Skip to content

Commit 891ced1

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-4rmq-mc2c-r495 GHSA-8jcj-g9f4-qx42 GHSA-8p44-g572-557h GHSA-hxp3-63hc-5366 GHSA-mg56-wc4q-rw4w GHSA-qgjp-5g5x-vhq2
1 parent 512ea3a commit 891ced1

File tree

6 files changed

+309
-16
lines changed

6 files changed

+309
-16
lines changed

‎advisories/github-reviewed/2025/12/GHSA-4rmq-mc2c-r495/GHSA-4rmq-mc2c-r495.json‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4rmq-mc2c-r495",
4+
"modified": "2025-12-09T14:25:03Z",
5+
"published": "2025-12-09T14:25:03Z",
6+
"aliases": [],
7+
"summary": "Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond",
8+
"details": "### Summary\n\nA state consistency bug in `x/costaking` can leave a BTC delegator with non-zero `ActiveSatoshis` (Phatom Stake) even after they have fully unbonded their BTC delegation, if their Finality Provider (FP) drops out of the active set in the exact same babylon block height. This creates a “phantom stake”: the delegator’s BTC capital is withdrawn, the FP is inactive, but costaking continues to treat the delegation as active BTC stake allowing ongoing rewards accrual without backing BTC.\n\n### Impact\n\nAn address can keep earning costaking rewards with zero BTC staked.\n\nReported by @BottyBott.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "Go",
19+
"name": "github.com/babylonlabs-io/babylon/v4"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "4.2.0"
30+
}
31+
]
32+
}
33+
]
34+
},
35+
{
36+
"package": {
37+
"ecosystem": "Go",
38+
"name": "github.com/babylonlabs-io/babylon/v3"
39+
},
40+
"ranges": [
41+
{
42+
"type": "ECOSYSTEM",
43+
"events": [
44+
{
45+
"introduced": "0"
46+
},
47+
{
48+
"last_affected": "3.0.0-snapshot.250805a"
49+
}
50+
]
51+
}
52+
]
53+
},
54+
{
55+
"package": {
56+
"ecosystem": "Go",
57+
"name": "github.com/babylonlabs-io/babylon/v2"
58+
},
59+
"ranges": [
60+
{
61+
"type": "ECOSYSTEM",
62+
"events": [
63+
{
64+
"introduced": "0"
65+
},
66+
{
67+
"last_affected": "2.3.2"
68+
}
69+
]
70+
}
71+
]
72+
},
73+
{
74+
"package": {
75+
"ecosystem": "Go",
76+
"name": "github.com/babylonlabs-io/babylon"
77+
},
78+
"ranges": [
79+
{
80+
"type": "ECOSYSTEM",
81+
"events": [
82+
{
83+
"introduced": "0"
84+
},
85+
{
86+
"last_affected": "1.1.0"
87+
}
88+
]
89+
}
90+
]
91+
}
92+
],
93+
"references": [
94+
{
95+
"type": "WEB",
96+
"url": "https://github.com/babylonlabs-io/babylon/security/advisories/GHSA-4rmq-mc2c-r495"
97+
},
98+
{
99+
"type": "WEB",
100+
"url": "https://github.com/babylonlabs-io/babylon/commit/e65c3a55a398a403103f1b089cf76f0d4befc7a0"
101+
},
102+
{
103+
"type": "PACKAGE",
104+
"url": "https://github.com/babylonlabs-io/babylon"
105+
}
106+
],
107+
"database_specific": {
108+
"cwe_ids": [
109+
"CWE-459"
110+
],
111+
"severity": "MODERATE",
112+
"github_reviewed": true,
113+
"github_reviewed_at": "2025-12-09T14:25:03Z",
114+
"nvd_published_at": null
115+
}
116+
}

advisories/unreviewed/2025/12/GHSA-8jcj-g9f4-qx42/GHSA-8jcj-g9f4-qx42.json renamed to advisories/github-reviewed/2025/12/GHSA-8jcj-g9f4-qx42/GHSA-8jcj-g9f4-qx42.json

Lines changed: 33 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8jcj-g9f4-qx42",
4-
"modified": "2025-12-08T18:30:42Z",
4+
"modified": "2025-12-09T14:25:29Z",
55
"published": "2025-12-08T18:30:42Z",
66
"aliases": [
77
"CVE-2025-65796"
88
],
9+
"summary": "memos vulnerability allows arbitrarily reactions deletion",
910
"details": "Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily delete reactions made to other users' Memos.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/usememos/memos"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.25.3"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -23,6 +44,14 @@
2344
"type": "WEB",
2445
"url": "https://github.com/usememos/memos/pull/5217"
2546
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/usememos/memos/commit/769dcd0cf9be83d472829f6e7903b201e42f6b3c"
50+
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/usememos/memos"
54+
},
2655
{
2756
"type": "WEB",
2857
"url": "https://herolab.usd.de/security-advisories/usd-2025-0060"
@@ -41,8 +70,8 @@
4170
"CWE-284"
4271
],
4372
"severity": "MODERATE",
44-
"github_reviewed": false,
45-
"github_reviewed_at": null,
73+
"github_reviewed": true,
74+
"github_reviewed_at": "2025-12-09T14:25:29Z",
4675
"nvd_published_at": "2025-12-08T16:15:53Z"
4776
}
4877
}

advisories/unreviewed/2025/12/GHSA-8p44-g572-557h/GHSA-8p44-g572-557h.json renamed to advisories/github-reviewed/2025/12/GHSA-8p44-g572-557h/GHSA-8p44-g572-557h.json

Lines changed: 33 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8p44-g572-557h",
4-
"modified": "2025-12-08T18:30:42Z",
4+
"modified": "2025-12-09T14:25:35Z",
55
"published": "2025-12-08T18:30:42Z",
66
"aliases": [
77
"CVE-2025-65798"
88
],
9+
"summary": "memos vulnerability allows arbitrarily modification or deletion of attachments",
910
"details": "Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete attachments made by other users.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/usememos/memos"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.25.3"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -23,6 +44,14 @@
2344
"type": "WEB",
2445
"url": "https://github.com/usememos/memos/pull/5217"
2546
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/usememos/memos/commit/769dcd0cf9be83d472829f6e7903b201e42f6b3c"
50+
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/usememos/memos"
54+
},
2655
{
2756
"type": "WEB",
2857
"url": "https://herolab.usd.de/security-advisories/usd-2025-0059"
@@ -41,8 +70,8 @@
4170
"CWE-284"
4271
],
4372
"severity": "MODERATE",
44-
"github_reviewed": false,
45-
"github_reviewed_at": null,
73+
"github_reviewed": true,
74+
"github_reviewed_at": "2025-12-09T14:25:35Z",
4675
"nvd_published_at": "2025-12-08T16:15:53Z"
4776
}
4877
}

‎advisories/github-reviewed/2025/12/GHSA-hxp3-63hc-5366/GHSA-hxp3-63hc-5366.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hxp3-63hc-5366",
4+
"modified": "2025-12-09T14:25:16Z",
5+
"published": "2025-12-09T14:25:15Z",
6+
"aliases": [
7+
"CVE-2025-66645"
8+
],
9+
"summary": "NiceGUI has a path traversal in app.add_media_files() allows arbitrary file read",
10+
"details": "### Summary\n\nA directory traversal vulnerability in NiceGUI's `App.add_media_files()` allows a remote attacker to read arbitrary files on the server filesystem.\n\n### Details\n\nHello, I am Seungbin Yang, a university student studying cybersecurity. \nWhile reviewing the source code of the repository, I discovered a potential vulnerability and successfully verified it with a PoC.\n\nThe `App.add_media_files(url_path, local_directory)` method allows users to serve media files. However, the implementation lacks proper path validation.\n\n```python\ndef add_media_files(self, url_path: str, local_directory: Union[str, Path]) -> None:\n @self.get(url_path.rstrip('/') + '/{filename:path}')\n def read_item(request: Request, filename: str, nicegui_chunk_size: int = 8192) -> Response:\n filepath = Path(local_directory) / filename\n if not filepath.is_file():\n raise HTTPException(status_code=404, detail='Not Found')\n return get_range_response(filepath, request, chunk_size=nicegui_chunk_size)\n```\nRoot Cause:\n1. The `{filename:path}` parameter accepts full paths, including traversal sequences like `../`.\n2. The code simply joins local_directory and filename without checking if the result is still inside the local_directory.\n3. There is no path sanitization or boundary check.\n\nConsequence:\nAn attacker can use `..` to access files outside the intended directory. If the application has permission, sensitive files (e.g., /etc/hosts, source code, config files) can be exposed.\n\n### POC\n1. Create `poc.py`:\n```python\n# poc.py\nfrom pathlib import Path\nfrom nicegui import app, ui\n\nMEDIA_DIR = Path(__file__).parent / 'media'\nMEDIA_DIR.mkdir(exist_ok=True)\n\n# Expose local \"media\" directory at /media\napp.add_media_files('/media', MEDIA_DIR)\n\[email protected]('/')\ndef index():\n ui.label('NiceGUI media PoC')\n\nui.run(port=8080, reload=False)\n```\n\n2. Run the application: `python3 poc.py`\n\n3. Exploit with curl: Use URL-encoded dots (`%2e`) to bypass client-side checks.\n```curl -v \"http://localhost:8080/media/%2e%2e/%2e%2e/%2e%2e/etc/hosts\"```\n\n\n### Result:\nThe HTTP status is 200 OK, and the response body contains the contents of the server’s /etc/hosts file.\n\nI have attached a screenshot of the successful exploitation below. As shown in the image, the content of /etc/hosts displayed via cat matches the output received from the curl request perfectly.\n\n<img width=\"1728\" height=\"1078\" alt=\"POC screenshot\" src=\"https://github.com/user-attachments/assets/6c1be75b-6be2-4372-90df-55042c1e4775\" />\n\n### Impact\n\nAny NiceGUI application that calls app.add_media_files() on a URL path reachable by an attacker is affected. An unauthenticated remote attacker can read sensitive files outside the intended media directory, potentially exposing:\n\n•Application source code and configuration files\n•Credentials, API keys, and secrets\n•Operating system configuration files (e.g., /etc/passwd, /etc/hosts)\n\nThis is my first github vulnerability report, so I would appreciate your understanding regarding any potential shortcomings. If you require any further information or clarification, please feel free to contact me at [email protected].\n\nThank you.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "nicegui"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "3.4.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/zauberzeug/nicegui/security/advisories/GHSA-hxp3-63hc-5366"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/zauberzeug/nicegui/commit/a1b89e2a24e1911a40389ace2153a37f4eea92a9"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/zauberzeug/nicegui"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-22"
55+
],
56+
"severity": "HIGH",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2025-12-09T14:25:15Z",
59+
"nvd_published_at": null
60+
}
61+
}

advisories/unreviewed/2025/12/GHSA-mg56-wc4q-rw4w/GHSA-mg56-wc4q-rw4w.json renamed to advisories/github-reviewed/2025/12/GHSA-mg56-wc4q-rw4w/GHSA-mg56-wc4q-rw4w.json

Lines changed: 33 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-mg56-wc4q-rw4w",
4-
"modified": "2025-12-08T18:30:44Z",
4+
"modified": "2025-12-09T14:25:51Z",
55
"published": "2025-12-08T18:30:44Z",
66
"aliases": [
77
"CVE-2025-65795"
88
],
9+
"summary": "memos vulnerability allows the creation of arbitrary accounts",
910
"details": "Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts via a crafted request.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/usememos/memos"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.25.3"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -23,6 +44,14 @@
2344
"type": "WEB",
2445
"url": "https://github.com/usememos/memos/pull/5217"
2546
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/usememos/memos/commit/769dcd0cf9be83d472829f6e7903b201e42f6b3c"
50+
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/usememos/memos"
54+
},
2655
{
2756
"type": "WEB",
2857
"url": "https://herolab.usd.de/usd-2025-0058"
@@ -41,8 +70,8 @@
4170
"CWE-284"
4271
],
4372
"severity": "HIGH",
44-
"github_reviewed": false,
45-
"github_reviewed_at": null,
73+
"github_reviewed": true,
74+
"github_reviewed_at": "2025-12-09T14:25:51Z",
4675
"nvd_published_at": "2025-12-08T17:16:21Z"
4776
}
4877
}

0 commit comments

Comments
 (0)