deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-cjjf-27cc-pvmv
Package: pyload-ng (PIP)
Severity: HIGH (CVSS 8.1)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-94: Improper Control of Generation of Code ('Code Injection'), CWE-116: Improper Encoding or Escaping of Output
Vulnerable versions: < 0.5.0b3.dev91
Patched in: 0.5.0b3.dev91

Summary: pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters

Details:
### Summary
pyLoad web interface contained insufficient input validation in both the Captcha script endpoint and the Click'N'Load (CNL) Blueprint. This flaw allowed untrusted user input to be processed unsafely, which could be exploited by an attacker to inject arbitrary content into the web UI or manipulate request handling. The vulnerability could lead to client-side code execution (XSS) or other unintended behaviors when a malicious payload is submitted.

user-supplied parameters from HTTP requests were not adequately validated or sanitized before being passed into the application logic and response generation. This allowed crafted input to alter the expected execution flow.
 CNL (Click'N'Load) blueprint exposed unsafe handling of untrusted parameters in HTTP requests. The application did not consistently enforce input validation or encoding, making it possible for an attacker to craft malicious requests.

### PoC

1. Run a vulnerable version of pyLoad prior to commit [`f9d27f2`](https://github.com/pyload/pyload/pull/4624).
2. Start the web UI and access the Captcha or CNL endpoints.
3. Submit a crafted request containing malicious JavaScript payloads in unvalidated parameters (`/flash/addcrypted2?jk=function(){alert(1)}&crypted=12345`).
4. Observe that the payload is reflected and executed in the client’s browser, demonstrating cross-site scripting (XSS).

Example request:

```http
GET /flash/addcrypted2?jk=function(){alert(1)}&crypted=12345 HTTP/1.1
Host: 127.0.0.1:8000
Content-Type: application/x-www-form-urlencoded
Content-Length: 107
```

### Refferences
- https://github.com/pyload/pyload/commit/5823327d0b797161c7195a1f660266d30a69f0ca
- [`@4624`](https://github.com/pyload/pyload/pull/4624)

### Impact

Exploiting this vulnerability allows an attacker to inject and execute arbitrary JavaScript within the browser session of a user accessing the pyLoad Web UI. In practice, this means an attacker could impersonate an administrator, steal authentication cookies or tokens, and perform unauthorized actions on behalf of the victim. Because the affected endpoints are part of the core interface, a successful attack undermines the trust and security of the entire application, potentially leading to a full compromise of the management interface and the data it controls. The impact is particularly severe in cases where the Web UI is exposed over a network without additional access restrictions, as it enables remote attackers to directly target users with crafted links or requests that trigger the vulnerability.
GitHub Security Advisory: GHSA-m9mp-6x32-5rhg
Package: scio-pypi (PIP)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: <= 1.0.0
Patched in: unpatched

Summary: scio is vunerable to  Remote Command Execution  through PyTorch

Details:
### Impact
PyTorch reported a [**critical** vulnerability](https://github.com/pytorch/pytorch/security/advisories/GHSA-53q9-r3pm-6pq6) when using `torch.load`, even with option `weights_only=True`, for `torch <= 2.5.1`.

In `scio <= 1.0.0`, the lower bound for `torch` is `2.3`.

### Patches
The lower bound was changed to `torch >= 2.6`, starting from `scio >= 1.0.1` (currently in dev state).

### Workarounds
You can manually check that you are using `torch >= 2.6`.
GitHub Security Advisory: GHSA-fh66-fcv5-jjfr
Package: matrix-synapse (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-1287: Improper Validation of Specified Type of Input
Vulnerable versions: >= 1.139.0rc2, < 1.139.1
Patched in: 1.139.1

Summary: Synapse's invalid device keys degrade federation functionality

Details:
### Impact

Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attacker registered on the victim homeserver to degrade federation functionality, unpredictably breaking outbound federation to other homeservers. 

### Patches

Patched in Synapse 1.138.3, 1.138.4, 1.139.1, and 1.139.2.

Note that even though 1.138.3 and 1.139.1 fix the vulnerability, they inadvertently introduced an unrelated regression. For this reason, it is recommend to skip these releases and upgrading straight to 1.138.4 and 1.139.2.

### Workarounds

The vulnerability can only be exploited by users registered on the victim homeserver.
GitHub Security Advisory: GHSA-fh66-fcv5-jjfr
Package: matrix-synapse (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-1287: Improper Validation of Specified Type of Input
Vulnerable versions: < 1.138.3
Patched in: 1.138.3

Summary: Synapse's invalid device keys degrade federation functionality

Details:
### Impact

Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attacker registered on the victim homeserver to degrade federation functionality, unpredictably breaking outbound federation to other homeservers. 

### Patches

Patched in Synapse 1.138.3, 1.138.4, 1.139.1, and 1.139.2.

Note that even though 1.138.3 and 1.139.1 fix the vulnerability, they inadvertently introduced an unrelated regression. For this reason, it is recommend to skip these releases and upgrading straight to 1.138.4 and 1.139.2.

### Workarounds

The vulnerability can only be exploited by users registered on the victim homeserver.
GitHub Security Advisory: GHSA-m42m-m8cr-8m58
Package: langchain-text-splitters (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: < 0.3.9
Patched in: 0.3.9

Summary: LangChain Text Splitters is vulnerable to XML External Entity (XXE) attacks due to unsafe XSLT parsing

Details:
The HTMLSectionSplitter class in langchain-text-splitters is vulnerable to XML External Entity (XXE) attacks due to unsafe XSLT parsing. This vulnerability arises because the class allows the use of arbitrary XSLT stylesheets, which are parsed using lxml.etree.parse() and lxml.etree.XSLT() without any hardening measures. In lxml versions up to 4.9.x, external entities are resolved by default, allowing attackers to read arbitrary local files or perform outbound HTTP(S) fetches. In lxml versions 5.0 and above, while entity expansion is disabled, the XSLT document() function can still read any URI unless XSLTAccessControl is applied. This vulnerability allows remote attackers to gain read-only access to any file the LangChain process can reach, including sensitive files such as SSH keys, environment files, source code, or cloud metadata. No authentication, special privileges, or user interaction are required, and the issue is exploitable in default deployments that enable custom XSLT.
GitHub Security Advisory: GHSA-6fvq-23cw-5628
Package: vllm (PIP)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-20: Improper Input Validation, CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 0.5.1, < 0.11.0
Patched in: 0.11.0

Summary: vLLM: Resource-Exhaustion (DoS) through Malicious Jinja Template in OpenAI-Compatible Server

Details:
### Summary

A resource-exhaustion (denial-of-service) vulnerability exists in multiple endpoints of the OpenAI-Compatible Server due to the ability to specify Jinja templates via the `chat_template` and `chat_template_kwargs` parameters. If an attacker can supply these parameters to the API, they can cause a service outage by exhausting CPU and/or memory resources.

### Details

When using an LLM as a chat model, the conversation history must be rendered into a text input for the model. In `hf/transformer`, this rendering is performed using a Jinja template. The OpenAI-Compatible Server launched by vllm serve exposes a `chat_template` parameter that lets users specify that template. In addition, the server accepts a `chat_template_kwargs` parameter to pass extra keyword arguments to the rendering function.

Because Jinja templates support programming-language-like constructs (loops, nested iterations, etc.), a crafted template can consume extremely large amounts of CPU and memory and thereby trigger a denial-of-service condition.

Importantly, simply forbidding the `chat_template` parameter does not fully mitigate the issue. The implementation constructs a dictionary of keyword arguments for `apply_hf_chat_template` and then updates that dictionary with the user-supplied `chat_template_kwargs` via `dict.update`. Since `dict.update` can overwrite existing keys, an attacker can place a `chat_template` key inside `chat_template_kwargs` to replace the template that will be used by `apply_hf_chat_template`.


```python
# vllm/entrypoints/openai/serving_engine.py#L794-L816
_chat_template_kwargs: dict[str, Any] = dict(
    chat_template=chat_template,
    add_generation_prompt=add_generation_prompt,
    continue_final_message=continue_final_message,
    tools=tool_dicts,
    documents=documents,
)
_chat_template_kwargs.update(chat_template_kwargs or {})

request_prompt: Union[str, list[int]]
if isinstance(tokenizer, MistralTokenizer):
    ...
else:
    request_prompt = apply_hf_chat_template(
        tokenizer=tokenizer,
        conversation=conversation,
        model_config=model_config,
        **_chat_template_kwargs,
    )
```

### Impact

If an OpenAI-Compatible Server exposes endpoints that accept `chat_template` or `chat_template_kwargs` from untrusted clients, an attacker can submit a malicious Jinja template (directly or by overriding `chat_template` inside `chat_template_kwargs`) that consumes excessive CPU and/or memory. This can result in a resource-exhaustion denial-of-service that renders the server unresponsive to legitimate requests.

### Fixes

* https://github.com/vllm-project/vllm/pull/25794
GitHub Security Advisory: GHSA-wr9h-g72x-mwhm
Package: vllm (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-385: Covert Timing Channel
Vulnerable versions: < 0.11.0
Patched in: 0.11.0

Summary: vLLM is vulnerable to timing attack at bearer auth

Details:
### Summary
The API key support in vLLM performed validation using a method that was vulnerable to a timing attack. This could potentially allow an attacker to discover a valid API key using an approach more efficient than brute force.

### Details
https://github.com/vllm-project/vllm/blob/4b946d693e0af15740e9ca9c0e059d5f333b1083/vllm/entrypoints/openai/api_server.py#L1270-L1274

API key validation used a string comparison that will take longer the more characters the provided API key gets correct. Data analysis across many attempts can allow an attacker to determine when it finds the next correct character in the key sequence.
 
### Impact
Deployments relying on vLLM's built-in API key validation are vulnerable to authentication bypass using this technique.
GitHub Security Advisory: GHSA-579p-qf78-fqm2
Package: clearml (PIP)
Severity: MODERATE (CVSS 5.8)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 2.0.2
Patched in: 2.0.2

Summary: clearml is vulnerable to Path Traversal through its `safe_extract` function

Details:
A vulnerability in clearml versions before 2.0.2 allows for path traversal due to improper handling of symbolic and hard links in the `safe_extract` function. This flaw can lead to arbitrary file writes outside the intended directory, potentially resulting in remote code execution if critical files are overwritten.
GitHub Security Advisory: GHSA-q92x-2x5g-h365
Package: zenml (PIP)
Severity: MODERATE (CVSS 6.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 0.81.0, < 0.84.2
Patched in: 0.84.2

Summary: ZenML is vulnerable to Path Traversal through its `PathMaterializer` class

Details:
ZenML version 0.83.1 is affected by a path traversal vulnerability in the `PathMaterializer` class. The `load` function uses `is_path_within_directory` to validate files during `data.tar.gz` extraction, which fails to effectively detect symbolic and hard links. This vulnerability can lead to arbitrary file writes, potentially resulting in arbitrary command execution if critical files are overwritten.
GitHub Security Advisory: GHSA-g8c6-8fjj-2r4m
Package: python-socketio (PIP)
Severity: MODERATE (CVSS 6.4)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 0.8.0, < 5.14.0
Patched in: 5.14.0

Summary: python-socketio vulnerable to arbitrary Python code execution (RCE) through malicious pickle deserialization in certain multi-server deployments

Details:
### Summary
A remote code execution vulnerability in python-socketio versions prior to 5.14.0 allows attackers to execute arbitrary Python code through malicious pickle deserialization in multi-server deployments on which the attacker previously gained access to the message queue that the servers use for internal communications.

### Details
When Socket.IO servers are configured to use a message queue backend such as Redis for inter-server communication, messages sent between the servers are encoded using the `pickle` Python module. When a server receives one of these messages through the message queue, it assumes it is trusted and immediately deserializes it.

The vulnerability stems from deserialization of messages using Python's `pickle.loads()` function. Having previously obtained access to the message queue, the attacker can send a python-socketio server a crafted pickle payload that executes arbitrary code during deserialization via Python's `__reduce__` method.

### Impact
This vulnerability only affects deployments with a compromised message queue. The attack can lead to the attacker executing random code in the context of, and with the privileges of a Socket.IO server process. 

Single-server systems that do not use a message queue, and multi-server systems with a secure message queue are not vulnerable.

### Remediation
In addition to making sure standard security practices are followed in the deployment of the message queue, users of the python-socketio package can upgrade to version 5.14.0 or newer, which remove the `pickle` module and use the much safer JSON encoding for inter-server messaging.
GitHub Security Advisory: GHSA-h952-963h-rv99
Package: executorch (PIP)
Severity: HIGH (CVSS 8.1)
CWE: CWE-122: Heap-based Buffer Overflow
Vulnerable versions: <= 0.6.0
Patched in: 0.7.0

Summary: ExecuTorch vulnerable to Heap-based Buffer Overflow attack

Details:
A heap-buffer-overflow vulnerability in the loading of ExecuTorch methods can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit 93b1a0c15f7eda49b2bc46b5b4c49557b4e9810f
GitHub Security Advisory: GHSA-8c95-hpq2-w46f
Package: nicegui (PIP)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 3.0.0
Patched in: 3.0.0

Summary: NiceGUI has a Reflected XSS

Details:
### Summary

A Cross-Site Scripting (XSS) risk exists in NiceGUI when developers render unescaped user input into the DOM using `ui.html()`. Before version 3.0, NiceGUI does not enforce HTML or JavaScript sanitization, so applications that directly combine components like `ui.input()` with `ui.html()` without escaping may allow attackers to execute arbitrary JavaScript in the user’s browser. Same holds for `ui.chat_message` with HTML content.

Applications that directly reflect user input via `ui.html()` (or `ui.chat_message` in HTML mode) are affected. This may lead to client-side code execution (e.g., session hijacking or phishing). Applications that do not pass untrusted input into ui.html() are not affected.

### Details

NiceGUI allows developers to bind user input directly into the DOM using `ui.html()` or `ui.chat_message()`. However, the library does not enforce any HTML or JavaScript sanitization, which potentially creates a dangerous attack surface for developers unaware of this behavior.

The vulnerable code path appears when combining these:

```python
ui.input("XSS Input:", on_change=inject)
def inject(e):
    ui.html(f'{e.value}')
```

In this setup, any input provided by the user is rendered **verbatim** into the page’s DOM via innerHTML, enabling injection of script-based payloads.

### PoC (Proof of Concept)

1. Create a simple app:

   ```python
   from nicegui import ui

   @ui.page('/')
   def main():
       def inject(e):
           ui.html(f'{e.value}')  # vulnerable use

       ui.input("XSS Input:", on_change=inject)

   ui.run()
   ```

2. Run the app:

   ```bash
   python app.py
   ```

3. In the browser, input the following payload:

   ```html
   <img src=x onerror=alert('XSS')>
   ```

4. Observe the JavaScript alert popup:

   ```
   XSS
   ```

### Impact

* **Vulnerability type:** Reflected Cross-Site Scripting (XSS)
* **Attack vector:** User input rendered as raw HTML
* **Affected users:** Any NiceGUI-based application using `ui.html()` or `ui.chat_message()` with HTML content from user input
GitHub Security Advisory: GHSA-6px8-mr29-cj4r
Package: datachain (PIP)
Severity: LOW (CVSS 2.5)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 0.34.2
Patched in: 0.34.2

Summary: DataChain Vulnerable to Deserialization of Untrusted Data from Environment Variables

Details:
The DataChain library reads serialized objects from environment variables (such as `DATACHAIN__METASTORE` and `DATACHAIN__WAREHOUSE`) in the `loader.py` module. An attacker with the ability to set these environment variables can trigger code execution when the application loads.
GitHub Security Advisory: GHSA-hpr9-3m2g-3j9p
Package: django (PIP)
Severity: HIGH (CVSS 7.1)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 5.2, < 5.2.7
Patched in: 5.2.7

Summary: Django vulnerable to SQL injection in column aliases

Details:
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).
GitHub Security Advisory: GHSA-hpr9-3m2g-3j9p
Package: django (PIP)
Severity: HIGH (CVSS 7.1)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 5.1, < 5.1.13
Patched in: 5.1.13

Summary: Django vulnerable to SQL injection in column aliases

Details:
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).
GitHub Security Advisory: GHSA-hpr9-3m2g-3j9p
Package: django (PIP)
Severity: HIGH (CVSS 7.1)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 4.2, < 4.2.25
Patched in: 4.2.25

Summary: Django vulnerable to SQL injection in column aliases

Details:
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).
GitHub Security Advisory: GHSA-q95w-c7qg-hrff
Package: django (PIP)
Severity: LOW (CVSS 3.1)
CWE: CWE-23: Relative Path Traversal
Vulnerable versions: >= 5.2, < 5.2.7
Patched in: 5.2.7

Summary: Django vulnerable to partial directory traversal via archives

Details:
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.
GitHub Security Advisory: GHSA-q95w-c7qg-hrff
Package: django (PIP)
Severity: LOW (CVSS 3.1)
CWE: CWE-23: Relative Path Traversal
Vulnerable versions: >= 5.1, < 5.1.13
Patched in: 5.1.13

Summary: Django vulnerable to partial directory traversal via archives

Details:
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.
GitHub Security Advisory: GHSA-q95w-c7qg-hrff
Package: django (PIP)
Severity: LOW (CVSS 3.1)
CWE: CWE-23: Relative Path Traversal
Vulnerable versions: >= 4.2, < 4.2.25
Patched in: 4.2.25

Summary: Django vulnerable to partial directory traversal via archives

Details:
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.
GitHub Security Advisory: GHSA-5m5w-w2h2-fqgq
Package: spdk (PIP)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer, CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Vulnerable versions: < 25.9
Patched in: 25.9

Summary: SPDK is vulnerable to buffer overflow in the NVMe-oF target component

Details:
Storage Performance Development Kit (SPDK) 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf.
GitHub Security Advisory: GHSA-538v-3wq9-4h3r
Package: pyfury (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 0.1.0, <= 0.10.3
Patched in: unpatched

Summary: Apache Pyfory python is vulnerable to deserialization of untrusted data

Details:
Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary code execution. An application is vulnerable if it reads pyfory serialized data from untrusted sources. An attacker can craft a data stream that selects pickle-fallback serializer during deserialization, leading to the execution of `pickle.loads`, which is vulnerable to remote code execution.

Users are recommended to upgrade to pyfory version 0.12.3 or later, which has removed pickle fallback serializer and thus fixes this issue.
GitHub Security Advisory: GHSA-538v-3wq9-4h3r
Package: pyfory (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 0.12.0, < 0.12.3
Patched in: 0.12.3

Summary: Apache Pyfory python is vulnerable to deserialization of untrusted data

Details:
Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary code execution. An application is vulnerable if it reads pyfory serialized data from untrusted sources. An attacker can craft a data stream that selects pickle-fallback serializer during deserialization, leading to the execution of `pickle.loads`, which is vulnerable to remote code execution.

Users are recommended to upgrade to pyfory version 0.12.3 or later, which has removed pickle fallback serializer and thus fixes this issue.