Snyk Security Database

@a2ui/web_core is an A2UI Core Library

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the OpenUrlImplementation function in basic_functions.ts, which passes a caller-supplied URL directly to window.open without validating the URL scheme. An attacker can supply a javascript: URI that executes arbitrary script in the context of the victim's browser when a user triggers the openUrl action.

praisonai-platform is a Platform layer for PraisonAI — workspace, auth, issues, projects

Affected versions of this package are vulnerable to Missing Authorization via the DELETE /workspaces/{workspace_id}/issues/{issue_id}/dependencies/{dep_id} route in src/praisonai-platform/praisonai_platform/api/routes/dependencies.py. The route accepts a dependency edge when either side of the edge matches the URL issue_id, but calls require_delete_permission only against the caller-selected URL issue. A workspace member who owns one side of a dependency edge can select their own issue as the URL issue, satisfy the ownership check, and delete a dependency edge that was created by and belongs to an owner-created issue. The same route family also permits ordinary workspace members to create dependency edges on owner-created issues without requiring owner or admin authority over the primary issue.

org.webjars.npm:happy-dom is a Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. It includes many web standards from WHATWG DOM and HTML.

Affected versions of this package are vulnerable to Arbitrary Code Injection via the ESM compiler (ECMAScriptModuleCompiler.ts), which fails to validate import alias default-value expressions in ES module source text before passing them to an evaluator. An attacker who can cause a page to load a module script containing an import binding with an injected default-value expression (e.g. import { missing as x = <arbitrary JS> } from '...') can achieve arbitrary code execution on the host Node.js process, including access to the filesystem through process.getBuiltinModule.