Snyk Security Database

Affected versions of this package are vulnerable to User Impersonation in its subnet matching logic, where an IPv4-mapped IPv6 trust entry with a short prefix such as ::ffff:10.0.0.0/8 compiles with all-zero leading bits and matches every address rather than the intended block. An attacker can control the value returned by proxyaddr(req, trust), and therefore req.ip and req.ips in Express, by sending an arbitrary X-Forwarded-For header, since every client is then trusted as a proxy at hop 0, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This requires the application to configure its trust list with an IPv4-mapped IPv6 subnet using a short prefix, or any IPv6 subnet with zero leading bits such as ::/1, and the misconfiguration compiles without error.

crewai-tools is a Set of tools for the crewAI framework

Affected versions of this package are vulnerable to Improper Protection of Alternate Path due to the blocklist mechanism operating at the import system level rather than accounting for the complete Python runtime. An attacker can bypass intended restrictions by directly invoking ctypes.CDLL or similar objects, allowing execution of native code within the sandboxed environment.

org.webjars.npm:morgan is a HTTP request logger middleware for node.js.

Affected versions of this package are vulnerable to Improper Output Neutralization for Logs via the escapeLogField function. An attacker can manipulate log entries by injecting unescaped double quotes into HTTP headers such as User-Agent or Referer, causing log consumers that parse logs by field position to misinterpret attacker-supplied data as subsequent fields.