Summary
UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()
References
Related vulnerabilities
All Supply chain →- MEDIUMGHSA-78VR-Q6CF-C7P6
Craft Commerce: Partial Payment Amount Without Lower Bound Validation
- MEDIUMGHSA-GXG4-2RRR-JHC7
OpenClaw: Hostname checks could treat trailing-dot hosts inconsistently
- MEDIUMGHSA-FJV8-J4P5-CR9M
Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape
- LOWGHSA-3MP7-VP6J-2MXX
BBOT: Server-Side Request Forgery (SSRF) in docker_pull module via WWW-Authenticate realm parsing
- HIGHGHSA-4PCV-MG8V-VRGF
PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter
- HIGHGHSA-C969-5X3P-VQ3V
PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters