Skip to content
Threat Feed
Subscribe

Tag

Code-Vulnerability

3 briefs RSS
high advisory

Stored XSS in @vue/server-renderer via Attribute Name Injection

An insufficient character blacklist in @vue/server-renderer allows attackers to inject arbitrary HTML attributes by including carriage return characters in dynamic binding keys.

@vue/server-renderer xss web-application vue ssr code-vulnerability
1t
high advisory

Grackle AI MCP Tool Layer Fail-Open Authorization Leads to IDOR and Privilege Escalation (GHSA-f9ff-5x35-7gfw)

The Grackle AI MCP tool layer, specifically versions of `@grackle-ai/mcp`, `@grackle-ai/plugin-core`, and `@grackle-ai/auth` up to `0.132.1`, suffers from an authorization bypass (IDOR) due to inconsistent inline checks, allowing a compromised scoped agent to perform unauthorized cross-task and cross-session operations, leading to data manipulation, denial of service, and sensitive data disclosure across workspaces.

@grackle-ai/mcp +2 idor authorization-bypass privilege-escalation denial-of-service code-vulnerability software-component
3t
high advisory

gitoxide Arbitrary Command Execution via .gitmodules Bypass

A vulnerability in gitoxide's `gix_submodule::File::update()` allows arbitrary command execution via a crafted `.gitmodules` file by incorrectly validating the source of the `update` command, enabling an attacker to inject malicious commands after a submodule has been initialized.

gix code-vulnerability remote-code-execution gitoxide
2r 1t 1c