Skip to content

Commit b4a354a

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-g5vp-j278-8pjh GHSA-8rh7-6779-cjqq GHSA-f6j3-w9v3-cq22 GHSA-ghq9-vc6f-8qjf
1 parent 91f7b0a commit b4a354a

File tree

4 files changed

+256
-6
lines changed

4 files changed

+256
-6
lines changed

‎advisories/github-reviewed/2024/11/GHSA-g5vp-j278-8pjh/GHSA-g5vp-j278-8pjh.json‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-g5vp-j278-8pjh",
4-
"modified": "2025-01-21T19:43:05Z",
4+
"modified": "2026-04-01T00:03:50Z",
55
"published": "2024-11-12T18:30:59Z",
6-
"aliases": [
7-
"CVE-2024-49048"
8-
],
9-
"summary": "TorchGeo Remote Code Execution Vulnerability",
10-
"details": "TorchGeo Remote Code Execution Vulnerability",
6+
"withdrawn": "2026-04-01T00:03:50Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: TorchGeo Remote Code Execution Vulnerability",
9+
"details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-ghq9-vc6f-8qjf. This link is maintained to preserve external references.\n\n## Original Description\nTorchGeo Remote Code Execution Vulnerability",
1110
"severity": [
1211
{
1312
"type": "CVSS_V3",

‎advisories/github-reviewed/2026/04/GHSA-8rh7-6779-cjqq/GHSA-8rh7-6779-cjqq.json‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8rh7-6779-cjqq",
4+
"modified": "2026-04-01T00:02:42Z",
5+
"published": "2026-04-01T00:02:42Z",
6+
"aliases": [],
7+
"summary": "OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover",
8+
"details": "## Summary\n\nOpenClaw loaded the current working directory `.env` before trusted state-dir configuration, allowing untrusted workspace state to inject host environment values.\n\n## Impact\n\nA repository or workspace containing a malicious `.env` file could override runtime configuration and security-sensitive environment settings when OpenClaw started there.\n\n## Affected Component\n\n`src/infra/dotenv.ts, src/cli/dotenv.ts`\n\n## Fixed Versions\n\n- Affected: `<= 2026.3.24`\n- Patched: `>= 2026.3.28`\n- Latest stable `2026.3.28` contains the fix.\n\n## Fix\n\nFixed by commit `6a79324802` (`Filter untrusted CWD .env entries before OpenClaw startup`).",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "openclaw"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "2026.3.28"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 2026.3.24"
36+
}
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-8rh7-6779-cjqq"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://github.com/openclaw/openclaw/commit/6a793248024dca7685f63bcceb64a0096fd1586d"
47+
},
48+
{
49+
"type": "PACKAGE",
50+
"url": "https://github.com/openclaw/openclaw"
51+
},
52+
{
53+
"type": "WEB",
54+
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.3.28"
55+
}
56+
],
57+
"database_specific": {
58+
"cwe_ids": [
59+
"CWE-426"
60+
],
61+
"severity": "CRITICAL",
62+
"github_reviewed": true,
63+
"github_reviewed_at": "2026-04-01T00:02:42Z",
64+
"nvd_published_at": null
65+
}
66+
}

‎advisories/github-reviewed/2026/04/GHSA-f6j3-w9v3-cq22/GHSA-f6j3-w9v3-cq22.json‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f6j3-w9v3-cq22",
4+
"modified": "2026-04-01T00:03:19Z",
5+
"published": "2026-04-01T00:03:19Z",
6+
"aliases": [
7+
"CVE-2026-34574"
8+
],
9+
"summary": "Parse Server has a session field immutability bypass via falsy-value guard",
10+
"details": "### Impact\n\nAn authenticated user can bypass the immutability guard on session fields (`expiresAt`, `createdWith`) by sending a null value in a PUT request to the session update endpoint. This allows nullifying the session expiry, making the session valid indefinitely and bypassing configured session length policies.\n\n### Patches\n\nThe truthiness-based guard checks were replaced with key-presence checks that reject any value for protected session fields, including null.\n\n### Workarounds\n\nThere is no known workaround. A `beforeSave` trigger on `_Session` could be used to reject null values for `expiresAt` and `createdWith`.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "parse-server"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "9.0.0"
29+
},
30+
{
31+
"fixed": "9.7.0-alpha.14"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "npm",
40+
"name": "parse-server"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "0"
48+
},
49+
{
50+
"fixed": "8.6.69"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-f6j3-w9v3-cq22"
61+
},
62+
{
63+
"type": "ADVISORY",
64+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34574"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://github.com/parse-community/parse-server/pull/10347"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://github.com/parse-community/parse-server/pull/10348"
73+
},
74+
{
75+
"type": "WEB",
76+
"url": "https://github.com/parse-community/parse-server/commit/90802969fc713b7bc9733d7255c7519a6ed75d21"
77+
},
78+
{
79+
"type": "WEB",
80+
"url": "https://github.com/parse-community/parse-server/commit/ebccd7fe2708007e62f705ee1c820a6766178777"
81+
},
82+
{
83+
"type": "PACKAGE",
84+
"url": "https://github.com/parse-community/parse-server"
85+
}
86+
],
87+
"database_specific": {
88+
"cwe_ids": [
89+
"CWE-697"
90+
],
91+
"severity": "MODERATE",
92+
"github_reviewed": true,
93+
"github_reviewed_at": "2026-04-01T00:03:19Z",
94+
"nvd_published_at": "2026-03-31T16:16:33Z"
95+
}
96+
}

‎advisories/github-reviewed/2026/04/GHSA-ghq9-vc6f-8qjf/GHSA-ghq9-vc6f-8qjf.json‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-ghq9-vc6f-8qjf",
4+
"modified": "2026-04-01T00:03:56Z",
5+
"published": "2026-04-01T00:03:56Z",
6+
"aliases": [
7+
"CVE-2024-49048"
8+
],
9+
"summary": "TorchGeo Remote Code Execution Vulnerability",
10+
"details": "### Impact\n\nTorchGeo 0.4–0.6.0 used an [`eval`](https://docs.python.org/3/library/functions.html#eval) statement in its model weight API that could allow an unauthenticated, remote attacker to execute arbitrary commands. All platforms that expose [`torchgeo.models.get_weight()`](https://torchgeo.readthedocs.io/en/v0.6.0/api/models.html#torchgeo.models.get_weight) or [`torchgeo.trainers`](https://torchgeo.readthedocs.io/en/v0.6.0/api/trainers.html) as an external API could be affected.\n\n### Patches\n\nThe `eval` statement was replaced with a fixed enum lookup, preventing arbitrary code injection. All users are encouraged to upgrade to TorchGeo 0.6.1 or newer.\n\n### Workarounds\n\nIn unpatched versions, input validation and sanitization can be used to avoid this vulnerability.\n\n### References\n\n#### Bug history\n\n* Introduced: https://github.com/torchgeo/torchgeo/pull/917\n* Patched: https://github.com/torchgeo/torchgeo/pull/2323\n* Released: [v0.6.1](https://github.com/microsoft/torchgeo/releases/tag/v0.6.1)",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "torchgeo"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0.4"
29+
},
30+
{
31+
"fixed": "0.6.1"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 0.6.0"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/torchgeo/torchgeo/security/advisories/GHSA-ghq9-vc6f-8qjf"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49048"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/torchgeo/torchgeo/pull/2323"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://github.com/torchgeo/torchgeo/pull/917"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/torchgeo/torchgeo/commit/1a980788cb7089a1115f3b786c7daa9dd47d7d7a"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://github.com/microsoft/torchgeo/releases/tag/v0.6.1"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/torchgeo/PYSEC-2024-204.yaml"
69+
},
70+
{
71+
"type": "PACKAGE",
72+
"url": "https://github.com/torchgeo/torchgeo"
73+
},
74+
{
75+
"type": "WEB",
76+
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49048"
77+
}
78+
],
79+
"database_specific": {
80+
"cwe_ids": [
81+
"CWE-94",
82+
"CWE-95"
83+
],
84+
"severity": "HIGH",
85+
"github_reviewed": true,
86+
"github_reviewed_at": "2026-04-01T00:03:56Z",
87+
"nvd_published_at": null
88+
}
89+
}

0 commit comments

Comments
 (0)