Snyk Security Database

ambar-src is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

pretix is a Reinventing presales, one ticket at a time

Affected versions of this package are vulnerable to Dynamic Variable Evaluation via the evaluation of placeholders in email templates. An attacker can access sensitive system information, such as configuration files, database passwords, or API keys, by crafting malicious placeholder names and injecting them into email subjects or bodies.

Note: Exploitation requires the attacker to have control over email templates or to influence buyer-controlled placeholders.

Affected versions of this package are vulnerable to Arbitrary Code Injection in the SpecificCompiler class, when handling untrusted Avro schemas. An attacker can execute code by supplying a malicious schema with commands injected in doc comment values, which can be executed during compilation.