Insufficient Verification of Data Authenticity

Summary

arduino/arduino-create-agent is a package to help manage Arduino development. The vulnerability affects the endpoint "/v2/pkgs/tools/installed" in versions prior to 1.3.3-rc3 and 2.0.0-dev and 2.0.0-test. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate his privileges to those of the user running the Arduino Create Agent service via a crafted "HTTP POST" request. Users are advised to upgrade. There are no known workarounds for this issue. This has the same fix as CVE-2023-43801 and CVE-2023-43803.