Threats tagged 'ghsa-g6f8-c3x9-jv7f'

### Impact An authenticated attacker can call the Autocomplete API with the configured endpoint as a substring to request another server-side route. ### Patches The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. The regex verifying the endpoint has been anchored to forbid substring injection. ### Workarounds Use `SharpFormAutocompleteRemoteField::setRemoteCallback()` instead of `SharpFormAutocompleteRemoteField::setRemoteEndpoint()`.