deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-5cvj-7rg6-jggj
Package: mlflow (PIP)
Severity: HIGH (CVSS 8.1)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 3.0.0rc0, < 3.0.0
Patched in: 3.0.0

Summary: MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability

Details:
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of model file paths. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26921.
GitHub Security Advisory: GHSA-2xpw-w6gg-jr37
Package: urllib3 (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
Vulnerable versions: >= 1.0, < 2.6.0
Patched in: 2.6.0

Summary: urllib3 streaming API improperly handles highly compressed data

Details:
### Impact

urllib3's [streaming API](https://urllib3.readthedocs.io/en/2.5.0/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.

When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation.

The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side, even if the application only requested a small chunk of data.


### Affected usages

Applications and libraries using urllib3 version 2.5.0 and earlier to stream large compressed responses or content from untrusted sources.

`stream()`, `read(amt=256)`, `read1(amt=256)`, `read_chunked(amt=256)`, `readinto(b)` are examples of `urllib3.HTTPResponse` method calls using the affected logic unless decoding is disabled explicitly.


### Remediation

Upgrade to at least urllib3 v2.6.0 in which the library avoids decompressing data that exceeds the requested amount.

If your environment contains a package facilitating the Brotli encoding, upgrade to at least Brotli 1.2.0 or brotlicffi 1.2.0.0 too. These versions are enforced by the `urllib3[brotli]` extra in the patched versions of urllib3.


### Credits

The issue was reported by @Cycloctane.
Supplemental information was provided by @stamparm during a security audit performed by [7ASecurity](https://7asecurity.com/) and facilitated by [OSTIF](https://ostif.org/).
GitHub Security Advisory: GHSA-gm62-xv2j-4w53
Package: urllib3 (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 1.24, < 2.6.0
Patched in: 2.6.0

Summary: urllib3 allows an unbounded number of links in the decompression chain

Details:
## Impact

urllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).

However, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.


## Affected usages

Applications and libraries using urllib3 version 2.5.0 and earlier for HTTP requests to untrusted sources unless they disable content decoding explicitly.


## Remediation

Upgrade to at least urllib3 v2.6.0 in which the library limits the number of links to 5.

If upgrading is not immediately possible, use [`preload_content=False`](https://urllib3.readthedocs.io/en/2.5.0/advanced-usage.html#streaming-and-i-o) and ensure that `resp.headers["content-encoding"]` contains a safe number of encodings before reading the response content.
GitHub Security Advisory: GHSA-frv8-gffc-37px
Package: open-webui (PIP)
Severity: LOW (CVSS 0.0)
CWE: CWE-284: Improper Access Control
Vulnerable versions: <= 0.6.33
Patched in: unpatched

Summary: open-webui is Vulnerable to Incorrect Access Control

Details:
open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers (a normal user) to stop arbitrary LLM response tasks.
GitHub Security Advisory: GHSA-3mwv-j45g-vp3w
Package: composio (PIP)
Severity: MODERATE (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: <= 0.7.20
Patched in: unpatched

Summary: ComposioHQ has a directory traversal vulnerability

Details:
Directory Traversal vulnerability in ComposioHQ v.0.7.20 allows a remote attacker to obtain sensitive information via the _download_file_or_dir function.
GitHub Security Advisory: GHSA-9pcc-gvx5-r5wm
Package: vllm (PIP)
Severity: HIGH (CVSS 8.0)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 0.5.2, < 0.10.0
Patched in: 0.10.0

Summary: Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration

Details:
### Affected Environments

Note that this issue only affects the V0 engine, which has been off by default since v0.8.0. Further, the issue only applies to a deployment using tensor parallelism across multiple hosts, which we do not expect to be a common deployment pattern.

Since V0 is has been off by default since v0.8.0 and the fix is fairly invasive, we have decided not to fix this issue. Instead we recommend that users ensure their environment is on a secure network in case this pattern is in use.

The V1 engine is not affected by this issue.

### Impact

In a multi-node vLLM deployment using the V0 engine, vLLM uses ZeroMQ for some multi-node communication purposes. The secondary vLLM hosts open a `SUB` ZeroMQ socket and connect to an `XPUB` socket on the primary vLLM host.

https://github.com/vllm-project/vllm/blob/c21b99b91241409c2fdf9f3f8c542e8748b317be/vllm/distributed/device_communicators/shm_broadcast.py#L295-L301

When data is received on this `SUB` socket, it is deserialized with `pickle`. This is unsafe, as it can be abused to execute code on a remote machine.

https://github.com/vllm-project/vllm/blob/c21b99b91241409c2fdf9f3f8c542e8748b317be/vllm/distributed/device_communicators/shm_broadcast.py#L468-L470

Since the vulnerability exists in a client that connects to the primary vLLM host, this vulnerability serves as an escalation point. If the primary vLLM host is compromised, this vulnerability could be used to compromise the rest of the hosts in the vLLM deployment.

Attackers could also use other means to exploit the vulnerability without requiring access to the primary vLLM host. One example would be the use of ARP cache poisoning to redirect traffic to a malicious endpoint used to deliver a payload with arbitrary code to execute on the target machine.
GitHub Security Advisory: GHSA-vrcr-9hj9-jcg6
Package: Django (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-407: Inefficient Algorithmic Complexity
Vulnerable versions: >= 4.2a1, < 4.2.27
Patched in: 4.2.27

Summary: Django is vulnerable to DoS via XML serializer text extraction

Details:
An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.
Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.
GitHub Security Advisory: GHSA-vrcr-9hj9-jcg6
Package: Django (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-407: Inefficient Algorithmic Complexity
Vulnerable versions: >= 5.1a1, < 5.1.15
Patched in: 5.1.15

Summary: Django is vulnerable to DoS via XML serializer text extraction

Details:
An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.
Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.
GitHub Security Advisory: GHSA-vrcr-9hj9-jcg6
Package: Django (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-407: Inefficient Algorithmic Complexity
Vulnerable versions: >= 5.2a1, < 5.2.9
Patched in: 5.2.9

Summary: Django is vulnerable to DoS via XML serializer text extraction

Details:
An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.
Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.
GitHub Security Advisory: GHSA-rqw2-ghq9-44m7
Package: Django (PIP)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 4.2a1, < 4.2.27
Patched in: 4.2.27

Summary: Django is vulnerable to SQL injection in column aliases

Details:
An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.
`FilteredRelation` is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()` on PostgreSQL.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Stackered for reporting this issue.
GitHub Security Advisory: GHSA-rqw2-ghq9-44m7
Package: Django (PIP)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 5.1a1, < 5.1.15
Patched in: 5.1.15

Summary: Django is vulnerable to SQL injection in column aliases

Details:
An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.
`FilteredRelation` is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()` on PostgreSQL.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Stackered for reporting this issue.
GitHub Security Advisory: GHSA-rqw2-ghq9-44m7
Package: Django (PIP)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 5.2a1, < 5.2.9
Patched in: 5.2.9

Summary: Django is vulnerable to SQL injection in column aliases

Details:
An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.
`FilteredRelation` is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()` on PostgreSQL.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Stackered for reporting this issue.
GitHub Security Advisory: GHSA-pc5g-j9j7-p4q3
Package: calibreweb (PIP)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 0.6.25
Patched in: unpatched

Summary: Calibre-Web Has a Stored Cross-Site Scripting (XSS) Vulnerability via the 'username' Field During User Creation

Details:
A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payload is stored unsanitized and later executed when the /ajax/listusers endpoint is accessed.
GitHub Security Advisory: GHSA-8fr4-5q9j-m8gm
Package: vllm (PIP)
Severity: HIGH (CVSS 7.1)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 0.11.1
Patched in: 0.11.1

Summary: vLLM vulnerable to remote code execution via transformers_utils/get_config

Details:
### Summary

`vllm` has a critical remote code execution vector in a config class named `Nemotron_Nano_VL_Config`. When `vllm` loads a model config that contains an `auto_map` entry, the config class resolves that mapping with `get_class_from_dynamic_module(...)` and immediately instantiates the returned class. This fetches and executes Python from the remote repository referenced in the `auto_map` string. Crucially, this happens even when the caller explicitly sets `trust_remote_code=False` in `vllm.transformers_utils.config.get_config`. In practice, an attacker can publish a benign-looking frontend repo whose `config.json` points via `auto_map` to a separate malicious backend repo; loading the frontend will silently run the backend’s code on the victim host.

### Details

The vulnerable code resolves and instantiates classes from `auto_map` entries without checking whether those entries point to a different repo or whether remote code execution is allowed.

```python
class Nemotron_Nano_VL_Config(PretrainedConfig):
    model_type = 'Llama_Nemotron_Nano_VL'

    def __init__(self, **kwargs):
        super().__init__(**kwargs)

        if vision_config is not None:
            assert "auto_map" in vision_config and "AutoConfig" in vision_config["auto_map"]
            # <-- vulnerable dynamic resolution + instantiation happens here
            vision_auto_config = get_class_from_dynamic_module(*vision_config["auto_map"]["AutoConfig"].split("--")[::-1])
            self.vision_config = vision_auto_config(**vision_config)
        else:
            self.vision_config = PretrainedConfig()
```

`get_class_from_dynamic_module(...)` is capable of fetching and importing code from the Hugging Face repo specified in the mapping. `trust_remote_code` is not enforced for this code path. As a result, a frontend repo can redirect the loader to any backend repo and cause code execution, bypassing the `trust_remote_code` guard.

### Impact

This is a critical vulnerability because it breaks the documented `trust_remote_code` safety boundary in a core model-loading utility. The vulnerable code lives in a common loading path, so any application, service, CI job, or developer machine that uses `vllm`’s transformer utilities to load configs can be affected. The attack requires only two repos and no user interaction beyond loading the frontend model. A successful exploit can execute arbitrary commands on the host.

### Fixes

* https://github.com/vllm-project/vllm/pull/28126
GitHub Security Advisory: GHSA-9h52-p55h-vw2f
Package: mcp (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action, CWE-1188: Initialization of a Resource with an Insecure Default
Vulnerable versions: < 1.23.0
Patched in: 1.23.0

Summary: Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default

Details:
### Description

The Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication using `FastMCP` with streamable HTTP or SSE transport, and has not configured `TransportSecuritySettings`, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances.

Note that running HTTP-based MCP servers locally without authentication is not recommended per MCP security best practices. This issue does not affect servers using stdio transport.

Servers created via `FastMCP()` now have DNS rebinding protection enabled by default when the `host` parameter is `127.0.0.1` or `localhost`. Users are advised to update to version `1.23.0` to receive this automatic protection. Users with custom low-level server configurations using `StreamableHTTPSessionManager` or `SseServerTransport` directly should explicitly configure `TransportSecuritySettings` when running an unauthenticated server on localhost.
GitHub Security Advisory: GHSA-2w93-qwpp-vgvj
Package: trytond (PIP)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 6.0.0, < 6.0.70
Patched in: 6.0.70

Summary: trytond does not enforce access rights for data export

Details:
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
GitHub Security Advisory: GHSA-2w93-qwpp-vgvj
Package: trytond (PIP)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 7.0.0, < 7.0.40
Patched in: 7.0.40

Summary: trytond does not enforce access rights for data export

Details:
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
GitHub Security Advisory: GHSA-2w93-qwpp-vgvj
Package: trytond (PIP)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 7.1.0, < 7.4.21
Patched in: 7.4.21

Summary: trytond does not enforce access rights for data export

Details:
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
GitHub Security Advisory: GHSA-2w93-qwpp-vgvj
Package: trytond (PIP)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 7.5.0, < 7.6.11
Patched in: 7.6.11

Summary: trytond does not enforce access rights for data export

Details:
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
GitHub Security Advisory: GHSA-p3p5-xrmv-4j6x
Package: trytond (PIP)
Severity: HIGH (CVSS 7.1)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 6.0.0, < 6.0.70
Patched in: 6.0.70

Summary: trytond does not enforce access rights for the route of the HTML editor.

Details:
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
GitHub Security Advisory: GHSA-p3p5-xrmv-4j6x
Package: trytond (PIP)
Severity: HIGH (CVSS 7.1)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 7.0.0, < 7.0.40
Patched in: 7.0.40

Summary: trytond does not enforce access rights for the route of the HTML editor.

Details:
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
GitHub Security Advisory: GHSA-p3p5-xrmv-4j6x
Package: trytond (PIP)
Severity: HIGH (CVSS 7.1)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 7.1.0, < 7.4.21
Patched in: 7.4.21

Summary: trytond does not enforce access rights for the route of the HTML editor.

Details:
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
GitHub Security Advisory: GHSA-p3p5-xrmv-4j6x
Package: trytond (PIP)
Severity: HIGH (CVSS 7.1)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 7.5.0, < 7.6.11
Patched in: 7.6.11

Summary: trytond does not enforce access rights for the route of the HTML editor.

Details:
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
GitHub Security Advisory: GHSA-jqfc-9q34-prhg
Package: trytond (PIP)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-402: Transmission of Private Resources into a New Sphere ('Resource Leak')
Vulnerable versions: < 6.0.70
Patched in: 6.0.70

Summary: trytond allows remote attackers to obtain sensitive trace-back (server setup) information

Details:
Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
GitHub Security Advisory: GHSA-jqfc-9q34-prhg
Package: trytond (PIP)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-402: Transmission of Private Resources into a New Sphere ('Resource Leak')
Vulnerable versions: >= 7.0.0, < 7.0.40
Patched in: 7.0.40

Summary: trytond allows remote attackers to obtain sensitive trace-back (server setup) information

Details:
Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
GitHub Security Advisory: GHSA-jqfc-9q34-prhg
Package: trytond (PIP)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-402: Transmission of Private Resources into a New Sphere ('Resource Leak')
Vulnerable versions: >= 7.1.0, < 7.4.21
Patched in: 7.4.21

Summary: trytond allows remote attackers to obtain sensitive trace-back (server setup) information

Details:
Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
GitHub Security Advisory: GHSA-jqfc-9q34-prhg
Package: trytond (PIP)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-402: Transmission of Private Resources into a New Sphere ('Resource Leak')
Vulnerable versions: >= 7.5.0, < 7.6.11
Patched in: 7.6.11

Summary: trytond allows remote attackers to obtain sensitive trace-back (server setup) information

Details:
Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
GitHub Security Advisory: GHSA-hgf8-39gv-g3f2
Package: werkzeug (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-67: Improper Handling of Windows Device Names
Vulnerable versions: < 3.1.4
Patched in: 3.1.4

Summary: Werkzeug safe_join() allows Windows special device names

Details:
Werkzeug's `safe_join` function allows path segments with Windows device names. On Windows, there are special device names such as `CON`, `AUX`, etc that are implicitly present and readable in every directory. `send_from_directory` uses `safe_join` to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.