Wasmtime versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contain a denial of service vulnerability. This occurs when dropping the Future returned by TypedFunc::call_async causes a panic in the host. The issue arises because if the guest task has not started, the cleanup code unwraps an error while searching for work items, leading to a crash in embedders that cancel pending calls.
Wasmtime versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contain a denial of service vulnerability. This flaw allows malicious components to cause the host to panic via thread.yield calls in start functions, leading to a crash of the embedding environment.
Wasmtime versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contain a denial of service vulnerability. This flaw allows malicious WebAssembly modules to cause the host to panic due to improper handling of the may_leave flag during memory reallocation (realloc). Attackers can exploit this by invoking host calls during realloc operations, leading to crashes.
Wasmtime versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contain a leftover assertion in the component::Func::call function. This assertion rejects guest exports using the async ABI option. An attacker supplying a component with an async-lifted export can cause the host process to crash when the embedder invokes that export via Func::call.
Frappe Framework versions prior to 15.111.0 and 16.x versions before 16.21.0 contain a server-side template injection vulnerability. This flaw allows an authenticated attacker with common operational privileges to inject and execute arbitrary template expressions on the server. The vulnerability arises because user-controlled message fields are rendered as templates without proper neutralization, enabling unrestricted server-side code execution.
Wasmtime versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contain a denial of service vulnerability. This flaw allows guest code to cause a host panic by performing out-of-bounds zero-length stream operations. Specifically, malicious guests can trigger panics in WASIp3 embedders via unvalidated zero-length component model stream reads or writes.
Wasmtime versions 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 have insufficient checks in the Store component when mixing asynchronous and synchronous WebAssembly calls. This flaw allows embedders that re-enter WebAssembly via synchronous APIs from asynchronously called host functions to cause runtime panics or unsound cross-thread movement of non-Send host variables.
Wasmtime versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contain a denial of service vulnerability. This flaw allows pending calls to trigger an assertion failure after a trap poisons the Store. Malicious guest code can cause a trap and let earlier calls proceed, crashing embedders that continue using the inconsistent Store.
Wasmtime versions 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contain a stack overflow vulnerability. This flaw allows guest code to crash the host by creating a long chain of recursive types that trigger unbounded recursive drops, exhausting the host's stack.
ZITADEL versions from 4.0.0 up to but not including 4.19.5 contain an authentication bypass vulnerability in the Login V2 UI. This flaw allows unauthenticated attackers to set the initial credential for users who have no authentication method configured. By computing a valid verificationCheck cookie using the user ID and browser fingerprint, attackers can set passwords, register passkeys, or link identity providers, effectively taking over user accounts.
Wasmtime versions before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 contain a vulnerability in the wasmtime-wasi-http component where set-path-with-query values are not properly verified as paths. This allows absolute-form URLs to be used verbatim as HTTP/1.1 request targets, potentially enabling a malicious guest to bypass embedder filtering policies and reach unauthorized hosts via forward proxies or gateways.
Wasmtime versions from 49.0.0 up to but not including 49.0.3 contain a denial-of-service vulnerability. This flaw allows a WebAssembly guest to cause a host panic by transcoding overlapping strings in fused adapters, specifically when a component-to-component call transfers a string whose source and destination alias each other. Instead of raising a trap, the host crashes, resulting in denial of service.
Wasmtime versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contain a denial of service vulnerability in the wasmtime-wasi-http component. This flaw allows guest code to crash the host by sending long request URLs that overflow a 16-bit index in the HTTP crate, causing a host panic.
Wasmtime versions 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 have a memory misalignment flaw in the VMContext layout. This flaw causes undefined behavior when WebAssembly modules contain an odd number of exception tags, misaligning subsequent host fields in embedders with exceptions enabled. No exploitation path is currently known, and the issue has a low severity rating.
Wasmtime versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contain a vulnerability that causes a panic (crash) when the host reads a component model stream as a different Rust item type than it was originally created with. This occurs because the host-to-host read path asserts matching TypeIds instead of returning an error, allowing guest code to trigger a crash by returning a host-created StreamReader<U> that the embedder reads as StreamReader<T>.
A vulnerability in Wasmtime before versions 36.0.18, 48.0.6, and 49.0.3 allows unbounded host memory growth. The issue arises because resource handle tables are capped only per component instance and do not account for allocations charged to any ResourceLimiter or StoreLimits. This enables a malicious guest to repeatedly allocate resources and instantiate sub-components, bypassing intended limits.
ZITADEL versions 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 have a missing authorization vulnerability in the Login V2 component. This flaw allows attackers to approve OAuth 2.0 device authorizations using a victim's active session without their consent. By sending a signed-in user a specially crafted link containing the attacker's user code, the attacker can obtain the victim's tokens and bypass project access controls via the OIDC device authorization API.
ZITADEL versions from 4.0.0 up to but not including 4.19.5 contain a host header injection vulnerability in the Login V2 UI. This flaw allows unauthenticated attackers to manipulate certain HTTP headers to poison password-reset, invite, and email-verification links. By exploiting this, attackers who know a victim's login name can redirect these links to their own host, intercept single-use codes, and potentially take over user accounts, including those of instance administrators.
Parse Server versions before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 improperly handle dot notation keys with null or undefined values during object saving. This causes writes to be stored but return errors, skipping afterSave triggers and LiveQuery events. An attacker with write access can exploit this behavior to bypass audit logging, notifications, and updates to derived data.
Crawl4AI versions before 0.9.5 have a denial of service vulnerability in the Docker API server. The vulnerability arises because the _clamp_untrusted() function does not properly limit certain delay parameters in untrusted CrawlerRunConfig inputs. This allows unauthenticated attackers to send excessively large values to specific endpoints, causing resource exhaustion and blocking other crawling operations.