deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-8p8v-wh79-9r56
Package: Django (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 6.0, < 6.0.3
Patched in: 6.0.3

Summary: Django vulnerable to Uncontrolled Resource Consumption

Details:
An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29.

`URLField.to_python()` in Django calls `urllib.parse.urlsplit()`, which performs NFKC normalization on Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to cause denial of service via large URL inputs containing these characters.

Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.
GitHub Security Advisory: GHSA-p4v8-rw59-93cq
Package: wagtail (PIP)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.3rc1, < 7.3.1
Patched in: 7.3.1

Summary:  Wagtail Vulnerable to Cross-site Scripting in simple_translation admin interface

Details:
### Impact
A stored Cross-site Scripting (XSS) vulnerability exists on confirmation messages within the `wagtail.contrib.simple_translation` module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

### Patches
Patched versions have been released as Wagtail 6.3.8, 7.0.6, 7.2.3 and 7.3.1.

### Workarounds
None

### Acknowledgements

Many thanks to Guan Chenxian (@GCXWLP) for reporting this issue.

### For more information

If there are any questions or comments about this advisory:

- Visit Wagtail's [support channels](https://docs.wagtail.io/en/stable/support.html)
- Email Wagtail at [security@wagtail.org](mailto:security@wagtail.org) (view the [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).
GitHub Security Advisory: GHSA-p4v8-rw59-93cq
Package: wagtail (PIP)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.1rc1, < 7.2.3
Patched in: 7.2.3

Summary:  Wagtail Vulnerable to Cross-site Scripting in simple_translation admin interface

Details:
### Impact
A stored Cross-site Scripting (XSS) vulnerability exists on confirmation messages within the `wagtail.contrib.simple_translation` module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

### Patches
Patched versions have been released as Wagtail 6.3.8, 7.0.6, 7.2.3 and 7.3.1.

### Workarounds
None

### Acknowledgements

Many thanks to Guan Chenxian (@GCXWLP) for reporting this issue.

### For more information

If there are any questions or comments about this advisory:

- Visit Wagtail's [support channels](https://docs.wagtail.io/en/stable/support.html)
- Email Wagtail at [security@wagtail.org](mailto:security@wagtail.org) (view the [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).
GitHub Security Advisory: GHSA-p4v8-rw59-93cq
Package: wagtail (PIP)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 6.4rc1, < 7.0.6
Patched in: 7.0.6

Summary:  Wagtail Vulnerable to Cross-site Scripting in simple_translation admin interface

Details:
### Impact
A stored Cross-site Scripting (XSS) vulnerability exists on confirmation messages within the `wagtail.contrib.simple_translation` module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

### Patches
Patched versions have been released as Wagtail 6.3.8, 7.0.6, 7.2.3 and 7.3.1.

### Workarounds
None

### Acknowledgements

Many thanks to Guan Chenxian (@GCXWLP) for reporting this issue.

### For more information

If there are any questions or comments about this advisory:

- Visit Wagtail's [support channels](https://docs.wagtail.io/en/stable/support.html)
- Email Wagtail at [security@wagtail.org](mailto:security@wagtail.org) (view the [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).
GitHub Security Advisory: GHSA-p4v8-rw59-93cq
Package: wagtail (PIP)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 6.3.8
Patched in: 6.3.8

Summary:  Wagtail Vulnerable to Cross-site Scripting in simple_translation admin interface

Details:
### Impact
A stored Cross-site Scripting (XSS) vulnerability exists on confirmation messages within the `wagtail.contrib.simple_translation` module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

### Patches
Patched versions have been released as Wagtail 6.3.8, 7.0.6, 7.2.3 and 7.3.1.

### Workarounds
None

### Acknowledgements

Many thanks to Guan Chenxian (@GCXWLP) for reporting this issue.

### For more information

If there are any questions or comments about this advisory:

- Visit Wagtail's [support channels](https://docs.wagtail.io/en/stable/support.html)
- Email Wagtail at [security@wagtail.org](mailto:security@wagtail.org) (view the [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).
GitHub Security Advisory: GHSA-p5cm-246w-84jm
Package: wagtail (PIP)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.3rc1, < 7.3.1
Patched in: 7.3.1

Summary: Wagtail Vulnerable to Cross-site Scripting in TableBlock class attributes

Details:
### Impact
A stored Cross-site Scripting (XSS) vulnerability exists on rendering `TableBlock` blocks within a StreamField. A user with access to create or edit pages containing `TableBlock` StreamField blocks is able to set specially-crafted `class` attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock.

### Patches
Patched versions have been released as Wagtail 6.3.8, 7.0.6, 7.2.3 and 7.3.1.

### Workarounds
Site owners who are unable to upgrade to the new versions can remediate the vulnerability by setting a `template` attribute on all TableBlock definitions, referencing a template that does not output `class` attributes. For example:

```django
<!-- For use with TableBlock(template="path/to/table_block.html") -->
<table>
    {% if table_caption %}
        <caption>{{ table_caption }}</caption>
    {% endif %}
    {% if table_header %}
        <thead>
            <tr>
                {% for cell in table_header %}
                    <th scope="col">{{ cell }}</th>
                {% endfor %}
            </tr>
        </thead>
    {% endif %}
    <tbody>
        {% for row in data %}
            <tr>
                {% for cell in row %}
                    {% if first_col_is_header and forloop.first %}
                        <th scope="row">{{ cell }}</th>
                    {% else %}
                        <td>{{ cell }}</td>
                    {% endif %}
                {% endfor %}
            </tr>
        {% endfor %}
    </tbody>
</table>
```

### Acknowledgements

Many thanks to Guan Chenxian (@GCXWLP) for reporting this issue.

### For more information

If there are any questions or comments about this advisory:

- Visit Wagtail's [support channels](https://docs.wagtail.io/en/stable/support.html)
- Email Wagtail at [security@wagtail.org](mailto:security@wagtail.org) (view the [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).
GitHub Security Advisory: GHSA-p5cm-246w-84jm
Package: wagtail (PIP)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.1rc1, < 7.2.3
Patched in: 7.2.3

Summary: Wagtail Vulnerable to Cross-site Scripting in TableBlock class attributes

Details:
### Impact
A stored Cross-site Scripting (XSS) vulnerability exists on rendering `TableBlock` blocks within a StreamField. A user with access to create or edit pages containing `TableBlock` StreamField blocks is able to set specially-crafted `class` attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock.

### Patches
Patched versions have been released as Wagtail 6.3.8, 7.0.6, 7.2.3 and 7.3.1.

### Workarounds
Site owners who are unable to upgrade to the new versions can remediate the vulnerability by setting a `template` attribute on all TableBlock definitions, referencing a template that does not output `class` attributes. For example:

```django
<!-- For use with TableBlock(template="path/to/table_block.html") -->
<table>
    {% if table_caption %}
        <caption>{{ table_caption }}</caption>
    {% endif %}
    {% if table_header %}
        <thead>
            <tr>
                {% for cell in table_header %}
                    <th scope="col">{{ cell }}</th>
                {% endfor %}
            </tr>
        </thead>
    {% endif %}
    <tbody>
        {% for row in data %}
            <tr>
                {% for cell in row %}
                    {% if first_col_is_header and forloop.first %}
                        <th scope="row">{{ cell }}</th>
                    {% else %}
                        <td>{{ cell }}</td>
                    {% endif %}
                {% endfor %}
            </tr>
        {% endfor %}
    </tbody>
</table>
```

### Acknowledgements

Many thanks to Guan Chenxian (@GCXWLP) for reporting this issue.

### For more information

If there are any questions or comments about this advisory:

- Visit Wagtail's [support channels](https://docs.wagtail.io/en/stable/support.html)
- Email Wagtail at [security@wagtail.org](mailto:security@wagtail.org) (view the [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).
GitHub Security Advisory: GHSA-p5cm-246w-84jm
Package: wagtail (PIP)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 6.4rc1, < 7.0.6
Patched in: 7.0.6

Summary: Wagtail Vulnerable to Cross-site Scripting in TableBlock class attributes

Details:
### Impact
A stored Cross-site Scripting (XSS) vulnerability exists on rendering `TableBlock` blocks within a StreamField. A user with access to create or edit pages containing `TableBlock` StreamField blocks is able to set specially-crafted `class` attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock.

### Patches
Patched versions have been released as Wagtail 6.3.8, 7.0.6, 7.2.3 and 7.3.1.

### Workarounds
Site owners who are unable to upgrade to the new versions can remediate the vulnerability by setting a `template` attribute on all TableBlock definitions, referencing a template that does not output `class` attributes. For example:

```django
<!-- For use with TableBlock(template="path/to/table_block.html") -->
<table>
    {% if table_caption %}
        <caption>{{ table_caption }}</caption>
    {% endif %}
    {% if table_header %}
        <thead>
            <tr>
                {% for cell in table_header %}
                    <th scope="col">{{ cell }}</th>
                {% endfor %}
            </tr>
        </thead>
    {% endif %}
    <tbody>
        {% for row in data %}
            <tr>
                {% for cell in row %}
                    {% if first_col_is_header and forloop.first %}
                        <th scope="row">{{ cell }}</th>
                    {% else %}
                        <td>{{ cell }}</td>
                    {% endif %}
                {% endfor %}
            </tr>
        {% endfor %}
    </tbody>
</table>
```

### Acknowledgements

Many thanks to Guan Chenxian (@GCXWLP) for reporting this issue.

### For more information

If there are any questions or comments about this advisory:

- Visit Wagtail's [support channels](https://docs.wagtail.io/en/stable/support.html)
- Email Wagtail at [security@wagtail.org](mailto:security@wagtail.org) (view the [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).
GitHub Security Advisory: GHSA-p5cm-246w-84jm
Package: wagtail (PIP)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 6.3.8
Patched in: 6.3.8

Summary: Wagtail Vulnerable to Cross-site Scripting in TableBlock class attributes

Details:
### Impact
A stored Cross-site Scripting (XSS) vulnerability exists on rendering `TableBlock` blocks within a StreamField. A user with access to create or edit pages containing `TableBlock` StreamField blocks is able to set specially-crafted `class` attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock.

### Patches
Patched versions have been released as Wagtail 6.3.8, 7.0.6, 7.2.3 and 7.3.1.

### Workarounds
Site owners who are unable to upgrade to the new versions can remediate the vulnerability by setting a `template` attribute on all TableBlock definitions, referencing a template that does not output `class` attributes. For example:

```django
<!-- For use with TableBlock(template="path/to/table_block.html") -->
<table>
    {% if table_caption %}
        <caption>{{ table_caption }}</caption>
    {% endif %}
    {% if table_header %}
        <thead>
            <tr>
                {% for cell in table_header %}
                    <th scope="col">{{ cell }}</th>
                {% endfor %}
            </tr>
        </thead>
    {% endif %}
    <tbody>
        {% for row in data %}
            <tr>
                {% for cell in row %}
                    {% if first_col_is_header and forloop.first %}
                        <th scope="row">{{ cell }}</th>
                    {% else %}
                        <td>{{ cell }}</td>
                    {% endif %}
                {% endfor %}
            </tr>
        {% endfor %}
    </tbody>
</table>
```

### Acknowledgements

Many thanks to Guan Chenxian (@GCXWLP) for reporting this issue.

### For more information

If there are any questions or comments about this advisory:

- Visit Wagtail's [support channels](https://docs.wagtail.io/en/stable/support.html)
- Email Wagtail at [security@wagtail.org](mailto:security@wagtail.org) (view the [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).
GitHub Security Advisory: GHSA-9m86-7pmv-2852
Package: pypdf (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-407: Inefficient Algorithmic Complexity
Vulnerable versions: < 6.7.5
Patched in: 6.7.5

Summary: pypdf vulnerable to inefficient decoding of ASCIIHexDecode streams

Details:
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the `/ASCIIHexDecode` filter.

### Patches
This has been fixed in [pypdf==6.7.5](https://github.com/py-pdf/pypdf/releases/tag/6.7.5).

### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#3666](https://github.com/py-pdf/pypdf/pull/3666).
GitHub Security Advisory: GHSA-vmwq-8g8c-jm79
Package: openchatbi (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 0.2.1
Patched in: 0.2.2

Summary: OpenChatBI has a Path Traversal Vulnerability in save_report Tool

Details:
### Impact
The `save_report` tool in `openchatbi/tool/save_report.py` suffers from a critical path traversal vulnerability due to insufficient input sanitization of the `file_format` parameter. 

The function only removes leading dots of `file_format` using `file_format.lstrip(".")` but allows path traversal sequences like `/../../` to pass through unchanged. When the filename is constructed via string concatenation in 

    f"{timestamp}_{clean_title}.{file_format}"

malicious path sequences are preserved, enabling attackers to write files outside the designated report directory. 

An attacker can manipulate the LLM to call the tool with a specific `file_format` to overwrite critical system files like `__init__.py`, potentially leading to remote code execution.


### Patches
- Affected versions:
<=0.2.1
- Patched versions:
0.2.2 (includes fix from PR #12: https://github.com/zhongyu09/openchatbi/pull/12)

### Workarounds
No

### References
- Issue #10: https://github.com/zhongyu09/openchatbi/issues/10
- PR #12: https://github.com/zhongyu09/openchatbi/pull/12
GitHub Security Advisory: GHSA-59g6-v3vg-f7wc
Package: cocoindex (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 0.3.34
Patched in: 0.3.34

Summary: CocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements

Details:
### Impact
The Doris target connector didn't verify the configured table name before creating some SQL statements (`ALTER TABLE`). So, in the application code, if the table name is provided by an untrusted upstream, it expose vulnerability to SQL injection when target schema change.

### Patches
Yes, it's fixed in cocoindex 0.3.34: we start to validate table names passed to Doris target at entry point and error out immediately if it's not a valid identifier.

### Workarounds
Users should make sure table names used to configure CocoIndex targets are valid, regardless of this fix. Which means

- The table name comes from a trusted source (e.g. for most cases it's just a fixed string literal).
- Even if it comes from an untrusted source (e.g. provided by end user), it should be validated before using it to configure the Doris target for CocoIndex.
GitHub Security Advisory: GHSA-43gx-6gv6-3jcp
Package: Products.isurlinportal (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: < 2.1.0
Patched in: 2.1.0

Summary: Products.isurlinportal has possible open redirect when using more than 2 forward slashes

Details:
### Impact
A url `/login?came_from=////evil.example` may redirect to an external website after login.

Standard Plone is not affected, but if you have customised the login, for example with add-ons, you might be affected. You can try the url to check if you are affected or not.

### Patches
The problem has been patched in `Products.isurlinportal`.

* Plone 6.2: upgrade to `Products.isurlinportal` 4.0.0.
* Plone 6.1: upgrade to `Products.isurlinportal` 3.1.0.
* Plone 6.0: upgrade to `Products.isurlinportal` 2.1.0.
* Older Plone versions don't have security support anymore.

### Workarounds
There are no known workarounds.

### Background
When you are anonymous and land on a page that requires a login, Plone sends you to the login form. After successful login, Plone redirects you back to the page you came from.  Various other forms and pages have a similar system.

This could get abused by an attacker to trick Plone into redirecting to a different website. Plone checks the page that would be redirected to. It is only accepted if it is within the Plone site domain or part of a different trusted domain.

The main check for this is in the `Products.isurlinportal` package. A lot of potentially malicious urls are already safely rejected, but here a loop hole was found.

This was discovered during a penetration test by the CERT-EU Team.
GitHub Security Advisory: GHSA-43gx-6gv6-3jcp
Package: Products.isurlinportal (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 3.0.0, < 3.1.0
Patched in: 3.1.0

Summary: Products.isurlinportal has possible open redirect when using more than 2 forward slashes

Details:
### Impact
A url `/login?came_from=////evil.example` may redirect to an external website after login.

Standard Plone is not affected, but if you have customised the login, for example with add-ons, you might be affected. You can try the url to check if you are affected or not.

### Patches
The problem has been patched in `Products.isurlinportal`.

* Plone 6.2: upgrade to `Products.isurlinportal` 4.0.0.
* Plone 6.1: upgrade to `Products.isurlinportal` 3.1.0.
* Plone 6.0: upgrade to `Products.isurlinportal` 2.1.0.
* Older Plone versions don't have security support anymore.

### Workarounds
There are no known workarounds.

### Background
When you are anonymous and land on a page that requires a login, Plone sends you to the login form. After successful login, Plone redirects you back to the page you came from.  Various other forms and pages have a similar system.

This could get abused by an attacker to trick Plone into redirecting to a different website. Plone checks the page that would be redirected to. It is only accepted if it is within the Plone site domain or part of a different trusted domain.

The main check for this is in the `Products.isurlinportal` package. A lot of potentially malicious urls are already safely rejected, but here a loop hole was found.

This was discovered during a penetration test by the CERT-EU Team.