Skip to content

Commit f7155e3

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3c4m-j3g4-hh25 GHSA-mf3j-86qx-cq5j
1 parent 5d1b3e5 commit f7155e3

2 files changed

Lines changed: 149 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-3c4m-j3g4-hh25/GHSA-3c4m-j3g4-hh25.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3c4m-j3g4-hh25",
4+
"modified": "2026-03-10T00:56:30Z",
5+
"published": "2026-03-10T00:56:30Z",
6+
"aliases": [
7+
"CVE-2026-30913"
8+
],
9+
"summary": "flarum/nicknames extension has display name injection in notification emails (autolink & markdown)",
10+
"details": "## Summary\n\nWhen the `flarum/nicknames` extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains.\n\n## Affected package\n\n- **`flarum/nicknames`** — permissive display name driver that allows special characters; affected since initial release on the `1.x` branch\n\nAny third-party display name driver that permits special characters would be equally affected.\n\n## Variants\n\n1. **Domain autolink** — a nickname such as `nasty.com` is automatically converted to a clickable hyperlink by virtually all email clients (Gmail, Outlook, Apple Mail, Thunderbird).\n2. **Markdown link syntax** — a nickname such as `[CLICK](https://evil.com)` is rendered as a clickable hyperlink by email clients that auto-render markdown in plain-text emails (e.g. Apple Mail, Thunderbird).\n\n## Steps to reproduce\n\n**Variant 1 (autolink — affects all email clients)**\n1. Enable `flarum/nicknames`, set nickname to `nasty.com`\n2. Trigger a notification email to another user (e.g. follow them, mention them)\n3. The nickname appears as a clickable link in the received email\n\n**Variant 2 (markdown — affects markdown-rendering email clients)**\n1. Enable `flarum/nicknames`, set nickname to `[CLICK](https://evil.com)`\n2. Trigger a notification email to another user\n3. In a markdown-rendering email client (e.g. Apple Mail), the nickname appears as a clickable link\n\n## Impact\n\nPhishing / social engineering: victims may be misled into visiting attacker-controlled URLs via links appearing to originate from a trusted platform notification email. Variant 1 is exploitable against virtually all email clients without any special conditions.\n\n- CVSS v3.1: `AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N` — **4.6 Medium**\n\n## Root cause\n\nThe default username-based display name driver constrains values to `[a-zA-Z0-9_-]+`, making it immune. `flarum/nicknames` introduced permissive validation (min/max length and an optional admin-configured regex) that allows arbitrary characters including those meaningful in URL and markdown contexts. This has been the case since the first commit of the extension.\n\n## Proposed fix\n\n- Add validation in `flarum/nicknames` to reject or sanitize nicknames containing characters that email clients may interpret as URLs or markdown links\n- Alternatively, sanitize the display name before insertion into notification email bodies so that legitimate nicknames like `Jane.Smith` are preserved but rendered safely\n\n## References\n\n- Bug bounty submission: SBB-L4ZVAFH8 (Intigriti)",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "flarum/nicknames"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.8.3"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/flarum/framework/security/advisories/GHSA-3c4m-j3g4-hh25"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/flarum/nicknames/commit/4dde99729abdce8f6e2a7437c86e38735fdcca28"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/flarum/framework"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/flarum/nicknames/releases/tag/v1.8.3"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-79"
59+
],
60+
"severity": "MODERATE",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-03-10T00:56:30Z",
63+
"nvd_published_at": null
64+
}
65+
}

‎advisories/github-reviewed/2026/03/GHSA-mf3j-86qx-cq5j/GHSA-mf3j-86qx-cq5j.json‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mf3j-86qx-cq5j",
4+
"modified": "2026-03-10T00:57:18Z",
5+
"published": "2026-03-10T00:57:18Z",
6+
"aliases": [
7+
"CVE-2026-30925"
8+
],
9+
"summary": "Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery",
10+
"details": "### Impact\n\nA malicious client can subscribe to a LiveQuery with a crafted `$regex` pattern that causes catastrophic backtracking, blocking the Node.js event loop. This makes the entire Parse Server unresponsive, affecting all clients. Any Parse Server deployment with LiveQuery enabled is affected. The attacker only needs the application ID and JavaScript key, both of which are public in client-side apps.\n\nThis only affects LiveQuery subscription matching, which evaluates regex in JavaScript on the Node.js event loop. Normal REST and GraphQL queries are not affected because their regex is evaluated by the database engine.\n\n### Patches\n\nRegex evaluation in LiveQuery subscription matching now runs in an isolated VM context with a configurable timeout via a new Parse Server option `liveQuery.regexTimeout, with defaults 100 ms. A regex that exceeds the timeout is treated as non-matching.\n\nThe protection adds approximately 50 microseconds of overhead per regex evaluation. For most applications this is negligible, but it can add up if there is a very large number of LiveQuery subscriptions that use `$regex` on the same class. For example, 10,000 concurrent regex subscriptions would add approximately 500ms of processing time per object save event on that class. Set `liveQuery.regexTimeout: 0` to disable the protection and use native regex evaluation without overhead.\n\n### Workarounds\n\nUse the `beforeSubscribe` Cloud Code hook to reject any LiveQuery subscription that contains a `$regex` operator. Note that this also blocks the LiveQuery `startsWith`, `endsWith`, and `contains` query methods, as they use `$regex` internally.\n\n```js\n// Repeat for each class that is used with LiveQuery\nParse.Cloud.beforeSubscribe('MyClass', request => {\n const where = request.query._where || {};\n for (const value of Object.values(where)) {\n if (value?.$regex) {\n throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, '$regex not allowed in LiveQuery subscriptions');\n }\n }\n});\n```\n\n### References\n\n- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-mf3j-86qx-cq5j\n- Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.14\n- Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.11",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "parse-server"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "9.0.0-alpha.1"
29+
},
30+
{
31+
"fixed": "9.5.0-alpha.14"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "npm",
40+
"name": "parse-server"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "0"
48+
},
49+
{
50+
"fixed": "8.6.11"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-mf3j-86qx-cq5j"
61+
},
62+
{
63+
"type": "PACKAGE",
64+
"url": "https://github.com/parse-community/parse-server"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://github.com/parse-community/parse-server/releases/tag/8.6.11"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.14"
73+
}
74+
],
75+
"database_specific": {
76+
"cwe_ids": [
77+
"CWE-1333"
78+
],
79+
"severity": "HIGH",
80+
"github_reviewed": true,
81+
"github_reviewed_at": "2026-03-10T00:57:18Z",
82+
"nvd_published_at": null
83+
}
84+
}

0 commit comments

Comments
 (0)