Snyk Security Database

@apostrophecms/import-export is an Import Export Documents for ApostropheCMS

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the import-export module, where an authenticated attacker can send a request that causes the server to crash, resulting in a denial of service. The vulnerability is network-exploitable and requires only low-privilege authentication with no user interaction.

docling-core is an A python library to define and validate data types in Docling.

Affected versions of this package are vulnerable to External Control of File Name or Path via _with_embedded_pictures and ImageRef when exporting a DoclingDocument containing untrusted content. Plain filesystem paths and file:// URIs embedded in an untrusted document are read directly during export operations (such as save_as_* in EMBEDDED mode), bypassing the allow_image_file_uri gate and the size limit. An attacker who can supply a malicious DoclingDocument can cause the application to read arbitrary local files and expose their contents through the exported output.

ognl:ognl is an OGNL - Object Graph Navigation Library.

Affected versions of this package are vulnerable to Protection Mechanism Failure in the stricter-invocation block list enforcement process. An attacker can bypass intended security restrictions by leveraging reflection proxies to invoke blocked methods, potentially leading to unauthorized actions such as code execution, file creation, or system command execution. This is only exploitable if the application evaluates untrusted OGNL expressions, uses the default permissive MemberAccess (or an equivalently permissive one that allows java.lang.reflect), and relies solely on the stricter-invocation block list for sandboxing.