GHSA-5www-2x9c-mgr6: 
JavaScript vulnerability analysis and mitigation

pineforge-codegen translates Pine v6 scripts into C++. In affected releases, two emission paths could write a name taken from the input script into the generated C++ without passing the codegen's name allocator, string escaper or a codegen-owned table: (1) a call to a function the codegen has no lowering for was written out as C++ call text instead of being refused; (2) a token in a type position was not checked against the type grammar before being written out as a C++ type name. A crafted Pine script could therefore make the generated program contain C++ calls or type names that the codegen never chose. Because the consumer chain compiles and runs the generated C++, this can affect the confidentiality, integrity and availability of the host that builds or runs it. Affected: pineforge-codegen on PyPI, versions >= 0.6.4 and < 1.6.3, and @pineforge/codegen-pyodide on npm, versions >= 0.7.0 and < 1.6.3, which ships the same Python sources. Images of ghcr.io/pineforge-4pass/pineforge-release before 1.6.3 contain an affected codegen. Fixed: in 1.6.3 of both packages, by commit 041889818e2206fdf7261574128064fb0b4142ad in pineforge-codegen-oss, released in 1.6.3. The 1.6.3 image of ghcr.io/pineforge-4pass/pineforge-release contains the fixed codegen. The generated C++ is no longer written from the script's names on these two paths. Upgrade: install pineforge-codegen 1.6.3 or later (pip install --upgrade "pineforge-codegen>=1.6.3"), @pineforge/codegen-pyodide 1.6.3 or later, or the 1.6.3 image. Generated C++ that was produced by an affected release from a script you do not trust should be treated as untrusted: regenerate it with 1.6.3 before compiling or running it. Mitigation if you cannot upgrade yet: do not compile or run C++ generated from a script you would not trust. From 1.6.2-rc.1 the package ships the pf-cpp-allowlist command, which flags dangerous primitives in a generated translation unit; it is a denylist with known false positives, a mitigation and not proof that a unit is safe. This advisory deliberately contains no reproduction recipe.