026-03-18T17:26:27Z",
6+
"aliases": [
7+
"CVE-2026-32937"
8+
],
9+
"summary": "Out-of-Bounds Slice Access in free5GC CHF Leading to DoS",
10+
"details": "### Impact\nThis is an out-of-bounds slice access vulnerability in the CHF `nchf-convergedcharging` service.\nA valid authenticated request to PUT `/nchf-convergedcharging/v3/recharging/:ueId?ratingGroup=...` can trigger a server-side panic in `github.com/free5gc/chf/internal/sbi.(*Server).RechargePut(...)` due to an out-of-range slice access. In the reported runtime, Gin recovery converts the panic into HTTP 500, but the recharge path remains remotely panic-triggerable and can be abused repeatedly to degrade recharge functionality and flood logs. In deployments without equivalent recovery handling, this panic may cause more severe service disruption.\n\n### Patches\nhttps://github.com/free5gc/chf/pull/61\n\n### Workarounds\n- Restrict access to the `nchf-convergedcharging` recharge endpoint to strictly trusted NF callers only.\n- Apply rate limiting or network ACLs in front of the CHF SBI interface to reduce repeated panic-trigger attempts.\n- If the recharge API is not required, temporarily disable or block external reachability to this route.\n- Ensure panic recovery, monitoring, and alerting are enabled.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/free5gc/chf"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.2.2"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-6g43-577r-wf4x"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/free5gc/free5gc/issues/864"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/free5gc/chf/pull/61"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/free5gc/chf/commit/55af766f321a00afa978e806548c96f8a7d2433e"
54+
},
55+
{
56+
"type": "PACKAGE",
57+
"url": "https://github.com/free5gc/chf"
58+
}
59+
],
60+
"database_specific": {
61+
"cwe_ids": [
62+
"CWE-129"
63+
],
64+
"severity": "HIGH",
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2026-03-18T17:26:27Z",
67+
"nvd_published_at": null
68+
}
69+
}

‎advisories/github-reviewed/2026/03/GHSA-762r-27w2-q22j/GHSA-762r-27w2-q22j.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-762r-27w2-q22j",
4+
"modified": "2026-03-18T17:26:59Z",
5+
"published": "2026-03-18T17:26:59Z",
6+
"aliases": [
7+
"CVE-2026-33209"
8+
],
9+
"summary": "Avo has a XSS vulnerability on `return_to` param",
10+
"details": "## Description\n\nA reflected cross-site scripting (XSS) vulnerability exists in the `return_to` query parameter used in the avo interface.\n\nAn attacker can craft a malicious URL that injects arbitrary JavaScript, which is executed when he clicks a dynamically generated navigation button.\n\n## Impact\n\nThis vulnerability may allow execution of arbitrary JavaScript in the context of the application.\n\nImpact varies depending on deployment:\n- In unauthenticated setups: exploitable via crafted links sent to users\n- In authenticated setups: limited to authenticated users and requires interaction",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "RubyGems",
21+
"name": "avo"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "3.30.3"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 3.30.2"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/avo-hq/avo/security/advisories/GHSA-762r-27w2-q22j"
45+
},
46+
{
47+
"type": "PACKAGE",
48+
"url": "https://github.com/avo-hq/avo"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-79"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": true,
57+
"github_reviewed_at": "2026-03-18T17:26:59Z",
58+
"nvd_published_at": null
59+
}
60+
}

0 commit comments

Comments
 (0)