GHSA-598q-jw82-5w66

Suggest an improvement
Source
https://github.com/advisories/GHSA-598q-jw82-5w66
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-598q-jw82-5w66/GHSA-598q-jw82-5w66.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-598q-jw82-5w66
Aliases
Published
2025-10-27T20:12:31Z
Modified
2025-10-27T22:31:55Z
Severity
  • 5.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N CVSS Calculator
Summary
InventoryGui affected by item duplication in GUIs which use GuiStorageElement
Details

Impact

Any plugin using the GuiStorageElement is impacted.

Patches

Patched with https://github.com/Phoenix616/InventoryGui/commit/27a52ef6d934a1c232e110e0010e4aa810c27029 ("backported" to 1.6.1-SNAPSHOT) Update to 1.6.2-SNAPSHOT to guarantee that it's included!

Workarounds

Don't use the GuiStorageElement in GUIs.

References

Original issue: https://github.com/Phoenix616/InventoryGui/issues/48

Database specific 
{
    "cwe_ids":  [
        "CWE-754",
        "CWE-837"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-10-27T20:12:31Z",
    "nvd_published_at":  "2025-10-27T21:15:38Z",
    "severity":  "MODERATE"
}
References

Affected packages

Maven / de.themoep:inventorygui

Package

Name
de.themoep:inventorygui
View open source insights on deps.dev
Purl
pkg:maven/de.themoep/inventorygui

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.6.2-SNAPSHOT

Database specific

last_known_affected_version_range 
"<= 1.6.1-SNAPSHOT"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-598q-jw82-5w66/GHSA-598q-jw82-5w66.json"