Security announcements for Volto and ClassicUI

This is a multi-part message in MIME format.
--===============2403190268004258501==
Content-Type: multipart/alternative;
 boundary="------------Sf7hZsUxjsqqcYwLUfhBIyuc"
Content-Language: en-GB

This is a multi-part message in MIME format.
--------------Sf7hZsUxjsqqcYwLUfhBIyuc
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

This message contains two security announcements.
One is from 2025-08-28 about Volto security releases.
One is from 2025-09-09 with a warning about a NodeJS security incident.
Sorry, we have not been keeing this announcement list up to date, 
posting more on the community.plone.org forum and the plone.org website.
This announcement list is on our radar again.


  Volto security releases, 2025-08-08

Text copied from plone.org advisory:
https://plone.org/security/announcements/plone-security-advisory-20250828

On behalf of the Plone Zope Security Team and the Volto team, I announce 
security releases for Volto, due to the following vulnerability.


    Impact

When visiting a specific URL, an anonymous user could cause the NodeJS 
server part of Volto to quit with an error.


    Patches

The problem has been patched and the patch has been backported to Volto 
major versions down until 16. It is advised to upgrade to the latest 
patch release of your respective current major version:

  * Volto 16: 16.34.0, https://github.com/plone/volto/releases/tag/16.34.0
  * Volto 17: 17.22.1, https://github.com/plone/volto/releases/tag/17.22.1
  * Volto 18: 18.24.0, https://github.com/plone/volto/releases/tag/18.24.0
  * Volto 19: 19.0.0-alpha4,
    https://github.com/plone/volto/releases/tag/19.0.0-alpha.4


    Workarounds

Make sure your setup automatically restarts processes that quit with an 
error. This won't prevent a crash, but it minimises downtime.


    Report

The problem was discovered by FHNW, a client of Plone provider 
kitconcept, who shared it with the Plone Zope Security Team 
(security-z4DKO/[email protected]).


    Github Advisory

The same information was published to GitHub in this advisory:
https://github.com/plone/volto/security/advisories/GHSA-xjhf-7833-3pm5


  Volto/ClassicUI security advisory, 2025-09-09 (dependencies)

Text copied from plone.org advisory:
https://plone.org/security/announcements/plone-security-advisory-20250909


    What happened?

It has come to our attention that there has a security incident 
affecting multiple npm packages under ownership of npm user ~qix 
(https://www.npmjs.com/~qix). An attacker was able to gain control over 
the packages for a short period of time and injected code aimed at 
stealing login credentials and reroute crypto currency transaction into 
different wallets. For more information on the details see this blogpost 
on aikido.dev: 
https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised. 
The affected packages are:

  * backslash
  * chalk-template
  * supports-hyperlinks
  * has-ansi
  * simple-swizzle
  * color-string
  * error-ex
  * color-name
  * is-arrayish
  * slice-ansi
  * color-convert
  * wrap-ansi
  * ansi-regex
  * supports-color
  * strip-ansi
  * chalk
  * debug
  * ansi-style


    How does it affect Plone?

For the Plone ecosystem the incident should have only very limited 
affect as in the volto core of the affected packages only the debug 
package <https://www.npmjs.com/package/debug> is actually used for 
actual builds. This is pinned to an unaffected version 
<https://github.com/plone/volto/blob/67b754385fd9ceecf37b26b8e79cf17ccda4f255/packages/volto/package.json#L189>. 
All other compromised packages are not used in the Volto core.

ClassicUI also uses some of the packages, but they are unaffected 
versions. So in released packages related to ClassicUI (patternslib, 
mockup, plone.staticresources) there is no problem, same as for Volto.


    What actions do I have to take?

In most cases none. But we still advise you to clean caches and 
node_modules, and install again in dev machines, or rebuild deployments.
If you maintain one or more frontend addons we advise you to check if 
you use any of the affected dependencies, especially without a version 
pin. If you do, pin the package to a version and realease an update of 
your addon.

Kind regards,

Maurits van Rees
Plone/Zope Security Team














--------------Sf7hZsUxjsqqcYwLUfhBIyuc
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="content-type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <p>This message contains two security announcements.<br>
      One is from 2025-08-28 about Volto security releases.<br>
      One is from 2025-09-09 with a warning about a NodeJS security
      incident.<br>
      Sorry, we have not been keeing this announcement list up to date,
      posting more on the community.plone.org forum and the plone.org
      website.<br>
      This announcement list is on our radar again.</p>
    <h1>Volto security releases, 2025-08-08</h1>
    <p>Text copied from plone.org advisory:<br>
      <a class="moz-txt-link-freetext"
href="https://plone.org/security/announcements/plone-security-advisory-20250828">https://plone.org/security/announcements/plone-security-advisory-20250828</a></p>
    <p>On behalf of the Plone Zope Security Team and the Volto team, I
      announce security releases for Volto, due to the following
      vulnerability.</p>
    <h2>Impact</h2>
    <p>When visiting a specific URL, an anonymous user could cause the
      NodeJS server part of Volto to quit with an error.</p>
    <h2>Patches</h2>
    <p>The problem has been patched and the patch has been backported to
      Volto major versions down until 16. It is advised to upgrade to
      the latest patch release of your respective current major version:</p>
    <ul>
      <li>Volto 16: 16.34.0, <a class="moz-txt-link-freetext"
          href="https://github.com/plone/volto/releases/tag/16.34.0">https://github.com/plone/volto/releases/tag/16.34.0</a></li>
      <li>Volto 17: 17.22.1, <a class="moz-txt-link-freetext"
          href="https://github.com/plone/volto/releases/tag/17.22.1">https://github.com/plone/volto/releases/tag/17.22.1</a></li>
      <li>Volto 18: 18.24.0, <a class="moz-txt-link-freetext"
          href="https://github.com/plone/volto/releases/tag/18.24.0">https://github.com/plone/volto/releases/tag/18.24.0</a></li>
      <li>Volto 19: 19.0.0-alpha4, <a class="moz-txt-link-freetext"
href="https://github.com/plone/volto/releases/tag/19.0.0-alpha.4">https://github.com/plone/volto/releases/tag/19.0.0-alpha.4</a></li>
    </ul>
    <h2>Workarounds</h2>
    <p>Make sure your setup automatically restarts processes that quit
      with an error. This won't prevent a crash, but it minimises
      downtime.</p>
    <h2>Report</h2>
    <p>The problem was discovered by FHNW, a client of Plone provider
      kitconcept, who shared it with the Plone Zope Security Team (<a
        class="moz-txt-link-abbreviated moz-txt-link-freetext"
        href="mailto:security-z4DKO/[email protected]">security-z4DKO/[email protected]</a>).</p>
    <h2>Github Advisory</h2>
    <p>The same information was published to GitHub in this advisory:<br>
      <a class="moz-txt-link-freetext"
href="https://github.com/plone/volto/security/advisories/GHSA-xjhf-7833-3pm5">https://github.com/plone/volto/security/advisories/GHSA-xjhf-7833-3pm5</a></p>
    <h1>Volto/ClassicUI security advisory, 2025-09-09 (dependencies)</h1>
    <p>Text copied from plone.org advisory:<br>
      <a class="moz-txt-link-freetext"
href="https://plone.org/security/announcements/plone-security-advisory-20250909">https://plone.org/security/announcements/plone-security-advisory-20250909</a></p>
    <h2>What happened?</h2>
    <p>It has come to our attention that there has a security incident
      affecting multiple npm packages under ownership of npm user ~qix (<a
        class="moz-txt-link-freetext" href="https://www.npmjs.com/~qix">https://www.npmjs.com/~qix</a>).
      An attacker was able to gain control over the packages for a short
      period of time and injected code aimed at stealing login
      credentials and reroute crypto currency transaction into different
      wallets. For more information on the details see this blogpost on
      aikido.dev: <a class="moz-txt-link-freetext"
href="https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised">https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised</a>.
      The affected packages are:</p>
    <ul>
      <li>backslash</li>
      <li>chalk-template</li>
      <li>supports-hyperlinks</li>
      <li>has-ansi</li>
      <li>simple-swizzle</li>
      <li>color-string</li>
      <li>error-ex</li>
      <li>color-name</li>
      <li>is-arrayish</li>
      <li>slice-ansi</li>
      <li>color-convert</li>
      <li>wrap-ansi</li>
      <li>ansi-regex</li>
      <li>supports-color</li>
      <li>strip-ansi</li>
      <li>chalk</li>
      <li>debug</li>
      <li>ansi-style</li>
    </ul>
    <h2>How does it affect Plone?</h2>
    <p>For the Plone ecosystem the incident should have only very
      limited affect as in the volto core of the affected packages only
      the <a moz-do-not-send="true"
        href="https://www.npmjs.com/package/debug">debug package</a> is
      actually used for actual builds. This is <a moz-do-not-send="true"
href="https://github.com/plone/volto/blob/67b754385fd9ceecf37b26b8e79cf17ccda4f255/packages/volto/package.json#L189">pinned
        to an unaffected version</a>. All other compromised packages are
      not used in the Volto core.</p>
    <p>ClassicUI also uses some of the packages, but they are unaffected
      versions. So in released packages related to ClassicUI
      (patternslib, mockup, plone.staticresources) there is no problem,
      same as for Volto.</p>
    <h2>What actions do I have to take?</h2>
    <p>In most cases none. But we still advise you to clean caches and
      node_modules, and install again in dev machines, or rebuild
      deployments.<br>
      If you maintain one or more frontend addons we advise you to check
      if you use any of the affected dependencies, especially without a
      version pin. If you do, pin the package to a version and realease
      an update of your addon.</p>
    <p>Kind regards,</p>
    <p>Maurits van Rees<br>
      Plone/Zope Security Team</p>
    <p><br>
    </p>
    <p><br>
    </p>
    <p><br>
    </p>
    <p><br>
    </p>
    <p><br>
    </p>
    <p><br>
    </p>
    <p><br>
    </p>
    <p><br>
    </p>
    <p><br>
    </p>
    <p><br>
    </p>
    <p><br>
    </p>
    <p><br>
    </p>
    <p><br>
    </p>
  </body>
</html>

--------------Sf7hZsUxjsqqcYwLUfhBIyuc--


--===============2403190268004258501==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============2403190268004258501==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________

Plone-Announce mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/plone-announce
--===============2403190268004258501==--