Snyk Security Database

Affected versions of this package are vulnerable to Denial of Service (DoS) via incomplete cleanup of uploaded files when a request is aborted before the storage engine assigns a file path. When an upload is aborted mid-flight, the finishAbort function in make-middleware.js snapshots only the files that already have a path at the moment of abort; any file whose storage engine completes naming and writing after that snapshot is never added to the removal list and is never deleted, leaving orphaned files on disk (or in the configured storage backend). An attacker can repeatedly send and abort multipart upload requests to accumulate unbounded orphaned files, exhausting available disk space.

crewai-tools is a Set of tools for the crewAI framework

Affected versions of this package are vulnerable to Improper Protection of Alternate Path due to the blocklist mechanism operating at the import system level rather than accounting for the complete Python runtime. An attacker can bypass intended restrictions by directly invoking ctypes.CDLL or similar objects, allowing execution of native code within the sandboxed environment.

org.webjars.npm:morgan is a HTTP request logger middleware for node.js.

Affected versions of this package are vulnerable to Improper Output Neutralization for Logs via the escapeLogField function. An attacker can manipulate log entries by injecting unescaped double quotes into HTTP headers such as User-Agent or Referer, causing log consumers that parse logs by field position to misinterpret attacker-supplied data as subsequent fields.