Page 24
A critical command injection vulnerability was discovered in `Plugins/converter.js` where `exec()` was used to invoke ffmpeg with unsanitized user-controlled input. By switching from `exec()` to `execFile()` with an argument array, the fix eliminates shell interpretation and prevents attackers from injecting arbitrary commands through media file paths.
A high-severity denial of service vulnerability (CVE-2026-25639) was discovered in Axios versions prior to 1.13.5, where the `mergeConfig` function failed to properly sanitize the `__proto__` key in configuration objects. This prototype pollution vulnerability could allow attackers to crash Node.js applications or cause unexpected behavior by manipulating JavaScript's prototype chain. The fix involved upgrading from Axios 1.13.2 to 1.18.0, which includes enhanced input validation in the configur
A missing `trustPolicy` setting in `pnpm-workspace.yaml` left a Node.js workspace vulnerable to malicious packages silently downgrading security configurations. The fix adds `trustPolicy: no-downgrade` alongside `blockExoticSubdeps: true` and a stricter `minimumReleaseAge`, closing a supply-chain attack primitive before it could be chained with other weaknesses.
A critical command injection vulnerability was discovered in app.js where the `exec()` function was used to run system commands with shell interpolation enabled. This allowed potential attackers to inject malicious commands through manipulated input. The fix replaces `exec()` with `execFile()`, which bypasses shell parsing entirely and executes binaries directly.
A DOM-based Cross-Site Scripting (XSS) vulnerability was discovered in the VvvebJs web editor's `inputs.js` file where the jQuery `tagsInput()` function at line 932 directly inserted user-controlled data into the DOM without sanitization. The fix applies HTML entity encoding to all string values before they reach the DOM, preventing malicious script injection while preserving legitimate tag functionality.
A high-severity CSRF vulnerability was discovered in Moodle's VvvebJs page builder where POST requests to `saveReusableUrl` and `saveUrl` endpoints lacked CSRF token validation. Without proper sesskey inclusion, attackers could trick authenticated users into executing unauthorized page modifications. The fix adds Moodle's sesskey token to both client-side fetch requests and enforces server-side validation with `require_sesskey()`.
CVE-2026-39244 is a high-severity Denial of Service vulnerability in the `adm-zip` npm package (versions before 0.6.0) that allows an attacker to cause excessive memory allocation by supplying a specially crafted ZIP file. The vulnerability was present in the `dsh-mneme` component of the project and was remediated by upgrading `adm-zip` from `0.5.18` to `0.6.0`. Left unpatched, this flaw could allow any user capable of uploading or supplying ZIP input to crash or severely degrade the Node.js ser
A critical path traversal vulnerability in `scripts/build-all.js` allowed attackers to escape the intended output directory by supplying crafted command-line arguments like `--output ../../../../etc/passwd`. The fix validates that the resolved output path remains within the repository root, preventing unauthorized file system access.
A high-severity Denial of Service vulnerability (CVE-2026-69152) was discovered in the `brace-expansion` npm package, where crafted input could generate unbounded intermediate arrays that exhaust system memory. This bypasses the earlier CVE-2026-14257 mitigation. The fix upgrades `brace-expansion` from version 1.1.12 (and 2.0.2) to patched versions 1.1.18 across the dependency tree in the `exia-invasion` project.
A critical password hashing weakness was discovered in the authentication controller where bcrypt was configured with only 10 salt rounds instead of the recommended minimum of 12. This configuration made user passwords significantly more vulnerable to brute-force attacks if an attacker gained access to the password hash database. The fix was a simple but impactful one-line change that doubles the computational cost required to crack passwords.
A high-severity security vulnerability was discovered in a React-Express booking application where the Express backend lacked CSRF middleware protection, while the frontend's coupon code input field in `Listing.jsx` allowed unrestricted user input. The fix implemented strict input validation using a regex pattern that whitelists only alphanumeric characters, hyphens, and underscores, preventing malicious payloads from reaching backend database operations.
A high-severity command injection vulnerability was discovered in `bin/cli.js` where user-controlled input was passed directly to `execSync()` without sanitization, potentially allowing attackers to execute arbitrary shell commands. The fix replaces shell-based execution with `execFileSync()` using an argv array, eliminating the attack surface entirely. This proactive hardening prevents exploitation of the Claude plugin marketplace install/update/uninstall functionality.