Snyk Security Database

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Check for Certificate Revocation via the Node.js TLS stack in the main and utility processes, which lacked an equivalent of Chromium's compiled-in SubjectPublicKeyInfo (SPKI) blocklist. A certificate chain containing a blocked SPKI hash that would be rejected in a renderer process is accepted by Node's tls, https, and fetch APIs, allowing a MitM attacker to present a chain built on a revoked or distrusted public key and have it verified successfully.

langgraph-checkpoint-sqlite is a Library with a SQLite implementation of LangGraph checkpoint saver.

Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference via the _group_ops function in the Postgres and SQLite store backends, due to namespaces being serialized by joining their labels with . before storage. An authenticated attacker can supply a namespace label containing a . character (for example, the single-element tuple ("foo.bar",)) to resolve to the same database row as a distinct namespace (for example, ("foo", "bar")), allowing cross-namespace data reads and limited writes against other tenants' stored items.

ognl:ognl is an OGNL - Object Graph Navigation Library.

Affected versions of this package are vulnerable to Protection Mechanism Failure in the stricter-invocation block list enforcement process. An attacker can bypass intended security restrictions by leveraging reflection proxies to invoke blocked methods, potentially leading to unauthorized actions such as code execution, file creation, or system command execution. This is only exploitable if the application evaluates untrusted OGNL expressions, uses the default permissive MemberAccess (or an equivalently permissive one that allows java.lang.reflect), and relies solely on the stricter-invocation block list for sandboxing.