perspective-dev vulnerabilities and threats

Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths. Attackers can bypass the insufficient query-string-stripping sanitization to traverse outside the configured asset root directory and retrieve sensitive files such as system credentials and application secrets, with results exposed cross-origin due to a wildcard Access-Control-Allow-Origin header set on all responses.

Perspective version 5.0.0 and earlier contains a denial of service vulnerability where remote attackers can submit crafted expressions with unbounded loops. This causes the server's event loop to block indefinitely, making the server unresponsive to all clients. The vulnerability arises from the lack of iteration caps, deadlines, or cancellation checks in expression evaluation within TableMakeViewReq messages.

Perspective version 5.0.0 has a denial-of-service vulnerability in its VirtualServer protocol dispatcher. Unauthenticated remote attackers can crash the server by sending malformed or incomplete protobuf messages that cause the server process to abort. This occurs due to unwrap() calls on None values triggered by missing required fields in certain requests.

Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML and JavaScript by writing table cell values containing unescaped HTML markup, which are interpolated directly into innerHTML during CSV serialization rendering. Attackers can craft table rows with payloads such as unquoted attribute injections containing event handler attributes that bypass RFC 4180 quoting, since angle brackets and event handler attributes are never escaped before assignment, causing malicious scripts to execute in the embedding page's origin.

Perspective version 5.0.0 and earlier contains a remote code execution vulnerability due to improper neutralization of directives in dynamically evaluated code. Unauthenticated attackers can submit crafted expression strings to the PolarsVirtualServer backend, which unsafely uses Python's eval() function with minimal restrictions. This allows attackers to traverse Python object attributes and invoke subprocess.Popen, resulting in arbitrary command execution within the Perspective host process.