Search: index.html

# Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API ## Summary The always-registered Planka migration lets any ordinary user select a Planka server. Although Vikunja caps each JSON response, pagination loop, and attachment independently, it has no aggregate job budget. The conversion stage downloads every advertised non-link attachment and keeps every byte slice live until the complete hierarchy is inserted. A public attacker server can therefore drive memory beyond any finite service allocation. The final Docker run preserved default SSRF policy and OOM-killed the healthy API after five individually valid 20 MiB attachment responses. ## Impact and affected scope - **Type:** Resource Exhaustion Dos - **Affected component:** POST /api/v2/migration/planka/migrate; Asynchronous migration.requested worker for the Planka migrator - **Preconditions:** A low-privilege Vikunja user supplies an attacker-operated public Planka URL and token. That server controls project/board/card/attachment counts and streams each attachment body at or below Vikunja's normal per-file limit. - **Verified revision:** `d66ef3d1a39c6f7289593059a1a34afd1d059260` on 28 August 2026 - **Affected release range:** `> 2.5.0` for the tested post-2.5.0 main branch; no released build was independently reproduced A low-privilege remote user operating a public HTTP server can terminate the shared Vikunja process and make the API unavailable with one migration submission. ## Technical details Planka conversion downloads each non-link attachment into a bytes.Buffer and assigns buf.Bytes() to the in-memory task attachment. Every allocation remains reachable in the hierarchy until all remote data has been fetched and InsertFromStructure begins. Per-response, per-page, and per-file limits do not cap the sum. Attack path: Authenticated migration request -> synchronous attacker-server credential probe -> asynchronous Migrate with no request deadline -> fetch attacker project/board metadata -> loop attacker attachment list -> individually size-limited downloads -> retain all FileContent slices -> process/container OOM and API termination Relevant code: - `pkg/routes/api/v2/migration_credentials.go:35` - `pkg/routes/api/v2/migration_shared.go:73` - `pkg/routes/api/v2/migration_shared.go:95` - `pkg/modules/migration/planka/client.go:37` - `pkg/modules/migration/planka/client.go:356` - `pkg/modules/migration/planka/fetch.go:29` - `pkg/modules/migration/planka/fetch.go:32` - `pkg/modules/migration/planka/convert.go:275` - `pkg/modules/migration/planka/convert.go:280` - `pkg/modules/migration/planka/convert.go:293` - `pkg/modules/migration/planka/planka.go:86` - `pkg/modules/migration/planka/planka.go:100` ## Reproduction Run this only against an authorized disposable environment. The complete verified minimum file set is reproduced below. It starts the isolated target, runs the security-relevant trigger, verifies an objective target/application signal, and exercises the available negative or sibling control. Create `reproduction/Dockerfile`: ```text FROM golang:1.27-bookworm AS builder WORKDIR /src COPY --from=target . . RUN mkdir -p frontend/dist \ && printf '<!doctype html><title>PoC</title>' > frontend/dist/index.html \ && go build -o /out/vikunja . FROM golang:1.27-bookworm RUN apt-get update \ && apt-get install -y --no-install-recommends ca-certificates curl python3 \ && rm -rf /var/lib/apt/lists/* WORKDIR /app COPY --from=builder /out/vikunja /app/vikunja COPY . /app RUN chmod +x /app/verify.sh ``` Create `reproduction/verify.sh`: ```sh #!/usr/bin/env bash set -euo pipefail test -d /target-repo test "$(git -C /target-repo rev-parse HEAD)" = "d66ef3d1a39c6f7289593059a1a34afd1d059260" test -z "${VIKUNJA_OUTGOINGREQUESTS_ALLOWNONROUTABLEIPS:-}" mkdir -p /work/files /work/logs export VIKUNJA_DATABASE_TYPE=sqlite export VIKUNJA_DATABASE_PATH=/work/vikunja.db export VIKUNJA_FILES_BASEPATH=/work/files export VIKUNJA_LOG_PATH=/work/logs export VIKUNJA_SERVICE_ROOTPATH=/work export VIKUNJA_SERVICE_INTERFACE=0.0.0.0:3456 export VIKUNJA_SERVICE_PUBLICURL=http://127.0.0.1:3456/ export VIKUNJA_SERVICE_FRONTENDURL=http://127.0.0.1:3456/ python3 /app/malicious_planka.py > /work/planka.log 2>&1 & PLANKA_PID=$! /app/vikunja > /work/vikunja.log 2>&1 & VIKUNJA_PID=$! cleanup() { if kill -0 "${VIKUNJA_PID}" 2>/dev/null; then kill "${VIKUNJA_PID}" 2>/dev/null || true wait "${VIKUNJA_PID}" 2>/dev/null || true fi if kill -0 "${PLANKA_PID}" 2>/dev/null; then kill "${PLANKA_PID}" 2>/dev/null || true wait "${PLANKA_PID}" 2>/dev/null || true fi } trap cleanup EXIT for _ in $(seq 1 90); do if curl -fsS http://127.0.0.1:3456/api/v2/health > /dev/null 2>&1 \ && curl -fsS http://93.184.216.34:18080/api/users/me > /dev/null 2>&1; then break fi sleep 1 done curl -fsS http://127.0.0.1:3456/api/v2/health > /dev/null curl -fsS http://93.184.216.34:18080/api/user

Outerbase Studio is a lightweight browser-based database GUI supporting PostgreSQL, MySQL, and SQLite. In version 0.10.2 and earlier, TextComponent in src/components/chart/index.tsx renders unsanitized Text Widget content through dangerouslySetInnerHTML, allowing injected markup with script-capable event handlers to execute when the widget is displayed. Outerbase Cloud and its backend services were discontinued in 2025, and the current architecture uses local browser dashboard storage, so the impact is limited to local self-XSS. Authentication token theft, account takeover, and backend database access are not applicable to the current architecture. No fixed release is available as of this review.

A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla < 5.0.5 - Quick Index inserts configurable class values into generated HTML without escaping them for an HTML attribute. A crafted value can close the intended class attribute and introduce a new attribute. Joomla's content filter cannot reliably prevent this because Quick Index creates the executable HTML after the authored plugin syntax was filtered.

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.16.1 and earlier, the manager role can store meta_page_title or meta_page_favicon through /api/admin/system-preferences, and MetaGenerator inserts those values into production homepage HTML without escaping attribute values or text content. The values pass unchanged through server/models/systemSettings.js and reach MetaGenerator.generate() in server/index.js. #assembleMeta() in server/utils/boot/MetaGenerator.js concatenates the stored values into HTML. When an administrator visits the homepage /, injected JavaScript can read the administrator JWT and use it to create API keys, access or modify workspace and chat data, delete users, and perform other administrator actions. server/endpoints/admin.js accepts the manager-controlled settings before server/models/systemSettings.js returns them unchanged. No fixed version is available as of this review.

CVE-2026-87500 is a critical vulnerability in Google Chrome prior to version 153.0.8010.36 involving improper validation of an array index in the ANGLE component. This flaw allows a remote attacker to potentially execute arbitrary code outside the browser sandbox by delivering a crafted HTML page. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability. Google has published an advisory indicating a stable channel update that addresses this issue.

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that attributeName selecting href or xlink:href gives the sibling values, from, to, or by attribute SVG SMIL URL semantics. In configurations that allow the animate, animateColor, animateMotion, animateTransform, or set elements, a values list can begin with a safe fragment and contain a later executable destination that survives allowedSchemesAppliedToAttributes checking. When the sanitized SVG is rendered, the browser can copy that later destination into the live link, and a victim who activates the link can execute script in the application's origin. This issue is fixed in version 2.17.7.

The npm package @worrisome/reutil is a malicious package used as part of a phishing campaign that hosts a fake Cloudflare Turnstile verification page. The package contains only an index.html file that, when opened in a browser, decrypts a redirect URL and navigates the user to a phishing site. It does not execute malicious code during npm install or affect the installing machine directly. The abuse involves using the npm registry as a static file host for phishing landing pages, targeting users who open the HTML in a browser rather than developers installing the package.

The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.get(url, rssParserConfig()) with no address validation. The same file guards the subscribe path with validateUrl(), which rejects private and reserved ranges through the private-ip library, and createPageSaveRequest applies the same check, so the omission is specific to this resolver. An authenticated user can direct the server to request arbitrary internal endpoints. The response is parsed as a feed or as HTML and the resolver returns the resulting url, title, description and type fields, so disclosure is limited to feed-shaped metadata and to link elements advertising RSS or Atom feeds; requests that do not parse still distinguish reachable ports from unreachable ones through the resulting error.

The npm package 'dzcvhfruwluwe' versions 1.0.0 and 1.0.1 contains a malicious index.html file that acts as a fake 'Cloudflare Verifying...' page. This page uses obfuscated JavaScript to redirect users' browsers after a short delay to an attacker-controlled external domain. The malicious behavior is client-side and does not execute during package installation or require-time, meaning it does not compromise the developer's environment directly. However, end users who load the HTML file in a browser are redirected to potentially harmful sites. This is a case of registry abuse hosting phishing or malvertising content rather than a traditional supply-chain attack. There is no CVSS score available for this threat. The package should be removed, and any secrets on compromised machines should be rotated due to the risk of full compromise.

The npm package 'egypt0811' version 1.0.0 contains a malicious index.html file that acts as a redirect page styled like a Cloudflare Turnstile interstitial. It includes obfuscated JavaScript that redirects browsers to a phishing or malicious destination URL. The package does not execute code during installation or require-time and does not contain Node.js modules or lifecycle scripts. This behavior indicates registry abuse to host a phishing redirect page rather than a direct supply-chain attack on developers. Any system with this package installed should be considered compromised, and secrets should be rotated immediately.

The npm package 'twcvhjlksdmx' versions 1.0.0 and 1.0.1 contains malicious code embedded in an index.html file that impersonates a Cloudflare interstitial and redirects users who open the HTML file in a browser. The package.json does not execute code during installation or require, so the malicious redirect only triggers if the HTML file is manually opened in a browser. Installation of this package can lead to full system compromise, requiring immediate secret and key rotation and package removal.

The mobicommn npm package version 1.0.0 contains malicious code in the form of an index.html file that mimics a Cloudflare Turnstile challenge. This HTML file, when loaded in a browser, reconstructs a URL from an obfuscated string and redirects the user. The malicious code does not execute during npm install or when the package is imported in Node.js, as Node does not execute HTML files. However, if the HTML file is opened in a browser, it can trigger the redirect. The package is considered fully compromising to any system where it is installed or running, with a recommendation to rotate all secrets and keys from a different machine and remove the package. There is no confirmed patch or fix available at this time.

The npm package 'cvbniydplwe3' version 1.0.0 contains a tarball with only an index.html file that renders a fake Cloudflare Turnstile interstitial and performs a browser-side redirect to a target URL. This package does not execute code during installation or require(), indicating it is not a traditional supply-chain attack but rather an abuse of the npm registry to host phishing or redirect content. Despite no direct code execution on the installer's machine, the presence of this package on a system is considered highly dangerous, as it may indicate compromise. Removal of the package alone may not fully remediate the risk, and secrets should be rotated immediately if the package was installed or run.

The npm package 'cvmbxcjiasdg' versions 1.0.0 and 1.0.1 contains malicious code that serves a fake Cloudflare Turnstile challenge via an index.html file. This HTML page uses obfuscated JavaScript to redirect users' browsers to a constructed URL, forwarding query parameters. The package does not execute code during npm install or require, indicating it is designed to abuse the npm registry as a static host for phishing or redirect lures rather than directly attacking developers. Any system running this package should be considered fully compromised, with immediate secret and key rotation recommended.

The npm package 'mnzjgxciwadk' version 1.0.0 contains a malicious HTML file that acts as a phishing or redirect landing page. The package's main file is an index.html that, when opened in a browser, presents a Cloudflare Turnstile-style challenge and then redirects the user to a URL under the *.olive.club domain using obfuscated JavaScript. This behavior does not trigger during npm install or when requiring/importing the package in code, so the threat targets users opening the HTML file rather than developers or build systems. The package represents registry abuse rather than a direct supply-chain attack. According to one source, any system with this package installed or running should be considered fully compromised, with immediate secret/key rotation recommended. No official patch or fix is indicated.

The npm package 'vkldhcmieru6' version 1.0.0 contains a malicious index.html file that impersonates a Cloudflare Turnstile challenge and redirects browser visitors to a potentially harmful URL. The package does not execute code during installation or when required in Node.js environments, so the threat targets users who visit the hosted HTML content rather than developers installing the package. There is no official patch or remediation information available.

The npm package csbcldfvivwfgd4 version 1.0.0 contains a malicious index.html file that mimics a Cloudflare challenge page and includes obfuscated JavaScript which redirects browser users to a potentially harmful URL. This malicious behavior only triggers when the HTML is rendered in a browser via an npm-backed CDN, not during installation or import in a Node.js environment. There is no code execution or credential theft on the installer's machine, but the package is abused as a phishing or malvertising redirect hosted on the npm registry.

The npm package 'fhj8cv9dkwm4' version 1.0.0 contains malicious code that serves a single index.html mimicking a Cloudflare Turnstile verification page. When rendered in a browser, the obfuscated script redirects users to a constructed '.club' URL with the current page's query parameters. The package does not execute code during installation or require time, but the redirect occurs only when the index.html is served and viewed in a browser. The presence of this package on any computer is considered a full compromise, and all secrets and keys on the affected system should be rotated immediately. Removal of the package alone does not guarantee elimination of all malicious software. No CVSS score is available for this threat.

The npm package 'yangming708' version 1.0.0 contains a tarball with only a package.json and an index.html file. The package.json specifies 'index.html' as the main entry, which is not a Node.js module, and no lifecycle scripts are declared. The index.html includes an obfuscated script that, when opened in a browser, redirects to a potentially malicious URL. Installing or requiring the package in a Node.js environment does not execute this code. However, if the HTML is opened in a browser, it can lead to a redirect to a malicious site. The package appears to be registry spam or a mispublished browser-side redirect page rather than a direct supply-chain attack. Despite this, one source claims that any system with this package installed or running should be considered compromised, recommending immediate secret rotation and package removal.