Threats tagged 'ghsa-v8g5-w742-7rxg'

AGL app-framework-main versions through 17.1.12 have a critical Zip Slip path traversal vulnerability combined with a TOCTOU race condition in the widget installation process. The vulnerability arises because ZIP entry names are insufficiently validated, allowing directory traversal sequences to bypass checks. Files can be extracted outside the intended directory before signature verification occurs, and cleanup does not remove these files if signature verification fails, leaving malicious files permanently on the filesystem.