{"answers":{"affected":"3 open source packages ship an affected version, including github.com/ewen-lbh/ffcss. It affects 1 product.","exploited":"There is no known exploitation of CVE-2023-52081 in the wild and no public exploit code.","fix":"Upgrade github.com/ewen-lbh/ffcss to 0.2.0 or later.","what":"CVE-2023-52081 is a medium-severity vulnerability in ewen-lbh ffcss, published on 28 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2023-52081 and fix it if it is affected.\n\nWhat it is: CVE-2023-52081 is a medium-severity vulnerability in ewen-lbh ffcss, published on 28 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2023-52081 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/ewen-lbh/ffcss (Go): affected all versions; fixed in 0.2.0\n- github.com/ewen-lbh/ffcss (Go): affected all versions; fixed in 0.2.0\n- github.com/ewen-lbh/ffcss (Go): affected all versions; fixed in 0.2.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-52081/ (Markdown: https://insights.sbomify.com/CVE-2023-52081/index.md)","id":"CVE-2023-52081","markdown":"https://insights.sbomify.com/CVE-2023-52081/index.md","name":"CVE-2023-52081","record":{"aliases":["GHSA-wpmx-564x-h2mh","GO-2023-2426"],"analysis":{"component_type":"developer_tool","fix_type":"upgrade","impacts":["security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Firefox CSS theme CLI","requires_auth":"none","summary":"Attackers can bypass input validation in ffcss using Unicode normalization to inject restricted characters, potentially affecting theme lookup logic.","user_interaction":"not_required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"firefox_css","vendor":"ewen-lbh"}],"cvss":{"score":5.3,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-74","name":"Improper Neutralization of Special Elements in Output Used by a Downstream Component"},{"id":"CWE-176","name":"Improper Handling of Unicode Encoding"}],"description":"ffcss is a CLI interface to apply and configure Firefox CSS themes. Prior to 0.2.0, the function `lookupPreprocess()` is meant to apply some transformations to a string by disabling characters in the regex `[-_ .]`. However, due to the use of late Unicode normalization of type NFKD, it is possible to bypass that validation and re-introduce all the characters in the regex `[-_ .]`. The `lookupPreprocess()` can be easily bypassed with equivalent Unicode characters like U+FE4D (﹍), which would result in the omitted U+005F (_), for instance. The `lookupPreprocess()` function is only ever used to search for themes loosely (case insensitively, while ignoring dashes, underscores and dots), so the actual security impact is classified as low. This vulnerability is fixed in 0.2.0. There are no known workarounds.","ecosystems":["Go"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"ewen-lbh/ffcss late-Unicode normalization vulnerability","id":"CVE-2023-52081","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":null,"products":[],"type":"security_feature_bypass","year":"2023"},"n_packages":3,"n_references":2,"next":{"headline":"Lychee is vulnerable to an SQL Injection in explain DB queries.","id":"CVE-2023-52082"},"packages":[{"ecosystem":"Go","fixed":["0.2.0"],"introduced":["0"],"last_affected":[],"package":"github.com/ewen-lbh/ffcss","purl":null,"source":"GHSA-wpmx-564x-h2mh"},{"ecosystem":"Go","fixed":["0.2.0"],"introduced":["0"],"last_affected":[],"package":"github.com/ewen-lbh/ffcss","purl":"pkg:golang/github.com/ewen-lbh/ffcss","source":"GHSA-wpmx-564x-h2mh"},{"ecosystem":"Go","fixed":["0.2.0"],"introduced":["0"],"last_affected":[],"package":"github.com/ewen-lbh/ffcss","purl":"pkg:golang/github.com/ewen-lbh/ffcss","source":"GO-2023-2426"}],"prev":{"headline":"Memory corruption in n/a","id":"CVE-2023-52080"},"products":["ffcss"],"published":"2023-12-28","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-02","vendors":["ewen-lbh"]},"summary":"Attackers can bypass input validation in ffcss using Unicode normalization to inject restricted characters, potentially affecting theme lookup logic.","url":"https://insights.sbomify.com/CVE-2023-52081/"}