deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-qh7q-6qm3-653w
Package: jupyter-server (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: <= 2.17.0
Patched in: 2.18.0

Summary: Jupyter Server has an open redirection vulnerability in `next` query parameter

Details:
### Summary

The `?next=...` URL query parameter has an open redirection vulnerability. In `jupyter_server<=2.17.0`, this URL query parameter allows redirection to arbitrary external domains, which can be exploited to facilitate phishing attacks on server users.

### Details

The vulnerability is caused by insufficient validation in the `LoginFormHandler._redirect_safe()` method.

- Source code reference: https://github.com/jupyter-server/jupyter_server/blob/987ebdd5e188cdc49751b01a0d6782d686492a53/jupyter_server/auth/login.py#L33-L76

This vulnerability was originally reported by Noriaki Iwasaki. All discovery credit goes to them.

### PoC

1. Navigate to `http://localhost:8888/login?next=///google.com`
2. Observe that the user is redirected to `google.com` despite it being an external domain.

The external domain passed in the `?next` parameter may be replaced with a malicious lookalike to facilitate phishing attacks. Jupyter Server deployments served on a public domain are especially vulnerable, as `prod.company.com` may be redirected to a look-alike URL such as `prod.company.dev`. 

### Impact

This vulnerability affects all users, especially enterprise users who work with sensitive/confidential data.

### Patches

Jupyter Server 2.18+

### Workaround

None.
GitHub Security Advisory: GHSA-8pqq-224h-x875
Package: ogham-mcp (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-798: Use of Hard-coded Credentials
Vulnerable versions: >= 0.6.3, < 0.11.1
Patched in: 0.11.1

Summary: ogham-mcp had credentials embedded in published PyPI sdists -- Neon postgres URLs and Voyage API key

Details:
## Summary

Between 2026-02 and 2026-04-24 a total of 22 public PyPI sdists of `ogham-mcp` contained development credentials embedded in source files. All credentials have since been rotated on the respective providers. No known exploitation. Upgrade to **v0.11.1** to get a clean release.

## What was leaked

| Credential | Location in sdist | Vulnerable range | Count |
|---|---|---|---|
| 3x Neon postgres URLs with passwords (US / EU / AP development databases) | top-level `Makefile` (`NEON_US`, `NEON_EU`, `NEON_AP` vars) | `>=0.6.5, <0.11.0` | 21 sdists |
| 1x Voyage AI API key (`pa-...`) | `tests/test_hooks.py::test_mask_secrets_key_value` -- test fixture that fed a real key into the redaction-function tester | `>=0.6.3, <0.11.1` | 22 sdists |

## Impact

- **Primary risk**: any consumer of the affected sdists could have extracted the credentials and used them. The Neon URLs pointed at development databases; the Voyage key was a rate-limited API key.
- **Observed exploitation**: none detected. Audit logs on both providers were reviewed post-rotation.
- **Remediation on our side**:
  - Neon passwords for all three regions rotated.
  - Voyage API key rotated.
  - All affected versions yanked from PyPI (v0.3.0 through v0.10.4 yanked on 2026-04-24; v0.11.0 pending yank after this advisory).
  - v0.11.0 removed the Neon URLs and introduced `make publish-check` which scans every sdist for credential patterns before upload.
  - v0.11.1 scrubs the Voyage key from the test fixture and excludes `benchmarks/`, `docs/`, `research/`, `extras/`, and `**/*.env*` from all future sdists via explicit hatchling sdist include/exclude in `pyproject.toml`.

## Action for users

- If users installed any version from `v0.3.0` through `v0.11.0`, upgrade to **v0.11.1** immediately:
  ```
  pip install --upgrade "ogham-mcp>=0.11.1"
  ```
- Users do not need to rotate anything on their end. The leaked credentials were owned by the project maintainer, not by users.

## Credit

Discovered during an internal pre-release audit on 2026-04-24 while preparing v0.11.1.
GitHub Security Advisory: GHSA-3h23-7824-pj8r
Package: archivebox (PIP)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Vulnerable versions: <= 0.8.6rc0
Patched in: unpatched

Summary: ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView

Details:
The /add/ endpoint (AddView in core/views.py) accepts a config JSON field that gets merged into the crawl config without validation. This config is exported as environment variables when archive plugins run, allowing injection of arbitrary tool arguments to achieve RCE.

When PUBLIC_ADD_VIEW=True (common for bookmarklet usage), this is exploitable without authentication. The endpoint is also @csrf_exempt.

Affected code:

core/views.py:887 - user config extracted with no validation:

```python
custom_config = form.cleaned_data.get("config") or {}
```

core/views.py:918 - merged into crawl config:

```python
config.update(custom_config)
```

config/configset.py:255-256 - crawl config applied with high priority:

```python
if crawl and hasattr(crawl, "config") and crawl.config:
    config.update(crawl.config)
```

hooks.py:398-411 - config exported as env vars:

```python
for key, value in config.items():
    if key in SKIP_KEYS: continue
    env[key] = str(value)
```

plugins/ytdlp/on_Snapshot__02_ytdlp.bg.py:122-123 - env var args passed to yt-dlp:

```python
ytdlp_args_extra = get_env_array("YTDLP_ARGS_EXTRA", [])
cmd.extend(ytdlp_args_extra)
```

PoC (pre-auth when PUBLIC_ADD_VIEW=True):

```bash
curl -X POST http://localhost:8000/add/ \
  -d "url=https://www.youtube.com/watch?v=dQw4w9WgXcQ" \
  -d "depth=0" \
  -d "config={\"YTDLP_ARGS_EXTRA\": \"[\\\"--exec\\\", \\\"id > /tmp/pwned\\\"]\"}" 
```

After the crawl runs, yt-dlp executes id > /tmp/pwned via its --exec flag.

Same approach works with GALLERYDL_ARGS_EXTRA (gallery-dl --exec), or overriding any *_BINARY key.

Impact: Remote code execution on the ArchiveBox server. Pre-auth when PUBLIC_ADD_VIEW=True.
GitHub Security Advisory: GHSA-v7cp-2cx9-x793
Package: changedetection.io (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: <= 0.54.9
Patched in: unpatched

Summary: changedetection.io project has an XXE vulnerability

Details:
# changedetection.io_XXE_01 Vulnerability Report: We discovered a XXE vulnerability in the changedetection.io project

While analyzing the code logic, it was determined that an area may lead to unintended behavior under specific conditions. With the project's security in mind, see the analysis results to discern whether this may indicate a potential security risk.

## Overview
- SOURCE_VERSION: `0.54.9 (9f3a9fdc18bba404244801e5df8109e213ce9ff4)`
- Vulnerability type: `XXE`
- Finding title: `XML XPath helpers parse untrusted XML with entity resolution left to lxml defaults`
- Affected location: `changedetectionio/html_tools.py:287`

## Root Cause
`xpath_filter()` switches to XML mode for XML/RSS content and creates `etree.XMLParser(strip_cdata=False)` without explicitly disabling external entity resolution, external DTD loading, or network-backed entity lookup. The helper then parses untrusted XML bytes directly with `etree.fromstring(...)`.

## Source-to-Sink Chain
1. Untrusted XML/RSS response content is fetched from monitored URLs.
2. Stream detection marks the content as XML/RSS and the include-filter path invokes `xpath_filter(..., is_xml=True)`.
3. `xpath_filter()` builds the default XML parser and calls `etree.fromstring(...)` at `changedetectionio/html_tools.py:287`.
4. External entity declarations in attacker XML can be expanded by parser-default behavior in affected runtime combinations.

## Exploitation Preconditions
1. Attacker controls the watched XML/RSS response body.
2. The watch uses an XPath include filter that triggers XML helper parsing.
3. Runtime parser behavior allows external entity expansion (for example, vulnerable dependency/default combinations).
4. The process can read the referenced local resource.

## Risk
The XML helper path can turn watch processing into a local file disclosure primitive when entity expansion is enabled by parser defaults.

## Impact
Sensitive local files can be exposed into extracted watch output, diff history, and downstream notification channels.

## Remediation
1. Harden XML parser construction with `resolve_entities=False`, `load_dtd=False`, and `no_network=True`.
2. Reject `DOCTYPE`/entity declarations for untrusted XML if DTD features are unnecessary.
3. Add regression tests that assert external entities are never expanded in XPath XML helper flows.
GitHub Security Advisory: GHSA-pwv6-vv43-88gr
Package: pillow (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-190: Integer Overflow or Wraparound, CWE-787: Out-of-bounds Write
Vulnerable versions: >= 10.3.0, < 12.2.0
Patched in: 12.2.0

Summary: Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)

Details:
### Impact
Processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution.

### Patches
Patched version: 12.2.0

Pillow 12.1.1 addressed CVE-2026-25990 by adding checks for tile extents in PSD image decoding/encoding to prevent an out-of-bounds write. However, the bounds checks computed tile extent sums using types susceptible to integer overflow, meaning a PSD image with carefully chosen tile dimensions could produce values that wrap around and bypass the checks, still triggering an out-of-bounds write in src/decode.c and src/encode.c. The fix avoids adding extents together before comparison.

### Workarounds
Use any version but affected versions: >= 10.3.0, < 12.2.0

### Resources
 - Fix: https://github.com/python-pillow/Pillow/pull/9520 
 - Original issue: CVE-2026-25990 (Pillow 12.1.1)
GitHub Security Advisory: GHSA-r73j-pqj5-w3x7
Package: pillow (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
Vulnerable versions: >= 4.2.0, < 12.2.0
Patched in: 12.2.0

Summary: Pillow has a PDF Parsing Trailer Infinite Loop (DoS)

Details:
### Impact
An attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive.

### Patches
Patched version: 12.2.0.

PdfParser (introduced in Pillow 4.2.0) follows Prev pointers in PDF trailers to read cross-reference sections. If a
trailer's Prev pointer references an offset that has already been processed — either pointing to itself or forming a
longer cycle — the parser enters an infinite loop. Pillow now tracks previously processed trailer offsets and raises an
error if a cycle is detected.

### Workarounds
Use any version but the affected versions: >= 4.2.0, < 12.2.0

### Resources
 - Fix: https://github.com/python-pillow/Pillow/pull/9519
GitHub Security Advisory: GHSA-wjx4-4jcj-g98j
Package: pillow (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-190: Integer Overflow or Wraparound
Vulnerable versions: < 12.2.0
Patched in: 12.2.0

Summary: Pillow has an integer overflow when processing fonts

Details:
If a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This has been fixed.
GitHub Security Advisory: GHSA-5xmw-vc9v-4wf2
Package: pillow (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-122: Heap-based Buffer Overflow
Vulnerable versions: >= 11.2.1, < 12.2.0
Patched in: 12.2.0

Summary: Pillow has a heap buffer overflow with nested list coordinates

Details:
Passing nested lists as coordinates to APIs that accept coordinates such as `ImagePath.Path`, `ImageDraw.ImageDraw.polygon` and `ImageDraw.ImageDraw.line` could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This was introduced in Pillow 11.2.1.
GitHub Security Advisory: GHSA-r35x-v8p8-xvhw
Package: pyp2spec (PIP)
Severity: HIGH (CVSS 7.8)
CWE: CWE-20: Improper Input Validation, CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 0.14.1
Patched in: 0.14.1

Summary: pyp2spec is Vulnerable to Code Injection

Details:
### Impact
pyp2spec was writing PyPI package metadata (e.g. the summary field) into the generated spec file without escaping RPM macro directives. When a packager then runs rpmbuild, those directives get evaluated, so a malicious package can execute arbitrary commands on the build machine.

The macro evaluates during spec parsing, not only during the build step. Any rpm tool touching the generated spec triggers execution, `rpmbuild -bs`, `rpmbuild --nobuild`, `rpm -q --specfile`, so the victim doesn't need to commit to a full build before getting compromised. The realistic attack path is typosquatting or targeting a package known to be under Fedora review rather than drive-by publishing. Fedora packagers hold dist-git SSH keys, Koji build credentials, and Bodhi update credentials, so compromise of one packager's workstation enables committing malicious source to dist-git and riding it through the normal build pipeline to end users.

### Patches
Patched in 0.14.1.

### Workarounds
None
GitHub Security Advisory: GHSA-h57c-v2v3-5v3v
Package: verl (PIP)
Severity: LOW (CVSS 5.6)
CWE: CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Vulnerable versions: <= 0.7.1
Patched in: unpatched

Summary: verl's math_equal() Vulnerable to Arbitrary Code Execution via Unsafe eval()

Details:
A vulnerability was identified in ByteDance verl up to 0.7.1. Affected is the function math_equal of the file prime_math/grader.py. The manipulation leads to a sandbox issue. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit is publicly available and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-rcmw-7mc7-3rj7
Package: sentry (PIP)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-290: Authentication Bypass by Spoofing
Vulnerable versions: >= 21.12.0, <= 26.4.0
Patched in: 26.4.1

Summary: Sentry's improper authentication on SAML SSO process allows user identity linking

Details:
### Impact
A critical vulnerability was discovered in the SAML SSO implementation of Sentry. It was reported to us via Sentry's private bug bounty program.

The vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. The victim email address must be known in order to exploit this vulnerability.

Self-hosted users are only vulnerable if the following conditions are met:
- They have more than one organization configured (SENTRY_SINGLE_ORGANIZATION = False).
- A malicious user has existing access and permissions to modify SSO settings for another organization in their multi-organization instance. 

### Patches
- [Sentry SaaS](https://sentry.io/): The fix was deployed in April. No action is required.
- [Self-Hosted Sentry](https://github.com/getsentry/self-hosted): If only a single organization is allowed (SENTRY_SINGLE_ORGANIZATION = True), then no action is needed. Sentry recommends upgrading to version 26.4.1 or higher.

### Workarounds
User account-based two-factor authentication prevents an attacker from being able to complete authentication with a victim's user account. Organization administrators cannot do this on a user's behalf, this requires individual users to ensure 2FA has been enabled for their account.

Users can manage their two-factor authentication settings through Account Settings > [Security](https://sentry.io/settings/account/security/) page. For step-by-step details, please see the Sentry [helpdesk article](https://sentry.zendesk.com/hc/en-us/articles/[PII_REDACTED]4235-How-do-I-enable-two-factor-authentication-2FA-on-my-Sentry-account).

### Resources

- https://github.com/getsentry/sentry/pull/113720 

Please note that this is distinct vulnerability from the similar https://github.com/getsentry/sentry/security/advisories/GHSA-7pq6-v88g-wf3w from 2025.
GitHub Security Advisory: GHSA-cr24-fv3h-8cjm
Package: agentscope (PIP)
Severity: MODERATE (CVSS 7.3)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: <= 1.0.18
Patched in: unpatched

Summary: AgentScope Vulnerable to Remote Code Injection

Details:
A vulnerability was determined in modelscope agentscope up to 1.0.18. Affected by this vulnerability is the function execute_python_code/execute_shell_command of the file src/AgentScope/tool/_coding/_python.py. This manipulation causes code injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-cg4x-64p3-x59h
Package: ckan (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 2.11.0, <= 2.11.4
Patched in: 2.11.5

Summary: CKAN has Unauthenticated Authorization Bypass in `datastore_search_sql`

Details:
### Impact

A vulnerability in `datastore_search_sql` allowed attackers to bypass authorization in order to gain access to private resources and PostgreSQL system information

### Patches
The issue has been patched in CKAN 2.10.10 and CKAN 2.11.5

### Workarounds
Disable the DataStore SQL search (`ckan.datastore.sqlsearch.enabled = false`). Note that the SQL search is disabled by default.

### More information

As stated in the [documentation](https://docs.ckan.org/en/2.11/maintaining/configuration.html#ckan-datastore-sqlsearch-enabled), this action function has protections that offer some safety but are not designed to prevent all types of abuse. Depending on the sensitivity of private data in your DataStore and the likelihood of abuse of your site, you may choose to disable this action function or restrict its use with a [`IAuthFunctions`](https://docs.ckan.org/en/2.11/extensions/plugin-interfaces.html#ckan.plugins.interfaces.IAuthFunctions) plugin.

### Credits

* Reported by Arvin Shivram of Brutecat Security
GitHub Security Advisory: GHSA-cg4x-64p3-x59h
Package: ckan (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 2.10.10
Patched in: 2.10.10

Summary: CKAN has Unauthenticated Authorization Bypass in `datastore_search_sql`

Details:
### Impact

A vulnerability in `datastore_search_sql` allowed attackers to bypass authorization in order to gain access to private resources and PostgreSQL system information

### Patches
The issue has been patched in CKAN 2.10.10 and CKAN 2.11.5

### Workarounds
Disable the DataStore SQL search (`ckan.datastore.sqlsearch.enabled = false`). Note that the SQL search is disabled by default.

### More information

As stated in the [documentation](https://docs.ckan.org/en/2.11/maintaining/configuration.html#ckan-datastore-sqlsearch-enabled), this action function has protections that offer some safety but are not designed to prevent all types of abuse. Depending on the sensitivity of private data in your DataStore and the likelihood of abuse of your site, you may choose to disable this action function or restrict its use with a [`IAuthFunctions`](https://docs.ckan.org/en/2.11/extensions/plugin-interfaces.html#ckan.plugins.interfaces.IAuthFunctions) plugin.

### Credits

* Reported by Arvin Shivram of Brutecat Security
GitHub Security Advisory: GHSA-cwcx-382v-8m9g
Package: weblate (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation, CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 5.17.1
Patched in: 5.17.1

Summary: Weblate Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url

Details:
### Impact
An authenticated user with `project.add` permission (default on hosted Weblate SaaS and for any user holding an active billing/trial plan) can import a crafted project backup ZIP whose `components/<name>.json` contains an attacker-chosen `repo` URL pointing at a **private address** (e.g. `http://127.0.0.1:9999/`) or using a **non-allow-listed scheme** (e.g. `file://`, `git://`). Weblate persists the component via `Component.objects.bulk_create([component])[0]`, which bypasses Django's `full_clean()` and therefore never runs the `validate_repo_url` validator. The URL is subsequently written verbatim into `.git/config` by `configure_repo(pull=False)`.

### Patches
* https://github.com/WeblateOrg/weblate/pull/19061
* https://github.com/WeblateOrg/weblate/pull/19062 

### Workarounds
Limiting who can create projects limits the scope.

### Resources
Weblate thanks @fg0x0 for reporting this vulnerability via GitHub.
GitHub Security Advisory: GHSA-6j8j-4qp3-36p2
Package: weblate (PIP)
Severity: MODERATE (CVSS 4.2)
CWE: CWE-613: Insufficient Session Expiration
Vulnerable versions: < 5.17.1
Patched in: 5.17.1

Summary: Weblate Doesn't Invalidate API Token on Password Change

Details:
### Impact
When a user changes their password, browser sessions are correctly invalidated via `cycle_session_keys()`, but DRF API tokens (`wlu_*` prefix) stored in `authtoken_token` are not revoked.

### Patches
* https://github.com/WeblateOrg/weblate/pull/19057

### Resources
Weblate thanks Sang Yu Jeon for reporting this via GitHub.
GitHub Security Advisory: GHSA-rch3-82jr-f9w9
Package: jupyterlab (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: <= 4.5.6
Patched in: 4.5.7

Summary: Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS

Details:
### Impact

A stored Cross-Site Scripting (XSS) vulnerability in Jupyter Notebook allows attackers to steal authentication tokens from users who open malicious notebook files and interact with elements that the attacker can make look indistinguishable from legitimate controls (single click interaction).

The vulnerability enables complete account takeover through the Jupyter REST API, allowing the attacker to:
1. Read all files
2. Modify/create files
3. Access running kernels and execute arbitrary code
4. Create terminals for shell access

### Patches

Jupyter Notebook 7.5.6 and JupyterLab 4.5.7 include patches for this vulnerability.

### Workarounds

The help extension can be disabled via CLI:

```
jupyter labextension disable @jupyter-notebook/help-extension
jupyter labextension disable @jupyterlab/help-extension
```

### Hardening

The patched versions include a toggle to disable the command linker functionality altogether, for example via `overrides.json`:

```json
{
  "@jupyterlab/apputils-extension:sanitizer": {
    "allowCommandLinker": false
  }
}
```

### Resources

- https://jupyterlab.readthedocs.io/en/latest/user/commands.html#commands-in-markdown-output-and-files

### Acknowledgments

Reported by Daniel Teixeira - NVIDIA AI Red Team