Vulnerabilities

A security vulnerability has been detected in MauricioMilano coder-api up to 1.1.0. Affected is the function createProject of the file src/core/projects.ts of the component Projects Endpoint. The manipulation leads to command injection. The attack must be carried out locally. The project was informed of the problem early through an issue report but has not responded yet.

A security flaw has been discovered in adolfosalasgomez3011 slidev-builder-mcp 2.1.0. This affects the function generateChart of the file src/tools/generateAssets.ts of the component generateAssets Tool. Performing a manipulation of the argument outputDir results in command injection. The attack is only possible with local access. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was identified in MIMICLab mcp-pdf-vision 1.1.0. The impacted element is the function load_pdf of the file src/index.ts. Such manipulation of the argument pdfPath/sessionId leads to command injection. The attack can only be performed from a local environment. The project was informed of the problem early through an issue report but has not responded yet.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> libceph: fix two unsafe bare decodes in decode_lockers()<br /> <br /> decode_lockers() in cls_lock_client.c contains two bare decode operations<br /> that allow a malicious or compromised OSD to trigger slab-out-of-bounds<br /> reads:<br /> <br /> 1. ceph_decode_32(p) at the num_lockers field has no preceding bounds<br /> check. ceph_start_decoding() accepts struct_len=0 as valid -- the<br /> internal ceph_decode_need(p, end, 0, bad) always passes -- so when an<br /> OSD sends struct_len=0, ceph_start_decoding() returns success with<br /> p == end. The immediately following bare ceph_decode_32(p) then reads<br /> 4 bytes past the validated buffer boundary. The garbage value is<br /> passed directly to kzalloc_objs() as the locker count.<br /> <br /> The sibling function decode_watchers() in osd_client.c already uses<br /> ceph_decode_32_safe() after its own ceph_start_decoding() call.<br /> decode_lockers() was the only site using the bare variant.<br /> <br /> 2. ceph_decode_8(p) after the decode_locker() loop has no preceding<br /> bounds check. If an OSD crafts num_lockers such that the loop<br /> advances p exactly to end, the subsequent bare ceph_decode_8(p) reads<br /> one byte past the validated buffer boundary. The result is passed<br /> directly into *type, which is used as a lock type discriminator by<br /> callers, giving an OSD-controlled one-byte OOB read with direct<br /> influence over the lock type field.<br /> <br /> Fix both by replacing bare operations with their safe variants:<br /> ceph_decode_32(p) -&gt; ceph_decode_32_safe(p, end, *num_lockers,<br /> err_inval)<br /> ceph_decode_8(p) -&gt; ceph_decode_8_safe(p, end, *type,<br /> err_free_lockers)<br /> <br /> The goto targets differ intentionally:<br /> err_inval: is a new label returning -EINVAL directly. It is used for<br /> the pre-allocation failure path where *lockers is not yet allocated<br /> and must not be passed to ceph_free_lockers().<br /> <br /> err_free_lockers: is the existing label. It is used for the<br /> post-allocation failure path where *lockers is allocated and must<br /> be freed.<br /> <br /> ret is set to -EINVAL before ceph_decode_8_safe() so that<br /> err_free_lockers returns the correct error code on bounds violation.<br /> Without this, err_free_lockers would return a stale ret value (0 from<br /> the successful decode_locker() loop), silently swallowing the error.<br /> <br /> -EINVAL is correct for both failure paths. The data received from the<br /> OSD is structurally malformed. -ENOMEM would misrepresent the failure<br /> class to callers and to stable@ backporters triaging error paths.<br /> <br /> Attacker model: a malicious or compromised OSD in a multi-tenant Ceph<br /> deployment can trigger this against any kernel client that issues the<br /> lock.get_info class method (e.g. during RBD exclusive lock acquisition).<br /> <br /> [ idryomov: trim changelog, formatting ]

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state<br /> <br /> Put all vmcs12 pages if KVM synthesizes a nested VM-Exit due to invalid<br /> guest while emulating VMLAUNCH or VMRESUME. The invalid guest state path<br /> doesn&amp;#39;t use nested_vmx_vmexit() as that API is intended to be used if and<br /> only if L2 is active, and the open coded equivalent neglects to put the<br /> vmcs12 pages. Failure to put the vmcs12 pages leaks any pinned pages<br /> (and/or mappings) if L1 retries VMLAUNCH/VMRESUME.<br /> <br /> Note, the !from_vmenter scenario doesn&amp;#39;t suffer the same problem, as<br /> vmx_get_nested_state_pages() only gets/pins/maps the vmcs12 pages if L2 is<br /> active, i.e. if a "full" VM-Exit is guaranteed before KVM will retry<br /> getting vmcs12 pages.

A security flaw has been discovered in Hulupeep mcp-ui-probe up to 0.2.0. Affected is the function get_journey/delete_journey/analyze_journey/usage_stats of the file src/journey/JourneyStorage.ts of the component Journey/Usage. The manipulation of the argument journeyId/filename results in path traversal. The attack requires a local approach. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the file src/mcp/utils/gitUtils.ts of the component review-git-diff Endpoint. Executing a manipulation of the argument args can lead to command injection. Upgrading to version 1.9.1 mitigates this issue. This patch is called e0729dcfd3a2b1682a7bff86e7174852c03419ba. It is advisable to upgrade the affected component.

A vulnerability was identified in abdullah1854 MCPGateway up to 549f494a9e363f40530149de324b8097de424230. This impacts the function getUsageByDateRange of the file src/services/claude-usage.ts of the component Claude Usage Range Endpoint. The manipulation of the argument since leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site&amp;#39;s user list and unpublished listings belonging to other users.

The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site&amp;#39;s download statistics.

The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and delete imported site-builder content.

The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest&amp;#39;s uploaded chatbot files before deletion, authorising the action solely by a client-supplied session cookie value, so an unauthenticated attacker who obtains a victim&amp;#39;s session identifier and file reference can delete that victim&amp;#39;s uploaded files.