Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via analyzeRepeatedExtglob in lib/parse.js, which skips single-branch repeated extglob patterns such as +(*) or +(*a). An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.

Affected versions of this package are vulnerable to Arbitrary Code Injection via OutputPHPFilter when the output_format='php' option is used. An attacker can supply SQL text containing unescaped dollar signs, embedding ${expr} or {${expr}} sequences that OutputPHPFilter places inside double-quoted PHP strings, causing arbitrary PHP code to execute when the generated snippet is run.

Affected versions of this package are vulnerable to Arbitrary Code Injection via DynamicRouterControlProducer in the dynamic-router-control component. An attacker can execute a supplied expression with the Camel process’s privileges by sending a subscribe or update control message containing a predicate and expression-language name to a transport routed to a dynamic-router-control endpoint; the compiled predicate is evaluated against exchanges routed through that channel, potentially enabling arbitrary code execution and compromising the application.

Notes

• Reaching the control endpoint requires the attacker to be able to send on a transport whose route forwards messages to it; the endpoint adds no separate authentication or user-interaction requirement.

Workarounds

• Do not forward messages from untrusted or shared transports to a dynamic-router-control endpoint; this prevents untrusted senders from supplying subscription expressions for evaluation.
• If control messages must cross such a transport, authenticate senders and remove the CamelDynamicRouterPredicate and CamelDynamicRouterExpressionLanguage headers, and clear the predicate and expressionLanguage fields from any DynamicRouterControlMessage before it reaches the endpoint. This keeps those expression inputs from being supplied by the message.
• Restrict who can send to transports that feed a dynamic-router-control endpoint; this limits who can reach the vulnerable control path.