The Trump cabinet’s shocking leak of its plans to bomb Yemen raises myriad confidentiality and legal issues. The security of the encrypted messaging app Signal is not one of them.

The eye-popping scandal surrounding the Trump cabinet’s accidental invitation to The Atlantic’s editor in chief to join a text-message group secretly planning a bombing in Yemen has rolled into its third day, and that controversy now has a name: SignalGate, a reference to the fact that the conversation took place on the end-to-end encrypted free messaging tool Signal.

As that name becomes a shorthand for the biggest public blunder of the second Trump administration to date, however, security and privacy experts who have promoted Signal as the best encrypted messaging tool available to the public want to be clear about one thing: SignalGate is not about Signal.

Since The Atlantic’s editor, Jeffrey Goldberg, revealed Monday that he was mistakenly included in a Signal group chat earlier this month created to plan US airstrikes against the Houthi rebels in Yemen, the reaction from the Trump cabinet’s critics and even the administration itself has in some cases seemed to cast blame on Signal for the security breach. Some commentators have pointed to reports last month of Signal-targeted phishing by Russian spies. National security adviser Michael Waltz, who reportedly invited Goldberg to the Signal group chat, has even suggested that Goldberg may have hacked into it.

On Wednesday afternoon, even President Donald Trump suggested Signal was somehow responsible for the group chat fiasco. “I don't know that Signal works,” Trump told reporters at the White House. “I think Signal could be defective, to be honest with you.”

The real lesson is much simpler, says Kenn White, a security and cryptography researcher who has conducted audits on widely used encryption tools in the past as the director of the Open Crypto Audit Project: Don’t invite untrusted contacts into your Signal group chat. And if you’re a government official working with highly sensitive or classified information, use the encrypted communication tools that run on restricted, often air-gapped devices intended for a top-secret setting rather than the unauthorized devices that can run publicly available apps like Signal.

“Unequivocally, no blame in this falls on Signal,” says White. “Signal is a communication tool designed for confidential conversations. If someone's brought into a conversation who’s not meant to be part of it, that's not a technology problem. That's an operator issue.”

Cryptographer Matt Green, a professor of computer science at Johns Hopkins University, puts it more simply. “Signal is a tool. If you misuse a tool, bad things are going to happen,” says Green. “If you hit yourself in the face with a hammer, it’s not the hammer’s fault. It’s really on you to make sure you know who you’re talking to.”

The only sense in which SignalGate _is_ a Signal-related scandal, White adds, is that the use of Signal suggests that the cabinet-level officials involved in the Houthi bombing plans, including secretary of defense Pete Hegseth and director of national intelligence Tulsi Gabbard, were conducting the conversation on internet-connected devices—possibly even including personal ones—since Signal wouldn’t typically be allowed on the official, highly restricted machines intended for such conversations. “In past administrations, at least, that would be absolutely forbidden, especially for classified communications,” says White.

Indeed, using Signal on internet-connected commercial devices doesn’t just leave communications open to anyone who can somehow exploit a hackable vulnerability in Signal, but anyone who can hack the iOS, Android, Windows, or Mac devices that might be running the Signal mobile or desktop apps.

This is why US agencies in general, and the Department of Defense in particular, conduct business on specially managed federal devices that are specially provisioned to control what software is installed and which features are available. Whether the cabinet members had conducted the discussion on Signal or another consumer platform, the core issue was communicating about incredibly high-stakes, secret military operations using inappropriate devices or software.

One of the most straightforward reasons that communication apps like Signal and WhatsApp are not suitable for classified government work is that they offer “disappearing message” features—mechanisms to automatically delete messages after a preset amount of time—that are incompatible with federal record retention laws. This issue was on full display in the principals’ chat about the impending strike on Yemen, which was originally set for one-week auto-delete before the Michael Waltz account changed the timer to four-week auto-delete, according to screenshots of the chat published by The Atlantic on Wednesday. Had The Atlantic’s Goldberg not been mistakenly included in the chat, its contents might not have been preserved in accordance with long-standing government requirements.

In congressional testimony on Wednesday, US director of national intelligence Tulsi Gabbard said that Signal can come preinstalled on government devices. Multiple sources tell WIRED that this is not the norm, though, and noted specifically that downloading consumer apps like Signal to Defense Department devices is highly restricted and often banned. The fact that Hegseth, the defense secretary, participated in the chat indicates that he either obtained an extremely unusual waiver to install Signal on a department device, bypassed the standard process for seeking such a waiver, or was using a non-DOD device for the chat. According to political consultant and podcaster FP Wellman, DOD “political appointees” demanded that Signal be installed on their government devices last month.

Core to the Trump administration’s defense of the behavior is the claim that no classified material was discussed in the Signal chat. In particular, Gabbard and others have noted that Hegseth himself is the classification authority for the information. Multiple sources tell WIRED, though, that this authority does not make a consumer application the right forum for such a discussion.

“The way this was being communicated, the conversation had no formal designation like 'for official use only' or something. But whether it should have been classified or not, whatever it was, it was obviously sensitive operational information that no soldier or officer would be expected to release to the public—but they had added a member of the media into the chat,” says Andy Jabbour, a US Army veteran and founder of the domestic security risk-management firm Gate 15.

Jabbour adds that military personnel undergo annual information awareness and security training to reinforce operating procedures for handling all levels of nonpublic information. Multiple sources emphasize to WIRED that while the information in the Yemen strike chat appears to meet the standard for classification, even nonclassified material can be extremely sensitive and is typically carefully protected.

“Putting aside for a moment that classified information should never be discussed over an unclassified system, it’s also just mind-boggling to me that all of these senior folks who were on this line and nobody bothered to even check, security hygiene 101, who are all the names? Who are they?” US senator Mark Warner, a Virginia Democrat, said during Tuesday’s Senate Intelligence Committee hearing.

According to The Atlantic, 12 Trump administration officials were in the Signal group chat, including vice president JD Vance, secretary of state Marco Rubio, and Trump adviser Susie Wiles. Jabbour adds that even with ​​decisionmaking authorities present and participating in a communication, establishing an information designation or declassifying information happens through an established, proactive process. As he puts it, “If you spill milk on the floor, you can’t just say, ‘That’s actually not spilled milk, because I intended to spill it.’”

All of which is to say, SignalGate raises plenty of security, privacy, and legal issues. But the security of Signal itself is not one of them. Despite that, in the wake of The Atlantic’s story on Monday, some have sought tenuous connections between the Trump cabinet’s security breach and Signal vulnerabilities. On Tuesday, for example, a Pentagon adviser echoed a report from Google’s security researchers, who alerted Signal earlier this year to a phishing technique that Russian military intelligence used to target the app’s users in Ukraine. But Signal pushed out an update to make that tactic—which tricks users into adding a hacker as a secondary device on their account—far harder to pull off, and the same tactic also targeted some accounts on the messaging services WhatsApp and Telegram.

“Phishing attacks against people using popular applications and websites are a fact of life on the internet,” Signal spokesperson Jun Harada tells WIRED. “Once we learned that Signal users were being targeted, and how they were being targeted, we introduced additional safeguards and in-app warnings to help protect people from falling victim to phishing attacks. This work was completed months ago."

In fact, says White, the cryptography researcher, if the Trump administration is going to put secret communications at risk by discussing war plans on unapproved commercial devices and freely available messaging apps, they could have done much worse than to choose Signal for those conversations, given its reputation and track record among security experts.

“Signal is the consensus recommendation for highly at-risk communities—human rights activists, attorneys, and confidential sources for journalists,” says White. Just not, as this week has made clear, executive branch officials planning airstrikes.

_Updated at 5:50 pm ET, March 25, 2025: Added remarks about Signal by President Trump._

SignalGate Isn’t About Signal

### Impact
SQL injection could be achieved via a specially crafted request, which could allow malicious person to gain access to sensitive information.

### Workarounds
Upgrading is required, no other workaround is present.

**Exploitability Metrics**

Attack Vector: This metric reflects the context by which vulnerability exploitation is possible. This metric value (and consequently the resulting severity) will be larger the more remote (logically, and physically) an attacker can be in order to exploit the vulnerable system. The assumption is that the number of potential attackers for a vulnerability that could be exploited from across a network is larger than the number of potential attackers that could exploit a vulnerability requiring physical access to a device, and therefore warrants a greater severity.

Attack Complexity: This metric captures measurable actions that must be taken by the attacker to actively evade or circumvent existing built-in security-enhancing conditions in order to obtain a working exploit. These are conditions whose primary purpose is to increase security and/or increase exploit engineering complexity. A vulnerability exploitable without a target-specific variable has a lower complexity than a vulnerability that would require non-trivial customization. This metric is meant to capture security mechanisms utilized by the vulnerable system.

Attack Requirements: This metric captures the prerequisite deployment and execution conditions or variables of the vulnerable system that enable the attack. These differ from security-enhancing techniques/technologies (ref Attack Complexity) as the primary purpose of these conditions is not to explicitly mitigate attacks, but rather, emerge naturally as a consequence of the deployment and execution of the vulnerable system.

Privileges Required: This metric describes the level of privileges an attacker must possess prior to successfully exploiting the vulnerability. The method by which the attacker obtains privileged credentials prior to the attack (e.g., free trial accounts), is outside the scope of this metric. Generally, self-service provisioned accounts do not constitute a privilege requirement if the attacker can grant themselves privileges as part of the attack.

User interaction: This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable system. This metric determines whether the vulnerability can be exploited solely at the will of the attacker, or whether a separate user (or user-initiated process) must participate in some manner.

**Vulnerable System Impact Metrics**

Confidentiality: This metric measures the impact to the confidentiality of the information managed by the VULNERABLE SYSTEM due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.

Integrity: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of the VULNERABLE SYSTEM is impacted when an attacker makes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging).

Availability: This metric measures the impact to the availability of the VULNERABLE SYSTEM resulting from a successfully exploited vulnerability. While the Confidentiality and Integrity impact metrics apply to the loss of confidentiality or integrity of data (e.g., information, files) used by the system, this metric refers to the loss of availability of the impacted system itself, such as a networked service (e.g., web, database, email). Since availability refers to the accessibility of information resources, attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system.

**Subsequent System Impact Metrics**

Confidentiality: This metric measures the impact to the confidentiality of the information managed by the SUBSEQUENT SYSTEM due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.

Integrity: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of the SUBSEQUENT SYSTEM is impacted when an attacker makes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging).

Availability: This metric measures the impact to the availability of the SUBSEQUENT SYSTEM resulting from a successfully exploited vulnerability. While the Confidentiality and Integrity impact metrics apply to the loss of confidentiality or integrity of data (e.g., information, files) used by the system, this metric refers to the loss of availability of the impacted system itself, such as a networked service (e.g., web, database, email). Since availability refers to the accessibility of information resources, attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system.

GHSA-6phg-4wmq-h5h3: Frappe has possibility of SQL injection due to improper validations

Researchers have uncovered a critical vulnerability (CVE-2025-29927) in Next.js middleware, allowing authorization bypass. Learn about the exploit and fixes.

A recent collaborative effort by researchers Rachid Allam and Yasser Allam has exposed a critical vulnerability within the Next.js framework, a widely used JavaScript framework based on React with nearly 10 million weekly downloads.

Their research, documented in a detailed publication, reveals a flaw in the Next.js middleware that allows for unauthorized access and control, impacting all versions of the framework. This flaw, designated CVE-2025-29927 and rated as critical, allows unauthorized access to protected resources.

Reportedly, the vulnerability specifically targets the middleware function, which is a component designed to execute code before a request is completed and is frequently used for crucial security functions, including authentication and authorization. However, the discovered vulnerability allows attackers to bypass these security measures.

The core of the vulnerability lies in the handling of the “x-middleware-subrequest” header. By manipulating this header with a specific value, attackers can effectively ignore the middleware’s intended rules, gaining unauthorized access. As Allam explained, “The header and its value act as a universal key allowing rules to be overridden.”

The vulnerability stems from code intended to prevent recursive requests, which could lead to infinite loops. Ironically, this very code introduced a point of failure, enabling the authorization bypass.

The value required for this bypass is derived from the middleware’s path, which, depending on the Next.js version, can be “middleware,” “src/middleware,” or a variation involving the “pages” directory in older versions.

Researchers demonstrated various exploits, including authorization/rewrite bypasses, Content Security Policy (CSP) bypasses, and even potential Denial-of-Service (DoS) attacks through cache poisoning.

“If the site has a cache/CDN system, it may be possible to force the caching of a 404 response, rendering its pages unusable,” they noted, highlighting the wide range of potential impacts.

They initially believed that only versions 12.0.0 and 12.0.7 were affected but later identified that all versions were vulnerable and duly notified the Next.js team.

The team promptly acknowledged the vulnerability, issuing an advisory and providing patches for vulnerable versions.

*   For Next.js 15.x, this issue is fixed in 15.2.3.
*   For Next.js 14.x, this issue is fixed in 14.2.25.
*   For Next.js 13.x, this issue is fixed in 13.5.9.
*   For Next.js 12.x, this issue is fixed in 12.3.5.

Earlier versions require workarounds, such as blocking external requests containing the “x-middleware-subrequest” header.

Notably, applications hosted on Vercel or Netlify have been automatically protected.  The framework’s maintainers have since admitted to missing “the mark on partner communications” and have committed to improving future security advisories by establishing a dedicated partner mailing list.

Next.js post on X (Source: zhero\_web\_security)

The Next.js documentation, which previously highlighted middleware’s role in authentication and authorization, has since been updated to emphasize that it should not be the sole security measure. 

Nevertheless, the discovery and disclosure of CVE-2025-29927 show the importance of proper security checks, especially in widely used frameworks like Next.js.

Next.js Middleware Flaw Lets Attackers Bypass Authorization

Specially crafted titles may have caused a regular expression to excessively backtrack and cause a local denial of service.

Additional Details are [available at Bugzilla](https://bugzilla.mozilla.org/show_bug.cgi?id=1948833)

Credit: DayShift

GHSA-3p6v-hrg8-8qj7: @mozilla/readability Denial of Service through Regex

Fake Booking.com emails sent to hotels lead to fake Captcha sites that trick the staff into infecting their own systems

A new phishing campaign that uses the fake CAPTCHA websites we reported about recently is targeting hotel staff in a likely attempt to access customer data, according to research from ThreatDown.

Here’s how it works: Cybercriminals send a fake Booking.com email to a hotel’s email address, asking them to confirm a booking.

> “Dear Team,
> 
> You have received a new booking. Please find the details below:
> 
> Reservation number: 5124588434141
> 
> Guest Name: Margit Kainz
> 
> Check-in Date: 2025-03-25
> 
> Check-out Date: 2025-04-01
> 
> Room Type: Deluxe Double Room
> 
> Guests: 2 Adults
> 
> Special Requests:Early check-in requested (before 2 PM)
> 
> Payment Status: Payment at property
> 
> {link to landing page}
> 
> (Copy and paste this link in your browser to confirm booking)
> 
> Please ensure the room is prepared according to the guest’s requests.
> 
> If you have any questions or need more information, please contact the guest directly or through our platform.
> 
> Thank you for your cooperation,
> 
> The Booking.com Team”

The email is sent only a few days before the check-in-date, which is very likely to create a sense of urgency—a common tactic of scammers.

But if the hotel staff were to copy and paste the URL into the browser address bar they will be greeted by this fake CAPTCHA website.

When they check the box, they’ll then see “verification” instructions that will effectively infect their system.

> “Verification steps
> 
> Press Windows Key + R.
> 
> Press Ctrl + V.
> 
> Press Enter”

As we explained in more detail here, these instructions will infect their Windows system with an information stealer or Trojan.

What the hotel staff would actually be doing is copy and pasting a mshta command into the Run prompt and then executing the command, which then fetches a remote file and then runs it on their system.

We don’t know the exact plans of the criminals once they have gained control over the system, but it’s highly likely they’re after customer payment details and other personal data: Data that is very valuable to them and can be traded on the dark web.

There isn’t much you can do to protect your own data in situations like these, when cybercriminals are attacking the companies that hold your personal information. However, there are a few things you can do to lower your risk.

**How to protect your data online**

*   **Don’t store your card details**. Not in your browser, not on websites. Sure, it’s more convenient to get sites to remember your card details for you, but we highly recommend not storing that information.
*   **Find out what information is already out there**. Our free Digital Footprint scan searches the dark web, social media, and other online sources, to tell you where your data has been exposed.
*   **Remove as much of that information as you can.** You can do this manually by cleaning things up yourself, or if you’re in the US then you can use Malwarebytes Personal Data Remover to do it for you.
*   **Monitor your accounts.** Check your accounts periodically for unexpected changes and notifications of suspicious login attempts.
*   **Use a different password for every online account.** Choose a strong password that you don’t use for anything else. Better yet, let a password manager choose one for you.
*   **Enable two-factor authentication (2FA).** If you can, use a FIDO2-compliant hardware key, laptop or phone as your second factor. Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device can’t be phished.
*   **Set up identity monitoring.** Identity monitoring alerts you if your personal information is found being traded illegally online, and helps you recover after.

 Fake Booking.com phish uses fake CAPTCHAs to trick hotel staff into downloading malware 

With its growing popularity, sponsored Google search ads have started impersonating DeepSeek AI.

_The threat intel research used in this post was provided by Malwarebytes Senior Director of Research, Jérôme Segura._

DeepSeek’s rising popularity has not only raised concerns and questions about privacy implications, but cybercriminals are also using it as a lure to trap unsuspecting Google searchers.

Unfortunately, we are getting so used to sponsored Google search results being abused by criminals that we advise people not to click on them. So, it was to be expected that DeepSeek would show up in our monitoring of fake Google ads.

Here’s the fake ad:

If you put it side by side with the real DeepSeek ads, the difference is relatively easy to spot:

But as an unsuspecting searcher, you aren’t likely to make that comparison, and as you may know from previous posts about fake Google sponsored ads, the criminals behind these campaigns can be a lot more convincing.

In this case, they certainly put a lot more effort into creating the fake website which the advertisement linked to:

It’s different from the real website, but it looks convincing, nonetheless.

Should you happen to click the download button, you will receive a Trojan programmed in Microsoft Intermediate Language (MSIL), which the Artificial Intelligence (AI) module in Malwarebytes/ThreatDown products detects as Malware.AI.1323738514.

**How to avoid these traps**

As we mentioned earlier, Google has demonstrated that it can’t keep fake ads out of its sponsored search results. And apparently the success rate of these fake ads is high enough to allow the criminals to pay Google enough to outrank legitimate brands.

So, our first tip is not to click on sponsored search results. Ever.

The second tip is to look at the advertiser by clicking the three dots behind the URL in the search result and look whether he advertiser listed is the legitimate owner of the brand or not.

Here is one example of another DeepSeek impersonator we found. The advertiser’s name is not in Chinese characters by the way. The language in which the advertiser’s name is written is Hebrew: תמיר כץ.

If you don’t want to see sponsored ads at all then it’s worth considering installing an ad-blocker that will make sure you go straight to the regular search results.

**We don’t just report on threats—we remove them**

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

 DeepSeek users targeted with fake sponsored Google ads that deliver malware 

With 23andMe filing for bankruptcy, here's how to remove your data from the company and protect yourself from the 2023 breach.

The genetic testing company 23andMe filed for bankruptcy on Sunday, announcing that, in searching for financial stability through its sale to a new owner, the business will continue operating as normal, including in how customer data is handled.

“The company intends to continue operating its business in the ordinary course throughout the sale process,” 23andMe wrote in a news statement. “There are no changes to the way the company stores, manages, or protects customer data.”

For some customers, that’s exactly the problem.

In 2023, not only did the company suffer a major data breach, it also placed some of the blame on the victims who, according to 23andMe, “negligently recycled and failed to update their passwords.”  With concerns now swirling about exactly who will become the new steward of 23andMe’s data following its bankruptcy, customers are asking how they can secure their most private genetic information, if at all.

Here are two big steps that 23andMe customers can take right now:

1.  Request that the company delete your data.
2.  Discover whether your data was included in the 2023 breach.

These are two, separate actions that will not impact one another and should be both taken for separate reasons—the first, to ask that the company remove your data from its possession; the second, to know how to protect yourself if your data was leaked in the past.

****What is happening?****

Over the weekend, 23andMe announced that it would file for bankruptcy after months of financial decline. Though the company was valued at a reported $6 billion in 2021, its genetic testing business—in which customers can have their saliva tested for insights into their genealogy and potential health risks—has faltered. Just last week, the company was reportedly valued at $50 million.

To save the company and its operations, 23andMe’s leadership is now on the hunt for a new owner (and that new owner’s cash infusion). One potential bidder has already made their intent abundantly clear: Former CEO Anne Wojcicki, who resigned the same day that the company announced its bankruptcy.

“I have resigned as CEO of the company so I can be in the best position to pursue the company as an independent bidder,” Wojcicki wrote on LinkedIn.

Wojcicki faces an uphill battle, though—her earlier proposal to take the company private was rejected last year.

Whoever becomes the new owner of 23andMe, however, could also become the new owner of 23andMe customer data. According to the company’s own privacy statement:

> “If we are involved in a bankruptcy, merger, acquisition, reorganization, or sale of assets, your Personal Information may be accessed, sold or transferred as part of that transaction.”

That has worried some experts who have pointed out that a new owner could, for instance, hand over customer data to insurance companies to hike up monthly premiums, or to data brokers to power increasingly invasive, targeted advertising.

For 23andMe customers who want to delete their data from 23andMe:

*   Log into your account and navigate to **Settings**.
*   Under **Settings**, scroll to the section titled **23andMe data**. Select **View**.
*   You will be asked to enter your date of birth for extra security. 
*   In the next section, you’ll be asked which, if there is any, personal data you’d like to download from the company (onto a personal, not public, computer). Once you’re finished, scroll to the bottom and select **Permanently delete data**.
*   You should then receive an email from 23andMe detailing its account deletion policy and requesting that you confirm your request. Once you confirm you’d like your data to be deleted, the deletion will begin automatically, and you’ll immediately lose access to your account. 

****How to find your 23andMe data in the 2023 breac**h**

In 2023, 23andMe suffered a data breach that impacted up to seven million people. Found being sold on the dark web, the data reportedly included “profile and account ID numbers, names, gender, birth year, maternal and paternal genetic markers, ancestral heritage results, and data on whether or not each user has opted into 23AndMe’s health data.”

With the data, cybercriminals could learn about a person’s genealogy and potentially use some of the information to aid them in committing identity fraud.

There is no meaningful way to _remove_ this data from the dark web. Instead, we recommend that you run a scan using our free Digital Footprint Portal to see if your data was exposed in the 2023 breach, and then to take additional steps to protect yourself.

If your data was exposed in the 23andMe breach, here is what you can do:

*   **Change your password.** You can make a stolen password useless to thieves by changing it. Choose a strong password that you don’t use for anything else. Better yet, let a password manager choose one for you.
*   **Enable two-factor authentication (2FA).** If you can, use a FIDO2-compliant hardware key, laptop or phone as your second factor. Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device can’t be phished.
*   **Watch out for fake vendors.** The thieves may contact you posing as the vendor. Check the vendor website to see if they are contacting victims, and verify the identity of anyone who contacts you using a different communication channel.
*   **Take your time.** Phishing attacks often impersonate people or brands you know, and use themes that require urgent attention, such as missed deliveries, account suspensions, and security alerts.
*   **Consider not storing your card details**. It’s definitely more convenient to get sites to remember your card details for you, but we highly recommend not storing that information on websites.
*   **Set up identity monitoring.** Identity monitoring alerts you if your personal information is found being traded illegally online, and helps you recover after.

 23andMe bankruptcy: How to delete your data and stay safe from the 2023 breach 

### Impact
Making crafted requests could lead to information disclosure that could further lead to account takeover.

### Workarounds
There's no workaround to fix this without upgrading.

### Credits
Thanks to Thanh of Calif.io for reporting the issue

GHSA-qrv3-jc3h-f3m6: Frappe vulnerable to information disclosure leading to account takeover

### Impact
A system user was able to create certain documents in a specific way that could lead to RCE.

### Workarounds
There's no workaround, an upgrade is required.

### Credits
Thanks to Thanh of Calif.io for reporting the issue

GHSA-v342-4xr9-x3q3: Frappe has Possibility of Remote Code Execution due to improper validation

### Impact
An SQL Injection vulnerability has been identified in Frappe Framework which could allow a malicious actor to access sensitive information.

### Workarounds
Upgrading is required, no other workaround is present.

### Credits

Thanks to Thanh of Calif.io for reporting the issue

Tag

#web