deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-2p2x-hpg8-cqp2
Package: litestar (PIP)
Severity: HIGH (CVSS 7.4)
CWE: CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains
Vulnerable versions: = 2.19.0
Patched in: 2.20.0

Summary: Litestar's CORS origin allowlist has a bypass due to unescaped regex metacharacters in allowed origins

Details:
### Summary
CORS origin validation can be bypassed because the allowed-origins allowlist is compiled into a regex without escaping metacharacters (notably .). An allowed origin like https://good.example can match https://goodXexample, resulting in Access-Control-Allow-Origin being set for an untrusted origin

### Details
CORSConfig.allowed_origins_regex is constructed using a regex built from configured allowlist values and used with fullmatch() for validation. Because metacharacters are not escaped, a malicious origin can match unexpectedly. The check relies on allowed_origins_regex.fullmatch(origin).

### PoC
Server (poc_cors_server.py)

```
from litestar import Litestar, get
from litestar.config.cors import CORSConfig

@get("/c")
async def c() -> str:
    return "ok"

cors = CORSConfig(
    allow_origins=["https://good.example"],
    allow_credentials=True,
)
app = Litestar([c], cors_config=cors)
```

`uvicorn poc_cors_server:app --host 127.0.0.1 --port 8002`

Client (poc_cors_client.py)

```
import http.client

def req(origin: str) -> tuple[int, str | None]:
    c = http.client.HTTPConnection("127.0.0.1", 8002, timeout=3)
    c.request("GET", "/c", headers={"Origin": origin, "Host": "example.com"})
    r = c.getresponse()
    r.read()
    acao = r.getheader("Access-Control-Allow-Origin")
    c.close()
    return r.status, acao

print("evil:", req("https://evil.example"))
print("bypass:", req("https://goodXexample")) 
```

Expected (vulnerable behavior):

Origin: https://evil.example → no ACAO
Origin: https://goodXexample → ACAO: https://goodxexample/ (bypass)

### Impact
Type: CORS policy bypass (cross-origin data exposure risk)
Who is impacted: apps using CORS allowlists to restrict browser cross-origin reads. If allow_credentials=True and authenticated endpoints return sensitive data, an attacker-controlled site can potentially read responses in a victim’s browser session.
GitHub Security Advisory: GHSA-27jc-jmp8-qfw5
Package: keylime (PIP)
Severity: CRITICAL (CVSS 9.4)
CWE: CWE-322: Key Exchange without Entity Authentication
Vulnerable versions: = 7.13.0
Patched in: 7.13.1

Summary: Duplicate Advisory: Keylime Missing Authentication for Critical Function and Improper Authentication

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-4jqp-9qjv-57m2. This link is maintained to preserve external references.

### Original Description
A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.
GitHub Security Advisory: GHSA-27jc-jmp8-qfw5
Package: keylime (PIP)
Severity: CRITICAL (CVSS 9.4)
CWE: CWE-322: Key Exchange without Entity Authentication
Vulnerable versions: >= 7.12.0, < 7.12.2
Patched in: 7.12.2

Summary: Duplicate Advisory: Keylime Missing Authentication for Critical Function and Improper Authentication

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-4jqp-9qjv-57m2. This link is maintained to preserve external references.

### Original Description
A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.
GitHub Security Advisory: GHSA-4f84-67cv-qrv3
Package: dydx-v4-client (PIP)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-506: Embedded Malicious Code
Vulnerable versions: = 1.1.5.post1
Patched in: 1.1.5

Summary: A single post-release of dydx-v4-client contained obfuscated multi-stage loader

Details:
A PyPI user account compromised by an attacker and was able to upload a malicious version (1.1.5.post1) of the `dydx-v4-client` package. This version contains a highly obfuscated multi-stage loader that ultimately executes malicious code on the host system.

While the final payload is not visible because it is tucked away inside 100 layers of encoding, the structural design—specifically the use of recursive decompression followed by an `exec()` call is a definitive indicator of malicious software, likely a "Crypter" or "Dropper" masquerading as a cryptocurrency-related utility with the intent on connecting to hxxps://dydx[.]priceoracle[.]site/py
to download and execute further payloads.

Users of the `dydx-v4-client` package should immediately uninstall version 1.1.5.post1and revert to the last known good version (1.1.5) or later secure versions once available. Additionally, users should monitor their systems for any unusual activity and consider running security scans to detect any potential compromise.
GitHub Security Advisory: GHSA-vf6j-c56p-cq58
Package: mcp-salesforce-connector (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 0.1.10
Patched in: 0.1.10

Summary: MCP-Salesforce's arbitrary attribute access leads to disclosure of Salesforce auth token

Details:
### Impact
_Disclosure of Salesforce OAuth bearer tokens used by the MCP._

### Patches
_fix applied in 0.1.10_

### Workarounds
_Rotate any Salesforce tokens/credentials used by MCP-Salesforce._
GitHub Security Advisory: GHSA-wjp5-868j-wqv7
Package: pydantic-ai-slim (PIP)
Severity: HIGH (CVSS 7.1)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 1.34.0, < 1.51.0
Patched in: 1.51.0

Summary: Pydantic AI has Stored XSS via Path Traversal in Web UI CDN URL

Details:
## Summary

A Path Traversal vulnerability in the [Pydantic AI web UI](https://ai.pydantic.dev/web/) allows an attacker to serve arbitrary JavaScript in the context of the application by crafting a malicious URL. If a victim clicks the link or visits it via an iframe, attacker-controlled code executes in their browser, enabling theft of chat history and other client-side data.

**This vulnerability only affects applications that use:**
- **`Agent.to_web`** to serve a chat interface
- **`clai web`** to serve a chat interface from the CLI

These are typically run locally (on `localhost`), but may also be deployed on a remote server.

### Description

The web UI serves its frontend HTML by fetching it from a CDN. In affected versions, the CDN URL is constructed using a `version` query parameter from the request URL. This parameter is not validated, allowing path traversal sequences that cause the server to fetch and serve attacker-controlled HTML/JavaScript from an arbitrary source on the same CDN, instead of the legitimate chat UI package.

### Who Is Affected

Projects are affected if your application uses `Agent.to_web` or `clai web` to serve the Pydantic AI chat interface.

### Attack Scenario

1. An attacker crafts a URL pointing to the victim's Pydantic AI web UI instance (either `localhost` with the known port, or a remote server endpoint) with a malicious `version` query parameter containing path traversal sequences.

2. The attacker gets the victim to visit this URL — directly via a link, through a redirect, or by embedding it in an iframe.

3. When the victim's browser loads the page, the server fetches and serves attacker-controlled HTML/JavaScript instead of the legitimate chat UI.

4. The attacker's JavaScript executes in the victim's browser in the context of the Pydantic AI web application, with access to:
   - **Chat history** stored in `localStorage` (all user messages and AI responses)
   - **Session cookies** that are not set as `HttpOnly`, if authentication middleware is configured

## Remediation

### Upgrade to Patched Version

**Upgrade** to the patched version or later. The fix removes the user-controllable `version` parameter entirely. The CDN URL is now hardcoded at startup and cannot be influenced by request parameters.

A new `html_source` parameter is available on `Agent.to_web` and `create_web_app` for applications that need to customize the UI source (e.g., for enterprise environments, offline usage, or custom UI builds). This parameter is only settable in application code, not via query parameters.
GitHub Security Advisory: GHSA-wjp5-868j-wqv7
Package: pydantic-ai (PIP)
Severity: HIGH (CVSS 7.1)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 1.34.0, < 1.51.0
Patched in: 1.51.0

Summary: Pydantic AI has Stored XSS via Path Traversal in Web UI CDN URL

Details:
## Summary

A Path Traversal vulnerability in the [Pydantic AI web UI](https://ai.pydantic.dev/web/) allows an attacker to serve arbitrary JavaScript in the context of the application by crafting a malicious URL. If a victim clicks the link or visits it via an iframe, attacker-controlled code executes in their browser, enabling theft of chat history and other client-side data.

**This vulnerability only affects applications that use:**
- **`Agent.to_web`** to serve a chat interface
- **`clai web`** to serve a chat interface from the CLI

These are typically run locally (on `localhost`), but may also be deployed on a remote server.

### Description

The web UI serves its frontend HTML by fetching it from a CDN. In affected versions, the CDN URL is constructed using a `version` query parameter from the request URL. This parameter is not validated, allowing path traversal sequences that cause the server to fetch and serve attacker-controlled HTML/JavaScript from an arbitrary source on the same CDN, instead of the legitimate chat UI package.

### Who Is Affected

Projects are affected if your application uses `Agent.to_web` or `clai web` to serve the Pydantic AI chat interface.

### Attack Scenario

1. An attacker crafts a URL pointing to the victim's Pydantic AI web UI instance (either `localhost` with the known port, or a remote server endpoint) with a malicious `version` query parameter containing path traversal sequences.

2. The attacker gets the victim to visit this URL — directly via a link, through a redirect, or by embedding it in an iframe.

3. When the victim's browser loads the page, the server fetches and serves attacker-controlled HTML/JavaScript instead of the legitimate chat UI.

4. The attacker's JavaScript executes in the victim's browser in the context of the Pydantic AI web application, with access to:
   - **Chat history** stored in `localStorage` (all user messages and AI responses)
   - **Session cookies** that are not set as `HttpOnly`, if authentication middleware is configured

## Remediation

### Upgrade to Patched Version

**Upgrade** to the patched version or later. The fix removes the user-controllable `version` parameter entirely. The CDN URL is now hardcoded at startup and cannot be influenced by request parameters.

A new `html_source` parameter is available on `Agent.to_web` and `create_web_app` for applications that need to customize the UI source (e.g., for enterprise environments, offline usage, or custom UI builds). This parameter is only settable in application code, not via query parameters.
GitHub Security Advisory: GHSA-2ww3-72rp-wpp4
Package: semantic-kernel (PIP)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 1.39.3
Patched in: 1.39.3

Summary: Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK

Details:
### Impact
_What kind of vulnerability is it? Who is impacted?_
An Arbitrary File Write vulnerability has been identified in Microsoft's Semantic Kernel .NET SDK, specifically within the `SessionsPythonPlugin`.
Developers who have built applications which include Microsoft's Semantic Kernel .NET SDK and are using the `SessionsPythonPlugin`

### Patches
_Has the problem been patched? What versions should users upgrade to?_
The problem has been fixed in [Microsoft.SemanticKernel.Plugins.Core version 1.71.0](https://www.nuget.org/packages/Microsoft.SemanticKernel.Plugins.Core/1.71.0). Users should upgrade to version 1.71.0 or higher.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
Users can create a [Function Invocation Filter](https://learn.microsoft.com/en-us/semantic-kernel/concepts/enterprise-readiness/filters?pivots=programming-language-csharp#function-invocation-filter) which checks the arguments being passed to any calls to `DownloadFileAsync ` or `UploadFileAsync` and ensures the provided `localFilePath` is allow listed.

### References
_Are there any links users can visit to find out more?_
- [Sample showing safe use of the CodeInterpreterPlugin](https://github.com/microsoft/semantic-kernel/blob/main/dotnet/samples/Demos/CodeInterpreterPlugin/Program.cs#L61-L64)
- [PR to Add file upload security controls to SessionsPythonPlugin](https://github.com/microsoft/semantic-kernel/pull/13478/changes#diff-88d3cacba2bfa84eef8f2aa171b34f9940338cbb784a3ffc49f5fe3af1b8943d)
GitHub Security Advisory: GHSA-3p7x-94q9-jq9x
Package: pgadmin4 (PIP)
Severity: HIGH (CVSS 7.4)
CWE: CWE-284: Improper Access Control, CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: < 9.12
Patched in: 9.12

Summary: pgadmin4 affected by a Restore restriction bypass via key disclosure vulnerability

Details:
pgAdmin versions 9.11 are affected by a Restore restriction bypass via key disclosure vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. An attacker with access to the pgAdmin web interface can observe an active restore operation, extract the `\restrict` key in real time, and race the restore process by overwriting the restore script with a payload that re-enables meta-commands using `\unrestrict <key>`. This results in reliable command execution on the pgAdmin host during the restore operation.
GitHub Security Advisory: GHSA-rf8c-3f5p-xv45
Package: web2py (PIP)
Severity: MODERATE (CVSS 4.7)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: < 3.1.1
Patched in: 3.1.1

Summary: web2py has an Open Redirect Vulnerability

Details:
web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an Open Redirect vulnerability. If this vulnerability is exploited, the user may be redirected to an arbitrary website when accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack.
GitHub Security Advisory: GHSA-v82v-c5x8-w282
Package: nicegui (PIP)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 3.6.1
Patched in: 3.7.0

Summary: NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content

Details:
## Description

The `ui.markdown()` component uses the `markdown2` library to convert markdown content to HTML, which is then rendered via `innerHTML`. By default, `markdown2` allows raw HTML to pass through unchanged. This means that if an application renders user-controlled content through `ui.markdown()`, an attacker can inject malicious HTML containing JavaScript event handlers.

Unlike other NiceGUI components that render HTML (`ui.html()`, `ui.chat_message()`, `ui.interactive_image()`), the `ui.markdown()` component does not provide or require a `sanitize` parameter, leaving applications vulnerable to XSS attacks.

## Proof of Concept

```python
from nicegui import ui

# User-controlled input containing malicious payload
user_input = 'Hello! <img src=x onerror="alert(\'XSS\')">'

ui.markdown(user_input)  # XSS executes when page loads

ui.run()
```

When this page loads, the JavaScript in the `onerror` handler executes, potentially allowing an attacker to:
- Steal session cookies or authentication tokens
- Perform actions on behalf of the user
- Redirect users to malicious sites
- Modify page content

## Impact

Applications that render user-provided content through `ui.markdown()` are vulnerable to stored or reflected XSS attacks. This is particularly concerning for:
- Chat applications displaying user messages
- CMS or documentation systems with user-editable content
- Any application that displays markdown from untrusted sources

## Remediation

A release has been published in version 3.7.0.

### For Users (Immediate Workaround)

Until a fix is released, **do not pass untrusted content directly to `ui.markdown()`**. Instead, use one of these approaches:

**Option 1: Convert and sanitize manually using `ui.html()`**

```python
import markdown2
from html_sanitizer import Sanitizer

sanitizer = Sanitizer()

def safe_markdown(content: str) -> None:
    """Render markdown with HTML sanitization."""
    html = markdown2.markdown(content)
    ui.html(sanitizer.sanitize(html), sanitize=False)

# Usage
safe_markdown(user_input)
```

**Option 2: Escape HTML before markdown conversion (if raw HTML not needed)**

```python
import html

# Escape HTML entities - prevents any HTML from being interpreted
ui.markdown(html.escape(user_input))
```

### Proposed Fix

Add a `sanitize` parameter to `ui.markdown()` consistent with other HTML-rendering components, and/or add an `escape_html` parameter.
GitHub Security Advisory: GHSA-7gcm-g887-7qv7
Package: protobuf (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-674: Uncontrolled Recursion
Vulnerable versions: < 5.29.6
Patched in: 5.29.6

Summary: protobuf affected by a JSON recursion depth bypass

Details:
A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.

Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.
GitHub Security Advisory: GHSA-7gcm-g887-7qv7
Package: protobuf (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-674: Uncontrolled Recursion
Vulnerable versions: >= 6.30.0rc1, <= 6.33.4
Patched in: 6.33.5

Summary: protobuf affected by a JSON recursion depth bypass

Details:
A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.

Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.
GitHub Security Advisory: GHSA-74vm-8frp-7w68
Package: epyt-flow (PIP)
Severity: CRITICAL (CVSS 10.0)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 0.16.1
Patched in: 0.16.1

Summary: EPyT-Flow vulnerable to unsafe JSON deserialization (__type__)

Details:
### Impact
EPyT-Flow’s REST API parses attacker-controlled JSON request bodies using a custom deserializer (my_load_from_json) that supports a __type__ field. When __type__ is present, the deserializer dynamically imports an attacker-specified module/class and instantiates it with attacker-supplied arguments. This allows invoking dangerous classes such as subprocess.Popen, which can lead to OS command execution during JSON parsing. This also affects the loading of JSON files.

### Patches
EPyT-Flow  has been patched in 0.16.1 -- affects all versions <= 0.16.0

### Workarounds
Do not load any JSON from untrusted sources and do not expose the REST API.

### Credits
EPyT-Flow  thanks Jarrett Chan (@syphonetic) for detecting and reporting the bug.
GitHub Security Advisory: GHSA-fjm6-8xp2-4fwc
Package: boltz (PIP)
Severity: HIGH (CVSS 8.4)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: <= 2.0.0
Patched in: unpatched

Summary: Boltz contains an insecure deserialization vulnerability in its molecule loading functionality

Details:
Boltz 2.0.0 contains an insecure deserialization vulnerability in its molecule loading functionality. The application uses Python pickle to deserialize molecule data files without validation. An attacker with the ability to place a malicious pickle file in a directory processed by boltz can achieve arbitrary code execution when the file is loaded.
GitHub Security Advisory: GHSA-8x2r-v9x5-3qgh
Package: pdfminer.six (PIP)
Severity: HIGH (CVSS 7.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 20251230
Patched in: 20251230

Summary: Duplicate Advisory: Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc

Details:
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-f83h-ghpp-7wcc. This link is maintained to preserve external references.

## Original Description
pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in a location accessible to the application can trigger arbitrary code execution or privilege escalation when the file is loaded by a trusted process. This is caused by an incomplete patch to CVE-2025-64512.
GitHub Security Advisory: GHSA-6426-9fv3-65x8
Package: Django (PIP)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 4.2a1, < 4.2.28
Patched in: 4.2.28

Summary: Django has an SQL Injection issue

Details:
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

`.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansion, used in `FilteredRelation`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django would like to thank Solomon Kebede for reporting this issue.
GitHub Security Advisory: GHSA-6426-9fv3-65x8
Package: Django (PIP)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 5.2a1, < 5.2.11
Patched in: 5.2.11

Summary: Django has an SQL Injection issue

Details:
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

`.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansion, used in `FilteredRelation`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django would like to thank Solomon Kebede for reporting this issue.