Snyk Security Database

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) via Workbook.xlsx.load() in lib/xlsx/xlsx.js. An attacker can exhaust memory and crash the process by supplying a highly compressible .xlsx file that expands into a very large amount of data during ZIP decompression. Services that call load() or readFile() on untrusted uploads are affected: the workbook loader decompresses archive entries into memory before XML parsing, so a small crafted file can trigger an out-of-memory termination and deny service to users.

Notes

• The vulnerability is still present in upstream exceljs; an unofficial fork - exceljs-hardened, carries the out-of-tree hardening mentioned in the referenced advisory.

Workarounds

• Run load() inside a process or container with a hard memory limit, so a decompression bomb can only crash that isolated process instead of exhausting the host.
• Pre-check the uploaded .xlsx file’s declared uncompressed sizes from the ZIP central directory before calling load(), so oversized archives are rejected before decompression begins.

feast is a Python SDK for Feast

Affected versions of this package are vulnerable to Use of Hard-coded Credentials via unverified intra-server JWT handling in sdk/python/feast/permissions/auth/oidc_token_parser.py, sdk/python/feast/permissions/auth/kubernetes_token_parser.py, and sdk/python/feast/permissions/security_manager.py. An attacker can bypass RBAC and gain trusted internal identity by sending a token whose preferred_username or Kubernetes service-account claim matches Feast’s hardcoded intra-communication value, even though the token signature is never verified before that claim is accepted. This lets a remote caller reach the server as an internal user and perform unchecked read and write operations across entities, feature views, data sources, and permission policies on any Feast deployment that exposes the affected auth path.

org.jenkins-ci.plugins:script-security is a package that allows Jenkins administrators to control what in-process scripts can be run by less-privileged users.

Affected versions of this package are vulnerable to Incorrect Authorization through improper handling of collection type casting operations in Groovy collections. An attacker with permission to define and run sandboxed scripts, including Pipelines, can bypass sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM by overriding collection methods to force execution on unverified elements during the cast.