deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-6wgj-66m2-xxp2
Package: ray (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-829: Inclusion of Functionality from Untrusted Control Sphere, CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 2.49.2
Patched in: unpatched

Summary: Ray has arbitrary code execution via jobs submission API

Details:
Anyscale Ray allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment.
GitHub Security Advisory: GHSA-hc5x-x2vx-497g
Package: gunicorn (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: < 22.0.0
Patched in: 22.0.0

Summary: Gunicorn HTTP Request/Response Smuggling vulnerability

Details:
Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback method of 'Content-Length,' making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse.
GitHub Security Advisory: GHSA-wf7f-8fxf-xfxc
Package: mlflow (PIP)
Severity: HIGH (CVSS 8.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 0.5.0, <= 3.4.0
Patched in: unpatched

Summary: MLFlow unsafe deserialization

Details:
Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user’s system when interacted with.
GitHub Security Advisory: GHSA-cr7q-2w66-hjcm
Package: llama-index-core (PIP)
Severity: HIGH (CVSS 7.3)
CWE: CWE-378: Creation of Temporary File With Insecure Permissions
Vulnerable versions: < 0.13.0
Patched in: 0.13.0

Summary: llama-index-core insecurely handles temporary files

Details:
The llama-index-core package, up to version 0.12.44, contains a vulnerability in the `get_cache_dir()` function where a predictable, hardcoded directory path `/tmp/llama_index` is used on Linux systems without proper security controls. This vulnerability allows attackers on multi-user systems to steal proprietary models, poison cached embeddings, or conduct symlink attacks. The issue affects all Linux deployments where multiple users share the same system. The vulnerability is classified under CWE-379, CWE-377, and CWE-367, indicating insecure temporary file creation and potential race conditions.
GitHub Security Advisory: GHSA-v39m-5m9j-m9w9
Package: mkdocs-include-markdown-plugin (PIP)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 7.1.8
Patched in: 7.1.8

Summary: mkdocs-include-markdown-plugin susceptible to unvalidated input colliding with substitution placeholders 

Details:
### Impact
CWE-20: Improper Input Validation
Low impact

### Patches
Patched in v7.1.8 (commit https://github.com/mondeja/mkdocs-include-markdown-plugin/commit/7466d67aa0de8ffbc427204ad2475fed07678915)

### Workarounds
No
GitHub Security Advisory: GHSA-q475-2pgm-7hvp
Package: apache-airflow (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-213: Exposure of Sensitive Information Due to Incompatible Policies
Vulnerable versions: = 3.0.3
Patched in: 3.0.4

Summary: Apache Airflow: Connection sensitive details exposed to users with READ permissions

Details:
Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively applying a "write-only" model for sensitive values.

In Airflow 3.0.3, this model was unintentionally violated: sensitive connection information could be viewed by users with READ permissions through both the API and the UI. This behavior also bypassed the `AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS` configuration option.

This issue does not affect Airflow 2.x, where exposing sensitive information to connection editors was the intended and documented behavior.

Users of Airflow 3.0.3 are advised to upgrade Airflow to >=3.0.4.
GitHub Security Advisory: GHSA-vvfj-2jqx-52jm
Package: jupyterlab (PIP)
Severity: LOW (CVSS 0.0)
CWE: CWE-1022: Use of Web Link to Untrusted Target with window.opener Access
Vulnerable versions: <= 4.4.7
Patched in: 4.4.8

Summary: JupyterLab LaTeX typesetter links did not enforce `noopener` attribute

Details:
Links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the `noopener` attribute.

This is deemed to have no impact on the default installations. Theoretically users of third-party LaTeX-rendering extensions could find themselves vulnerable to reverse tabnabbing attacks if:
- links generated by those extensions included `target=_blank` (no such extensions are known at time of writing) and
- they were to click on a link generated in LaTeX (typically visibly different from other links).

For consistency with handling on other links, new versions of JupyterLab will enforce `noopener` and `target=_blank` on all links generated by typesetters. The former will harden the resilience of JupyterLab to extensions with lack of secure defaults in link rendering, and the latter will improve user experience by preventing accidental state loss when clicking on links rendered by LaTeX typesetters.

### Impact

Since the official LaTeX typesetter extensions for JupyterLab: `jupyterlab-mathjax` (default), `jupyterlab-mathjax2` and `jupyterlab-katex` do not include the `target=_blank`, there is no impact for JupyterLab users.

### Patches

JupyterLab 4.4.8

### Workarounds

No workarounds are necessary.

### References

None
GitHub Security Advisory: GHSA-9x36-c74v-fgr6
Package: ml-logger (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: <= 0.10.36
Patched in: unpatched

Summary: ml-logger file handler allows reading arbitrary files

Details:
A security flaw has been discovered in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected by this issue is the function stream_handler of the file ml_logger/server.py of the component File Handler. Performing manipulation of the argument key results in information disclosure. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
GitHub Security Advisory: GHSA-8x9j-2p8r-7xc6
Package: ml-logger (PIP)
Severity: MODERATE (CVSS 7.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 0.10.36
Patched in: unpatched

Summary: ml-logger has path traversal in the file argument

Details:
A vulnerability was identified in geyang ml-logger 0.10.36 and prior. Affected by this vulnerability is the function log_handler of the file ml_logger/server.py. Such manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit is publicly available and might be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
GitHub Security Advisory: GHSA-57hm-8rjv-498w
Package: ml-logger (PIP)
Severity: LOW (CVSS 6.3)
CWE: CWE-20: Improper Input Validation, CWE-502: Deserialization of Untrusted Data
Vulnerable versions: <= 0.10.36
Patched in: unpatched

Summary: ml-logger deserialization vulnerability

Details:
A vulnerability was determined in geyang ml-logger 0.10.36 and prior. Affected is the function log_handler of the file ml_logger/server.py of the component Ping Handler. This manipulation of the argument data causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
GitHub Security Advisory: GHSA-x75h-m6jj-6cj2
Package: llama-stack (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 0.2.20
Patched in: 0.2.20

Summary: Llama Stack could potentially allow for remote code execution

Details:
Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolve_ast_by_type function which could potentially allow for remote code execution.
GitHub Security Advisory: GHSA-vv9c-xxg7-wmv7
Package: invokeai (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-73: External Control of File Name or Path
Vulnerable versions: < 6.7.0
Patched in: 6.7.0

Summary: InvokeAI has External Control of File Name or Path

Details:
### Path Traversal Vulnerability in InvokeAI

A path traversal vulnerability in **InvokeAI** (versions < 6.7.0) allows an unauthenticated remote attacker to read files outside the intended media directory via the **bulk downloads** API.

The endpoint accepts a user-controlled file/item name and concatenates it into a filesystem path without proper canonicalization or allow-listing. By supplying sequences such as `../` (or absolute paths), an attacker can cause the server to traverse directories and return arbitrary files.

In certain storage or back-end configurations, abusing attacker-controlled paths can also lead to unintended overwriting or deletion of files referenced by the crafted path.

The issue is fixed in **6.7.0**, which normalizes and validates input paths and rejects traversal attempts.

**Affected versions:** `< 6.7.0`
**Patched version:** `6.7.0`
GitHub Security Advisory: GHSA-hrmc-jmp7-mpm2
Package: h2o (PIP)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: <= 3.46.0.7
Patched in: unpatched

Summary: H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL

Details:
H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution. Exploitation can occur when an attacker has access to post to the ImportSQLTable URI with a JSON document containing a connection_url property with any typical JDBC Connection URL attack payload such as one that uses queryInterceptors.
GitHub Security Advisory: GHSA-4w7r-h757-3r74
Package: transformers (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 4.53.0
Patched in: 4.53.0

Summary: Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer

Details:
The huggingface/transformers library, versions prior to 4.53.0, is vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer. The vulnerability arises from the _do_use_weight_decay method, which processes user-controlled regular expressions in the include_in_weight_decay and exclude_from_weight_decay lists. Malicious regular expressions can cause catastrophic backtracking during the re.search call, leading to 100% CPU utilization and a denial of service. This issue can be exploited by attackers who can control the patterns in these lists, potentially causing the machine learning task to hang and rendering services unresponsive.
GitHub Security Advisory: GHSA-5w3j-gwgh-4rfv
Package: h2o (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: <= 3.46.0.7
Patched in: unpatched

Summary: H2O affected by a deserialization vulnerability

Details:
A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.7, allowing attackers to read arbitrary system files and execute arbitrary code. The vulnerability arises from improper handling of JDBC connection parameters, which can be exploited by bypassing regular expression checks and using double URL encoding. This issue impacts all users of the affected versions.
GitHub Security Advisory: GHSA-5xf2-f6ch-6p8r
Package: codechecker (PIP)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-121: Stack-based Buffer Overflow
Vulnerable versions: <= 6.26.1
Patched in: 6.26.2

Summary: CodeChecker has a buffer overflow in the log command

Details:
### Summary
CodeChecker versions up to 6.26.1 contain a buffer overflow vulnerability in the internal `ldlogger` library, which is executed by the `CodeChecker log` command.

### Details
Unsafe usage of `strcpy()` function in the internal `ldlogger` library allows attackers to trigger a buffer overflow by supplying crafted inputs from the command line. Specifically, the destination buffer is stack-allocated with a fixed size of 4096 bytes, while `strcpy()` is called without any length checks, enabling an attacker to overrun the buffer.

### PoC
Example script is included below to illustrate how this vulnerability can be exploited.
```bash
#!/bin/bash

export CC_LOGGER_DEF_DIRS=1; 
payload=''; for i in $(seq 1 4090); do payload+='A'; done

CodeChecker log -b "/very/long/path/to/$payload/gcc a.c" -o compilation.json
```

### Impact
Any environment where the vulnerable `CodeChecker log` command is executed with untrusted user input is affected by this vulnerability.
GitHub Security Advisory: GHSA-77wq-646f-jrm2
Package: keras (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-913: Improper Control of Dynamically-Managed Code Resources
Vulnerable versions: >= 3.0.0, < 3.11.3
Patched in: 3.11.3

Summary: Duplicate Advisory: The Keras `Model.load_model` method **silently** ignores `safe_mode=True` and allows arbitrary code execution when a `.h5`/`.hdf5` file is loaded.

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-36rr-ww3j-vrjv. This link is maintained to preserve external references.

### Original Description
The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True.

One can create a specially crafted .h5/.hdf5 model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed.

This is achieved by crafting a special .h5 archive file that uses the Lambda layer feature of keras which allows arbitrary Python code in the form of pickled code. The vulnerability comes from the fact that the safe_mode=True option is not honored when reading .h5 archives.

Note that the .h5/.hdf5 format is a legacy format supported by Keras 3 for backwards compatibility.
GitHub Security Advisory: GHSA-36fq-jgmw-4r9c
Package: keras (PIP)
Severity: HIGH (CVSS 7.3)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 3.11.0
Patched in: 3.11.0

Summary: Keras is vulnerable to Deserialization of Untrusted Data

Details:
### Arbitrary Code Execution in Keras

Keras versions prior to 3.11.0 allow for arbitrary code execution when loading a crafted `.keras` model archive, even when `safe_mode=True`.

The issue arises because the archive’s `config.json` is parsed before layer deserialization. This can invoke `keras.config.enable_unsafe_deserialization()`, effectively disabling safe mode from within the loading process itself. An attacker can place this call first in the archive and then include a `Lambda` layer whose function is deserialized from a pickle, leading to the execution of attacker-controlled Python code as soon as a victim loads the model file.

Exploitation requires a user to open an untrusted model; no additional privileges are needed. The fix in version 3.11.0 enforces safe-mode semantics *before* reading any user-controlled configuration and prevents the toggling of unsafe deserialization via the config file.

**Affected versions:** < 3.11.0
**Patched version:** 3.11.0

It is recommended to upgrade to version 3.11.0 or later and to avoid opening untrusted model files.
GitHub Security Advisory: GHSA-hf6h-9wq7-hmjg
Package: picklescan (PIP)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-693: Protection Mechanism Failure
Vulnerable versions: < 0.0.31
Patched in: 0.0.31

Summary: Duplicate Advisory: Picklescan is Vulnerable to Unsafe Globals Check Bypass through Subclass Imports

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-f7qq-56ww-84cr. This link is maintained to preserve external references.

### Original Description
A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass the unsafe globals check. This is possible because the scanner performs an exact match for module names, allowing malicious payloads to be loaded via submodules of dangerous packages (e.g., 'asyncio.unix_events' instead of 'asyncio'). 

When the incorrectly considered safe file is loaded after scan, it can lead to the execution of malicious code.
GitHub Security Advisory: GHSA-j424-mc44-f4hj
Package: picklescan (PIP)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 0.0.31
Patched in: 0.0.31

Summary: Duplicate Advisory: Picklescan Bypass is Possible via File Extension Mismatch

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-jgw4-cr84-mqxg. This link is maintained to preserve external references.

### Original Description
An Improper Input Validation vulnerability in the scanning logic of mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass pickle files security checks by supplying a standard pickle file with a PyTorch-related file extension. When the pickle file incorrectly considered safe is loaded, it can lead to the execution of malicious code.
GitHub Security Advisory: GHSA-4vr7-g93g-cf6m
Package: picklescan (PIP)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-755: Improper Handling of Exceptional Conditions
Vulnerable versions: < 0.0.31
Patched in: 0.0.31

Summary: Duplicate Advisory: Picklescan: ZIP archive scan bypass is possible through non-exhaustive Cyclic Redundancy Check

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-m4j5-5x4r-2xp9. This link is maintained to preserve external references.

### Original Description
An Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 picklescan allows a remote attacker to bypass security scans. This is achieved by crafting a ZIP archive containing a file with a bad Cyclic Redundancy Check (CRC), which causes the scanner to halt and fail to analyze the contents for malicious pickle files. When the file incorrectly considered safe is loaded, it can lead to the execution of malicious code.
GitHub Security Advisory: GHSA-qmgv-j263-qr33
Package: langchain-chatchat (PIP)
Severity: LOW (CVSS 6.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 0.3.1.3
Patched in: unpatched

Summary: Langchain-Chatchat has a Path Traversal vulnerability

Details:
A vulnerability classified as critical has been found in chatchat-space Langchain-Chatchat up to 0.3.1. This affects the function upload_temp_docs of the file /knowledge_base/upload_temp_docs of the component Backend. The manipulation of the argument flag leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
GitHub Security Advisory: GHSA-9cg4-9hv5-3376
Package: webssh (PIP)
Severity: LOW (CVSS 4.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.6.3
Patched in: 1.6.3

Summary: WebSSH Cross-site Scripting vulnerability

Details:
A vulnerability, which was classified as problematic, has been found in Huashengdun WebSSH up to 1.6.2. Affected by this issue is some unknown functionality of the component Login Page. The manipulation of the argument hostname/port leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-4hqq-7q79-932p
Package: mcp-kubernetes-server (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: <= 0.1.11
Patched in: unpatched

Summary: mcp-kubernetes-server has an OS Command Injection vulnerability

Details:
`feiskyer/mcp-kubernetes-server` through **0.1.11** allows **OS command injection** via the `/mcp/kubectl` endpoint. The handler constructs a shell command with user-supplied arguments and executes it with `subprocess` using `shell=True`, enabling injection through shell metacharacters (e.g., `;`, `&&`, `$()`), even when the server is running in **read-only** mode.

A remote, unauthenticated attacker can execute arbitrary OS commands on the host, resulting in full compromise of confidentiality, integrity, and availability.

This issue is **distinct from** `mcp-server-kubernetes` and from **CVE-2025-53355**.
GitHub Security Advisory: GHSA-hjm5-xgj8-vwj6
Package: mcp-kubernetes-server (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Vulnerable versions: <= 0.1.11
Patched in: unpatched

Summary: mcp-kubernetes-server has a Command Injection vulnerability

Details:
`mcp-kubernetes-server` does not correctly enforce the `--disable-write` / `--disable-delete` protections when commands are chained. The server only inspects the first token to decide whether an operation is write/delete, which allows a read-like command to be followed by a write action using shell metacharacters (e.g., `kubectl version; kubectl delete pod <name>`). A remote attacker who can invoke the server may therefore bypass the intended write/delete restrictions and perform state-changing operations against the Kubernetes cluster.

**Affected versions:** through `0.1.11` (no patched release available as of now).

**Mitigations:**
- Run with `--disable-kubectl` and/or `--disable-helm` to fully block those execution paths.
- Put the server behind an allow-list proxy restricting allowed subcommands.
GitHub Security Advisory: GHSA-rcv9-qm8p-9p6j
Package: transformers (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: < 4.53.0
Patched in: 4.53.0

Summary: Hugging Face Transformers library has Regular Expression Denial of Service

Details:
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the `normalize_numbers()` method of the `EnglishNormalizer` class. This vulnerability affects versions up to 4.52.4 and is fixed in version 4.53.0. The issue arises from the method's handling of numeric strings, which can be exploited using crafted input strings containing long sequences of digits, leading to excessive CPU consumption. This vulnerability impacts text-to-speech and number normalization tasks, potentially causing service disruption, resource exhaustion, and API vulnerabilities.
GitHub Security Advisory: GHSA-59p9-h35m-wg4g
Package: transformers (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: < 4.53.0
Patched in: 4.53.0

Summary: Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer

Details:
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's `remove_language_code()` method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. The issue arises from inefficient regex processing, which can be exploited by crafted input strings containing malformed language code patterns, leading to excessive CPU consumption and potential denial of service.