From 463c07293a673850001acbd705e7277e4ff7631e Mon Sep 17 00:00:00 2001 From: Henrique Cabral Date: Fri, 4 Jul 2025 09:22:26 -0300 Subject: [PATCH 1/2] New Vuln: CVE-2025-47944 in Multer --- input/new.json | 35 ++++++++++++++++++++++------------- 1 file changed, 22 insertions(+), 13 deletions(-) diff --git a/input/new.json b/input/new.json index 87646b9a..8b1bae19 100644 --- a/input/new.json +++ b/input/new.json @@ -1,15 +1,24 @@ { - "package_name": "", - "patch_versions": [], - "vulnerable_ranges": [], - "cwe": [], - "tldr": "", - "doest_this_affect_me": "", - "how_to_fix": "", - "vulnerable_to": "", - "related_cve_id": "", - "language": "", - "severity_class": "", - "aikido_score": 0, - "changelog": "" + "package_name": "Multer", + "patch_versions": [ + "2.0.0" + ], + "vulnerable_ranges": [ + [ + "1.4.4-lts.1", + "1.4.5-lts.2" + ] + ], + "cwe": [ + "CWE-248" + ], + "tldr": "Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.0 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.0 to receive a patch. No known workarounds are available.", + "doest_this_affect_me": "You are affected if you are using a version that falls within the vulnerable range.", + "how_to_fix": "Upgrade the `Multer` library to the patch version.", + "vulnerable_to": "Uncaught Exception", + "related_cve_id": "CVE-2025-47944", + "language": "JS", + "severity_class": "HIGH", + "aikido_score": 75, + "changelog": "https://github.com/expressjs/multer/releases/tag/v2.0.1" } From f3b1a45e1d9369928a259d6d653cb520d2b6ff89 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Fri, 4 Jul 2025 12:26:58 +0000 Subject: [PATCH 2/2] Move new vulnerability to vulnerabilities/AIKIDO-2025-10435.json and reset new.json template --- input/new.json | 35 ++++++++++---------------- vulnerabilities/AIKIDO-2025-10435.json | 26 +++++++++++++++++++ 2 files changed, 39 insertions(+), 22 deletions(-) create mode 100644 vulnerabilities/AIKIDO-2025-10435.json diff --git a/input/new.json b/input/new.json index 8b1bae19..87646b9a 100644 --- a/input/new.json +++ b/input/new.json @@ -1,24 +1,15 @@ { - "package_name": "Multer", - "patch_versions": [ - "2.0.0" - ], - "vulnerable_ranges": [ - [ - "1.4.4-lts.1", - "1.4.5-lts.2" - ] - ], - "cwe": [ - "CWE-248" - ], - "tldr": "Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.0 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.0 to receive a patch. No known workarounds are available.", - "doest_this_affect_me": "You are affected if you are using a version that falls within the vulnerable range.", - "how_to_fix": "Upgrade the `Multer` library to the patch version.", - "vulnerable_to": "Uncaught Exception", - "related_cve_id": "CVE-2025-47944", - "language": "JS", - "severity_class": "HIGH", - "aikido_score": 75, - "changelog": "https://github.com/expressjs/multer/releases/tag/v2.0.1" + "package_name": "", + "patch_versions": [], + "vulnerable_ranges": [], + "cwe": [], + "tldr": "", + "doest_this_affect_me": "", + "how_to_fix": "", + "vulnerable_to": "", + "related_cve_id": "", + "language": "", + "severity_class": "", + "aikido_score": 0, + "changelog": "" } diff --git a/vulnerabilities/AIKIDO-2025-10435.json b/vulnerabilities/AIKIDO-2025-10435.json new file mode 100644 index 00000000..e4eb9813 --- /dev/null +++ b/vulnerabilities/AIKIDO-2025-10435.json @@ -0,0 +1,26 @@ +{ + "package_name": "Multer", + "patch_versions": [ + "2.0.0" + ], + "vulnerable_ranges": [ + [ + "1.4.4-lts.1", + "1.4.5-lts.2" + ] + ], + "cwe": [ + "CWE-248" + ], + "tldr": "Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.0 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.0 to receive a patch. No known workarounds are available.", + "doest_this_affect_me": "You are affected if you are using a version that falls within the vulnerable range.", + "how_to_fix": "Upgrade the `Multer` library to the patch version.", + "vulnerable_to": "Uncaught Exception", + "related_cve_id": "CVE-2025-47944", + "language": "JS", + "severity_class": "HIGH", + "aikido_score": 75, + "changelog": "https://github.com/expressjs/multer/releases/tag/v2.0.1", + "last_modified": "2025-07-04", + "published": "2025-07-04" +}