How to fix?

next is a react framework.

Affected versions of this package are vulnerable to Improper Authorization due to the improper handling of thex-middleware-subrequest header. An attacker can bypass authorization checks by sending crafted requests containing this specific header.

dmentThis issue was found to be a duplicate.The original vulnerability with details can be found [here](https://security.snyk.io/vuln/via thepull_package API function. An attacker can execute arbitrary commands on the victim's machine by exploiting theproject_wheel_metadata function to execute thesetup.py file inside the tar file.

Note:

This vulnerability bypasses the protections newly implemented through thesafe_extract() function.).

Affected versions of this package are vulnerable to Denial of Service (DoS) through therun_tool command which exposes classes in thewater.tools package via theast parser. An attacker can shut down the server and write large files to arbitrary directories by exploiting theXGBoostLibExtractTool class.

We’ve disclosed

3397

vulnerabilities

by Snyk Security
Researchers