Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Litestar repository vulnerable to Environment Variable injection in `docs-preview.yml` workflow
Vulnerability Description
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions 2.10.0 and prior, Litestar's `docs-preview.yml` workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation. This issue grants a malicious actor the permission to write issues, read metadata, and write pull requests. In addition, the `DOCS_PREVIEW_DEPLOY_TOKEN` is exposed to the attacker. Commit 84d351e96aaa2a1338006d6e7221eded161f517b contains a fix for this issue.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Vulnerability Title
Litestar 安全漏洞
Vulnerability Description
Litestar是Litestar开源的一个强大、灵活但固执己见的 ASGI 框架。 Litestar 2.10.0版本及之前版本存在安全漏洞，该漏洞源于容易受到环境变量注入攻击，导致机密泄露和存储库操纵。此问题授予恶意行为者写入问题、读取元数据和写入拉取请求的权限。
CVSS Information
N/A
Vulnerability Type
N/A