GHSA-rgvh-4m82-fvjq

Source

https://github.com/advisories/GHSA-rgvh-4m82-fvjq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-rgvh-4m82-fvjq/GHSA-rgvh-4m82-fvjq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rgvh-4m82-fvjq

Aliases

CVE-2025-62782

Published

2025-10-27T20:12:50Z

Modified

2025-10-27T22:32:04Z

Severity

5.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:L/SC:N/SI:L/SA:L CVSS Calculator

Summary

InventoryGui allows item duplication with experimental "Bundle" item in GUIs which use GuiStorageElement

Details

Impact

Any plugin using the GuiStorageElement is impacted when used on a server which allows the (currently experimental) Bundle items.

Patches

Patched with https://github.com/Phoenix616/InventoryGui/commit/00e684bd689ebc60bcb5b83ce4ef3c5a01778494 ("backported" to 1.6.3-SNAPSHOT)

Update to 1.6.4-SNAPSHOT to guarantee that it's included!

Workarounds

Don't enable the experiment "Bundle" items or don't use the GuiStorageElement in GUIs.

References

Original issue: https://github.com/Phoenix616/InventoryGui/issues/51

Database specific

{
    "cwe_ids":  [
        "CWE-837"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-10-27T20:12:50Z",
    "nvd_published_at":  "2025-10-27T21:15:38Z",
    "severity":  "MODERATE"
}

References

Affected packages

Maven / de.themoep:inventorygui

Package

Name: de.themoep:inventorygui; View open source insights on deps.dev
Purl: pkg:maven/de.themoep/inventorygui

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.6.4-SNAPSHOT

Database specific

last_known_affected_version_range

"<= 1.6.3-SNAPSHOT"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-rgvh-4m82-fvjq/GHSA-rgvh-4m82-fvjq.json"