GHSA-rgvh-4m82-fvjqMedium
InventoryGui allows item duplication with experimental "Bundle" item in GUIs which use GuiStorageElement
🔗 CVE IDs covered (1)
📋 Description
Impact
Any plugin using the GuiStorageElement is impacted when used on a server which allows the (currently experimental) Bundle items.
Patches
Patched with https://github.com/Phoenix616/InventoryGui/commit/00e684bd689ebc60bcb5b83ce4ef3c5a01778494 ("backported" to 1.6.3-SNAPSHOT)
Update to 1.6.4-SNAPSHOT to guarantee that it's included!
Workarounds
Don't enable the experiment "Bundle" items or don't use the GuiStorageElement in GUIs.
References
Original issue: https://github.com/Phoenix616/InventoryGui/issues/51
🎯 Affected products1
- maven/de.themoep:inventorygui:<= 1.6.3-SNAPSHOT
🔗 References (5)
- https://github.com/Phoenix616/InventoryGui/security/advisories/GHSA-rgvh-4m82-fvjq
- https://github.com/Phoenix616/InventoryGui/issues/51
- https://github.com/Phoenix616/InventoryGui/commit/00e684bd689ebc60bcb5b83ce4ef3c5a01778494
- https://nvd.nist.gov/vuln/detail/CVE-2025-62782
- https://github.com/advisories/GHSA-rgvh-4m82-fvjq