Threats tagged 'ghsa-9m43-j2p8-v7v3'

Zipline versions before 4.8.0 have a race condition vulnerability in the file src/server/routes/raw/[id].ts. This flaw allows remote attackers to bypass file maxViews limits by exploiting non-atomic view counting. By sending parallel requests, attackers can cause the system to read the same pre-increment view count multiple times, enabling them to view files that should be limited or deleted after a certain number of views beyond the intended limit.