← Back to Security Research Portal (ccsimplyspolit.github.io)

GHSA-hw42-92fr-x9vc: STEP Record Injection via Unvalidated Typed-Value Type Names in the STEP Mutation Writer (LTplus-AG/ifc-lite)

[PUBLISHED BY VENDOR • FIXED IN @ifc-lite/export@4.13.1 & ifc-lite-export@27.0.0]
Reported to LTplus-AG/ifc-lite and officially published as GHSA-hw42-92fr-x9vc by maintainer Louis True (@louistrue) on 2026-10-29 with accepted finder credit to @ccsimplyspolit.

0x00 // GitHub Security Advisory & Remediation Metadata

{
  "ghsa_id": "GHSA-hw42-92fr-x9vc",
  "repository": "LTplus-AG/ifc-lite",
  "packages": ["npm:@ifc-lite/export", "cargo:ifc-lite-export"],
  "html_url": "https://github.com/LTplus-AG/ifc-lite/security/advisories/GHSA-hw42-92fr-x9vc",
  "state": "published",
  "published_at": "2026-10-29",
  "patched_versions": ["@ifc-lite/export@4.13.1", "ifc-lite-export@27.0.0"],
  "summary": "STEP record injection via unvalidated typed-value type names in the STEP mutation writer",
  "severity": "moderate",
  "credits": [
    {
      "login": "ccsimplyspolit",
      "type": "finder",
      "state": "accepted"
    }
  ],
  "cwe_ids": [
    "CWE-74"
  ]
}