Dotvvm
Monthly
We need answer JSON only. Need synthesize. Must include all fields strings, data_quality_flags array? It says JSON array but every field plain text string? Conflict: data_quality_flags should be JSON array. We need output valid JSON object with that field as array. Need follow. Let's analyze CVE. CVE-2026-57578: DotVVM open source MVVM framework for web apps. Prior to 4.2.11, 4.3.15, 5.0.0-preview09-final, AuthorizeActionFilter performs no authorization because explicit implementations return completed tasks instead of invoking checks. Applications relying on this filter expose protected commands, view models, presenters to unauthorized requests. AuthorizeAttribute workaround. Fixed versions. CVSS 4.0 vector: AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Score 9.2. CWE-862 Missing Authorization. Patch available. Reported by GitHub_M. CPE riganti:dotvvm. Tags: Authentication Bypass, Dotvvm. SSVC exploitation none, automatable no, technical impact total. ENVD affected versions. References: GHSA, commits, release tags. Need produce original synthesis. Product name: DotVVM. Summary not copy; start with impact verb and product. E.g. "Missing authorization in DotVVM's AuthorizeActionFilter silently disables access control for protected commands, view models, and presenters, allowing unauthenticated requests to invoke them in affected versions prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final. No exploit code or active exploitation is identified, but the flaw requires no special bypass and can be triggered remotely against applications that use the filter." Need mention actively exploited? KEV absent. POC absent. No public exploit. Technical context: AuthorizeActionFilter is action filter in DotVVM pipeline. Explicit interface implementations ICommandActionFilter.OnCommandExecutingAsync, IViewModelActionFilter.OnViewModelCreatedAsync, IPresenterActionFilter.OnPresenterExecutingAsync return Task.CompletedTask, skip IAuthorizationFilter? Need mention CWE-86
A regular-expression denial-of-service (ReDoS) flaw in DotVVM's routing engine (DotvvmRoute.IsMatch / DotvvmRouteParser.RouteRegex) lets a remote requester send a long, near-matching URL path and force excessive regex backtracking, tying up a worker thread for roughly one second per request. Only applications that declare routes with multiple unconstrained parameters inside a single path segment (e.g. "edit/{a}-{b}-{c}/done") are exposed; fully constrained or slash-separated routes are unaffected. The issue is fixed in DotVVM 4.2.11, 4.3.15 and 5.0.0-preview09-final, which apply a one-second regex timeout and then permanently switch the route to the .NET non-backtracking engine (or return HTTP 503 on runtimes older than .NET 8). There is no CISA KEV entry and no public exploit code identified at time of analysis, and CISA's SSVC assessment rates Exploitation as none and Automatable as no.
Unrestricted file upload in DotVVM before 4.2.11, 4.3.15, and 5.0.0-preview09-final lets unauthenticated remote users push arbitrary files into the application's configured upload storage by posting directly to DotvvmFileUploadMiddleware without a valid X-DotVVM-UploadToken, enabling repeated uploads that exhaust disk space and cause denial of service. The flaw stems from the middleware storing files without verifying a per-render cryptographic token or applying the previously client-supplied type/size constraints server-side. No CISA KEV listing or public exploit code was identified at time of analysis; the vendor has released fixes and adds an optional AuthorizeFileUpload authorization hook.
We need answer JSON only. Need synthesize. Must include all fields strings, data_quality_flags array? It says JSON array but every field plain text string? Conflict: data_quality_flags should be JSON array. We need output valid JSON object with that field as array. Need follow. Let's analyze CVE. CVE-2026-57578: DotVVM open source MVVM framework for web apps. Prior to 4.2.11, 4.3.15, 5.0.0-preview09-final, AuthorizeActionFilter performs no authorization because explicit implementations return completed tasks instead of invoking checks. Applications relying on this filter expose protected commands, view models, presenters to unauthorized requests. AuthorizeAttribute workaround. Fixed versions. CVSS 4.0 vector: AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Score 9.2. CWE-862 Missing Authorization. Patch available. Reported by GitHub_M. CPE riganti:dotvvm. Tags: Authentication Bypass, Dotvvm. SSVC exploitation none, automatable no, technical impact total. ENVD affected versions. References: GHSA, commits, release tags. Need produce original synthesis. Product name: DotVVM. Summary not copy; start with impact verb and product. E.g. "Missing authorization in DotVVM's AuthorizeActionFilter silently disables access control for protected commands, view models, and presenters, allowing unauthenticated requests to invoke them in affected versions prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final. No exploit code or active exploitation is identified, but the flaw requires no special bypass and can be triggered remotely against applications that use the filter." Need mention actively exploited? KEV absent. POC absent. No public exploit. Technical context: AuthorizeActionFilter is action filter in DotVVM pipeline. Explicit interface implementations ICommandActionFilter.OnCommandExecutingAsync, IViewModelActionFilter.OnViewModelCreatedAsync, IPresenterActionFilter.OnPresenterExecutingAsync return Task.CompletedTask, skip IAuthorizationFilter? Need mention CWE-86
A regular-expression denial-of-service (ReDoS) flaw in DotVVM's routing engine (DotvvmRoute.IsMatch / DotvvmRouteParser.RouteRegex) lets a remote requester send a long, near-matching URL path and force excessive regex backtracking, tying up a worker thread for roughly one second per request. Only applications that declare routes with multiple unconstrained parameters inside a single path segment (e.g. "edit/{a}-{b}-{c}/done") are exposed; fully constrained or slash-separated routes are unaffected. The issue is fixed in DotVVM 4.2.11, 4.3.15 and 5.0.0-preview09-final, which apply a one-second regex timeout and then permanently switch the route to the .NET non-backtracking engine (or return HTTP 503 on runtimes older than .NET 8). There is no CISA KEV entry and no public exploit code identified at time of analysis, and CISA's SSVC assessment rates Exploitation as none and Automatable as no.
Unrestricted file upload in DotVVM before 4.2.11, 4.3.15, and 5.0.0-preview09-final lets unauthenticated remote users push arbitrary files into the application's configured upload storage by posting directly to DotvvmFileUploadMiddleware without a valid X-DotVVM-UploadToken, enabling repeated uploads that exhaust disk space and cause denial of service. The flaw stems from the middleware storing files without verifying a per-render cryptographic token or applying the previously client-supplied type/size constraints server-side. No CISA KEV listing or public exploit code was identified at time of analysis; the vendor has released fixes and adds an optional AuthorizeFileUpload authorization hook.