Grid
Monthly
Arbitrary Perl code execution in GRID::Machine through version 0.127 occurs when clients connect to remote hosts via RPC over SSH, as the client-side deserializer uses eval() on untrusted data from the remote peer without validation. A compromised or malicious remote host can inject arbitrary Perl code into Dumper-formatted responses that executes silently on the client during RPC calls, while maintaining correct return values to avoid detection. The vulnerability is design-inherent but the trust requirement for remote hosts is not documented, creating a security expectation mismatch for users.
Integer overflow in the Rust `grid` crate's `Grid::expand_rows()` method (versions 0.17.0 through 1.0.0) corrupts the relationship between logical grid dimensions and physical backing storage, allowing the safe `get()` API to invoke `get_unchecked()` with an invalid index and trigger undefined behavior. A publicly available proof-of-concept included in the GHSA advisory demonstrates a process crash (SIGSEGV or illegal instruction trap) using only safe Rust code by passing `usize::MAX / 2` to `expand_rows()`. No CISA KEV listing exists and EPSS sits at 0.01% (2nd percentile), but the SSVC framework confirms poc-level exploitation status; the fix is available in version 1.0.1.
GRID Organiser App versions 1.0.0 through 1.0.5 on Android expose a hard-coded cryptographic key used for the SegmentWriteKey parameter in the res/raw/app.json component file, enabling local attackers with user-level privileges to manipulate argument values and potentially perform data injection and user profile manipulation. The vulnerability has a CVSS v4.0 score of 1.9 with low confidentiality impact, requires local access and low privileges, and publicly available exploit code exists, though active exploitation has not been confirmed by CISA.
An issue was discovered in Sylius products. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Arbitrary Perl code execution in GRID::Machine through version 0.127 occurs when clients connect to remote hosts via RPC over SSH, as the client-side deserializer uses eval() on untrusted data from the remote peer without validation. A compromised or malicious remote host can inject arbitrary Perl code into Dumper-formatted responses that executes silently on the client during RPC calls, while maintaining correct return values to avoid detection. The vulnerability is design-inherent but the trust requirement for remote hosts is not documented, creating a security expectation mismatch for users.
Integer overflow in the Rust `grid` crate's `Grid::expand_rows()` method (versions 0.17.0 through 1.0.0) corrupts the relationship between logical grid dimensions and physical backing storage, allowing the safe `get()` API to invoke `get_unchecked()` with an invalid index and trigger undefined behavior. A publicly available proof-of-concept included in the GHSA advisory demonstrates a process crash (SIGSEGV or illegal instruction trap) using only safe Rust code by passing `usize::MAX / 2` to `expand_rows()`. No CISA KEV listing exists and EPSS sits at 0.01% (2nd percentile), but the SSVC framework confirms poc-level exploitation status; the fix is available in version 1.0.1.
GRID Organiser App versions 1.0.0 through 1.0.5 on Android expose a hard-coded cryptographic key used for the SegmentWriteKey parameter in the res/raw/app.json component file, enabling local attackers with user-level privileges to manipulate argument values and potentially perform data injection and user profile manipulation. The vulnerability has a CVSS v4.0 score of 1.9 with low confidentiality impact, requires local access and low privileges, and publicly available exploit code exists, though active exploitation has not been confirmed by CISA.
An issue was discovered in Sylius products. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.