{"vulnerability": "cve-2025-2778", "sightings": [{"uuid": "2e1d38c5-11c4-4531-8fae-f07e9f738b04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27780", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lkri2jaqmo26", "content": "", "creation_timestamp": "2025-03-20T00:49:02.298889Z"}, {"uuid": "0bc84e3f-053b-4f0a-be93-0ecc5cc24b4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27786", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lkri2jdzli2s", "content": "", "creation_timestamp": "2025-03-20T00:49:02.917239Z"}, {"uuid": "b5f85219-bff3-4b62-8cc9-842ea4c02a21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27784", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lkri2o7rtg2h", "content": "", "creation_timestamp": "2025-03-20T00:49:12.003051Z"}, {"uuid": "6d299974-8197-44b3-8d71-4d28e5487fd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27781", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lkri2k4gpy2n", "content": "", "creation_timestamp": "2025-03-20T00:49:06.995819Z"}, {"uuid": "e184f250-99de-4a79-831e-ded4b225ee18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27785", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lkri2kd5wc2j", "content": "", "creation_timestamp": "2025-03-20T00:49:10.220273Z"}, {"uuid": "72f7d199-b825-4352-9672-50badfccdc0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27787", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lkri2nz43q2s", "content": "", "creation_timestamp": "2025-03-20T00:49:10.807792Z"}, {"uuid": "58e90185-7507-437c-a85c-422ce5a673d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27782", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lkri2o4ggi2n", "content": "", "creation_timestamp": "2025-03-20T00:49:11.354396Z"}, {"uuid": "26fd1c1e-4b39-47c9-ad95-3720c6950ffd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27783", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lkri2od4bo2h", "content": "", "creation_timestamp": "2025-03-20T00:49:12.614353Z"}, {"uuid": "756d5bf8-79e2-47c1-9943-d16164a439e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2778", "type": "seen", "source": "https://infosec.exchange/users/shadowserver/statuses/114466967388160257", "content": "", "creation_timestamp": "2025-05-07T14:15:11.744895Z"}, {"uuid": "e0d2b3af-5e23-4f87-9b01-933db006384f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2778", "type": "seen", "source": "https://bsky.app/profile/shadowserver.bsky.social/post/3lolll3ln2k2p", "content": "", "creation_timestamp": "2025-05-07T14:16:50.812711Z"}, {"uuid": "05e145b7-b6fd-42b1-a4fe-3b3a82d61ff3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2778", "type": "seen", "source": "https://bsky.app/profile/shadowserver.bsky.social/post/3lolll4zukc2p", "content": "", "creation_timestamp": "2025-05-07T14:16:52.146228Z"}, {"uuid": "7a6bfc94-8ce8-4a24-9deb-34ea61a68c17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2778", "type": "seen", "source": "https://bsky.app/profile/shadowserver.bsky.social/post/3lolll4zwis2p", "content": "", "creation_timestamp": "2025-05-07T14:16:53.473837Z"}, {"uuid": "0332f36b-b21a-4bff-ae90-d254bdf6b425", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2778", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/114467330819942836", "content": "", "creation_timestamp": "2025-05-07T15:47:36.276878Z"}, {"uuid": "51f08b81-b705-40b1-a8e2-bc490430619c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2778", "type": "seen", "source": "https://mstdn.ca/users/rfwaveio/statuses/114472197786505302", "content": "", "creation_timestamp": "2025-05-08T12:25:23.841009Z"}, {"uuid": "d41006b7-dbf3-40a0-92ce-f16a0eeb6f20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27788", "type": "seen", "source": "MISP/682bdba3-46b7-4a8f-b7be-c6bf4b4f9868", "content": "", "creation_timestamp": "2025-08-13T13:26:34.000000Z"}, {"uuid": "9f01c1b5-d4b6-4bdf-b031-2ea2a23a66ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2778", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/115424694369254779", "content": "", "creation_timestamp": "2025-10-23T17:37:45.920382Z"}, {"uuid": "b4985f2a-331b-4a6a-b8ae-05f674d84697", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27789", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3m6mmbvm3sc2c", "content": "", "creation_timestamp": "2025-11-27T14:45:18.630116Z"}, {"uuid": "1689ae3d-95a1-4180-aaf2-a09904987ad4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27789", "type": "seen", "source": "https://gist.github.com/jrvssingh-cpu/5ca4be6b05f749c6962d84fae197cdc9", "content": "", "creation_timestamp": "2026-02-25T10:55:46.000000Z"}, {"uuid": "987b0b60-f58e-4021-ba4a-54138cd9b722", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27784", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/8165", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-27774\n\ud83d\udd25 CVSS Score: 8.8 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P)\n\ud83d\udd39 Description: Applio is a voice conversion tool. Versions 3.2.7 and prior are vulnerable to server-side request forgery (SSRF) and file write in `model_download.py` (line 156 in 3.2.7). The blind SSRF allows for sending requests on behalf of Applio server and can be leveraged to probe for other vulnerabilities on the server itself or on other back-end systems on the internal network, that the Applio server can reach. The blind SSRF can also be coupled with the an arbitrary file read (e.g., CVE-2025-27784) to read files from hosts on the internal network, that the Applio server can reach, which would make it a full SSRF. The file write allows for writing files on the server, which can be coupled with other vulnerabilities, for example an unsafe deserialization, to achieve remote code execution on the Applio server. As of time of publication, no known patches are available.\n\ud83d\udccf Published: 2025-03-19T20:42:56.129Z\n\ud83d\udccf Modified: 2025-03-19T20:42:56.129Z\n\ud83d\udd17 References:\n1. https://securitylab.github.com/advisories/GHSL-2024-341_GHSL-2024-353_Applio/\n2. https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/assets/flask/routes.py#L14\n3. https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/rvc/lib/tools/model_download.py#L143\n4. https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/rvc/lib/tools/model_download.py#L147-L148\n5. https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/download/download.py#L192-L196", "creation_timestamp": "2025-03-19T21:18:41.000000Z"}, {"uuid": "c183e675-3a0d-4e07-b1ac-6aa9be450763", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27785", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/8157", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-27785\n\ud83d\udd25 CVSS Score: 7.7 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P)\n\ud83d\udd39 Description: Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file read in train.py's `export_index` function. This issue may lead to reading arbitrary files on the Applio server. It can also be used in conjunction with blind server-side request forgery to read files from servers on the internal network that the Applio server has access to. As of time of publication, no known patches are available.\n\ud83d\udccf Published: 2025-03-19T20:35:10.662Z\n\ud83d\udccf Modified: 2025-03-19T20:47:30.839Z\n\ud83d\udd17 References:\n1. https://securitylab.github.com/advisories/GHSL-2024-341_GHSL-2024-353_Applio/\n2. https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/train/train.py#L273\n3. https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/train/train.py#L816", "creation_timestamp": "2025-03-19T21:18:27.000000Z"}, {"uuid": "585d2997-2909-4bd5-8fd5-7804f6c16c2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27781", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/8156", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-27781\n\ud83d\udd25 CVSS Score: 8.9 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P)\n\ud83d\udd39 Description: Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in inference.py. `model_file` in inference.py as well as `model_file` in tts.py take user-supplied input (e.g. a path to a model) and pass that value to the `change_choices` and later to `get_speakers_id` function, which loads that model with `torch.load` in inference.py (line 326 in 3.2.8-bugfix), which is vulnerable to unsafe deserialization. The issue can lead to remote code execution. A patch is available on the `main` branch of the repository.\n\ud83d\udccf Published: 2025-03-19T20:22:38.448Z\n\ud83d\udccf Modified: 2025-03-19T20:48:03.243Z\n\ud83d\udd17 References:\n1. https://securitylab.github.com/advisories/GHSL-2024-341_GHSL-2024-353_Applio/\n2. https://github.com/IAHispano/Applio/commit/eb21d9dd349a6ae1a28c440b30d306eafba65097\n3. https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/inference/inference.py#L325\n4. https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/inference/inference.py#L338-L345\n5. https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/tts/tts.py#L50-L57", "creation_timestamp": "2025-03-19T21:18:27.000000Z"}, {"uuid": "fa0c313e-c51c-41b7-b63e-31582b68e1ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27784", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/8260", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-27776\n\ud83d\udd25 CVSS Score: 8.8 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P)\n\ud83d\udd39 Description: Applio is a voice conversion tool. Versions 3.2.7 and prior are vulnerable to server-side request forgery (SSRF) and file write in `model_download.py` (line 240 in 3.2.7). The blind SSRF allows for sending requests on behalf of Applio server and can be leveraged to probe for other vulnerabilities on the server itself or on other back-end systems on the internal network, that the Applio server can reach. The blind SSRF can also be coupled with the arbitrary file read CVE-2025-27784 to read files from hosts on the internal network, that the Applio server can reach, which would make it a full SSRF. The file write allows for writing files on the server, which can be coupled with other vulnerabilities, for example an unsafe deserialization, to achieve remote code execution on the Applio server. As of time of publication, no known patches are available.\n\ud83d\udccf Published: 2025-03-19T20:42:38.780Z\n\ud83d\udccf Modified: 2025-03-20T19:10:17.135Z\n\ud83d\udd17 References:\n1. https://securitylab.github.com/advisories/GHSL-2024-341_GHSL-2024-353_Applio/\n2. https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/assets/flask/routes.py#L14\n3. https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/rvc/lib/tools/model_download.py#L240\n4. https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/download/download.py#L192-L196", "creation_timestamp": "2025-03-20T19:18:21.000000Z"}, {"uuid": "49a1fca1-d402-494e-ae23-cdbaf42e8e4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2778", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/15322", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-2778\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: No description available\n\ud83d\udccf Published: N/A\n\ud83d\udccf Modified: 2025-05-07T14:54:59.732Z\n\ud83d\udd17 References:\nNo references available.", "creation_timestamp": "2025-05-07T15:22:38.000000Z"}, {"uuid": "57f04e58-83b1-415c-aa55-a1892fbf170f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27784", "type": "seen", "source": "https://t.me/cvedetector/20678", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-27777 - Applio Voice Conversion Tool SSRF Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-27777 \nPublished : March 19, 2025, 9:15 p.m. | 16\u00a0minutes ago \nDescription : Applio is a voice conversion tool. Versions 3.2.7 and prior are vulnerable to server-side request forgery (SSRF) in `model_download.py` (line 195 in 3.2.7). The blind SSRF allows for sending requests on behalf of Applio server and can be leveraged to probe for other vulnerabilities on the server itself or on other back-end systems on the internal network, that the Applio server can reach. The blind SSRF can also be coupled with a arbitrary file read (e.g., CVE-2025-27784) to read files from hosts on the internal network, that the Applio server can reach, which would make it a full SSRF. As of time of publication, no known patches are available. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"19 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-19T23:00:29.000000Z"}, {"uuid": "31829803-b0b7-4198-9cd4-c31884964669", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27785", "type": "seen", "source": "https://t.me/cvedetector/20675", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-27785 - Applio Voice Conversion Tool Arbitrary File Read Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-27785 \nPublished : March 19, 2025, 9:15 p.m. | 15\u00a0minutes ago \nDescription : Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file read in train.py's `export_index` function. This issue may lead to reading arbitrary files on the Applio server. It can also be used in conjunction with blind server-side request forgery to read files from servers on the internal network that the Applio server has access to. As of time of publication, no known patches are available. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"19 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-19T23:00:26.000000Z"}, {"uuid": "457bec7b-7119-42a4-98e7-8432296650e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27786", "type": "seen", "source": "https://t.me/cvedetector/20676", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-27786 - Applio File Deletion Vulnerability (Arbitrary File Removal)\", \n  \"Content\": \"CVE ID : CVE-2025-27786 \nPublished : March 19, 2025, 9:15 p.m. | 15\u00a0minutes ago \nDescription : Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file removal in core.py. `output_tts_path` in tts.py takes arbitrary user input and passes it to `run_tts_script` function in core.py, which checks if the path in `output_tts_path` exists, and if yes, removes that path, which leads to arbitrary file removal. As of time of publication, no known patches are available. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"19 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-19T23:00:27.000000Z"}, {"uuid": "b9ba7430-38b9-4596-bc0b-4c2c50d75e8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27784", "type": "seen", "source": "https://t.me/cvedetector/20683", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-27776 - Applio Voice Conversion Tool SSRF and File Write Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-27776 \nPublished : March 19, 2025, 9:15 p.m. | 16\u00a0minutes ago \nDescription : Applio is a voice conversion tool. Versions 3.2.7 and prior are vulnerable to server-side request forgery (SSRF) and file write in `model_download.py` (line 240 in 3.2.7). The blind SSRF allows for sending requests on behalf of Applio server and can be leveraged to probe for other vulnerabilities on the server itself or on other back-end systems on the internal network, that the Applio server can reach. The blind SSRF can also be coupled with the arbitrary file read CVE-2025-27784 to read files from hosts on the internal network, that the Applio server can reach, which would make it a full SSRF. The file write allows for writing files on the server, which can be coupled with other vulnerabilities, for example an unsafe deserialization, to achieve remote code execution on the Applio server. As of time of publication, no known patches are available. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"19 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-19T23:00:36.000000Z"}, {"uuid": "3fc6abb6-e519-43fd-98d4-1167701f5064", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27784", "type": "seen", "source": "https://t.me/cvedetector/20682", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-27774 - Applio Voice Conversion Tool Server-Side Request Forgery and File Write Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-27774 \nPublished : March 19, 2025, 9:15 p.m. | 16\u00a0minutes ago \nDescription : Applio is a voice conversion tool. Versions 3.2.7 and prior are vulnerable to server-side request forgery (SSRF) and file write in `model_download.py` (line 156 in 3.2.7). The blind SSRF allows for sending requests on behalf of Applio server and can be leveraged to probe for other vulnerabilities on the server itself or on other back-end systems on the internal network, that the Applio server can reach. The blind SSRF can also be coupled with the an arbitrary file read (e.g., CVE-2025-27784) to read files from hosts on the internal network, that the Applio server can reach, which would make it a full SSRF. The file write allows for writing files on the server, which can be coupled with other vulnerabilities, for example an unsafe deserialization, to achieve remote code execution on the Applio server. As of time of publication, no known patches are available. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"19 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-19T23:00:35.000000Z"}, {"uuid": "2a738d7b-fcf2-4c3a-9152-ca5022137abe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27780", "type": "seen", "source": "https://t.me/cvedetector/20681", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-27780 - Applio Remote Code Execution Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-27780 \nPublished : March 19, 2025, 9:15 p.m. | 15\u00a0minutes ago \nDescription : Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in model_information.py. `model_name` in model_information.py takes user-supplied input (e.g. a path to a model) and pass that value to the `run_model_information_script` and later to `model_information` function, which loads that model with `torch.load` in rvc/train/process/model_information.py (on line 16 in 3.2.8-bugfix), which is vulnerable to unsafe deserialization. The issue can lead to remote code execution. A patch is available in the `main` branch of the repository. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"19 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-19T23:00:34.000000Z"}, {"uuid": "7295df55-ba03-4a50-a8ba-0727e5061230", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27784", "type": "seen", "source": "https://t.me/cvedetector/20674", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-27784 - Applio Voice Conversion Tool File Read Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-27784 \nPublished : March 19, 2025, 9:15 p.m. | 15\u00a0minutes ago \nDescription : Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file read in train.py's `export_pth` function. This issue may lead to reading arbitrary files on the Applio server. It can also be used in conjunction with blind server-side request forgery to read files from servers on the internal network that the Applio server has access to. As of time of publication, no known patches are available. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"19 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-19T23:00:25.000000Z"}, {"uuid": "11d0de27-560b-4876-b483-8d005d07208c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27782", "type": "seen", "source": "https://t.me/cvedetector/20672", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-27782 - Applio Voice Conversion Tool Arbitrary File Write and RCE Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-27782 \nPublished : March 19, 2025, 9:15 p.m. | 15\u00a0minutes ago \nDescription : Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file write in inference.py. This issue may lead to writing arbitrary files on the Applio server. It can also be used in conjunction with an unsafe deserialization to achieve remote code execution. As of time of publication, no known patches are available. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"19 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-19T23:00:21.000000Z"}, {"uuid": "9b09576a-aaa5-46cc-96ec-2025a771befc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27783", "type": "seen", "source": "https://t.me/cvedetector/20673", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-27783 - Applio Voice Conversion Tool Remote Code Execution and Arbitrary File Write Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-27783 \nPublished : March 19, 2025, 9:15 p.m. | 15\u00a0minutes ago \nDescription : Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file write in train.py. This issue may lead to writing arbitrary files on the Applio server. It can also be used in conjunction with an unsafe deserialization to achieve remote code execution. As of time of publication, no known patches are available. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"19 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-19T23:00:22.000000Z"}, {"uuid": "f8cfbe75-1196-4caf-972c-36b939662af6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27787", "type": "seen", "source": "https://t.me/cvedetector/20670", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-27787 - Applio Path Traversal and Denial of Service Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-27787 \nPublished : March 19, 2025, 9:15 p.m. | 15\u00a0minutes ago \nDescription : Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to denial of service (DoS) in restart.py. `model_name` in train.py takes user input, and passes it to the `stop_train` function in restart.py, which uses it construct a path to a folder with `config.json`. That `config.json` is opened and the list of values under \"process_pids\" are read. Next all the process IDs listed in the JSON are killed. Using one of the arbitrary file writes, one can  write to `logs/foobar` a `config.json` file, which contains a list of process IDs. Then one can access this endpoint to kill these processes. Since an attacker can't know what process is running on which process ID, they can send a list of hundreds of process IDs, which can kill the process that applio is using to run, as well as other, potentially important processes, which leads to DoS. Note that constructing a path with user input also enables path traversal. For example, by supplying \"../../\" in `model_name` one can access `config.json` freom locations two folders down on the server. As of time of publication, no known patches are available. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"19 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-19T23:00:19.000000Z"}, {"uuid": "2c413978-f23d-4cd6-a284-dcd538cba939", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27781", "type": "seen", "source": "https://t.me/cvedetector/20671", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-27781 - Applio Remote Code Execution Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-27781 \nPublished : March 19, 2025, 9:15 p.m. | 15\u00a0minutes ago \nDescription : Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in inference.py. `model_file` in inference.py as well as `model_file` in tts.py take user-supplied input (e.g. a path to a model) and pass that value to the `change_choices` and later to `get_speakers_id` function, which loads that model with `torch.load` in inference.py (line 326 in 3.2.8-bugfix), which is vulnerable to unsafe deserialization. The issue can lead to remote code execution. A patch is available on the `main` branch of the repository. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"19 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-19T23:00:20.000000Z"}, {"uuid": "306af495-5534-4089-a999-ade63c7b26e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2778", "type": "published-proof-of-concept", "source": "https://t.me/ton618cyber/9219", "content": "#exploit\nCVE-2025-2775 CVE-2025-2776 CVE-2025-2777 CVE-2025-2778\nSysOwned, Your Friendly Support Ticket - SysAid On-Premise Pre-Auth RCE Chain\n]-> https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/\n\n]-> https://github.com/watchtowrlabs/watchTowr-vs-SysAid-PreAuth-RCE-Chain", "creation_timestamp": "2025-05-10T02:44:20.000000Z"}, {"uuid": "598935a8-eace-42b8-b304-12398e105ecf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2778", "type": "published-proof-of-concept", "source": "https://t.me/ton618cyber/3785", "content": "#exploit\nCVE-2025-2775 CVE-2025-2776 CVE-2025-2777 CVE-2025-2778\nSysOwned, Your Friendly Support Ticket - SysAid On-Premise Pre-Auth RCE Chain\n]-> https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/\n\n]-> https://github.com/watchtowrlabs/watchTowr-vs-SysAid-PreAuth-RCE-Chain", "creation_timestamp": "2025-05-10T02:44:20.000000Z"}, {"uuid": "9f46dae9-6c1f-46ae-b213-8d518698d886", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27787", "type": "published-proof-of-concept", "source": "Telegram/f9bJ_Gi25q0ZeFbva3U2-T1otHLP8tha0QyjUNdGGgBSvDk", "content": "", "creation_timestamp": "2025-03-19T23:33:38.000000Z"}, {"uuid": "d1b07663-5979-456f-8266-2ba5d45be0da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27786", "type": "published-proof-of-concept", "source": "Telegram/f9bJ_Gi25q0ZeFbva3U2-T1otHLP8tha0QyjUNdGGgBSvDk", "content": "", "creation_timestamp": "2025-03-19T23:33:38.000000Z"}, {"uuid": "21a7201a-d9a9-4dd2-94c0-b3c42bba50a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27783", "type": "published-proof-of-concept", "source": "Telegram/f9bJ_Gi25q0ZeFbva3U2-T1otHLP8tha0QyjUNdGGgBSvDk", "content": "", "creation_timestamp": "2025-03-19T23:33:38.000000Z"}, {"uuid": "2544c446-b1b2-4915-bbae-08b83b4c914c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27780", "type": "published-proof-of-concept", "source": "Telegram/jlMT5pQePgK5GBSq5wMoupEVU9UT7ofYY1WgfO6aSFHSaLY", "content": "", "creation_timestamp": "2025-03-19T22:01:14.000000Z"}, {"uuid": "e3b9c3cf-2b23-442a-be82-a4ad528f8525", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27783", "type": "published-proof-of-concept", "source": "Telegram/e8K6ei2MJobaYeBw9lEyjrqpWhjWmsfq7ceAEPONUHatpcs", "content": "", "creation_timestamp": "2025-03-19T23:33:39.000000Z"}, {"uuid": "92dbe806-5f42-4c15-85b0-6191f9397f84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27782", "type": "published-proof-of-concept", "source": "Telegram/e8K6ei2MJobaYeBw9lEyjrqpWhjWmsfq7ceAEPONUHatpcs", "content": "", "creation_timestamp": "2025-03-19T23:33:39.000000Z"}, {"uuid": "cfb01c9e-3869-4fbb-bc80-4738bdd52156", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27785", "type": "published-proof-of-concept", "source": "Telegram/f9bJ_Gi25q0ZeFbva3U2-T1otHLP8tha0QyjUNdGGgBSvDk", "content": "", "creation_timestamp": "2025-03-19T23:33:38.000000Z"}, {"uuid": "6fb74e28-7f86-44c8-a85c-e69c77ab2eed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27784", "type": "published-proof-of-concept", "source": "Telegram/f9bJ_Gi25q0ZeFbva3U2-T1otHLP8tha0QyjUNdGGgBSvDk", "content": "", "creation_timestamp": "2025-03-19T23:33:38.000000Z"}, {"uuid": "31add72f-adf5-4abd-8d91-c479bdbfd076", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27781", "type": "published-proof-of-concept", "source": "Telegram/jlMT5pQePgK5GBSq5wMoupEVU9UT7ofYY1WgfO6aSFHSaLY", "content": "", "creation_timestamp": "2025-03-19T22:01:14.000000Z"}, {"uuid": "0f4f0122-8e06-4af2-ac8c-c6f4bd488c9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2778", "type": "exploited", "source": "https://t.me/true_secator/7023", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 WatchTowr Labs \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0442\u0440\u0438 \u043e\u0448\u0438\u0431\u043a\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u041f\u041e \u0418\u0422-\u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 SysAid.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u043a\u0430\u043a CVE-2025-2775 \u0438 CVE-2025-2776 (\u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 XXE \u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0435 /mdm/checkin), CVE-2025-2777 (\u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 XXE \u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0435 /lshw).\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c watchTowr Labs, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043b\u0435\u0433\u043a\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u043e\u0433\u043e HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u0430 POST \u043a \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u043c \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u043c \u0442\u043e\u0447\u043a\u0430\u043c.\n\n\u0423\u0441\u043f\u0435\u0448\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u0444\u0430\u0439\u043b\u0430\u043c \u0441 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0435\u0439, \u0432\u043a\u043b\u044e\u0447\u0430\u044f InitAccount.cmd, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0438 \u0442\u0435\u043a\u0441\u0442\u043e\u0432\u044b\u0439 \u043f\u0430\u0440\u043e\u043b\u044c.\n\n\u041f\u043e\u043b\u0443\u0447\u0438\u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0434\u043e\u0441\u0442\u0443\u043f, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0431\u0435\u0437 \u0442\u0440\u0443\u0434\u0430 \u043c\u043e\u0436\u0435\u0442 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a SysAid.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c XXE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u044b \u0441 \u0434\u0440\u0443\u0433\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u041e\u0421, \u043e\u0442\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u043e\u0439 CVE-2025-2778, \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.\n\n\u0412\u0441\u0435 \u0447\u0435\u0442\u044b\u0440\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b SysAid \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u043e\u043c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 24.4.60 b16 \u0432 \u043d\u0430\u0447\u0430\u043b\u0435 \u043c\u0430\u0440\u0442\u0430 2025 \u0433\u043e\u0434\u0430.\n\n\u0423\u0447\u0438\u0442\u044b\u0432\u0430\u044f \u0434\u0430\u0432\u043d\u044e\u044e \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0443 \u043d\u0430\u0446\u0435\u043b\u0438\u0432\u0430\u043d\u0438\u0435 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 SysAid\u00a0\u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u0431\u0430\u043d\u0434 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 (\u0432 \u0447\u0438\u0441\u043b\u0435 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0442\u043c\u0435\u0442\u0438\u043b\u0438\u0441\u044c Cl0p) \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438 PoC, \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u044f\u044e\u0449\u0435\u0433\u043e \u0432\u0441\u0435 \u0447\u0435\u0442\u044b\u0440\u0435\u00a0\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043d\u0430\u043a\u0430\u0442\u0438\u0442\u044c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.", "creation_timestamp": "2025-05-12T17:15:08.000000Z"}, {"uuid": "117a77ca-9fd0-4c9b-b72a-eece43f6ef8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2778", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/12025", "content": "#exploit\nCVE-2025-2775 CVE-2025-2776 CVE-2025-2777 CVE-2025-2778\nSysOwned, Your Friendly Support Ticket - SysAid On-Premise Pre-Auth RCE Chain\n]-> https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/\n\n]-> https://github.com/watchtowrlabs/watchTowr-vs-SysAid-PreAuth-RCE-Chain", "creation_timestamp": "2025-05-10T00:52:20.000000Z"}, {"uuid": "79d0cee5-5e69-49d1-9e6f-004b4051f1e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2778", "type": "published-proof-of-concept", "source": "https://t.me/liwaamohammad/1962", "content": "https://github.com/watchtowrlabs/watchTowr-vs-SysAid-PreAuth-RCE-Chain\n\nPoC for SysAid PreAuth RCE Chain (CVE-2025-2775, CVE-2025-2776, CVE-2025-2777, CVE-2025-2778)\n#github #exploit", "creation_timestamp": "2025-05-09T14:18:17.000000Z"}, {"uuid": "c4a31ebc-eb74-4493-a582-3bc54f54dcd9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2778", "type": "seen", "source": "https://t.me/cyberwarehouse/812", "content": "#exploit\nCVE-2025-2775 CVE-2025-2776 CVE-2025-2777 CVE-2025-2778\nSysOwned, Your Friendly Support Ticket - SysAid On-Premise Pre-Auth RCE Chain\n]-> https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/\n\n]-> https://github.com/watchtowrlabs/watchTowr-vs-SysAid-PreAuth-RCE-Chain", "creation_timestamp": "2026-07-26T02:00:13.086299Z"}, {"uuid": "8cd35c12-db1a-4014-b4f4-edc57e5fec3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2778", "type": "published-proof-of-concept", "source": "https://t.me/cyberwarehouse/812", "content": "#exploit\nCVE-2025-2775 CVE-2025-2776 CVE-2025-2777 CVE-2025-2778\nSysOwned, Your Friendly Support Ticket - SysAid On-Premise Pre-Auth RCE Chain\n]-> https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/\n\n]-> https://github.com/watchtowrlabs/watchTowr-vs-SysAid-PreAuth-RCE-Chain", "creation_timestamp": "2026-07-27T00:00:29.709429Z"}, {"uuid": "a9d43ded-d60d-4cb1-ba5e-910a23aaf627", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27789", "type": "seen", "source": "https://gist.github.com/djlan/08b65cfaf26247f94419d7a882d7d203", "content": "# \u4fee\u590d `@babel/helpers` \u7684 CVE-2025-27789\uff1a\u901a\u8fc7 npm overrides \u7edf\u4e00\u5b89\u5168\u7248\u672c\n\n> **\u4e00\u53e5\u8bdd\u6458\u8981\uff1a** \u6b64 PR \u5728\u5ba2\u6237\u7aef\u3001\u793a\u4f8b\u5bbf\u4e3b\u5e94\u7528\u548c\u6269\u5c55\u793a\u4f8b\u7684 6 \u4e2a `package.json` \u4e2d\u52a0\u5165 `@babel/helpers: ^7.27.6` \u7684 npm `overrides`\uff0c\u4f7f\u8fd9\u4e9b\u72ec\u7acb\u5b89\u88c5\u8fb9\u754c\u5185\u7684\u4f20\u9012\u4f9d\u8d56\u89e3\u6790\u5230 PR \u6240\u6307\u5b9a\u7684\u5b89\u5168\u7248\u672c\u8303\u56f4\u3002\n\n| \u9879\u76ee | \u5185\u5bb9 |\n|---|---|\n| PR | [AzureNotebooks PR 648520](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/648520) |\n| \u4f5c\u8005 | GitHub Copilot |\n| \u72b6\u6001 | Active\uff1b\u975e Draft\uff1b\u5305\u5185\u8bb0\u5f55\u7684\u5408\u5e76\u72b6\u6001\u4e3a `succeeded` |\n| \u5206\u652f | `copilot/swe-wi2417040-d3514` \u2192 `main` |\n| \u521b\u5efa\u65f6\u95f4 | 2025-07-02 16:57:51\uff08\u6570\u636e\u5305\u672a\u6ce8\u660e\u65f6\u533a\uff09 |\n| \u63d0\u4ea4 | 1 |\n| \u8fed\u4ee3 | 2 |\n| \u6587\u4ef6 | 6 \u4e2a\u4fee\u6539 |\n| \u5dee\u5f02\u7edf\u8ba1 | \u7ea6 `+17 / -10` \u884c\uff08\u6309\u6570\u636e\u5305\u4e2d\u7684\u6587\u672c diff \u7edf\u8ba1\uff0c\u5305\u542b\u683c\u5f0f\u8c03\u6574\uff09 |\n\n## \u76ee\u5f55\n\n1. [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n2. [\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e](#\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e)\n3. [\u5de5\u4f5c\u539f\u7406](#\u5de5\u4f5c\u539f\u7406)\n4. [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n5. [\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8](#\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8)\n6. [\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae](#\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae)\n7. [\u5dee\u5f02\u8986\u76d6\u4e0e\u5206\u6790\u8fb9\u754c](#\u5dee\u5f02\u8986\u76d6\u4e0e\u5206\u6790\u8fb9\u754c)\n\n## \u53d8\u66f4\u6982\u89c8\n\nPR \u63cf\u8ff0\u79f0\uff0c\u7ec4\u4ef6\u6cbb\u7406\u53d1\u73b0 `@babel/helpers` 7.24.4 \u5b58\u5728 CVE-2025-27789\uff1b\u4ed3\u5e93\u4e2d\u867d\u672a\u53d1\u73b0\u5bf9\u8be5\u5177\u4f53\u7248\u672c\u7684\u76f4\u63a5\u5f15\u7528\uff0c\u4f46\u5b83\u53ef\u80fd\u7531\u4f20\u9012\u4f9d\u8d56\u5f15\u5165\u3002\u4e3a\u907f\u514d\u6bcf\u6761\u4f9d\u8d56\u94fe\u5206\u522b\u5347\u7ea7\uff0c\u53d8\u66f4\u5728 6 \u4e2a\u53ef\u72ec\u7acb\u5b89\u88c5 npm \u4f9d\u8d56\u7684\u5305\u4e2d\u8bbe\u7f6e\u6839\u7ea7 `overrides`\uff0c\u8981\u6c42 npm \u5c06\u4f9d\u8d56\u6811\u4e2d\u7684 `@babel/helpers` \u89e3\u6790\u5230 `^7.27.6`\u3002\n\n\u6539\u52a8\u6ca1\u6709\u4fee\u6539\u5e94\u7528\u4e1a\u52a1\u4ee3\u7801\u3001Babel \u8c03\u7528\u65b9\u5f0f\u6216\u516c\u5f00 API\u3002\u5176\u4f5c\u7528\u53d1\u751f\u5728\u4f9d\u8d56\u5b89\u88c5/\u89e3\u6790\u9636\u6bb5\uff1a\u91cd\u65b0\u6267\u884c\u517c\u5bb9 `overrides` \u7684 npm \u5b89\u88c5\u540e\uff0c\u53d7\u8fd9\u4e9b\u6e05\u5355\u63a7\u5236\u7684\u4f9d\u8d56\u6811\u5e94\u91c7\u7528\u6ee1\u8db3\u8be5\u8303\u56f4\u7684\u7248\u672c\u3002\n\n## \u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e\n\n### 1. \u4e3b\u5ba2\u6237\u7aef\u4f9d\u8d56\u6cbb\u7406\n\n- [`src/client/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/648520?path=/src/client/package.json&_a=files)\uff1a\u5728\u73b0\u6709 `overrides` \u4e2d\u589e\u52a0 `@babel/helpers: ^7.27.6`\u3002\n- \u8fd9\u662f\u4e3b\u8981\u5ba2\u6237\u7aef\u5305\u7684\u96c6\u4e2d\u4f9d\u8d56\u7ea6\u675f\uff0c\u53ef\u8986\u76d6\u5ba2\u6237\u7aef\u4f9d\u8d56\u6811\u4e2d\u76f4\u63a5\u6216\u95f4\u63a5\u5f15\u5165\u7684 `@babel/helpers`\u3002\n- \u8be5\u6587\u4ef6\u539f\u672c\u5df2\u6709\u591a\u4e2a\u5b89\u5168\u6216\u517c\u5bb9\u6027\u8986\u76d6\u9879\uff0c\u672c\u6b21\u6cbf\u7528\u65e2\u6709\u673a\u5236\uff0c\u6ca1\u6709\u5f15\u5165\u65b0\u7684\u4f9d\u8d56\u7ba1\u7406\u6a21\u5f0f\u3002\n\n### 2. \u793a\u4f8b\u5bbf\u4e3b\u5e94\u7528\n\n- [`sample/react-host-app/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/648520?path=/sample/react-host-app/package.json&_a=files)\uff1a\u5728\u5df2\u6709 `postcss` override \u540e\u8ffd\u52a0 `@babel/helpers`\u3002\n- [`sample/angular-host-app/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/648520?path=/sample/angular-host-app/package.json&_a=files)\uff1a\u4fdd\u7559\u539f\u6709 `semver@7`\u3001`postcss`\u3001`follow-redirects` \u7ea6\u675f\u5e76\u8ffd\u52a0 `@babel/helpers`\uff1b\u540c\u65f6\u5c06\u591a\u884c JSON \u538b\u7f29\u4e3a\u5355\u884c\uff0c\u5c5e\u4e8e\u8868\u793a\u5f62\u5f0f\u53d8\u5316\u3002\n- \u4e24\u4e2a\u5bbf\u4e3b\u5e94\u7528\u62e5\u6709\u5404\u81ea\u7684 `package.json`\uff0c\u56e0\u6b64\u4ec5\u4fee\u6539\u4e3b\u5ba2\u6237\u7aef\u6e05\u5355\u4e0d\u8db3\u4ee5\u7ea6\u675f\u5b83\u4eec\u72ec\u7acb\u5b89\u88c5\u65f6\u7684\u4f9d\u8d56\u6811\uff1b\u672c\u6b21\u5206\u522b\u6dfb\u52a0 override\uff0c\u4f7f React \u548c Angular \u793a\u4f8b\u5177\u6709\u76f8\u540c\u7684\u5b89\u5168\u57fa\u7ebf\u3002\n\n### 3. \u901a\u7528\u6269\u5c55\u793a\u4f8b\n\n- [`sample/extensions/common-extensions/NotebookGrader/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/648520?path=/sample/extensions/common-extensions/NotebookGrader/package.json&_a=files)\n- [`sample/extensions/common-extensions/SystemMonitor/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/648520?path=/sample/extensions/common-extensions/SystemMonitor/package.json&_a=files)\n\n\u8fd9\u4e24\u4e2a\u6269\u5c55\u6b64\u524d\u6ca1\u6709 `overrides` \u8282\u70b9\u3002\u672c\u6b21\u65b0\u589e\u6839\u7ea7\u8282\u70b9\uff0c\u4f7f\u6269\u5c55\u5728\u72ec\u7acb\u5b89\u88c5\u4f9d\u8d56\u65f6\u4e5f\u80fd\u8986\u76d6\u4f20\u9012\u4f9d\u8d56\u4e2d\u7684 `@babel/helpers`\u3002SystemMonitor \u6587\u4ef6\u8fd8\u51fa\u73b0\u4e86\u6587\u4ef6\u672b\u5c3e\u6362\u884c\u72b6\u6001\u53d8\u5316\uff0c\u4f46\u6ca1\u6709\u5305\u5185\u8bc1\u636e\u8868\u660e\u5176\u914d\u7f6e\u8bed\u4e49\u53d1\u751f\u5176\u4ed6\u6539\u53d8\u3002\n\n### 4. \u670d\u52a1\u7aef Terminal \u6269\u5c55\u793a\u4f8b\n\n- [`sample/extensions/server-extensions/Terminal/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/648520?path=/sample/extensions/server-extensions/Terminal/package.json&_a=files)\uff1a\u65b0\u589e\u76f8\u540c\u7684 `@babel/helpers` override\u3002\n- \u540c\u4e00\u6587\u4ef6\u8fd8\u628a `CommandPrompt` \u56fe\u6807\u503c\u4ece\u5b57\u9762 Unicode \u5b57\u7b26\u6539\u4e3a JSON Unicode \u8f6c\u4e49 `\\uE756`\u3002\u4e24\u79cd\u5199\u6cd5\u5728 JSON \u89e3\u7801\u540e\u901a\u5e38\u8868\u793a\u540c\u4e00\u4e2a\u7801\u4f4d\uff0c\u56e0\u6b64\u9884\u671f\u4e0d\u6539\u53d8\u56fe\u6807\u503c\uff0c\u4f46\u8fd9\u662f\u5b89\u5168\u4f9d\u8d56\u4fee\u590d\u4e4b\u5916\u7684\u9644\u5e26\u53d8\u66f4\uff0c\u5e94\u5355\u72ec\u6838\u5b9e\u7ec8\u7aef\u83dc\u5355\u56fe\u6807\u4ecd\u53ef\u6b63\u786e\u6e32\u67d3\u3002\n- \u6587\u4ef6\u672b\u5c3e\u6362\u884c\u72b6\u6001\u4e5f\u53d1\u751f\u53d8\u5316\uff0c\u4e0d\u5f71\u54cd JSON \u6570\u636e\u6a21\u578b\u3002\n\n## \u5de5\u4f5c\u539f\u7406\n\n`overrides` \u662f npm \u5728\u6784\u9020\u4f9d\u8d56\u6811\u65f6\u5e94\u7528\u7684\u9876\u5c42\u7ea6\u675f\u3002\u5373\u4f7f `@babel/helpers` \u4e0d\u662f\u8fd9\u4e9b\u9879\u76ee\u7684\u76f4\u63a5 dependency\uff0c\u53ea\u8981\u67d0\u4e2a\u76f4\u63a5\u6216\u4f20\u9012\u4f9d\u8d56\u8bf7\u6c42\u5b83\uff0cnpm \u4e5f\u4f1a\u5c1d\u8bd5\u6309\u7167 override \u9009\u62e9\u6ee1\u8db3 `^7.27.6` \u7684\u7248\u672c\u3002\u8fd9\u6837\u53ef\u4ee5\u5728\u4e0d\u9010\u4e00\u4fee\u6539\u4e0a\u6e38\u5305\u7248\u672c\u7684\u60c5\u51b5\u4e0b\u7edf\u4e00\u4f20\u9012\u4f9d\u8d56\u3002\n\n`^7.27.6` \u4e0d\u662f\u7cbe\u786e\u9501\u5b9a\uff1a\u6309\u7167\u8bed\u4e49\u5316\u7248\u672c\u89c4\u5219\uff0c\u5b83\u5141\u8bb8\u5b89\u88c5 `7.27.6` \u53ca\u4e4b\u540e\u3001\u4f46\u4f4e\u4e8e `8.0.0` \u7684\u517c\u5bb9\u7248\u672c\u3002\u5b9e\u9645\u843d\u5730\u7248\u672c\u4ecd\u53d6\u51b3\u4e8e\u5b89\u88c5\u65f6\u53ef\u7528\u7684\u6ce8\u518c\u8868\u7248\u672c\u3001\u9501\u6587\u4ef6\u72b6\u6001\u4ee5\u53ca\u6240\u4f7f\u7528\u7684 npm \u7248\u672c\u3002\n\n\u6bcf\u4e2a\u6e05\u5355\u90fd\u9700\u8981\u5355\u72ec\u8bbe\u7f6e override\uff0c\u56e0\u4e3a npm override \u7684\u4f5c\u7528\u57df\u662f\u6267\u884c\u5b89\u88c5\u7684\u6839\u9879\u76ee\uff1b\u67d0\u4e2a\u5b50\u9879\u76ee\u4e0d\u4f1a\u81ea\u52a8\u7ee7\u627f\u53e6\u4e00\u4e2a\u76ee\u5f55\u4e2d `package.json` \u7684\u6839\u7ea7 override\u3002\n\n## \u5f71\u54cd\u5206\u6790\n\n### \u6b63\u9762\u5f71\u54cd\n\n- \u5c06 6 \u4e2a\u5b89\u88c5\u8fb9\u754c\u7684 `@babel/helpers` \u6700\u4f4e\u7248\u672c\u63d0\u5347\u5230 PR \u6307\u5b9a\u7684 `7.27.6`\uff0c\u964d\u4f4e\u7ee7\u7eed\u89e3\u6790\u5230 PR \u6240\u8ff0\u6613\u53d7\u5f71\u54cd\u7248\u672c\u7684\u53ef\u80fd\u6027\u3002\n- \u4fee\u6539\u96c6\u4e2d\u5728\u4f9d\u8d56\u5143\u6570\u636e\uff0c\u4e0d\u6539\u53d8\u5e94\u7528\u6e90\u4ee3\u7801\u63a5\u53e3\uff0c\u9884\u671f\u4e1a\u52a1\u529f\u80fd\u5f71\u54cd\u8f83\u5c0f\u3002\n- \u5bf9\u4e3b\u5ba2\u6237\u7aef\u3001\u5bbf\u4e3b\u793a\u4f8b\u548c\u6269\u5c55\u793a\u4f8b\u540c\u65f6\u5904\u7406\uff0c\u907f\u514d\u53ea\u4fee\u590d\u4e3b\u5305\u800c\u9057\u6f0f\u53ef\u72ec\u7acb\u5b89\u88c5\u7684\u6837\u4f8b\u5de5\u7a0b\u3002\n\n### \u8fd0\u884c\u65f6\u4e0e\u6784\u5efa\u5f71\u54cd\n\n- \u53d8\u66f4\u672c\u8eab\u5728\u5b89\u88c5\u65f6\u751f\u6548\uff1b\u5982\u679c\u6784\u5efa\u590d\u7528\u65e7\u7684 `node_modules` \u6216\u65e7\u9501\u6587\u4ef6\u4e14\u4e0d\u91cd\u65b0\u89e3\u6790\u4f9d\u8d56\uff0c\u65b0\u7684 override \u53ef\u80fd\u4e0d\u4f1a\u7acb\u5373\u4f53\u73b0\u5728\u4ea7\u7269\u4e2d\u3002\n- `@babel/helpers` \u63d0\u4f9b Babel \u8f6c\u8bd1\u4ee3\u7801\u4f7f\u7528\u7684\u8fd0\u884c\u65f6\u8f85\u52a9\u5b9e\u73b0\u3002\u867d\u7136\u540c\u5c5e 7.x \u8303\u56f4\u901a\u5e38\u5f3a\u8c03\u517c\u5bb9\u6027\uff0c\u4f46\u5f3a\u5236\u66ff\u6362\u4f20\u9012\u7248\u672c\u4ecd\u53ef\u80fd\u5f71\u54cd\u7531\u65e7 Babel \u5de5\u5177\u94fe\u751f\u6210\u6216\u6d88\u8d39\u8f85\u52a9\u51fd\u6570\u7684\u6784\u5efa\u7ed3\u679c\uff0c\u9700\u8981\u901a\u8fc7\u5b9e\u9645\u5b89\u88c5\u548c\u6784\u5efa\u786e\u8ba4\u3002\n- Terminal \u7684\u56fe\u6807\u8f6c\u4e49\u53d8\u66f4\u7406\u8bba\u4e0a\u4fdd\u6301\u540c\u4e00\u7801\u4f4d\uff0c\u4f46\u5b83\u4e0d\u5c5e\u4e8e CVE \u4fee\u590d\u7684\u5fc5\u8981\u90e8\u5206\uff0c\u82e5\u6d88\u8d39\u65b9\u8bfb\u53d6\u7684\u662f\u539f\u59cb JSON \u6587\u672c\u800c\u975e\u89e3\u6790\u540e\u7684\u503c\uff0c\u884c\u4e3a\u53ef\u80fd\u4e0d\u540c\uff1b\u6570\u636e\u5305\u672a\u63d0\u4f9b\u6d88\u8d39\u5b9e\u73b0\uff0c\u4e0d\u80fd\u65ad\u8a00\u7edd\u5bf9\u65e0\u5f71\u54cd\u3002\n\n## \u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\n\n| \u98ce\u9669 | \u5177\u4f53\u5173\u6ce8\u70b9 | \u5efa\u8bae |\n|---|---|---|\n| npm \u7248\u672c\u517c\u5bb9\u6027 | `overrides` \u9700\u8981\u652f\u6301\u8be5\u5b57\u6bb5\u7684 npm \u7248\u672c\uff1b\u8f83\u65e7 npm \u53ef\u80fd\u5ffd\u7565\u6216\u4e0d\u652f\u6301\u5b83\u3002\u6570\u636e\u5305\u672a\u7ed9\u51fa CI/\u5f00\u53d1\u73af\u5883 npm \u7248\u672c\u3002 | \u7528\u4ed3\u5e93\u89c4\u5b9a\u7684 Node/npm \u7248\u672c\u6267\u884c\u5b89\u88c5\uff0c\u5e76\u786e\u8ba4 override \u88ab\u5e94\u7528\u3002 |\n| \u9501\u6587\u4ef6\u672a\u540c\u6b65 | \u6570\u636e\u5305\u7684 6 \u4e2a\u53d8\u66f4\u5747\u4e3a `package.json`\uff0c\u6ca1\u6709\u5bf9\u5e94 lockfile \u5dee\u5f02\u3002\u82e5\u4ed3\u5e93\u4f7f\u7528 `npm ci`\uff0c\u6e05\u5355\u4e0e\u9501\u6587\u4ef6\u4e0d\u4e00\u81f4\u53ef\u80fd\u5931\u8d25\uff0c\u6216\u9501\u5b9a\u7ed3\u679c\u53ef\u80fd\u4ecd\u9700\u91cd\u65b0\u751f\u6210\u3002 | \u68c0\u67e5\u5404\u76ee\u5f55\u662f\u5426\u5b58\u5728\u53d7\u7248\u672c\u63a7\u5236\u7684 lockfile\uff0c\u5e76\u6309\u4ed3\u5e93\u6d41\u7a0b\u66f4\u65b0\u6216\u8bc1\u660e\u65e0\u9700\u66f4\u65b0\u3002 |\n| \u8303\u56f4\u800c\u975e\u7cbe\u786e\u7248\u672c | `^7.27.6` \u53ef\u81ea\u52a8\u63a5\u53d7\u540e\u7eed 7.x \u7248\u672c\uff0c\u672a\u6765\u5b89\u88c5\u7ed3\u679c\u53ef\u80fd\u53d8\u5316\u3002 | \u82e5\u6784\u5efa\u8981\u6c42\u5b8c\u5168\u53ef\u91cd\u590d\uff0c\u5e94\u4f9d\u8d56 lockfile \u56fa\u5b9a\u89e3\u6790\u7ed3\u679c\uff0c\u6216\u8bc4\u4f30\u662f\u5426\u5e94\u4f7f\u7528\u7cbe\u786e\u7248\u672c\u3002 |\n| \u4f20\u9012\u4f9d\u8d56\u517c\u5bb9\u6027 | \u67d0\u4e9b\u4e0a\u6e38\u4f9d\u8d56\u53ef\u80fd\u58f0\u660e\u6216\u9690\u542b\u4f9d\u8d56\u8f83\u65e7 helper \u884c\u4e3a\uff1b\u5f3a\u5236\u7edf\u4e00\u7248\u672c\u53ef\u80fd\u66b4\u9732\u6784\u5efa/\u8fd0\u884c\u65f6\u5dee\u5f02\u3002 | \u5bf9\u5168\u90e8 6 \u4e2a\u5b89\u88c5\u8fb9\u754c\u6267\u884c\u5e72\u51c0\u5b89\u88c5\u4e0e\u6784\u5efa\uff0c\u800c\u4e0d\u53ea\u68c0\u67e5 JSON \u8bed\u6cd5\u3002 |\n| \u8986\u76d6\u662f\u5426\u771f\u6b63\u751f\u6548 | override \u4ec5\u5bf9\u4ee5\u5bf9\u5e94\u6e05\u5355\u4e3a\u5b89\u88c5\u6839\u76ee\u5f55\u7684 npm \u4f9d\u8d56\u6811\u751f\u6548\uff1b\u5176\u4ed6\u5de5\u4f5c\u533a\u6216\u4e0d\u540c\u5305\u7ba1\u7406\u5668\u4e0d\u4e00\u5b9a\u91c7\u7528\u5b83\u3002 | \u4f7f\u7528 `npm ls @babel/helpers` \u6216\u7b49\u4ef7\u547d\u4ee4\u9010\u4e2a\u9a8c\u8bc1\u5b9e\u9645\u89e3\u6790\u7248\u672c\u3002 |\n| \u65e0\u5173\u683c\u5f0f/\u5185\u5bb9\u53d8\u66f4 | Angular \u6e05\u5355\u88ab\u538b\u7f29\u4e3a\u5355\u884c\uff1bTerminal \u56fe\u6807\u6539\u4e3a\u8f6c\u4e49\u5f62\u5f0f\u3002\u5b83\u4eec\u589e\u52a0\u5ba1\u9605\u566a\u58f0\uff0cTerminal \u53d8\u66f4\u8fd8\u6709\u8f7b\u5fae\u884c\u4e3a\u98ce\u9669\u3002 | \u786e\u8ba4\u683c\u5f0f\u5316\u7b26\u5408\u4ed3\u5e93\u60ef\u4f8b\uff0c\u5e76\u5355\u72ec\u9a8c\u8bc1 Terminal \u56fe\u6807\uff1b\u82e5\u975e\u5fc5\u8981\u53ef\u62c6\u9664\u9644\u5e26\u53d8\u66f4\u3002 |\n| \u5b89\u5168\u7ed3\u8bba\u8303\u56f4 | \u6570\u636e\u5305\u53ea\u8f6c\u8ff0 PR \u5bf9 CVE \u548c\u5b89\u5168\u7248\u672c\u7684\u63cf\u8ff0\uff0c\u6ca1\u6709\u6f0f\u6d1e\u516c\u544a\u3001\u626b\u63cf\u62a5\u544a\u6216\u5b89\u88c5\u540e\u7684\u4f9d\u8d56\u6811\u8bc1\u636e\u3002 | \u4ee5\u7ec4\u4ef6\u6cbb\u7406\u544a\u8b66/\u5b98\u65b9\u516c\u544a\u786e\u8ba4\u4fee\u590d\u7248\u672c\uff0c\u5e76\u5728\u5b89\u88c5\u540e\u91cd\u65b0\u8fd0\u884c\u5b89\u5168\u626b\u63cf\u3002 |\n\n## \u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae\n\n\u6570\u636e\u5305\u6ca1\u6709\u5305\u542b\u6d4b\u8bd5\u4fee\u6539\u3001\u6d4b\u8bd5\u6267\u884c\u7ed3\u679c\u3001CI \u6784\u5efa\u7ed3\u679c\u6216\u7ec4\u4ef6\u6cbb\u7406\u590d\u626b\u7ed3\u679c\uff0c\u56e0\u6b64\u4e0d\u80fd\u58f0\u79f0\u672c PR \u5df2\u901a\u8fc7\u8fd9\u4e9b\u9a8c\u8bc1\u3002\u5efa\u8bae\u81f3\u5c11\u6267\u884c\uff1a\n\n1. \u5728 6 \u4e2a\u76ee\u5f55\u5206\u522b\u8fdb\u884c\u4ed3\u5e93\u89c4\u5b9a\u7684\u5e72\u51c0\u4f9d\u8d56\u5b89\u88c5\uff0c\u786e\u8ba4 JSON \u53ef\u89e3\u6790\u4e14 npm \u63a5\u53d7 `overrides`\u3002\n2. \u5bf9\u6bcf\u4e2a\u5b89\u88c5\u8fb9\u754c\u67e5\u8be2 `@babel/helpers` \u7684\u5b9e\u9645\u4f9d\u8d56\u6811\uff0c\u786e\u8ba4\u4e0d\u5b58\u5728\u4f4e\u4e8e `7.27.6` \u7684\u89e3\u6790\u5b9e\u4f8b\uff0c\u5e76\u8bb0\u5f55\u6700\u7ec8\u7248\u672c\u3002\n3. \u8fd0\u884c\u4e3b\u5ba2\u6237\u7aef\u3001React/Angular \u5bbf\u4e3b\u5e94\u7528\u4ee5\u53ca\u4e09\u4e2a\u6269\u5c55\u793a\u4f8b\u7684\u73b0\u6709\u6784\u5efa\u548c\u6d4b\u8bd5\u3002\n4. \u542f\u52a8\u6216\u6267\u884c Terminal \u793a\u4f8b\u7684\u76f8\u5173 UI \u9a8c\u8bc1\uff0c\u786e\u8ba4 `CommandPrompt` \u56fe\u6807\u4ecd\u6b63\u786e\u663e\u793a\u3002\n5. \u91cd\u65b0\u8fd0\u884c\u7ec4\u4ef6\u6cbb\u7406\u6216\u4ed3\u5e93\u73b0\u6709\u5b89\u5168\u626b\u63cf\uff0c\u786e\u8ba4 CVE-2025-27789 \u544a\u8b66\u88ab\u89e3\u9664\u3002\n6. \u82e5\u5b58\u5728 lockfile\uff0c\u4f7f\u7528 CI \u540c\u6b3e `npm ci` \u9a8c\u8bc1\u6e05\u5355\u4e0e\u9501\u6587\u4ef6\u4e00\u81f4\u4e14\u5b89\u88c5\u53ef\u91cd\u590d\u3002\n\n## \u5dee\u5f02\u8986\u76d6\u4e0e\u5206\u6790\u8fb9\u754c\n\n- \u6570\u636e\u5305\u5217\u51fa 6 \u4e2a changed files\uff0c\u5e76\u63d0\u4f9b\u4e86\u5bf9\u5e94\u7684 6 \u4efd diff\uff1b\u6bcf\u4efd diff \u7684 `truncated` \u5747\u4e3a `false`\uff0c\u603b\u4f53 `diffTruncated` \u4e5f\u4e3a `false`\u3002\u56e0\u6b64\uff0c\u5305\u5185\u5217\u51fa\u7684\u6587\u4ef6\u7ea7\u5dee\u5f02\u6ca1\u6709\u6807\u8bb0\u4e3a\u622a\u65ad\u3002\n- \u603b\u5dee\u5f02\u5927\u5c0f\u4e3a 3,061 \u5b57\u8282\uff0c\u4f4e\u4e8e\u6570\u636e\u5305\u6ce8\u660e\u7684\u603b\u4f53 524,288 \u5b57\u8282\u548c\u5355\u6587\u4ef6 65,536 \u5b57\u8282\u4e0a\u9650\u3002\n- \u6570\u636e\u5305\u6ca1\u6709 errors \u6216 warnings\u3002\n- \u201c\u672a\u622a\u65ad\u201d\u4ec5\u8868\u793a\u5bfc\u51fa\u7684 diff \u6587\u672c\u672a\u89e6\u53d1\u622a\u65ad\u6807\u8bb0\uff0c\u4e0d\u4ee3\u8868\u6570\u636e\u5305\u5305\u542b\u4ed3\u5e93\u5b8c\u6574\u6587\u4ef6\u5185\u5bb9\u6216\u6240\u6709\u5916\u90e8\u4e0a\u4e0b\u6587\u3002\u5305\u4e2d\u672a\u63d0\u4f9b\u5b8c\u6574 `package.json`\u3001\u4efb\u4f55 lockfile \u5185\u5bb9\u3001\u4f9d\u8d56\u89e3\u6790\u6811\u3001CVE \u516c\u544a\u6b63\u6587\u3001\u6784\u5efa\u65e5\u5fd7\u3001\u6d4b\u8bd5\u7ed3\u679c\u3001\u7b56\u7565\u9a8c\u8bc1\u7ed3\u679c\u6216 PR \u8ba8\u8bba\uff0c\u56e0\u6b64\u4e0a\u8ff0\u9879\u76ee\u5747\u672a\u4f5c\u8d85\u51fa\u8bc1\u636e\u7684\u7ed3\u8bba\u3002\n- \u884c\u6570\u7edf\u8ba1\u6765\u81ea\u5305\u5185\u6587\u672c diff\uff1bAngular \u7684\u5355\u884c\u683c\u5f0f\u5316\u3001\u6587\u4ef6\u672b\u5c3e\u6362\u884c\u6807\u8bb0\u4ee5\u53ca Terminal \u7684\u5b57\u7b26\u8f6c\u4e49\u4f1a\u4f7f\u884c\u7ea7\u7edf\u8ba1\u9ad8\u4e8e\u5b9e\u9645\u8bed\u4e49\u6539\u52a8\u91cf\u3002\n", "creation_timestamp": "2026-09-01T20:22:11.504472Z"}, {"uuid": "ce7f0f49-186d-459e-9067-274745e1aa3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27789", "type": "seen", "source": "https://gist.github.com/djlan/74212a12decc46a1ae79f40089381559", "content": "# \u66f4\u65b0 @babel \u4f9d\u8d56\u4ee5\u4fee\u590d CVE-2025-27789\n\n> **\u4e00\u53e5\u8bdd\u603b\u7ed3\uff1a** \u672c PR \u901a\u8fc7\u63d0\u5347 AzNB.Lobby \u7684 Babel \u7f16\u8bd1\u4e0e Jest \u8f6c\u8bd1\u5de5\u5177\u7248\u672c\uff0c\u4f7f\u4f9d\u8d56\u89e3\u6790\u8f6c\u5411\u5305\u542b\u5df2\u4fee\u590d `@babel/helpers` \u7684\u8f83\u65b0\u7248\u672c\uff1b\u4f46\u6700\u7ec8\u53d8\u66f4\u672a\u63d0\u4ea4\u9501\u6587\u4ef6\uff0c\u4e5f\u672a\u63d0\u4f9b\u6784\u5efa\u3001\u6d4b\u8bd5\u6216\u5b89\u5168\u626b\u63cf\u7ed3\u679c\u3002\n\n| \u9879\u76ee | \u5185\u5bb9 |\n|---|---|\n| PR | [AzureNotebooks PR 648522](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/648522) |\n| \u4f5c\u8005 | GitHub Copilot |\n| \u72b6\u6001 | Active\uff0c\u975e\u8349\u7a3f\uff1b\u5408\u5e76\u72b6\u6001\u4e3a Succeeded |\n| \u5206\u652f | `copilot/swe-wi2417022-e4ab6` \u2192 `main` |\n| \u521b\u5efa\u65f6\u95f4 | 2025-07-02 16:58:51 |\n| \u63d0\u4ea4\u6570 | 2 |\n| \u8fed\u4ee3\u6570 | 3 |\n| \u53d8\u66f4\u7edf\u8ba1 | 1 \u4e2a\u6587\u4ef6\uff0c4 \u884c\u65b0\u589e\u30014 \u884c\u5220\u9664 |\n| \u5dee\u5f02\u91c7\u96c6 | `git-local`\uff0c\u5171 1006 \u5b57\u8282\uff0c\u6574\u4f53\u53ca\u5355\u6587\u4ef6\u5dee\u5f02\u5747\u672a\u622a\u65ad |\n\n## \u76ee\u5f55\n\n- [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n- [\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e](#\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e)\n  - [\u5b89\u5168\u4f9d\u8d56\u5347\u7ea7](#\u5b89\u5168\u4f9d\u8d56\u5347\u7ea7)\n  - [Babel \u7f16\u8bd1\u94fe\u517c\u5bb9\u6027](#babel-\u7f16\u8bd1\u94fe\u517c\u5bb9\u6027)\n  - [Jest \u8f6c\u8bd1\u96c6\u6210](#jest-\u8f6c\u8bd1\u96c6\u6210)\n  - [\u6587\u6863\u4e0e\u63d0\u4ea4\u6f14\u8fdb](#\u6587\u6863\u4e0e\u63d0\u4ea4\u6f14\u8fdb)\n- [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n- [\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8](#\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8)\n- [\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1](#\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1)\n- [\u5dee\u5f02\u8986\u76d6\u4e0e\u5206\u6790\u8fb9\u754c](#\u5dee\u5f02\u8986\u76d6\u4e0e\u5206\u6790\u8fb9\u754c)\n\n## \u53d8\u66f4\u6982\u89c8\n\n\u6700\u7ec8\u4ee3\u7801\u53d8\u66f4\u96c6\u4e2d\u5728 [AzNB.Lobby/package.json](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/648522?path=/src/service/aznb/AzNB.Collab/AzNB.Lobby/package.json&_a=files) \u7684 `devDependencies`\uff1a\n\n| \u4f9d\u8d56 | \u539f\u7248\u672c\u8303\u56f4 | \u65b0\u7248\u672c\u8303\u56f4 | \u4f5c\u7528 |\n|---|---:|---:|---|\n| `@babel/core` | `^7.19.6` | `^7.27.0` | Babel \u6838\u5fc3\u7f16\u8bd1\u4e0e\u63d2\u4ef6\u8c03\u5ea6 |\n| `@babel/preset-env` | `^7.19.4` | `^7.27.0` | \u6309\u76ee\u6807\u8fd0\u884c\u73af\u5883\u8f6c\u6362 JavaScript |\n| `@babel/preset-typescript` | `^7.18.6` | `^7.23.3` | \u79fb\u9664 TypeScript \u7c7b\u578b\u8bed\u6cd5\u5e76\u4ea4\u7ed9 Babel \u8f6c\u6362 |\n| `babel-jest` | `^29.2.2` | `^29.7.0` | \u5728 Jest \u6d4b\u8bd5\u8fd0\u884c\u65f6\u4f7f\u7528 Babel \u8f6c\u8bd1\u6e90\u7801 |\n\nPR \u7684\u76ee\u6807\u662f\u5904\u7406 `@babel/helpers 7.22.5` \u5bf9\u5e94\u7684 CVE-2025-27789\u3002\u5b9e\u73b0\u65b9\u5f0f\u4e0d\u662f\u76f4\u63a5\u58f0\u660e `@babel/helpers`\uff0c\u800c\u662f\u5347\u7ea7\u5f15\u5165\u5b83\u7684 Babel \u5de5\u5177\u94fe\uff0c\u8ba9\u540e\u7eed\u4f9d\u8d56\u5b89\u88c5\u6839\u636e\u65b0\u7684\u4e0a\u6e38\u7ea6\u675f\u89e3\u6790\u5230\u975e\u6f0f\u6d1e\u7248\u672c\u3002\u7531\u4e8e\u8fd9\u4e9b\u5305\u5747\u4f4d\u4e8e `devDependencies`\uff0c\u76f4\u63a5\u5f71\u54cd\u4e3b\u8981\u843d\u5728\u672c\u5730\u5f00\u53d1\u3001\u6784\u5efa\u548c\u6d4b\u8bd5\u9636\u6bb5\uff0c\u800c\u4e0d\u662f\u5e94\u7528\u8fd0\u884c\u65f6\u663e\u5f0f\u4f9d\u8d56\u3002\n\n## \u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e\n\n### \u5b89\u5168\u4f9d\u8d56\u5347\u7ea7\n\n[package.json](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/648522?path=/src/service/aznb/AzNB.Collab/AzNB.Lobby/package.json&_a=files) \u5c06 `@babel/core` \u63d0\u5347\u5230 `^7.27.0`\u3002\u6839\u636e PR \u63cf\u8ff0\uff0c\u6f0f\u6d1e\u6765\u6e90\u4f4d\u4e8e `@babel/core` \u7684\u4f20\u9012\u4f9d\u8d56\u94fe\u4e2d\uff0c\u56e0\u6b64\u6838\u5fc3\u5305\u5347\u7ea7\u540e\uff0c\u5176\u4f9d\u8d56\u58f0\u660e\u4f1a\u8981\u6c42\u8f83\u65b0\u7684 `@babel/helpers`\uff0c\u4ece\u6e90\u5934\u907f\u514d\u7ee7\u7eed\u5f15\u7528\u5df2\u77e5\u6f0f\u6d1e\u7248\u672c\u3002\n\n`@babel/preset-env` \u540c\u6b65\u63d0\u5347\u5230 `^7.27.0`\uff0c\u4f7f\u9884\u8bbe\u4e0e Babel \u6838\u5fc3\u4fdd\u6301\u540c\u4e00\u4ee3\u7248\u672c\uff0c\u964d\u4f4e\u6838\u5fc3\u548c\u9884\u8bbe\u4e4b\u95f4 API\u3001\u63d2\u4ef6\u96c6\u5408\u6216\u4f9d\u8d56\u7ea6\u675f\u4e0d\u4e00\u81f4\u7684\u6982\u7387\u3002\n\n\u9700\u8981\u6ce8\u610f\uff0c\u5206\u6790\u5305\u4e2d\u6ca1\u6709\u6700\u7ec8\u5b89\u88c5\u540e\u7684\u4f9d\u8d56\u6811\u6216\u9501\u6587\u4ef6\u5dee\u5f02\uff0c\u56e0\u6b64\u53ea\u80fd\u786e\u8ba4\u6e05\u5355\u4e2d\u7684\u7248\u672c\u8303\u56f4\u5df2\u66f4\u65b0\uff0c\u4e0d\u80fd\u4ec5\u51ed\u5f53\u524d\u5dee\u5f02\u786e\u8ba4\u5b9e\u9645\u5b89\u88c5\u7248\u672c\u6216\u5b89\u5168\u544a\u8b66\u5df2\u7ecf\u6d88\u5931\u3002\n\n### Babel \u7f16\u8bd1\u94fe\u517c\u5bb9\u6027\n\n`@babel/preset-typescript` \u4ece `^7.18.6` \u5347\u81f3 `^7.23.3`\uff0c\u4f7f TypeScript \u8bed\u6cd5\u8f6c\u6362\u7ec4\u4ef6\u4e0e\u8f83\u65b0\u7684 Babel \u6838\u5fc3\u66f4\u63a5\u8fd1\u3002\u8be5\u5347\u7ea7\u53ef\u80fd\u5e26\u5165 7.19 \u81f3 7.23 \u671f\u95f4\u5bf9 TypeScript \u65b0\u8bed\u6cd5\u3001\u7c7b\u7279\u6027\u3001\u6a21\u5757\u5904\u7406\u6216\u914d\u7f6e\u6821\u9a8c\u7684\u53d8\u5316\u3002\n\n\u672c\u6b21\u6ca1\u6709\u4fee\u6539 Babel \u914d\u7f6e\u6216\u4e1a\u52a1\u6e90\u7801\uff0c\u56e0\u6b64\u5de5\u4f5c\u673a\u5236\u4ecd\u662f\u6cbf\u7528\u73b0\u6709\u7f16\u8bd1\u914d\u7f6e\uff0c\u4ec5\u66ff\u6362\u6267\u884c\u8fd9\u4e9b\u914d\u7f6e\u7684\u5de5\u5177\u7248\u672c\u3002\u662f\u5426\u4ea7\u751f\u8f93\u51fa\u5dee\u5f02\u53d6\u51b3\u4e8e\u9879\u76ee\u73b0\u6709\u7684 Babel \u914d\u7f6e\u3001\u76ee\u6807\u73af\u5883\u548c\u6e90\u7801\u8bed\u6cd5\uff1b\u8fd9\u4e9b\u5185\u5bb9\u672a\u5305\u542b\u5728\u5206\u6790\u5305\u4e2d\uff0c\u4e0d\u80fd\u8fdb\u4e00\u6b65\u65ad\u8a00\u3002\n\n### Jest \u8f6c\u8bd1\u96c6\u6210\n\n`babel-jest` \u4ece `^29.2.2` \u5347\u81f3 `^29.7.0`\u3002\u5b83\u4e0e Jest \u8fd0\u884c\u65f6\u96c6\u6210\uff0c\u5728\u6d4b\u8bd5\u52a0\u8f7d JavaScript \u6216 TypeScript \u6587\u4ef6\u65f6\u8c03\u7528 Babel\u3002\u5347\u7ea7\u4fdd\u6301\u5728 Jest 29 \u4e3b\u7248\u672c\u5185\uff0c\u4e3b\u8981\u76ee\u7684\u662f\u8ba9\u6d4b\u8bd5\u8f6c\u8bd1\u5c42\u4e0e\u66f4\u65b0\u540e\u7684 Babel \u4f9d\u8d56\u517c\u5bb9\uff0c\u540c\u65f6\u5438\u6536 29.x \u540e\u7eed\u4fee\u590d\u3002\n\n\u8fd9\u9879\u6539\u52a8\u4e0d\u6539\u53d8\u6d4b\u8bd5\u811a\u672c\u672c\u8eab\uff0c\u4f46\u53ef\u80fd\u6539\u53d8\u6d4b\u8bd5\u6587\u4ef6\u7684\u8f6c\u6362\u3001\u7f13\u5b58\u952e\u6216 source map \u884c\u4e3a\u3002\u5206\u6790\u5305\u6ca1\u6709\u6d4b\u8bd5\u6267\u884c\u7ed3\u679c\uff0c\u65e0\u6cd5\u786e\u8ba4\u73b0\u6709\u6d4b\u8bd5\u5728\u65b0\u7ec4\u5408\u4e0b\u7684\u5b9e\u9645\u8868\u73b0\u3002\n\n### \u6587\u6863\u4e0e\u63d0\u4ea4\u6f14\u8fdb\n\nPR \u63cf\u8ff0\u63d0\u5230\u66fe\u6dfb\u52a0 `SECURITY_UPDATE.md`\uff0c\u63d0\u4ea4\u5386\u53f2\u968f\u540e\u663e\u793a\u8be5\u6587\u4ef6\u6309\u8bc4\u5ba1\u610f\u89c1\u88ab\u5220\u9664\u3002\u6700\u7ec8 `changedFiles` \u548c\u5dee\u5f02\u4e2d\u53ea\u6709 `package.json`\uff0c\u56e0\u6b64\u8be5\u6587\u6863\u4e0d\u5c5e\u4e8e\u6700\u7ec8 PR \u5185\u5bb9\uff0c\u672c\u8bf4\u660e\u4e0d\u5bf9\u5176\u6b63\u6587\u4f5c\u5206\u6790\u3002\n\n## \u5f71\u54cd\u5206\u6790\n\n### \u9884\u671f\u6536\u76ca\n\n- \u4fee\u6b63 Babel \u4f20\u9012\u4f9d\u8d56\u7684\u7248\u672c\u7ea6\u675f\uff0c\u4e3a\u6d88\u9664 CVE-2025-27789 \u544a\u8b66\u63d0\u4f9b\u4f9d\u8d56\u6e05\u5355\u5c42\u9762\u7684\u57fa\u7840\u3002\n- \u5bf9\u9f50 `@babel/core`\u3001`@babel/preset-env` \u548c `babel-jest`\uff0c\u907f\u514d\u53ea\u5347\u7ea7\u5355\u4e2a\u5305\u5bfc\u81f4\u5de5\u5177\u94fe\u7248\u672c\u7ec4\u5408\u4e0d\u534f\u8c03\u3002\n- \u53d8\u66f4\u8303\u56f4\u4ec5\u9650 AzNB.Lobby \u7684\u5f00\u53d1\u4f9d\u8d56\u58f0\u660e\uff0c\u6ca1\u6709\u770b\u5230\u751f\u4ea7\u4ee3\u7801\u3001\u516c\u5f00 API\u3001\u6570\u636e\u6a21\u578b\u6216\u90e8\u7f72\u914d\u7f6e\u53d8\u5316\u3002\n\n### \u5f71\u54cd\u8303\u56f4\n\n- **\u5f00\u53d1\u4e0e CI \u6784\u5efa\uff1a** \u5b89\u88c5\u4f9d\u8d56\u548c\u6267\u884c Babel \u7f16\u8bd1\u65f6\u4f1a\u4f7f\u7528\u65b0\u7248\u672c\u5de5\u5177\u94fe\u3002\n- **\u6d4b\u8bd5\uff1a** Jest \u901a\u8fc7 `babel-jest` \u8f6c\u8bd1\u6d4b\u8bd5\u53ca\u88ab\u6d4b\u6e90\u7801\u7684\u884c\u4e3a\u53ef\u80fd\u53d1\u751f\u7ec6\u5fae\u53d8\u5316\u3002\n- **\u8fd0\u884c\u65f6\uff1a** \u8fd9\u4e9b\u4f9d\u8d56\u4f4d\u4e8e `devDependencies`\uff1b\u5305\u5185\u672a\u5c55\u793a\u5c06\u5176\u6253\u5165\u751f\u4ea7\u5236\u54c1\u7684\u8bc1\u636e\uff0c\u56e0\u6b64\u65e0\u6cd5\u786e\u8ba4\u751f\u4ea7\u5236\u54c1\u662f\u5426\u5b8c\u5168\u4e0d\u53d7\u5f71\u54cd\u3002\n- **\u4f9d\u8d56\u53ef\u590d\u73b0\u6027\uff1a** \u6700\u7ec8\u5dee\u5f02\u6ca1\u6709\u9501\u6587\u4ef6\uff0c\u5f53\u524d PR \u672c\u8eab\u672a\u56fa\u5b9a\u65b0\u7684\u5b8c\u6574\u4f20\u9012\u4f9d\u8d56\u6811\u3002\n\n## \u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\n\n1. **\u9501\u6587\u4ef6\u672a\u540c\u6b65\u662f\u6700\u5177\u4f53\u7684\u4ea4\u4ed8\u98ce\u9669\u3002** PR \u63cf\u8ff0\u6307\u51fa\u53d7\u5f71\u54cd\u7248\u672c\u66fe\u51fa\u73b0\u5728 `package-lock.json`\uff0c\u4f46\u6700\u7ec8\u53d8\u66f4\u5217\u8868\u6ca1\u6709\u8be5\u6587\u4ef6\u3002\u82e5 CI \u6216\u53d1\u5e03\u6d41\u7a0b\u4f7f\u7528 `npm ci`\uff0c\u5b83\u901a\u5e38\u8981\u6c42 `package.json` \u4e0e\u9501\u6587\u4ef6\u4e00\u81f4\uff0c\u53ef\u80fd\u76f4\u63a5\u5931\u8d25\uff1b\u5373\u4f7f\u6d41\u7a0b\u5141\u8bb8\u5b89\u88c5\uff0c\u4e5f\u53ef\u80fd\u7ee7\u7eed\u4f7f\u7528\u65e7\u9501\u5b9a\u7ed3\u679c\u6216\u5728\u4e0d\u540c\u65f6\u95f4\u89e3\u6790\u51fa\u4e0d\u540c\u4f9d\u8d56\u6811\u3002\n2. **Babel \u8de8\u591a\u4e2a\u6b21\u7248\u672c\u5347\u7ea7\u53ef\u80fd\u6539\u53d8\u7f16\u8bd1\u8f93\u51fa\u3002** `@babel/core` \u548c `@babel/preset-env` \u4ece 7.19 \u63d0\u5347\u5230 7.27\uff0c\u53ef\u80fd\u6d89\u53ca\u63d2\u4ef6\u9ed8\u8ba4\u884c\u4e3a\u3001\u76ee\u6807\u73af\u5883\u6570\u636e\u548c\u8bed\u6cd5\u8f6c\u6362\u4fee\u590d\u3002\u65e7\u6d4f\u89c8\u5668\u6216\u7279\u5b9a Node.js \u7248\u672c\u7684\u8f93\u51fa\u517c\u5bb9\u6027\u9700\u8981\u901a\u8fc7\u5b9e\u9645\u6784\u5efa\u4ea7\u7269\u786e\u8ba4\u3002\n3. **TypeScript \u8f6c\u8bd1\u8bed\u4e49\u53ef\u80fd\u6709\u5dee\u5f02\u3002** `@babel/preset-typescript` \u7684\u5347\u7ea7\u53ef\u80fd\u5f71\u54cd\u8f83\u65b0 TypeScript \u8bed\u6cd5\u3001\u7c7b\u5b57\u6bb5\u3001\u547d\u540d\u7a7a\u95f4\u6216\u4ec5\u7c7b\u578b\u5bfc\u5165\u7684\u5904\u7406\uff1b\u98ce\u9669\u53d6\u51b3\u4e8e\u9879\u76ee\u6e90\u7801\u548c Babel \u914d\u7f6e\uff0c\u5305\u5185\u672a\u63d0\u4f9b\u8fd9\u4e9b\u5185\u5bb9\u3002\n4. **Jest \u8f6c\u6362\u4e0e\u7f13\u5b58\u517c\u5bb9\u6027\u3002** \u5c3d\u7ba1 `babel-jest` \u4fdd\u6301\u5728 29.x\uff0c\u7248\u672c\u53d8\u5316\u4ecd\u53ef\u80fd\u5f71\u54cd\u8f6c\u6362\u7f13\u5b58\u3001source map \u548c Babel \u914d\u7f6e\u52a0\u8f7d\u3002\u9700\u8981\u5173\u6ce8\u5feb\u7167\u3001\u8986\u76d6\u7387\u5b9a\u4f4d\u53ca\u4f9d\u8d56\u4e8e\u8f6c\u6362\u7ec6\u8282\u7684\u6d4b\u8bd5\u3002\n5. **Caret \u8303\u56f4\u5141\u8bb8\u540e\u7eed\u6f02\u79fb\u3002** \u65b0\u7248\u672c\u7ee7\u7eed\u4f7f\u7528 `^`\uff0c\u672a\u6765\u91cd\u65b0\u751f\u6210\u9501\u6587\u4ef6\u65f6\u53ef\u89e3\u6790\u5230\u66f4\u9ad8\u7684\u517c\u5bb9\u6b21\u7248\u672c\u3002\u82e5\u6ca1\u6709\u63d0\u4ea4\u5e76\u5ba1\u6838\u9501\u6587\u4ef6\uff0c\u5b9e\u9645\u5b89\u88c5\u5185\u5bb9\u4e0d\u5b8c\u5168\u7531\u672c\u6b21\u56db\u4e2a\u7248\u672c\u53f7\u51b3\u5b9a\u3002\n6. **\u5b89\u5168\u4fee\u590d\u5c1a\u7f3a\u95ed\u73af\u8bc1\u636e\u3002** \u6e05\u5355\u5347\u7ea7\u610f\u56fe\u5408\u7406\uff0c\u4f46\u5206\u6790\u5305\u6ca1\u6709\u65b0\u7684 `package-lock.json`\u3001`npm ls @babel/helpers` \u8f93\u51fa\u6216\u5b89\u5168\u626b\u63cf\u7ed3\u679c\uff0c\u4e0d\u80fd\u786e\u8ba4\u6700\u7ec8\u89e3\u6790\u7248\u672c\u53ca CVE \u544a\u8b66\u72b6\u6001\u3002\n\n## \u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\n\n\u5206\u6790\u5305\u6ca1\u6709\u5305\u542b\u65b0\u589e\u6216\u4fee\u6539\u7684\u6d4b\u8bd5\u6587\u4ef6\uff0c\u4e5f\u6ca1\u6709\u63d0\u4f9b\u6784\u5efa\u3001\u5355\u5143\u6d4b\u8bd5\u3001\u96c6\u6210\u6d4b\u8bd5\u6216\u5b89\u5168\u626b\u63cf\u7684\u6267\u884c\u7ed3\u679c\u3002PR \u63cf\u8ff0\u5c06\u4ee5\u4e0b\u4e8b\u9879\u5217\u4e3a\u5408\u5e76\u540e\u7684\u540e\u7eed\u6b65\u9aa4\uff0c\u800c\u975e\u5f53\u524d\u5305\u4e2d\u5df2\u7ecf\u5b8c\u6210\u7684\u9a8c\u8bc1\uff1a\n\n- \u5728\u53d7\u5f71\u54cd\u76ee\u5f55\u6267\u884c\u4f9d\u8d56\u5b89\u88c5\u5e76\u66f4\u65b0\u9501\u6587\u4ef6\u3002\n- \u9a8c\u8bc1\u9879\u76ee\u6784\u5efa\u548c\u6d4b\u8bd5\u901a\u8fc7\u3002\n- \u5728\u7ec4\u4ef6\u6cbb\u7406\u6216\u5176\u4ed6\u5b89\u5168\u626b\u63cf\u5de5\u5177\u4e2d\u786e\u8ba4\u6f0f\u6d1e\u5df2\u89e3\u51b3\u3002\n\n\u56e0\u6b64\uff0c\u672c PR \u5f53\u524d\u53ef\u786e\u8ba4\u7684\u662f\u4f9d\u8d56\u58f0\u660e\u53d1\u751f\u4e86\u53d8\u5316\uff1b\u65e0\u6cd5\u786e\u8ba4\u5b89\u88c5\u3001\u7f16\u8bd1\u3001\u6d4b\u8bd5\u548c\u5b89\u5168\u626b\u63cf\u7684\u6700\u7ec8\u7ed3\u679c\u3002\n\n## \u5dee\u5f02\u8986\u76d6\u4e0e\u5206\u6790\u8fb9\u754c\n\n- \u5206\u6790\u5305\u58f0\u660e\u5171\u6709 **1 \u4e2a\u6700\u7ec8\u53d8\u66f4\u6587\u4ef6**\uff0c\u4e14\u63d0\u4f9b\u4e86\u8be5\u6587\u4ef6\u7684\u5b8c\u6574\u5dee\u5f02\uff1b\u5355\u6587\u4ef6 `truncated` \u4e3a `false`\uff0c\u6574\u4f53 `diffTruncated` \u4e5f\u4e3a `false`\u3002\n- \u5dee\u5f02\u603b\u91cf\u4e3a **1006 \u5b57\u8282**\uff0c\u672a\u8fbe\u5230\u5305\u4e2d\u8bb0\u5f55\u7684\u6574\u4f53\u6216\u5355\u6587\u4ef6\u622a\u65ad\u4e0a\u9650\uff0c\u56e0\u6b64\u4e0d\u5b58\u5728\u5df2\u6807\u8bb0\u7684\u622a\u65ad\u7247\u6bb5\u3002\n- \u672c\u8bf4\u660e\u8986\u76d6\u4e86\u5305\u5185\u63d0\u4f9b\u7684\u5168\u90e8\u6700\u7ec8\u4ee3\u7801\u5dee\u5f02\uff0c\u4f46\u5206\u6790\u5305\u4e0d\u5305\u542b\u4ed3\u5e93\u5176\u4ed6\u6587\u4ef6\u5185\u5bb9\uff0c\u65e0\u6cd5\u68c0\u67e5 Babel/Jest \u914d\u7f6e\u3001\u6e90\u7801\u8bed\u6cd5\u4f7f\u7528\u3001CI \u547d\u4ee4\u6216 Node.js/npm \u7248\u672c\u517c\u5bb9\u6027\u3002\n- PR \u63cf\u8ff0\u63d0\u5230 `package-lock.json` \u4e2d\u7684\u6f0f\u6d1e\u4f9d\u8d56\uff0c\u4f46\u8be5\u9501\u6587\u4ef6\u4e0d\u5728\u6700\u7ec8\u53d8\u66f4\u6216\u5dee\u5f02\u4e2d\uff1b\u4e0d\u80fd\u63a8\u65ad\u5176\u5f53\u524d\u5185\u5bb9\uff0c\u4e5f\u4e0d\u80fd\u58f0\u79f0\u5df2\u5206\u6790\u6216\u66f4\u65b0\u3002\n- \u63d0\u4ea4\u5386\u53f2\u8868\u660e `SECURITY_UPDATE.md` \u66fe\u6dfb\u52a0\u540e\u5220\u9664\uff0c\u4f46\u5305\u5185\u6ca1\u6709\u8be5\u6587\u4ef6\u5185\u5bb9\uff1b\u9664\u786e\u8ba4\u5b83\u4e0d\u5728\u6700\u7ec8\u53d8\u66f4\u4e2d\u5916\uff0c\u4e0d\u5bf9\u5176\u5185\u5bb9\u4f5c\u4efb\u4f55\u5224\u65ad\u3002\n", "creation_timestamp": "2026-09-01T20:22:11.563649Z"}, {"uuid": "521ae6ff-92ae-4dec-b352-b5a8976b3dd9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27789", "type": "seen", "source": "https://gist.github.com/djlan/1a2315d247f96c9ac406eb3048e294c5", "content": "# \u4fee\u590d `@babel/runtime` 7.24.0 \u4e2d\u7684 CVE-2025-27789 \u6f0f\u6d1e\n\n> **\u4e00\u53e5\u8bdd\u6458\u8981\uff1a** \u6b64 PR \u5728 7 \u4e2a\u72ec\u7acb\u7684 npm \u5305\u6e05\u5355\u4e2d\u52a0\u5165\u6839\u7ea7 `overrides`\uff0c\u8981\u6c42\u4f20\u9012\u4f9d\u8d56\u4e2d\u7684 `@babel/runtime` \u89e3\u6790\u4e3a `>=7.24.1`\uff0c\u4ee5\u89c4\u907f 7.24.0 \u6240\u6d89\u53ca\u7684\u4e2d\u7b49\u7ea7\u522b CVE-2025-27789\u3002\n\n| \u9879\u76ee | \u4fe1\u606f |\n|---|---|\n| PR | [AzureNotebooks PR 648523](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/648523) |\n| \u4f5c\u8005 | GitHub Copilot |\n| \u72b6\u6001 | Active\uff0c\u975e\u8349\u7a3f\uff1b\u6570\u636e\u5305\u4e2d\u7684\u5408\u5e76\u72b6\u6001\u4e3a `succeeded` |\n| \u5206\u652f | `copilot/swe-wi2417041-81c63` \u2192 `main` |\n| \u521b\u5efa\u65f6\u95f4 | 2025-07-02 16:59:09 |\n| \u53d8\u66f4\u7edf\u8ba1 | 7 \u4e2a\u6587\u4ef6\uff0c\u65b0\u589e 21 \u884c\u3001\u5220\u9664 2 \u884c\uff1b1 \u4e2a\u63d0\u4ea4\uff0c2 \u6b21\u8fed\u4ee3 |\n\n## \u76ee\u5f55\n\n- [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n- [\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e](#\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e)\n  - [\u901a\u7528\u793a\u4f8b\u6269\u5c55](#1-\u901a\u7528\u793a\u4f8b\u6269\u5c55)\n  - [Terminal \u670d\u52a1\u7aef\u6269\u5c55](#2-terminal-\u670d\u52a1\u7aef\u6269\u5c55)\n  - [AzNB Lobby \u670d\u52a1](#3-aznb-lobby-\u670d\u52a1)\n- [\u5de5\u4f5c\u539f\u7406](#\u5de5\u4f5c\u539f\u7406)\n- [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n- [\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8](#\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8)\n- [\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u60c5\u51b5](#\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u60c5\u51b5)\n- [\u5dee\u5f02\u8986\u76d6\u4e0e\u5206\u6790\u8fb9\u754c](#\u5dee\u5f02\u8986\u76d6\u4e0e\u5206\u6790\u8fb9\u754c)\n\n## \u53d8\u66f4\u6982\u89c8\n\n\u8be5 PR \u7684\u76ee\u6807\u4e0d\u662f\u4fee\u6539\u4e1a\u52a1\u903b\u8f91\uff0c\u800c\u662f\u7edf\u4e00\u7ea6\u675f npm \u7684\u4f9d\u8d56\u89e3\u6790\u7ed3\u679c\u3002CVE-2025-27789 \u51fa\u73b0\u5728 `@babel/runtime` 7.24.0\uff1b\u5373\u4f7f\u5404\u9879\u76ee\u6ca1\u6709\u76f4\u63a5\u58f0\u660e\u8be5\u7248\u672c\uff0c\u5b83\u4ecd\u53ef\u80fd\u7531\u5176\u4ed6\u4f9d\u8d56\u95f4\u63a5\u5f15\u5165\u3002\u56e0\u6b64\uff0cPR \u5728\u6bcf\u4e2a\u76f8\u5173 `package.json` \u7684\u6839\u7ea7\u52a0\u5165\uff1a\n\n`\"@babel/runtime\": \">=7.24.1\"`\n\n\u8fd9\u9879\u7ea6\u675f\u4f7f npm \u5728\u5b89\u88c5\u8fd9\u4e9b\u5305\u7684\u4f9d\u8d56\u6811\u65f6\uff0c\u4e0d\u518d\u9009\u62e9 7.24.0\uff0c\u800c\u662f\u9009\u62e9\u6ee1\u8db3\u4e0b\u9650\u8981\u6c42\u7684\u7248\u672c\u3002\u73b0\u6709\u76f4\u63a5\u4f9d\u8d56\u3001\u811a\u672c\u548c\u8fd0\u884c\u65f6\u4ee3\u7801\u5747\u672a\u5728\u6570\u636e\u5305\u6240\u793a\u5dee\u5f02\u4e2d\u6539\u53d8\u3002\n\n## \u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e\n\n### 1. \u901a\u7528\u793a\u4f8b\u6269\u5c55\n\n\u4ee5\u4e0b 5 \u4e2a\u901a\u7528\u6269\u5c55\u5206\u522b\u62e5\u6709\u81ea\u5df1\u7684\u5305\u6e05\u5355\uff0c\u56e0\u6b64\u9700\u8981\u9010\u5305\u8bbe\u7f6e\u8986\u76d6\u89c4\u5219\uff1a\n\n| \u6587\u4ef6 | \u53d8\u66f4\u53ca\u4f5c\u7528 |\n|---|---|\n| [NotebookGrader/package.json](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/648523?path=/sample/extensions/common-extensions/NotebookGrader/package.json&_a=files) | \u65b0\u589e\u6839\u7ea7 `overrides`\uff0c\u7ea6\u675f\u8bc4\u5206\u6269\u5c55\u4f9d\u8d56\u6811\u4e2d\u7684 `@babel/runtime`\u3002 |\n| [PowerQueryCellTest/package.json](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/648523?path=/sample/extensions/common-extensions/PowerQueryCellTest/package.json&_a=files) | \u65b0\u589e\u76f8\u540c\u8986\u76d6\u89c4\u5219\uff0c\u907f\u514d\u6d4b\u8bd5\u6269\u5c55\u7684\u4f20\u9012\u4f9d\u8d56\u89e3\u6790\u5230\u6f0f\u6d1e\u7248\u672c\u3002 |\n| [ReactViewTest/package.json](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/648523?path=/sample/extensions/common-extensions/ReactViewTest/package.json&_a=files) | \u5728\u5df2\u6709\u7684 `postcss` \u8986\u76d6\u9879\u65c1\u8ffd\u52a0 `@babel/runtime` \u89c4\u5219\uff1b\u539f\u6709 `postcss` \u56fa\u5b9a\u7248\u672c\u4fdd\u6301\u4e0d\u53d8\u3002 |\n| [ReverseSelectionStateful/package.json](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/648523?path=/sample/extensions/common-extensions/ReverseSelectionStateful/package.json&_a=files) | \u65b0\u589e\u8986\u76d6\u89c4\u5219\uff0c\u7ea6\u675f\u8be5\u6709\u72b6\u6001\u9009\u62e9\u793a\u4f8b\u7684\u4f9d\u8d56\u6811\u3002 |\n| [SystemMonitor/package.json](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/648523?path=/sample/extensions/common-extensions/SystemMonitor/package.json&_a=files) | \u65b0\u589e\u8986\u76d6\u89c4\u5219\uff0c\u7ea6\u675f\u7cfb\u7edf\u76d1\u63a7\u6269\u5c55\u7684\u4f9d\u8d56\u6811\u3002 |\n\n\u8fd9\u4e9b\u4fee\u6539\u91c7\u7528\u76f8\u540c\u7b56\u7565\uff0c\u8bf4\u660e\u76f8\u5173\u6269\u5c55\u53ef\u80fd\u4f5c\u4e3a\u72ec\u7acb npm \u5b89\u88c5\u5355\u5143\u5904\u7406\uff1b\u4ec5\u5728\u67d0\u4e2a\u4e0a\u5c42\u76ee\u5f55\u8bbe\u7f6e\u89c4\u5219\u672a\u5fc5\u4f1a\u8986\u76d6\u6240\u6709\u72ec\u7acb\u5b89\u88c5\u573a\u666f\uff0c\u56e0\u6b64\u9010\u4e2a\u5305\u58f0\u660e\u53ef\u4f7f\u7ea6\u675f\u5728\u5404\u5305\u5b89\u88c5\u5165\u53e3\u751f\u6548\u3002\n\n### 2. Terminal \u670d\u52a1\u7aef\u6269\u5c55\n\n[Terminal/package.json](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/648523?path=/sample/extensions/server-extensions/Terminal/package.json&_a=files) \u65b0\u589e\u540c\u4e00\u6839\u7ea7\u8986\u76d6\u89c4\u5219\u3002Terminal \u7684\u73b0\u6709\u4f9d\u8d56\uff08\u5305\u62ec React\u3001xterm \u548c xterm-addon-fit\uff09\u6ca1\u6709\u5728\u6240\u63d0\u4f9b\u5dee\u5f02\u4e2d\u8c03\u6574\uff1b\u53d8\u66f4\u53ea\u5f71\u54cd\u5b89\u88c5\u65f6\u5bf9\u5176\u5b8c\u6574\u4f20\u9012\u4f9d\u8d56\u6811\u7684\u89e3\u6790\u3002\n\n### 3. AzNB Lobby \u670d\u52a1\n\n[AzNB.Lobby/package.json](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/648523?path=/src/service/aznb/AzNB.Collab/AzNB.Lobby/package.json&_a=files) \u5728\u73b0\u6709\u914d\u7f6e\u6570\u7ec4\u4e4b\u540e\u65b0\u589e\u6839\u7ea7 `overrides`\u3002\u8be5\u4fee\u6539\u4fdd\u6301\u539f\u6570\u7ec4\u5185\u5bb9\u4e0d\u53d8\uff0c\u4ec5\u8c03\u6574 JSON \u7ed3\u6784\u4ee5\u5bb9\u7eb3\u65b0\u7684\u9876\u5c42\u5b57\u6bb5\uff0c\u5e76\u628a Lobby \u670d\u52a1\u7684\u4f20\u9012\u4f9d\u8d56\u7eb3\u5165\u540c\u6837\u7684\u5b89\u5168\u7248\u672c\u4e0b\u9650\u3002\n\n## \u5de5\u4f5c\u539f\u7406\n\n1. npm \u8bfb\u53d6\u6bcf\u4e2a\u5305\u6839\u76ee\u5f55\u7684 `package.json`\u3002\n2. `overrides` \u6307\u793a npm \u5728\u6784\u5efa\u4f9d\u8d56\u6811\u65f6\u66ff\u6362\u6216\u7ea6\u675f\u5339\u914d\u7684\u4f20\u9012\u4f9d\u8d56\u3002\n3. \u5bf9 `@babel/runtime` \u4f7f\u7528 `>=7.24.1` \u540e\uff0c7.24.0 \u4e0d\u6ee1\u8db3\u7ea6\u675f\uff0c\u4e0d\u80fd\u6210\u4e3a\u6700\u7ec8\u89e3\u6790\u7248\u672c\u3002\n4. \u4f9d\u8d56\u65b9\u4ecd\u4ee5\u539f\u65b9\u5f0f\u5f15\u7528 Babel runtime\uff1b\u6539\u53d8\u7684\u662f\u5b89\u88c5\u4ea7\u7269\u4e2d\u7684\u7248\u672c\u9009\u62e9\uff0c\u800c\u4e0d\u662f\u5e94\u7528\u4ee3\u7801\u7684\u8c03\u7528\u8def\u5f84\u3002\n\n\u8fd9\u79cd\u65b9\u5f0f\u9002\u5408\u5904\u7406\u4f20\u9012\u4f9d\u8d56\u6f0f\u6d1e\uff0c\u56e0\u4e3a\u65e0\u9700\u7b49\u5f85\u6bcf\u4e00\u4e2a\u4e0a\u6e38\u5305\u66f4\u65b0\u81ea\u5df1\u7684\u4f9d\u8d56\u58f0\u660e\u3002\u4e0d\u8fc7\uff0c\u771f\u6b63\u5b89\u88c5\u5230\u7684\u5177\u4f53\u7248\u672c\u4ecd\u7531 npm\u3001\u6ce8\u518c\u8868\u53ef\u7528\u7248\u672c\u3001\u5176\u4ed6\u7248\u672c\u7ea6\u675f\u4ee5\u53ca\u9501\u6587\u4ef6\u5171\u540c\u51b3\u5b9a\u3002\n\n## \u5f71\u54cd\u5206\u6790\n\n**\u5b89\u5168\u5f71\u54cd\uff1a** \u9884\u671f\u6d88\u9664\u8fd9 7 \u4e2a npm \u5b89\u88c5\u5165\u53e3\u89e3\u6790\u5230 `@babel/runtime` 7.24.0 \u7684\u60c5\u51b5\uff0c\u4ece\u4f9d\u8d56\u5c42\u9762\u7f13\u89e3 CVE-2025-27789\u3002\n\n**\u6784\u5efa\u4e0e\u5b89\u88c5\u5f71\u54cd\uff1a** \u540e\u7eed\u6267\u884c npm \u5b89\u88c5\u65f6\uff0c\u4f9d\u8d56\u6811\u53ef\u80fd\u53d1\u751f\u53d8\u5316\uff0c\u5e76\u4e0b\u8f7d 7.24.1 \u6216\u66f4\u9ad8\u7248\u672c\u3002\u82e5\u7f13\u5b58\u6216\u65e2\u6709 `node_modules` \u672a\u91cd\u65b0\u5b89\u88c5\uff0c\u8986\u76d6\u89c4\u5219\u4e0d\u4f1a\u81ea\u52a8\u6539\u5199\u5df2\u7ecf\u843d\u76d8\u7684\u65e7\u4f9d\u8d56\u3002\n\n**\u8fd0\u884c\u65f6\u5f71\u54cd\uff1a** \u6570\u636e\u5305\u4e2d\u7684\u5dee\u5f02\u6ca1\u6709\u4fee\u6539\u6e90\u4ee3\u7801\u3001\u8c03\u7528\u63a5\u53e3\u6216\u914d\u7f6e\u884c\u4e3a\uff0c\u56e0\u6b64\u6ca1\u6709\u76f4\u63a5\u7684\u4e1a\u52a1\u903b\u8f91\u53d8\u5316\u3002PR \u63cf\u8ff0\u79f0\u201c\u4e0d\u5f71\u54cd\u8fd0\u884c\u65f6\u884c\u4e3a\u201d\uff0c\u4f46\u6570\u636e\u5305\u672a\u5305\u542b\u6784\u5efa\u4ea7\u7269\u6216\u8fd0\u884c\u6d4b\u8bd5\u7ed3\u679c\u6765\u72ec\u7acb\u8bc1\u660e\u8fd9\u4e00\u70b9\u3002\n\n**\u7ef4\u62a4\u5f71\u54cd\uff1a** \u89c4\u5219\u88ab\u590d\u5236\u5230 7 \u4e2a\u5305\u4e2d\u3002\u8fd9\u6837\u53ef\u8986\u76d6\u72ec\u7acb\u5b89\u88c5\u5165\u53e3\uff0c\u4f46\u672a\u6765\u8c03\u6574\u5b89\u5168\u4e0b\u9650\u65f6\u9700\u8981\u540c\u6b65\u7ef4\u62a4\u6240\u6709\u4f4d\u7f6e\u3002\n\n## \u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\n\n| \u98ce\u9669/\u5173\u6ce8\u70b9 | \u5177\u4f53\u8bf4\u660e |\n|---|---|\n| npm \u7248\u672c\u517c\u5bb9\u6027 | `overrides` \u4f9d\u8d56 npm \u5ba2\u6237\u7aef\u652f\u6301\u3002\u4f7f\u7528\u4e0d\u652f\u6301\u8be5\u5b57\u6bb5\u7684\u65e7\u7248 npm \u65f6\uff0c\u89c4\u5219\u53ef\u80fd\u65e0\u6cd5\u751f\u6548\u6216\u5b89\u88c5\u884c\u4e3a\u53ef\u80fd\u4e0d\u7b26\u5408\u9884\u671f\uff1b\u6570\u636e\u5305\u672a\u63d0\u4f9b CI/\u5f00\u53d1\u73af\u5883\u7684 npm \u7248\u672c\u3002 |\n| \u5f00\u653e\u5f0f\u7248\u672c\u4e0a\u9650 | `>=7.24.1` \u6ca1\u6709\u4e0a\u9650\uff0c\u4f1a\u5141\u8bb8\u5c06\u6765\u7684\u66f4\u9ad8\u7248\u672c\u3002\u867d\u7136 `@babel/runtime` \u901a\u5e38\u9075\u5faa\u8bed\u4e49\u5316\u7248\u672c\uff0c\u4f46\u672a\u6765\u5927\u7248\u672c\u4ecd\u53ef\u80fd\u5e26\u6765\u517c\u5bb9\u6027\u53d8\u5316\uff1b\u56fa\u5b9a\u7248\u672c\u6216\u9650\u5b9a\u4e3b\u7248\u672c\u53ef\u964d\u4f4e\u6f02\u79fb\uff0c\u4f46\u4f1a\u589e\u52a0\u7ef4\u62a4\u6210\u672c\u3002 |\n| \u9501\u6587\u4ef6\u672a\u968f PR \u66f4\u65b0 | 7 \u4e2a\u5dee\u5f02\u5747\u4e3a `package.json`\uff0c\u6570\u636e\u5305\u4e2d\u6ca1\u6709\u5bf9\u5e94\u9501\u6587\u4ef6\u53d8\u66f4\u3002\u56e0\u6b64\u65e0\u6cd5\u4ece\u672c\u6b21\u5dee\u5f02\u786e\u8ba4\u6700\u7ec8\u89e3\u6790\u51fa\u7684\u786e\u5207\u7248\u672c\uff0c\u4e5f\u65e0\u6cd5\u786e\u8ba4\u73b0\u6709\u9501\u5b9a\u7ed3\u679c\u662f\u5426\u5df2\u5237\u65b0\u3002 |\n| \u591a\u5305\u8986\u76d6\u9057\u6f0f | PR \u8986\u76d6\u4e86\u6570\u636e\u5305\u5217\u51fa\u7684 7 \u4e2a\u76f8\u5173\u5305\uff0c\u4f46\u6570\u636e\u5305\u6ca1\u6709\u63d0\u4f9b\u4ed3\u5e93\u5168\u91cf\u4f9d\u8d56\u626b\u63cf\u7ed3\u679c\uff0c\u4e0d\u80fd\u636e\u6b64\u65ad\u8a00\u4ed3\u5e93\u4e2d\u4e0d\u5b58\u5728\u5176\u4ed6\u4f1a\u5f15\u5165 7.24.0 \u7684 npm \u5305\u3002 |\n| \u4e0a\u6e38\u4f9d\u8d56\u517c\u5bb9\u6027 | \u5f3a\u5236\u63d0\u5347\u4f20\u9012\u4f9d\u8d56\u53ef\u80fd\u4e0e\u67d0\u4e2a\u4e0a\u6e38\u5305\u7684\u9690\u542b\u5047\u8bbe\u4e0d\u4e00\u81f4\u3002\u9700\u8981\u901a\u8fc7\u5b89\u88c5\u3001\u6784\u5efa\u53ca\u76f8\u5173\u6269\u5c55\u6d4b\u8bd5\u786e\u8ba4\uff0c\u800c\u4e0d\u80fd\u53ea\u4f9d\u8d56 JSON \u8bed\u6cd5\u6b63\u786e\u6027\u3002 |\n| \u73af\u5883\u4e0e\u7f13\u5b58 | \u4f7f\u7528\u65e7 lockfile\u3001\u79bb\u7ebf\u7f13\u5b58\u6216\u672a\u6e05\u7406\u7684 `node_modules` \u65f6\uff0c\u5b89\u5168\u626b\u63cf\u7ed3\u679c\u53ef\u80fd\u4e0d\u4f1a\u7acb\u5373\u53cd\u6620\u65b0\u89c4\u5219\uff0c\u9700\u8981\u786e\u4fdd\u5b9e\u9645\u5b89\u88c5\u6d41\u7a0b\u91cd\u65b0\u89e3\u6790\u4f9d\u8d56\u3002 |\n\n## \u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u60c5\u51b5\n\nPR \u63cf\u8ff0\u4ec5\u8bf4\u660e\u8be5\u53d8\u66f4\u201c\u53ea\u5f71\u54cd npm install \u65f6\u7684\u5305\u89e3\u6790\u201d\u4e14\u201c\u65e0\u8fd0\u884c\u65f6\u884c\u4e3a\u5f71\u54cd\u201d\u3002\u6570\u636e\u5305\u6ca1\u6709\u63d0\u4f9b\u5b9e\u9645\u6267\u884c\u8fc7\u7684\u547d\u4ee4\u3001CI \u6784\u5efa\u7ed3\u679c\u3001\u5355\u5143\u6d4b\u8bd5\u7ed3\u679c\u3001\u5b89\u88c5\u65e5\u5fd7\u6216\u7ec4\u4ef6\u6cbb\u7406\u590d\u626b\u7ed3\u679c\uff0c\u56e0\u6b64\u4e0d\u80fd\u58f0\u79f0\u8fd9\u4e9b\u9a8c\u8bc1\u5df2\u7ecf\u5b8c\u6210\u3002\n\n\u5efa\u8bae\u81f3\u5c11\u9a8c\u8bc1\uff1a\n\n1. \u5728\u4ed3\u5e93\u89c4\u5b9a\u7684 npm \u7248\u672c\u4e0b\uff0c\u5bf9 7 \u4e2a\u5305\u6267\u884c\u5bf9\u5e94\u7684\u5e72\u51c0\u4f9d\u8d56\u5b89\u88c5\uff0c\u786e\u8ba4 `overrides` \u88ab\u8bc6\u522b\u4e14\u5b89\u88c5\u6210\u529f\u3002\n2. \u4f7f\u7528 `npm ls @babel/runtime` \u6216\u7b49\u6548\u7684\u9501\u6587\u4ef6/\u4f9d\u8d56\u6811\u68c0\u67e5\uff0c\u786e\u8ba4\u4e0d\u5b58\u5728 7.24.0\uff0c\u4e14\u6240\u6709\u89e3\u6790\u7248\u672c\u5747\u6ee1\u8db3 `>=7.24.1`\u3002\n3. \u8fd0\u884c\u8fd9\u4e9b\u6269\u5c55\u548c Lobby \u670d\u52a1\u5df2\u6709\u7684\u6700\u5c0f\u6784\u5efa\u53ca\u6d4b\u8bd5\u96c6\u5408\uff0c\u91cd\u70b9\u6392\u67e5 Babel helper\u3001\u6253\u5305\u548c\u542f\u52a8\u9636\u6bb5\u7684\u517c\u5bb9\u6027\u95ee\u9898\u3002\n4. \u91cd\u65b0\u8fd0\u884c\u89e6\u53d1\u8be5 PR \u7684\u7ec4\u4ef6\u6cbb\u7406\u6216\u6f0f\u6d1e\u626b\u63cf\uff0c\u786e\u8ba4 CVE-2025-27789 \u544a\u8b66\u5173\u95ed\u3002\n\n## \u5dee\u5f02\u8986\u76d6\u4e0e\u5206\u6790\u8fb9\u754c\n\n\u6570\u636e\u5305\u58f0\u660e `diffMethod` \u4e3a `git-local`\uff0c\u603b\u5dee\u5f02\u5927\u5c0f\u4e3a 3,411 \u5b57\u8282\uff1bPR \u7684 7 \u4e2a\u53d8\u66f4\u6587\u4ef6\u5747\u5305\u542b\u5dee\u5f02\u5185\u5bb9\uff0c\u6240\u6709\u6587\u4ef6\u7684 `truncated` \u5747\u4e3a `false`\uff0c\u6574\u4f53 `diffTruncated` \u4e5f\u4e3a `false`\uff0c\u4e14\u6ca1\u6709\u5bfc\u51fa\u9519\u8bef\u6216\u8b66\u544a\u3002\u56e0\u6b64\uff0c\u672c\u8bf4\u660e\u8986\u76d6\u4e86\u6570\u636e\u5305\u4e2d\u63d0\u4f9b\u7684\u5168\u90e8 7 \u4e2a\u6587\u4ef6\u5dee\u5f02\u3002\n\n\u4f46\u201c\u5dee\u5f02\u672a\u622a\u65ad\u201d\u53ea\u8868\u793a\u5bfc\u51fa\u7684 PR \u5dee\u5f02\u5b8c\u6574\uff0c\u4e0d\u4ee3\u8868\u6570\u636e\u5305\u5305\u542b\u4ed3\u5e93\u5176\u4ed6\u6587\u4ef6\u7684\u5b8c\u6574\u5185\u5bb9\u3001\u5b89\u88c5\u540e\u7684\u4f9d\u8d56\u6811\u3001\u9501\u6587\u4ef6\u72b6\u6001\u3001CI \u65e5\u5fd7\u6216\u5b89\u5168\u626b\u63cf\u7ed3\u679c\u3002\u4e0a\u8ff0\u7f3a\u5931\u5185\u5bb9\u672a\u88ab\u5f53\u4f5c\u5df2\u5206\u6790\u6216\u5df2\u9a8c\u8bc1\u7684\u4e8b\u5b9e\u3002\n", "creation_timestamp": "2026-09-01T20:22:11.628623Z"}]}