#git

# Summary Loading a malicious schema definition in `GraphQL::Schema.from_introspection` (or `GraphQL::Schema::Loader.load`) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use [GraphQL::Client](https://github.com/github-community-projects/graphql-client) to load external schemas via GraphQL introspection.

# Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mj4v-hp69-27x5. This link is maintained to preserve external references. # Original Description Plenti <= 0.7.16 is vulnerable to code execution. Users uploading '.svelte' files with the /postLocal endpoint can define the file name as javascript codes. The server executes the uploaded file name in host, and cause code execution.

UNC3886 hackers target Juniper routers with custom backdoor malware, exploiting outdated systems for stealthy access and espionage. Learn how to stay protected.

### Impact Medium ### Patches Version 3.4.17 fixes illuminate/validation v 8.0.0 to 11.44.0 ### Workarounds Register \MacropaySolutions\LaravelCrudWizard\Providers\ValidationServiceProvider instead of Illuminate\Validation\ValidationServiceProvider::class if you are using illuminate/validation < 11.44.1 ### References https://github.com/laravel/framework/security/advisories/GHSA-78fx-h6xr-vch4

Sports betting is a multi-billion-dollar industry, but behind the flashing lights and promises of easy money lies a hidden underworld of deception.

San Jose, United States / California, 12th March 2025, CyberNewsWire

API attacks are constantly on the rise, with a recent alarming study showing that 59% of organizations give…

Google spies on Android device users, starting from even before they have logged in to their Google account.

Lazarus Group targets developers with malicious npm packages, stealing credentials, crypto, and installing backdoor. Stay alert to protect your projects.

# Description [An issue was discovered in IBC-Go's deserialization of acknowledgements](https://github.com/cosmos/ibc-go/security/advisories/GHSA-jg6f-48ff-5xrw) that results in non-deterministic behavior which can halt a chain. Any user that can open an IBC channel can introduce this state to the chain. This an upstream dependency used in cheqd-node, rather than a custom module. ## Impact Could result in a chain halt. ## Patches Validators, full nodes, and IBC relayers should upgrade to **[cheqd-node v3.1.7](https://github.com/cheqd/cheqd-node/releases/tag/v3.1.7)**. This upgrade does not require a software upgrade proposal on-chain and is meant to be non state-breaking. ## References See [ASA-2025-004: Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result in a chain halt](https://github.com/cosmos/ibc-go/security/advisories/GHSA-jg6f-48ff-5xrw) upstream on IBC-Go.