CVE-2024-43788

A DOM Clobbering vulnerability was found in Webpack via `AutoPublicPathRuntimeModule`. DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script through seemingly benign HTML markups in the webpage, for example, through a post or comment, and leverages the gadgets (pieces of JS code) living in the existing javascript code to transform it into executable code. This vulnerability can lead to Cross-site scripting (XSS) on websites that include Webpack-generated files and allow users to inject certain scriptless HTML tags with improperly sanitized name or ID attributes.

This update for pgadmin4 fixes the following issues. Fixed socket.io: unhandled 'error' event. Fixed requirejs: prototype pollution via function config. Fixed requirejs: prototype pollution via function s.contexts._.configure. Fixed axios: server-side request forgery due to requests for path relative URLs being processed as protocol relative URLs in axios. Fixed micromatch: vulnerable to Regular Expression Denial of Service. Fixed braces: fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. Fixed webpack: DOM clobbering gadget in AutoPublicPathRuntimeModule could lead to XSS Fixed elliptic: ECDSA signature verification error due to leading zero may reject legitimate transactions in elliptic. Fixed elliptic: Missing Validation in Elliptic's EDDSA Signature Verification. Fixed OAuth2 issue that could lead to information leak.