Description
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
EnergizeLab station-middleware
Default version status: unaffected
1.6.5 to ≤ 1.8.2affected
References
- https://github.com/xn0tsa/your-secrets-are-safe-with-me ↗
- https://takeonme.org/gcves/GCVE-1337-2026-00000000000000110111111111111111110000000000000000000011111100011111111110000000000000000000011111111111111000000000000000000010001/ ↗
- https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab ↗