CWE-918

{
  "affected": [],
  "aliases": [
    "CVE-2024-56471"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-05T23:15:09Z",
    "severity": "MODERATE"
  },
  "details": "IBM Aspera Shares\u00a01.9.0 through 1.10.0 PL6  is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.",
  "id": "GHSA-2xhr-8668-crpg",
  "modified": "2025-02-06T06:31:26Z",
  "published": "2025-02-06T06:31:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56471"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7182490"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-23768"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-16T06:15:51Z",
    "severity": "MODERATE"
  },
  "details": "lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListener or EmbedSecurityListener option is enabled and embed or object tags are used with a src attribute missing a file extension.",
  "id": "GHSA-2xhv-22cq-xj7w",
  "modified": "2026-01-16T18:31:31Z",
  "published": "2026-01-16T06:30:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23768"
    },
    {
      "type": "WEB",
      "url": "https://github.com/naver/lucy-xss-filter/pull/31"
    },
    {
      "type": "WEB",
      "url": "https://cve.naver.com/detail/cve-2026-23768.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-15330"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-10T05:16:33Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was determined in zhayujie CowAgent up to 2.1.1. Impacted is the function _build_image_content/_download_to_data_url of the file agent/tools/vision/vision.py of the component Vision Tool. Executing a manipulation of the argument image can lead to server-side request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.1.2 is recommended to address this issue. This patch is called e85290cddcbb5ffc9c235927f4c92e5b4c3ec264. Upgrading the affected component is advised.",
  "id": "GHSA-2xj7-6vvg-p9hp",
  "modified": "2026-07-10T06:31:21Z",
  "published": "2026-07-10T06:31:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15330"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zhayujie/CowAgent/issues/2872"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zhayujie/CowAgent/pull/2886"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zhayujie/CowAgent/commit/e85290cddcbb5ffc9c235927f4c92e5b4c3ec264"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zhayujie/CowAgent"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zhayujie/CowAgent/releases/tag/2.1.2"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-15330"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/853103"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/377273"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/377273/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-6195"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-31T00:15:08Z",
    "severity": "LOW"
  },
  "details": "An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.5 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. GitLab was vulnerable to Server Side Request Forgery when an attacker uses a malicious URL in the markdown  image value when importing a GitHub repository.",
  "id": "GHSA-2xjp-r9f7-cm2x",
  "modified": "2025-01-31T00:30:44Z",
  "published": "2025-01-31T00:30:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6195"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/2249268"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/432276"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-12605"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-06T14:16:20Z",
    "severity": "CRITICAL"
  },
  "details": "In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if the victim is authenticated into the Admin Console -\\\u003e full unauthenticated takeover of Eclipse GlassFish domain until the token expires.",
  "id": "GHSA-325x-xm3p-mmv6",
  "modified": "2026-08-06T15:32:43Z",
  "published": "2026-08-06T15:32:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12605"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/127"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/445"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2007-6758"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-01-23T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Server-side request forgery (SSRF) vulnerability in feed-proxy.php in extjs 5.0.0.",
  "id": "GHSA-3267-cjm3-377p",
  "modified": "2022-04-21T01:48:50Z",
  "published": "2022-04-21T01:48:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-6758"
    },
    {
      "type": "WEB",
      "url": "http://attrition.org/pipermail/vim/2007-April/001545.html"
    },
    {
      "type": "WEB",
      "url": "http://cxsecurity.com/issue/WLB-2015050162"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2016-5968"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2016-11-25T03:59:00Z",
    "severity": "MODERATE"
  },
  "details": "The Replay Server in IBM Tealeaf Customer Experience 8.x before 8.7.1.8847 FP10, 8.8.x before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, 9.0.1A before 9.0.1.5108 FP5, 9.0.2 before 9.0.2.1223 FP3, and 9.0.2A before 9.0.2.5224 FP3 allows remote attackers to conduct SSRF attacks via unspecified vectors.",
  "id": "GHSA-328r-gg4v-8wh6",
  "modified": "2022-05-17T03:40:07Z",
  "published": "2022-05-17T03:40:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5968"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21989374"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/94516"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-0455"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-26T16:27:50Z",
    "severity": "CRITICAL"
  },
  "details": "The inclusion of the web scraper for AnythingLLM means that any user with the proper authorization level (manager, admin, and when in single user) could put in the URL\n```\nhttp://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance\n```\nwhich is a special IP and URL that resolves only when the request comes from within an EC2 instance. This would allow the user to see the connection/secret credentials for their specific instance and be able to manage it regardless of who deployed it.\n\nThe user would have to have pre-existing knowledge of the hosting infra which the target instance is deployed on, but if sent - would resolve if on EC2 and the proper `iptable` or firewall rule is not configured for their setup.",
  "id": "GHSA-32rv-jjcf-cmrm",
  "modified": "2024-02-26T18:30:29Z",
  "published": "2024-02-26T18:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0455"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mintplex-labs/anything-llm/commit/b2b2c2afe15c48952d57b4d01e7108f9515c5f55"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/07d83b49-7ebb-40d2-83fc-78381e3c5c9c"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-5014"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-25T21:16:00Z",
    "severity": "HIGH"
  },
  "details": "In WhatsUp Gold versions released before 2023.1.3, a Server Side Request Forgery vulnerability exists in the\u00a0GetASPReport feature. This allows any authenticated user to retrieve ASP reports from an HTML form.",
  "id": "GHSA-3325-26ch-q5p3",
  "modified": "2024-08-21T15:30:49Z",
  "published": "2024-06-25T21:31:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5014"
    },
    {
      "type": "WEB",
      "url": "https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024"
    },
    {
      "type": "WEB",
      "url": "https://www.progress.com/network-monitoring"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.6.3"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "jupyterlab"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.6.0"
            },
            {
              "fixed": "4.6.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.5.10"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "jupyterlab"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.5.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-102904"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209",
      "CWE-88",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-01T15:21:17Z",
    "nvd_published_at": "2026-09-29T21:17:18Z",
    "severity": "MODERATE"
  },
  "details": "JupyterLab\u0027s PyPI extension manager runs `python -m pip uninstall` with the extension name taken from the request body. `ExtensionHandler.post` validates the name for `cmd=install` but not for `cmd=uninstall`, so a name that begins with `-` reaches the command line and pip reads it as an option rather than as a package.\n\n```python\ncmdline = [\n    sys.executable,\n    \"-m\",\n    \"pip\",\n    \"uninstall\",\n    \"--yes\",\n    \"--no-input\",\n    extension,\n]\n```\n\nAn extension name of the form `-r` followed by a path therefore made pip open that path as a requirements file. pip\u0027s parse error quotes the line it could not read and names the file it came from, and JupyterLab returned that error in the response body, so the line reached the requester.\n\nThis has security implications only for deployments that combine all of the following:\n\n- the (default) PyPI Extension Manager enabled, so that uninstall requests reach pip;\n- an authenticated account permitted to call the extension API; and\n- kernels and terminals disabled or delegated to remote hosts (otherwise a user with kernel access can read the same files and make the same outbound requests directly, regardless of this endpoint)\n\nUnlike [GHSA-37w4-hwhx-4rc4](https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-37w4-hwhx-4rc4) and [GHSA-89vp-jrxv-24w8](https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-89vp-jrxv-24w8), this does not need an allowlist or blocklist to be configured. The uninstall path never consulted the listing.\n\n### Impact\n\nAn authenticated user gains a read of server-side files and an outbound request from the server, both outside the confinement that the contents root and the disabled kernels were meant to provide. The user cannot choose which line of a file is returned, and cannot write content of their choosing.\n\n#### Reading files the account cannot reach\n\n`-r\u003cpath\u003e` makes pip open the path as a requirements file. The first line that pip cannot parse as a requirement comes back in the response together with the path. Blank lines and `#` comments are skipped. A line that is a valid package name is accepted silently, and the request answers 201 with no message, so a secret made only of letters, digits, dots, hyphens and underscores is not disclosed. One line is returned per request, and the requester cannot select which one.\n\nThe same option distinguishes a missing path (`[Errno 2] No such file or directory`), an unreadable one (`[Errno 13] Permission denied`) and a directory (`[Errno 21] Is a directory`), so any path on the host can be probed for existence and readability.\n\n#### Reaching hosts and ports the account cannot reach\n\n`-r` also accepts a URL. pip fetches it with an ordinary GET from the server\u0027s network position and reflects the first unparsable line of the response body the same way. A response whose body is a single line comes back in full. In a deployment where the single-user server sits inside a private network, this reaches internal services and cloud instance metadata endpoints that the user has no other route to.\n\n#### Writing files\n\n`--log=\u003cpath\u003e` makes pip create that file if it is absent and append its own log to it otherwise. The content is pip\u0027s log text, not text the requester chooses, so the effect is to create files at chosen paths and to corrupt a file that has to parse, such as a configuration file read at the next start.\n\n#### What this does not add\n\nThe same endpoint already uninstalls any installed package when it is given an ordinary, valid package name, so the injection adds no availability impact beyond what the extension manager already permits. Deployments that treat that as unacceptable should use the read-only extension manager, as described below.\n\npip refuses `--python` after a subcommand name, and ignores editable entries in an uninstall requirements file, so neither gives code execution.\n\n### Patches\n\nJupyterLab [`v4.6.4`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.4) and [`v4.5.11`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.11) contain the patch. The uninstall name is now validated as a PyPI package name in both the HTTP handler and `PyPIExtensionManager.uninstall`, and the pip command line carries an explicit `--` before the package operand.\n\nUsers of applications that depend on JupyterLab, such as Notebook v7+, should update `jupyterlab` package too.\n\n### Workarounds\n\nDeployments wanting to disable programmatic extension installation and removal entirely can switch to the read-only extension manager:\n\n```bash\n--LabApp.extension_manager=readonly\n```\n\nor the following traitlet:\n\n```python\nc.LabApp.extension_manager = \u0027readonly\u0027\n```\n\nYou can confirm that the read-only manager is in use from GUI:\n\n\u003cimg width=\"293\" height=\"293\" alt=\"image\" src=\"https://github.com/user-attachments/assets/8016c809-633e-4ed0-a5bc-6bc4793caa0f\" /\u003e\n\nUsers lose the ability to install and remove extensions from the Extension Manager; extensions must then be installed by an administrator in the environment.\n\nNote: an egress policy that blocks outbound requests from the single-user server limits the reach of the URL variant, but does not address the file read or the file write.",
  "id": "GHSA-3325-v43h-43rv",
  "modified": "2026-10-01T15:21:17Z",
  "published": "2026-10-01T15:21:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-3325-v43h-43rv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102904"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/commit/9e1951e57da499ca66ef5e0caf68e71ad2e3d1a5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/commit/a274a8276b9185d03efd4c3c20713d3137ac49e6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/commit/e277bc958e737130ac47b6c5078d08b29298828f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jupyterlab/jupyterlab"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.11"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs"
}