Snyk Security Database

maplibre-gl is a BSD licensed community fork of mapbox-gl, a WebGL interactive maps library

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the DOM.removeAttributes function, which iterates over a live NamedNodeMap while simultaneously calling removeAttribute. Because removing an attribute shifts the live collection's indices, the attribute immediately following each removed one is skipped, allowing a second dangerous attribute to survive DOM.sanitize and be injected into the DOM. An attacker who can supply malicious map content can thereby execute arbitrary JavaScript in the victim's browser.

ultralytics is an Ultralytics YOLOv8 for SOTA object detection, multi-object tracking, instance segmentation, pose estimation and image classification.

Affected versions of this package are vulnerable to Arbitrary Code Injection via the check_det_dataset function in ultralytics/data/utils.py. An attacker can execute arbitrary Python code in the current user’s context by supplying a malicious dataset YAML whose download value is executed when the requested validation split is missing and autodownload is enabled; exploitation requires the user to open the malicious file or visit a malicious page.

Affected versions of this package are vulnerable to Use of Incorrect Operator via the FetchSnapshot RPC handler in the Kafka Raft client. An authenticated attacker with CLUSTER_ACTION privilege can terminate the controller by sending a crafted FetchSnapshotRequest with an empty topics array or a topic containing no partitions.