github.com/infiniflow/ragflow

When a COPY command has more than two arguments, the last one should end with a slash.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious modu…

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In ord…

Command injection: exec.Command/exec.CommandContext is invoked with a shell (sh/bash -c) plus an interpolated string, or with argv[0] AND its args spread from the same parsed slice ($A[0], $A[1:]...) — i.e. a command string split into an argv and executed, which lets input choose…

Command injection: exec.Command/exec.CommandContext is invoked with a shell (sh/bash -c) plus an interpolated string, or with argv[0] AND its args spread from the same parsed slice (argv[0], argv[1:]...) — i.e. a command string split into an argv and executed, which lets input ch…

Committed PEM private-key material (a "-----BEGIN ... PRIVATE KEY-----" block). Anyone with repo read access holds the key: rotate it, remove it from history, and load keys at runtime from a secret store / mounted volume instead. (First-party socbox rule; Apache-2.0.)

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

SQL built by concatenation/Sprintf passed to Query/Exec/QueryRow — SQL injection. The statement text is assembled from a formatted or concatenated string (directly or via an intermediate variable). Use parameterized placeholders ($1/?) with separate args, never string building. C…

yaml.load without SafeLoader can instantiate arbitrary Python objects. Use yaml.safe_load() (or Loader=SafeLoader). (Apache-2.0.)

yaml.load without SafeLoader can instantiate arbitrary Python objects. Use yaml.safe_load() (or Loader=SafeLoader). (Apache-2.0.)

yaml.load without SafeLoader can instantiate arbitrary Python objects. Use yaml.safe_load() (or Loader=SafeLoader). (Apache-2.0.)

yaml.load without SafeLoader can instantiate arbitrary Python objects. Use yaml.safe_load() (or Loader=SafeLoader). (Apache-2.0.)

'apt-get' install should use '--no-install-recommends' to minimize image size.

'apt-get' install should use '--no-install-recommends' to minimize image size.

'apt-get' install should use '--no-install-recommends' to minimize image size.

React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can res…

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, seven recursive traversals in lib/dom.js operate without a depth limit. A suffic…

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order…

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability ex…

Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments…

Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or ran in environments wh…

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON respo…

Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transf…

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorizati…

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial …

Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-…

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the NO_PROXY protection. This vu…

Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter are read via direct property access without hasOwnPropert…

form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line fee…

form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line fee…

The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic, allowing a denial of service attack.

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious modul…

Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "__proto__" member is an o…

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()`, especially when c…

Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()`, especially when c…

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and load…

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferen…

The ports which are lower than 1024 receive and transmit various sensitive and privileged data. Allowing containers to use them can bring serious implications.

SheetJS Community Edition before 0.19.3 allows Prototype Pollution via a crafted file. In other words. 0.19.2 and earlier are affected, whereas 0.19.3 and later are unaffected.

React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering wh…

React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime, certain crafted requests can consume disproportionate server resources via unbounded path expansion in the __manifest endpoint, re…

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does…

React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sou…

React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sou…

React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing protot…

Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine a…

An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS).

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled comment content to be serialized into XML…

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package serializes DocumentType node fields (internalSubset, publicId, syste…

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled processing instruction data to be seriali…

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator…