Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

islandora/crayfish

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.8PackagistPublished

    Crayfish allows Remote Code Execution via Homarus Authorization header

    CVE-2025-25286 · GHSA-mm6v-68qp-f9fw

    Affected
    • Packagist islandora/crayfish < 4.1.0
    Fixed in
    4.1.0· Vendor fix available
    Issue
    Impact Remote code execution may be possible in web-accessible installations of Homarus in certain configurations. Patches The issue has been patched in islandora/crayfish:4.1.0 Workarounds The exploit requires making a request against the Homarus's /convert endpoint; therefore, the ability to exploit is much reduced if the microservice is not directly accessible from the Internet, so: Prevent general access from the Internet from hitting Homarus. Configure auth in Crayfish to be more strongly required, such that requests with Authorization headers that do not validate are rejected before the problematic CLI interpolation occurs. References - XBOW-024-071

    Recommended action: Upgrade to 4.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →