heroic-games-launcher vulnerabilities (openSUSE)
13 vulnerabilities.
heroic-games-launcheropenSUSEelectron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`7.8 Highheroic-games-launcheropenSUSEelectron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`8.2 Highheroic-games-launcheropenSUSEextract-zip unvalidated symlink path traversal8.6 Highheroic-games-launcheropenSUSEshell-quote parse() is quadratic in token count, enabling denial of service8.7 Highheroic-games-launcheropenSUSEws: Memory exhaustion DoS from tiny fragments and data chunks7.5 Highheroic-games-launcheropenSUSExmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion7.5 Highheroic-games-launcheropenSUSEfast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)7.5 Highheroic-games-launcheropenSUSEsimple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE9.8 Criticalheroic-games-launcheropenSUSE@tootallnate/once vulnerable to Incorrect Control Flow Scoping4.8 Mediumheroic-games-launcheropenSUSERollup 4 has Arbitrary File Write via Path Traversal8.8 Highheroic-games-launcheropenSUSEfast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)7.5 Highheroic-games-launcheropenSUSEUncontrolled Resource Consumption in @isaacs/brace-expansion9.2 Criticalheroic-games-launcheropenSUSEReact Router vulnerable to XSS via Open Redirects8.0 High