deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-rch3-82jr-f9w9
Package: notebook (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 7.0.0, <= 7.5.5
Patched in: 7.5.6

Summary: Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS

Details:
### Impact

A stored Cross-Site Scripting (XSS) vulnerability in Jupyter Notebook allows attackers to steal authentication tokens from users who open malicious notebook files and interact with elements that the attacker can make look indistinguishable from legitimate controls (single click interaction).

The vulnerability enables complete account takeover through the Jupyter REST API, allowing the attacker to:
1. Read all files
2. Modify/create files
3. Access running kernels and execute arbitrary code
4. Create terminals for shell access

### Patches

Jupyter Notebook 7.5.6 and JupyterLab 4.5.7 include patches for this vulnerability.

### Workarounds

The help extension can be disabled via CLI:

```
jupyter labextension disable @jupyter-notebook/help-extension
jupyter labextension disable @jupyterlab/help-extension
```

### Hardening

The patched versions include a toggle to disable the command linker functionality altogether, for example via `overrides.json`:

```json
{
  "@jupyterlab/apputils-extension:sanitizer": {
    "allowCommandLinker": false
  }
}
```

### Resources

- https://jupyterlab.readthedocs.io/en/latest/user/commands.html#commands-in-markdown-output-and-files

### Acknowledgments

Reported by Daniel Teixeira - NVIDIA AI Red Team
GitHub Security Advisory: GHSA-h7j7-3rx6-xvcg
Package: ckan (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE-863: Incorrect Authorization
Vulnerable versions: >= 2.11.0, <= 2.11.4
Patched in: 2.11.5

Summary: CKAN has Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`

Details:
### Impact

A vulnerability in `datastore_search_sql` allowed attackers to inject SQL in order to gain access to private resources and PostgreSQL system information.

### Patches
The issue has been patched in CKAN 2.10.10 and CKAN 2.11.5

### Workarounds
Disable the DataStore SQL search (`ckan.datastore.sqlsearch.enabled = false`). Note that the SQL search is disabled by default.

### More information

As stated in the [documentation](https://docs.ckan.org/en/2.11/maintaining/configuration.html#ckan-datastore-sqlsearch-enabled), this action function has protections that offer some safety but are not designed to prevent all types of abuse. Depending on the sensitivity of private data in a project's DataStore and the likelihood of abuse of a consuming site, a developer may choose to disable this action function or restrict its use with a [`IAuthFunctions`](https://docs.ckan.org/en/2.11/extensions/plugin-interfaces.html#ckan.plugins.interfaces.IAuthFunctions) plugin.

### Credits

* Reported by Arvin Shivram of Brutecat Security
GitHub Security Advisory: GHSA-h7j7-3rx6-xvcg
Package: ckan (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE-863: Incorrect Authorization
Vulnerable versions: < 2.10.10
Patched in: 2.10.10

Summary: CKAN has Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`

Details:
### Impact

A vulnerability in `datastore_search_sql` allowed attackers to inject SQL in order to gain access to private resources and PostgreSQL system information.

### Patches
The issue has been patched in CKAN 2.10.10 and CKAN 2.11.5

### Workarounds
Disable the DataStore SQL search (`ckan.datastore.sqlsearch.enabled = false`). Note that the SQL search is disabled by default.

### More information

As stated in the [documentation](https://docs.ckan.org/en/2.11/maintaining/configuration.html#ckan-datastore-sqlsearch-enabled), this action function has protections that offer some safety but are not designed to prevent all types of abuse. Depending on the sensitivity of private data in a project's DataStore and the likelihood of abuse of a consuming site, a developer may choose to disable this action function or restrict its use with a [`IAuthFunctions`](https://docs.ckan.org/en/2.11/extensions/plugin-interfaces.html#ckan.plugins.interfaces.IAuthFunctions) plugin.

### Credits

* Reported by Arvin Shivram of Brutecat Security
GitHub Security Advisory: GHSA-jgvc-94c8-3chc
Package: pygeoapi (PIP)
Severity: HIGH (CVSS 8.6)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 0.23.0, < 0.23.3
Patched in: 0.23.3

Summary: pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber  

Details:
### Impact
OGC API - Process execution requests can use the `subscriber` object to requests to internal HTTP services.

### Patches
The issue has been patched in master branch and made available as part of the 0.23.3 release.  The patch disables any HTTP requests made to internal resources by default (unless explicitly defined in configuration by a new `allow_internal_requests` directive.

The commit/fix can be found in [3a63f5b0cc6275e3ae0edb47726b13a43cdd90ef](https://github.com/geopython/pygeoapi/commit/3a63f5b0cc6275e3ae0edb47726b13a43cdd90ef).

### Workarounds
Users can update existing applications by disabling process based resources in their pygeoapi config, until 0.23.3 can be installed and deployed.
GitHub Security Advisory: GHSA-f6pr-83pg-ghh6
Package: pygeoapi (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 0.23.0, < 0.23.3
Patched in: 0.23.3

Summary: pygeoapi 0.23.x: Path Traversal in STAC FileSystemProvider

Details:
### Impact
A raw string path concatenation vulnerability in pygeoapi's STAC FileSystemProvider plugin can allow for requests to STAC collection based collections to expose directories without authentication.  The issue manifests when pygeoapi is deployed without a proxy or web front end that would normalize URLs with `..` values, along with a resource of type `stac-collection` defined in configuration.

### Patches
The issue has been patched in master branch and made available as part of the 0.23.3 release.

The commit/fix can be found in [bf25b8695edbdd5476eeffc102b633d1d3e45f52](https://github.com/geopython/pygeoapi/commit/bf25b8695edbdd5476eeffc102b633d1d3e45f52).
### Workarounds
Users can safeguard existing applications by disabling STAC collection based resources in their pygeoapi config, until 0.23.3 can be installed and deployed.
GitHub Security Advisory: GHSA-rxpq-xgqx-fr7p
Package: instructlab (PIP)
Severity: HIGH (CVSS 8.8)
CWE: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Vulnerable versions: <= 0.26.1
Patched in: unpatched

Summary: InstructLab Includes Functionality from Untrusted Control Sphere

Details:
A flaw was found in InstructLab. The `linux_train.py` script hardcodes `trust_remote_code=True` when loading models from HuggingFace. This allows a remote attacker to achieve arbitrary Python code execution by convincing a user to run `ilab train/download/generate` with a specially crafted malicious model from the HuggingFace Hub. This vulnerability can lead to complete system compromise.
GitHub Security Advisory: GHSA-pqmg-c2j8-fq92
Package: instructlab (PIP)
Severity: HIGH (CVSS 7.1)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 0.26.1
Patched in: unpatched

Summary: InstructLab vulnerable to Path Traversal

Details:
A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the `logs_dir` parameter. This allows the attacker to create new directories and write files to arbitrary locations on the system, potentially leading to unauthorized data modification or disclosure.
GitHub Security Advisory: GHSA-mcvf-jxcw-vj73
Package: ckan (PIP)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 2.11.0, <= 2.11.4
Patched in: 2.11.5

Summary: CKAN has CSRF exemption primed by anonymous requests

Details:
Views can be marked as exempt from CSRF protection 

Access to the views via tokens or unauthenticated requests marked the endpoint as not requiring CSRF protection. 

The marking was a member variable in flask-wtf.csrf.CSRFProtect(), which was stored as a module level variable in the flask_app middleware. Thsi API was never intended for request level changes, it is primarily a decorator for static configuration. 

An unauthenticated request could hit a protected endpoint, exempting it from CSRF protection for the life of the particular server process. (e.g. one worker of uwsgi).

This could be leveraged with XSS to perform actions using other user's credentials.

### References

* [Vulnerability report](https://github.com/Shirshaw64p/security-advisories/tree/main/CVE-2026-41255) by @Shirshaw64p (original reporter)
GitHub Security Advisory: GHSA-mcvf-jxcw-vj73
Package: ckan (PIP)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 2.10.0, < 2.10.10
Patched in: 2.10.10

Summary: CKAN has CSRF exemption primed by anonymous requests

Details:
Views can be marked as exempt from CSRF protection 

Access to the views via tokens or unauthenticated requests marked the endpoint as not requiring CSRF protection. 

The marking was a member variable in flask-wtf.csrf.CSRFProtect(), which was stored as a module level variable in the flask_app middleware. Thsi API was never intended for request level changes, it is primarily a decorator for static configuration. 

An unauthenticated request could hit a protected endpoint, exempting it from CSRF protection for the life of the particular server process. (e.g. one worker of uwsgi).

This could be leveraged with XSS to perform actions using other user's credentials.

### References

* [Vulnerability report](https://github.com/Shirshaw64p/security-advisories/tree/main/CVE-2026-41255) by @Shirshaw64p (original reporter)
GitHub Security Advisory: GHSA-mpfm-fpgx-647q
Package: ckan (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: < 2.10.10
Patched in: 2.10.10

Summary: CKAN has no certificate validation on STMP connection

Details:
### Impact
Configured SMTP server may be spoofed with any certificate (e.g. self-signed), leaving credentials and all emails sent open to MITM attacks.

### Patches
The vulnerability has been patched in CKAN 2.10.10 and CKAN 2.11.5
GitHub Security Advisory: GHSA-mpfm-fpgx-647q
Package: ckan (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: >= 2.11.0, <= 2.11.4
Patched in: 2.11.5

Summary: CKAN has no certificate validation on STMP connection

Details:
### Impact
Configured SMTP server may be spoofed with any certificate (e.g. self-signed), leaving credentials and all emails sent open to MITM attacks.

### Patches
The vulnerability has been patched in CKAN 2.10.10 and CKAN 2.11.5
GitHub Security Advisory: GHSA-3gxm-wfjx-m847
Package: beets (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.10.0
Patched in: 2.10.0

Summary: beets has a Cross-site Scripting vulnerability

Details:
During code logic analyis, an area that may lead to unintended behavior under specific conditions was discovered. 

## Overview
- Verified Version: `80cd21554124da07d17a4f962c7d770a4f70d0f2`
- Vulnerability Type: Stored XSS
- Affected Location: `beetsplug/web/templates/index.html:42`
- Trigger Scenario: Metadata fields such as `title`, `lyrics`, or `comments` are rendered with raw template interpolation and inserted into DOM via `.html(...)`.

## Root Cause
The bundled web UI uses Underscore template interpolation mode `<%= ... %>` for untrusted metadata fields. In this runtime, `<%= ... %>` is raw insertion and HTML escaping is only performed by `<%- ... %>`. Rendered output is then inserted with `.html(...)`, allowing attacker-controlled markup to become active DOM.

## Source-to-Sink Chain
1. Source (attacker-controlled input)
- Item metadata values (for example `title`, `lyrics`, `comments`) can contain attacker HTML payload.

2. Data flow
- Templates in `beetsplug/web/templates/index.html:42-46,87-91` render metadata with `<%= ... %>`.
- Underscore runtime defines `<%= ... %>` as raw interpolation (`beetsplug/web/static/underscore.js:890-907`).

3. Sink (security-sensitive action)
- Frontend inserts rendered template output into DOM via `$(this.el).html(this.template(this.model.toJSON()));` in `beetsplug/web/static/beets.js:182,208,220`.

## Exploitation Preconditions
1. Victim opens the web UI page that renders attacker-controlled metadata.
2. Metadata includes executable HTML/JS payload.

## Risk
Stored payload executes in the web UI context and can perform actions available to that origin.

## Impact
Attacker can run arbitrary JavaScript in the victim browser, exfiltrate viewable data, and perform UI-driven actions as the victim session.

## Remediation
1. Replace raw interpolation `<%= ... %>` with escaped output `<%- ... %>` for untrusted fields.
2. Avoid `.html(...)` for untrusted template output; use text-safe rendering.
3. Sanitize metadata values on ingest and before rendering, including attribute contexts.
GitHub Security Advisory: GHSA-crx8-wpv6-jrj2
Package: agentscope (PIP)
Severity: MODERATE (CVSS 7.3)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 1.0.18
Patched in: unpatched

Summary: AgentScope vulnerable to Server-Side Request Forgery

Details:
A weakness has been identified in modelscope agentscope up to 1.0.18. This vulnerability affects the function _process_audio_block of the file src/agentscope/agent/_agent_base.py. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-8ggf-r3vm-p3jc
Package: agentscope (PIP)
Severity: MODERATE (CVSS 7.3)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 1.0.18
Patched in: unpatched

Summary: AgentScope vulnerable to Server-Side Request Forgery

Details:
A security flaw has been discovered in modelscope agentscope up to 1.0.18. This affects the function _get_bytes_from_web_url of the file src/agentscope/_utils/_common.py of the component Internal Service. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-659x-hm75-hpv7
Package: agentscope (PIP)
Severity: MODERATE (CVSS 7.3)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 1.0.18
Patched in: unpatched

Summary: AgentScope vulnerable to Server-Side Request Forgery

Details:
A vulnerability was identified in modelscope agentscope up to 1.0.18. Affected by this issue is the function _parse_url/prepare_image/openai_audio_to_text of the file src/agentscope/tool/_multi_modality/_openai_tools.py of the component Cloud Metadata Endpoint. Such manipulation of the argument image_url/audio_file_url leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-v66p-f7x3-4794
Package: langflow (PIP)
Severity: LOW (CVSS 6.3)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: <= 1.8.3
Patched in: unpatched

Summary: Langflow vulnerable to injection

Details:
A vulnerability was detected in langflow-ai langflow up to 1.8.3. The impacted element is the function get_client_ip/install_mcp_config of the file src/backend/base/langflow/api/v1/mcp_projects.py of the component Model Context Protocol Configuration API. Performing a manipulation of the argument X-Forwarded-For results in injection. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-v4p8-mg3p-g94g
Package: litellm (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: >= 1.74.2, < 1.83.7
Patched in: 1.83.7

Summary: LiteLLM: Authenticated command execution via MCP stdio test endpoints

Details:
### Impact

Two endpoints used to preview an MCP server before saving it — `POST /mcp-rest/test/connection` and `POST /mcp-rest/test/tools/list` — accepted a full server configuration in the request body, including the `command`, `args`, and `env` fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process.

The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host.

### Patches

Fixed in **`1.83.7`**. Both test endpoints now require the `PROXY_ADMIN` role, bringing them into line with the save endpoint.

### Workarounds

If upgrading is not immediately possible, developers should block `POST /mcp-rest/test/connection` and `POST /mcp-rest/test/tools/list` at their reverse proxy or API gateway.
GitHub Security Advisory: GHSA-xfhx-r7ww-5995
Package: keras (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 3.13.0, < 3.13.2
Patched in: 3.13.2

Summary: Duplicate Advisory: Google Keras Allocates Resources Without Limits or Throttling in the HDF5 weight loading component

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-mgx6-5cf9-rr43. This link is maintained to preserve external references.

### Original Description
Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.12.0 and 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.
GitHub Security Advisory: GHSA-jgq2-vq69-gr6h
Package: openviking (PIP)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-636: Not Failing Securely ('Failing Open')
Vulnerable versions: < 0.3.9
Patched in: 0.3.9

Summary: OpenViking: Unauthenticated remote bot control via OpenAPI HTTP routes

Details:
OpenViking prior to commit c7bb167 contains an authentication bypass vulnerability in the VikingBot OpenAPI HTTP route surface where the authentication check fails open when the api_key configuration value is unset or empty. Remote attackers with network access to the exposed service can invoke privileged bot-control functionality without providing a valid X-API-Key header, including submitting attacker-controlled prompts, creating or using bot sessions, and accessing downstream tools, integrations, secrets, or data accessible to the bot.
GitHub Security Advisory: GHSA-gx2m-mcc2-r4p3
Package: wlc (PIP)
Severity: MODERATE (CVSS 5.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.0.0
Patched in: 2.0.0

Summary: wlc: print_html outputs API data without HTML escaping

Details:
### Impact
The HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser.


### Patches
* https://github.com/WeblateOrg/wlc/pull/1327

### Workarounds
The only vulnerable code path is HTML output which is opt-in.

### References
Weblate thanks @fg0x0 for reporting this on GitHub.
GitHub Security Advisory: GHSA-9jpj-cph8-w449
Package: langflow (PIP)
Severity: LOW (CVSS 4.3)
CWE: CWE-312: Cleartext Storage of Sensitive Information, CWE-313: Cleartext Storage in a File or on Disk
Vulnerable versions: < 1.9.1
Patched in: 1.9.1

Summary: Langflow: Cleartext Storage of Authentication Settings in Project Creation Endpoint

Details:
A security vulnerability has been detected in langflow-ai langflow up to 1.8.3. The affected element is the function create_project/encrypt_auth_settings of the file src/backend/base/Langflow/api/v1/projects.py of the component Project Creation Endpoint. Such manipulation of the argument auth_settings leads to cleartext storage in a file or on disk. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-5jjf-wcvf-923w
Package: langflow (PIP)
Severity: LOW (CVSS 2.7)
CWE: CWE-256: Plaintext Storage of a Password
Vulnerable versions: <= 1.8.3
Patched in: unpatched

Summary: Langflow has an Information Leak through Incomplete API Key Redaction

Details:
A weakness has been identified in langflow-ai langflow up to 1.8.3. Impacted is the function remove_api_keys/has_api_terms of the file src/backend/base/langflow/api/utils/core.py of the component Flow Using API. This manipulation causes unprotected storage of credentials. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-vvfc-fp59-m92g
Package: langflow-base (PIP)
Severity: MODERATE (CVSS 7.3)
CWE: CWE-284: Improper Access Control
Vulnerable versions: < 1.9.1
Patched in: 1.9.1

Summary: Langflow: DoS Through Lack of File Size Restriction via Deprecated Unauthenticated File Upload API

Details:
A security flaw has been discovered in langflow-ai langflow up to 1.1.0. This issue affects the function create_upload_file of the file src/backend/base/Langflow/api/v1/endpoints.py of the component API Endpoint. The manipulation results in unrestricted upload. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.