CVE-2025-1022
published 2025-02-05CVE-2025-1022: Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html()…
PriorityP347high8.2CVSS 3.1
AVNACLPRNUINSUCHILAN
EPSS
0.44%
36.2th percentile
Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(), which can be bypassed by omitting the slashes in the file URI (e.g., file:../../../../etc/passwd). This is due to missing validations of the user input that should be blocking file URI schemes (e.g., file:// and file:/) in the HTML content. **Note:** Further analysis has identified additional proof-of-concept exploits leveraging the vulnerable function. Developers using this package should ensure proper input validation to mitigate potential risks, as the issue remains unaddressed.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jupyterlab | jupyterlab | >= 0 < 4.4.8 | 4.4.8 |
| spatie | browsershot | < 5.0.5 | 5.0.5 |
| spatie | browsershot | >= 0 < 5.0.5 | 5.0.5 |
CVSS provenance
nvdv3.18.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
nvdv4.07.8HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
JupyterLab LaTeX typesetter links did not enforce `noopener` attribute
ghsa·2025-09-26
CVE-2025-59842 [LOW] CWE-1022 JupyterLab LaTeX typesetter links did not enforce `noopener` attribute
JupyterLab LaTeX typesetter links did not enforce `noopener` attribute
Links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the `noopener` attribute.
This is deemed to have no impact on the default installations. Theoretically users of third-party LaTeX-rendering extensions could find themselves vulnerable to reverse tabnabbing attacks if:
- links generated by those extensions included `target=_blank` (no such extensions are known at time of writing) and
- they were to click on a link generated in LaTeX (typically visibly different from other links).
For consistency with handling on other links, new versions of JupyterLab will enforce `noopener` and `target=_blank` on all links generated by typesetters. The former
GHSA
Browsershot Path Traversal
ghsa·2025-02-05
CVE-2025-1022 [HIGH] CWE-20 Browsershot Path Traversal
Browsershot Path Traversal
Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(), which can be bypassed by omitting the slashes in the file URI (e.g., file:../../../../etc/passwd). This is due to missing validations of the user input that should be blocking file URI schemes (e.g., file:// and file:/) in the HTML content.
OSV
Browsershot Path Traversal
osv·2025-02-05
CVE-2025-1022 [HIGH] Browsershot Path Traversal
Browsershot Path Traversal
Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(), which can be bypassed by omitting the slashes in the file URI (e.g., file:../../../../etc/passwd). This is due to missing validations of the user input that should be blocking file URI schemes (e.g., file:// and file:/) in the HTML content.
Red Hat
jupyterlab: JupyterLab LaTeX typesetter links did not enforce `noopener` attribute
vendor_redhat·2025-09-26·CVSS 2.1
CVE-2025-59842 [LOW] CWE-1022 jupyterlab: JupyterLab LaTeX typesetter links did not enforce `noopener` attribute
jupyterlab: JupyterLab LaTeX typesetter links did not enforce `noopener` attribute
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to version 4.4.8, links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the noopener attribute. This is deemed to have no impact on the default installations. Theoretically users of third-party LaTeX-rendering extensions could find themselves vulnerable to reverse tabnabbing attacks if links generated by those extensions included target=_blank (no such extensions are known at time of writing) and they were to click on a link generated in LaTeX (typically visibly different from other links). This issue ha
Red Hat
kernel: Linux kernel: PCI link speed calculation DoS
vendor_redhat·2025-09-11·CVSS 5.5
CVE-2025-39784 [MEDIUM] CWE-1419 kernel: Linux kernel: PCI link speed calculation DoS
kernel: Linux kernel: PCI link speed calculation DoS
In the Linux kernel, the following vulnerability has been resolved:
PCI: Fix link speed calculation on retrain failure
When pcie_failed_link_retrain() fails to retrain, it tries to revert to the
previous link speed. However it calculates that speed from the Link
Control 2 register without masking out non-speed bits first.
PCIE_LNKCTL2_TLS2SPEED() converts such incorrect values to
PCI_SPEED_UNKNOWN (0xff), which in turn causes a WARN splat in
pcie_set_target_speed():
pci 0000:00:01.1: [1022:14ed] type 01 class 0x060400 PCIe Root Port
pci 0000:00:01.1: broken device, retraining non-functional downstream link at 2.5GT/s
pci 0000:00:01.1: retraining failed
WARNING: CPU: 1 PID: 1 at drivers/pci/pcie/bwctrl.c:168 pcie_set_target_speed
RDX: 00
Red Hat
kernel: nbd: fix uaf in nbd_genl_connect() error path
vendor_redhat·2025-07-25·CVSS 7.8
CVE-2025-38443 [HIGH] CWE-416 kernel: nbd: fix uaf in nbd_genl_connect() error path
kernel: nbd: fix uaf in nbd_genl_connect() error path
In the Linux kernel, the following vulnerability has been resolved:
nbd: fix uaf in nbd_genl_connect() error path
There is a use-after-free issue in nbd:
block nbd6: Receive control failed (result -104)
block nbd6: shutting down sockets
BUG: KASAN: slab-use-after-free in recv_work+0x694/0xa80 drivers/block/nbd.c:1022
Write of size 4 at addr ffff8880295de478 by task kworker/u33:0/67
CPU: 2 UID: 0 PID: 67 Comm: kworker/u33:0 Not tainted 6.15.0-rc5-syzkaller-00123-g2c89c1b655c0 #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: nbd6-recv recv_work
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_address_d
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-39784 kernel: Linux kernel: PCI link speed calculation DoS
bugzilla·2025-09-11·CVSS 5.5
CVE-2025-39784 [MEDIUM] CVE-2025-39784 kernel: Linux kernel: PCI link speed calculation DoS
CVE-2025-39784 kernel: Linux kernel: PCI link speed calculation DoS
In the Linux kernel, the following vulnerability has been resolved:
PCI: Fix link speed calculation on retrain failure
When pcie_failed_link_retrain() fails to retrain, it tries to revert to the
previous link speed. However it calculates that speed from the Link
Control 2 register without masking out non-speed bits first.
PCIE_LNKCTL2_TLS2SPEED() converts such incorrect values to
PCI_SPEED_UNKNOWN (0xff), which in turn causes a WARN splat in
pcie_set_target_speed():
pci 0000:00:01.1: [1022:14ed] type 01 class 0x060400 PCIe Root Port
pci 0000:00:01.1: broken device, retraining non-functional downstream link at 2.5GT/s
pci 0000:00:01.1: retraining failed
WARNING: CPU: 1 PID: 1 at drivers/pci/pcie/bwctrl.c:168 pcie_set_t
Bugzilla
CVE-2025-38443 kernel: nbd: fix uaf in nbd_genl_connect() error path
bugzilla·2025-07-25·CVSS 7.8
CVE-2025-38443 [HIGH] CVE-2025-38443 kernel: nbd: fix uaf in nbd_genl_connect() error path
CVE-2025-38443 kernel: nbd: fix uaf in nbd_genl_connect() error path
In the Linux kernel, the following vulnerability has been resolved:
nbd: fix uaf in nbd_genl_connect() error path
There is a use-after-free issue in nbd:
block nbd6: Receive control failed (result -104)
block nbd6: shutting down sockets
BUG: KASAN: slab-use-after-free in recv_work+0x694/0xa80 drivers/block/nbd.c:1022
Write of size 4 at addr ffff8880295de478 by task kworker/u33:0/67
CPU: 2 UID: 0 PID: 67 Comm: kworker/u33:0 Not tainted 6.15.0-rc5-syzkaller-00123-g2c89c1b655c0 #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: nbd6-recv recv_work
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:
https://gist.github.com/mrdgef/a820837c530e09e1dd725e013e0d4341https://github.com/spatie/browsershot/commit/bcfd608b264fab654bf78e199bdfbb03e9323eb7https://github.com/spatie/browsershot/commit/e3273974506865a24fbb5b65b534d8d4b8dfbf72https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8496747https://gist.github.com/mrdgef/a820837c530e09e1dd725e013e0d4341
2025-02-05
Published