Skip to content

Commit 521b576

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-7jc7-g598-2p64 GHSA-hx9m-jf43-8ffr GHSA-r8w2-w357-9pjv
1 parent ba0cd04 commit 521b576

3 files changed

Lines changed: 124 additions & 10 deletions

File tree

advisories/unreviewed/2026/01/GHSA-7jc7-g598-2p64/GHSA-7jc7-g598-2p64.json renamed to advisories/github-reviewed/2026/01/GHSA-7jc7-g598-2p64/GHSA-7jc7-g598-2p64.json

Lines changed: 30 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,49 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-7jc7-g598-2p64",
4-
"modified": "2026-01-21T15:31:15Z",
4+
"modified": "2026-01-21T16:56:55Z",
55
"published": "2026-01-20T18:31:57Z",
66
"aliases": [
77
"CVE-2025-65482"
88
],
9+
"summary": "XDocReport affected by an XML External Entity (XXE) vulnerability",
910
"details": "An XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "fr.opensagres.xdocreport:fr.opensagres.xdocreport.document"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0.9.2"
29+
},
30+
{
31+
"fixed": "2.0.4"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
2041
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65482"
2142
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/opensagres/xdocreport/commit/d9b90ae6c9489dc43f6427ec7b315cab34125332"
46+
},
2247
{
2348
"type": "WEB",
2449
"url": "https://drive.google.com/drive/folders/1hUyCznpBN7ivo5krmyJ4OQc_q626Hy5q?usp=sharing"
@@ -28,7 +53,7 @@
2853
"url": "https://github.com/AT190510-Cuong/CVE-2025-65482-XXE-"
2954
},
3055
{
31-
"type": "WEB",
56+
"type": "PACKAGE",
3257
"url": "https://github.com/opensagres/xdocreport"
3358
},
3459
{
@@ -45,8 +70,8 @@
4570
"CWE-611"
4671
],
4772
"severity": "CRITICAL",
48-
"github_reviewed": false,
49-
"github_reviewed_at": null,
73+
"github_reviewed": true,
74+
"github_reviewed_at": "2026-01-21T16:56:55Z",
5075
"nvd_published_at": "2026-01-20T16:16:06Z"
5176
}
5277
}

‎advisories/github-reviewed/2026/01/GHSA-hx9m-jf43-8ffr/GHSA-hx9m-jf43-8ffr.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hx9m-jf43-8ffr",
4+
"modified": "2026-01-21T16:57:06Z",
5+
"published": "2026-01-21T16:57:06Z",
6+
"aliases": [
7+
"CVE-2026-23956"
8+
],
9+
"summary": "seroval affected by Denial of Service via RegExp serialization",
10+
"details": "Overriding RegExp serialization with extremely large patterns can **exhaust JavaScript runtime memory** during deserialization. Additionally, overriding RegExp serialization with patterns that trigger **catastrophic backtracking** can lead to ReDoS (Regular Expression Denial of Service). \n\n**Mitigation**: \n`Seroval` introduces `disabledFeatures` (a bitmask) in serialization/deserialization methods, with `Feature.RegExp` as a dedicated flag. **Users are recommended to configure `disabledFeatures` to disable RegExp serialization entirely.**",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "seroval"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.4.1"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 1.4.0"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-hx9m-jf43-8ffr"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060"
49+
},
50+
{
51+
"type": "PACKAGE",
52+
"url": "https://github.com/lxsmnsyc/seroval"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-1333"
58+
],
59+
"severity": "HIGH",
60+
"github_reviewed": true,
61+
"github_reviewed_at": "2026-01-21T16:57:06Z",
62+
"nvd_published_at": null
63+
}
64+
}

advisories/unreviewed/2026/01/GHSA-r8w2-w357-9pjv/GHSA-r8w2-w357-9pjv.json renamed to advisories/github-reviewed/2026/01/GHSA-r8w2-w357-9pjv/GHSA-r8w2-w357-9pjv.json

Lines changed: 30 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-r8w2-w357-9pjv",
4-
"modified": "2026-01-21T15:31:15Z",
4+
"modified": "2026-01-21T16:56:50Z",
55
"published": "2026-01-20T18:31:57Z",
66
"aliases": [
77
"CVE-2025-64087"
88
],
9+
"summary": "XDocReport affected by a Server-Side Template Injection (SSTI) vulnerability",
910
"details": "A Server-Side Template Injection (SSTI) vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers to execute arbitrary code via injecting crafted template expressions.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "fr.opensagres.xdocreport:fr.opensagres.xdocreport.template.freemarker"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.1.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -25,10 +46,14 @@
2546
},
2647
{
2748
"type": "WEB",
28-
"url": "https://github.com/AT190510-Cuong/CVE-2025-64087-SSTI-"
49+
"url": "https://github.com/opensagres/xdocreport/commit/3b35d105e5ae2006bcaa2b07563188efc466711d"
2950
},
3051
{
3152
"type": "WEB",
53+
"url": "https://github.com/AT190510-Cuong/CVE-2025-64087-SSTI-"
54+
},
55+
{
56+
"type": "PACKAGE",
3257
"url": "https://github.com/opensagres/xdocreport"
3358
},
3459
{
@@ -45,8 +70,8 @@
4570
"CWE-1336"
4671
],
4772
"severity": "CRITICAL",
48-
"github_reviewed": false,
49-
"github_reviewed_at": null,
73+
"github_reviewed": true,
74+
"github_reviewed_at": "2026-01-21T16:56:50Z",
5075
"nvd_published_at": "2026-01-20T16:16:06Z"
5176
}
5277
}

0 commit comments

Comments
 (0)