deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-mrvr-7493-pfq3
Package: aim (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 3.22.0
Patched in: unpatched

Summary: Aim Path Traversal vulnerability

Details:
In version 3.22.0 of aimhubio/aim, the LocalFileManager._cleanup function in the aim tracking server accepts a user-specified glob-pattern for deleting files. The function does not verify that the matched files are within the directory managed by LocalFileManager, allowing a maliciously crafted glob-pattern to lead to arbitrary file deletion.
GitHub Security Advisory: GHSA-jccx-m9v4-9hwh
Package: lollms (PIP)
Severity: HIGH (CVSS 8.4)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 11.0.0
Patched in: 11.0.0

Summary: LoLLMS Code Injection vulnerability

Details:
A remote code execution vulnerability exists in the Calculate function of parisneo/lollms version 9.8. The vulnerability arises from the use of Python's `eval()` function to evaluate mathematical expressions within a Python sandbox that disables `__builtins__` and only allows functions from the `math` module. This sandbox can be bypassed by loading the `os` module using the `_frozen_importlib.BuiltinImporter` class, allowing an attacker to execute arbitrary commands on the server. The issue is fixed in version 9.10.
GitHub Security Advisory: GHSA-p5vx-9hj8-cf4h
Package: open-webui (PIP)
Severity: MODERATE (CVSS 6.9)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: <= 0.3.8
Patched in: unpatched

Summary: Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF)

Details:
In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. This vulnerability allows an attacker to perform Cross-Site Request Forgery (CSRF) attacks, where an unaware user can unintentionally perform sensitive actions by simply visiting a malicious site or through top-level navigation. The affected endpoints include /rag/api/v1/reset, /rag/api/v1/reset/db, /api/v1/memories/reset, and /rag/api/v1/reset/uploads. This impacts both the availability and integrity of the application.
GitHub Security Advisory: GHSA-xx7c-j7h3-vjcq
Package: torchserve (PIP)
Severity: MODERATE (CVSS 6.3)
Vulnerable versions: <= 0.11.0
Patched in: unpatched

Summary: TorchServe script references S3 bucket without ensuring ownership or confirming accessibility

Details:
In the latest version of pytorch/serve, the script 'upload_results_to_s3.sh' references the S3 bucket 'benchmarkai-metrics-prod' without ensuring its ownership or confirming its accessibility. This could lead to potential security vulnerabilities or unauthorized access to the bucket if it is not properly secured or claimed by the appropriate entity. The issue may result in data breaches, exposure of proprietary information, or unauthorized modifications to stored data.
GitHub Security Advisory: GHSA-jvpf-xf32-2w4q
Package: llama-index (PIP)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-674: Uncontrolled Recursion
Vulnerable versions: < 0.12.9
Patched in: 0.12.9

Summary: LlamaIndex Uncontrolled Resource Consumption vulnerability

Details:
A vulnerability in the `KnowledgeBaseWebReader` class of the run-llama/llama_index repository, version latest, allows an attacker to cause a Denial of Service (DoS) by controlling a URL variable to contain the root URL. This leads to infinite recursive calls to the `get_article_urls` method, exhausting system resources and potentially crashing the application.
GitHub Security Advisory: GHSA-p6h7-hfj2-vmcf
Package: agentscope (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-36: Absolute Path Traversal
Vulnerable versions: <= 0.0.4
Patched in: unpatched

Summary: AgentScope arbitrary file download vulnerability in rpc_agent_client

Details:
An arbitrary file download vulnerability exists in the rpc_agent_client component of modelscope/agentscope version v0.0.4. This vulnerability allows any user to download any file from the rpc_agent's host by exploiting the download_file method. This can lead to unauthorized access to sensitive information, including configuration files, credentials, and potentially system files, which may facilitate further exploitation such as privilege escalation or lateral movement within the network.
GitHub Security Advisory: GHSA-98fp-7v67-4v3q
Package: pytorch-lightning (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-248: Uncaught Exception
Vulnerable versions: <= 2.3.2
Patched in: unpatched

Summary: PyTorch Lightning denial of service vulnerability

Details:
A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the `/api/v1/state` endpoint of `LightningApp`. This issue occurs due to improper handling of unexpected state values, which results in the server shutting down.
GitHub Security Advisory: GHSA-gj27-76gq-5v3p
Package: open-webui (PIP)
Severity: HIGH (CVSS 8.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 0.3.8
Patched in: unpatched

Summary: Open WebUI stored cross-site scripting (XSS) vulnerability

Details:
A stored cross-site scripting (XSS) vulnerability exists in open-webui/open-webui version 0.3.8. The vulnerability is present in the `/api/v1/models/add` endpoint, where the model description field is improperly sanitized before being rendered in chat. This allows an attacker to inject malicious scripts that can be executed by any user, including administrators, potentially leading to arbitrary code execution.
GitHub Security Advisory: GHSA-4cv3-v7pv-rfhf
Package: pytorch-lightning (PIP)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-434: Unrestricted Upload of File with Dangerous Type
Vulnerable versions: < 2.4.0
Patched in: 2.4.0

Summary: PyTorch Lightning path traversal vulnerability

Details:
In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the `LightningApp` when running on a Windows host. The vulnerability occurs at the `/api/v1/upload_file/` endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to potential remote code execution (RCE) by overwriting critical files or placing malicious files in sensitive locations.
GitHub Security Advisory: GHSA-4vmg-rw8f-92f9
Package: torch (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: <= 2.3.1
Patched in: unpatched

Summary: Withdrawn Advisory: PyTorch deserialization vulnerability

Details:
## Withdrawn Advisory
This advisory has been withdrawn because it describes known functionality of PyTorch. This link is maintained to preserve external references.

## Original Description
A deserialization vulnerability exists in the Pytorch RPC framework (torch.distributed.rpc) in pytorch/pytorch versions <=2.3.1. The vulnerability arises from the lack of security verification during the deserialization process of PythonUDF objects in pytorch/torch/distributed/rpc/internal.py. This flaw allows an attacker to execute arbitrary code remotely by sending a malicious serialized PythonUDF object, leading to remote code execution (RCE) on the master node.
GitHub Security Advisory: GHSA-6w7p-xrvp-p7xv
Package: aim (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-1088: Synchronous Access of Remote Resource without Timeout
Vulnerable versions: <= 3.23.0
Patched in: unpatched

Summary: Aim allows denial of service due to no timeouts for some tracking server endpoints

Details:
In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the server to wait indefinitely for a response. This can lead to a denial of service, as the tracking server does not respond to other requests while waiting. The issue arises in the client used by the `aim` tracking server to communicate with external resources, specifically in the `_run_read_instructions` method and similar calls without timeouts.
GitHub Security Advisory: GHSA-ff5c-56m7-vc75
Package: open-webui (PIP)
Severity: HIGH (CVSS 8.1)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-434: Unrestricted Upload of File with Dangerous Type
Vulnerable versions: < 0.5.17
Patched in: 0.5.17

Summary: Open WebUI allows Remote Code Execution via Arbitrary File Upload to /audio/api/v1/transcriptions

Details:
OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint `/audio/api/v1/transcriptions` that allows for arbitrary file upload. The application performs insufficient validation on the `file.content_type` and allows user-controlled filenames, leading to a path traversal vulnerability. This can be exploited by an authenticated user to overwrite critical files within the Docker container, potentially leading to remote code execution as the root user.
GitHub Security Advisory: GHSA-9vf8-xgwm-97r8
Package: open-webui (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-287: Improper Authentication, CWE-306: Missing Authentication for Critical Function
Vulnerable versions: <= 0.3.10
Patched in: unpatched

Summary: Open WebUI lacks authentication for the `api/v1/utils/pdf` endpoint

Details:
In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service. This vulnerability can be exploited by sending a POST request with an excessively large payload, potentially leading to server resource exhaustion and denial of service (DoS). Additionally, unauthorized users can misuse the endpoint to generate PDFs without verification, resulting in service misuse and potential operational and financial impacts.
GitHub Security Advisory: GHSA-5v9m-57mq-qc75
Package: open-webui (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: <= 0.3.8
Patched in: unpatched

Summary: Open WebUI denial of service through endpoint for converting markdown

Details:
In version 0.3.8 of open-webui, an endpoint for converting markdown to HTML is exposed without authentication. A maliciously crafted markdown payload can cause the server to spend excessive time converting it, leading to a denial of service. The server becomes unresponsive to other requests until the conversion is complete.
GitHub Security Advisory: GHSA-7v2w-h4gh-w5cv
Package: gradio (PIP)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: <= 4.37.2
Patched in: unpatched

Summary: Gradio Vulnerable to Open Redirect

Details:
An open redirect vulnerability exists in the latest version of gradio-app/gradio. The vulnerability allows an attacker to redirect users to a malicious website by URL encoding. This can be exploited by sending a crafted request to the application, which results in a 302 redirect to an attacker-controlled site.
GitHub Security Advisory: GHSA-85jc-8h5p-8vw8
Package: open-webui (PIP)
Severity: HIGH (CVSS 8.0)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: < 0.3.33
Patched in: 0.3.33

Summary: Open WebUI Cross-Site Request Forgery (CSRF) Vulnerability

Details:
A vulnerability in open-webui/open-webui versions <= 0.3.8 allows remote code execution by non-admin users via Cross-Site Request Forgery (CSRF). The application uses cookies with the SameSite attribute set to lax for authentication and lacks CSRF tokens. This allows an attacker to craft a malicious HTML that, when accessed by a victim, can modify the Python code of an existing pipeline and execute arbitrary code with the victim's privileges.
GitHub Security Advisory: GHSA-6wj5-5pgr-jwq8
Package: open-webui (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 0.4.7
Patched in: 0.4.7

Summary: Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability in api/chat/file

Details:
A vulnerability in open-webui/open-webui version 79778fa allows an attacker to cause a Denial of Service (DoS) by uploading a file with a malformed multipart boundary. By appending a large number of characters to the end of the multipart boundary, the server continuously processes each character, rendering the application inaccessible. This issue can prevent all users from accessing the application until the server recovers.
GitHub Security Advisory: GHSA-x757-hv69-jr45
Package: open-webui (PIP)
Severity: HIGH (CVSS 7.7)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 0.3.8
Patched in: unpatched

Summary: Open WebUI has SSRF in /openai/models

Details:
The `/openai/models` endpoint in open-webui/open-webui version 0.3.8 is vulnerable to Server-Side Request Forgery (SSRF). An attacker can change the OpenAI URL to any URL without checks, causing the endpoint to send a request to the specified URL and return the output. This vulnerability allows the attacker to access internal services and potentially gain command execution by accessing instance secrets.
GitHub Security Advisory: GHSA-h36j-8vv3-cj52
Package: onnx (PIP)
Severity: HIGH (CVSS 8.1)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 1.17.0
Patched in: 1.17.0

Summary: Open Neural Network Exchange (ONNX) Path Traversal Vulnerability

Details:
A vulnerability in the `download_model` function of the onnx/onnx framework, before and including version 1.16.1, allows for arbitrary file overwrite due to inadequate prevention of path traversal attacks in malicious tar files. This vulnerability can be exploited by an attacker to overwrite files in the user's directory, potentially leading to remote command execution.
GitHub Security Advisory: GHSA-75px-35p4-qq6h
Package: aim (PIP)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-73: External Control of File Name or Path
Vulnerable versions: <= 3.19.3
Patched in: unpatched

Summary: Aim External Control of File Name or Path vulnerability

Details:
A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to exploit the `tarfile.extractall()` function to extract the contents of a maliciously crafted tarfile to arbitrary locations on the host server. The attacker can control `repo.path` and `run_hash` to bypass directory existence checks and extract files to unintended locations, potentially overwriting critical files. This can lead to arbitrary data being written to arbitrary locations on the remote tracking server, which could be used for further attacks such as writing a new SSH key to the target server.
GitHub Security Advisory: GHSA-p6x3-v6g3-7557
Package: aim (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-23: Relative Path Traversal
Vulnerable versions: <= 3.19.3
Patched in: unpatched

Summary: Aim Relative Path Traversal vulnerability

Details:
A vulnerability in the `runs/delete-batch` endpoint of aimhubio/aim version 3.19.3 allows for arbitrary file or directory deletion through path traversal. The endpoint does not mitigate path traversal when handling user-specified run-names, which are used to specify log/metadata files for deletion. This can be exploited to delete arbitrary files or directories, potentially causing denial of service or data loss.
GitHub Security Advisory: GHSA-w466-2wfc-8g58
Package: open-webui (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: <= 0.3.32
Patched in: unpatched

Summary: Open WebUI has vulnerable dependency on starlette via fastapi

Details:
In version 0.3.32 of open-webui, the application uses a vulnerable version of the starlette package through its dependency on fastapi. The starlette package versions <=0.49 are susceptible to uncontrolled resource consumption, which can be exploited to cause a denial of service through memory exhaustion. This issue is addressed in fastapi version 0.115.3.
GitHub Security Advisory: GHSA-jmgm-gx32-vp4w
Package: llama-index (PIP)
Severity: HIGH (CVSS 7.1)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE-379: Creation of Temporary File in Directory with Insecure Permissions
Vulnerable versions: < 0.12.3
Patched in: 0.12.3

Summary: LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure Permissions

Details:
A vulnerability in the `default_jsonalyzer` function of the `JSONalyzeQueryEngine` in the run-llama/llama_index repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service (DoS) attacks. The vulnerability affects the latest version and is fixed in version 0.12.3.
GitHub Security Advisory: GHSA-35p3-6j45-prwm
Package: aim (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: <= 3.25.0
Patched in: unpatched

Summary: Aim Uncontrolled Resource Consumption vulnerability

Details:
A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service (DoS) attack. The issue arises when a large number of tracked metrics are retrieved simultaneously from the Aim web API, causing the web server to become unresponsive. The root cause is the lack of a limit on the number of metrics that can be requested per call, combined with the server's single-threaded nature, leading to excessive resource consumption and blocking of the server.
GitHub Security Advisory: GHSA-v5pj-jrpv-h6g2
Package: aim (PIP)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-1088: Synchronous Access of Remote Resource without Timeout
Vulnerable versions: <= 3.25.0
Patched in: unpatched

Summary: Aim vulnerable to Synchronous Access of Remote Resource without Timeout

Details:
A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service through the misuse of the sshfs-client. The tracking server, which is single-threaded, can be made unresponsive by requesting it to connect to an unresponsive socket via sshfs. The lack of an additional timeout setting in the sshfs-client causes the server to hang for a significant amount of time, preventing it from responding to other requests.
GitHub Security Advisory: GHSA-x5xw-28w4-53j5
Package: imaginAIry (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: <= 15.0.0
Patched in: unpatched

Summary: imaginAIry Denial of Service (DoS) vulnerability

Details:
A Denial of Service (DoS) vulnerability exists in the brycedrennan/imaginairy repository, version 15.0.0. The vulnerability is present in the `/api/stablestudio/generate` endpoint, which can be exploited by sending an invalid request. This causes the server process to terminate abruptly, outputting `KILLED` in the terminal, and results in the unavailability of the server. This issue disrupts the server's functionality, affecting all users.
GitHub Security Advisory: GHSA-hh3j-9m59-p8vc
Package: bentoml (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: <= 1.3.9
Patched in: unpatched

Summary: BentoML vulnerable to Uncontrolled Resource Consumption

Details:
In bentoml/bentoml version 1.3.9, the `/login` endpoint of the newly integrated Gradio app is vulnerable to a Denial of Service (DoS) attack. This vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. The server continuously processes each character, leading to excessive resource consumption and rendering the service unavailable. The issue is unauthenticated and does not require any user interaction.
GitHub Security Advisory: GHSA-6rvg-6v2m-4j46
Package: transformers (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: < 4.48.0
Patched in: 4.48.0

Summary: Transformers Regular Expression Denial of Service (ReDoS) vulnerability

Details:
A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file tokenization_nougat_fast.py. The vulnerability occurs in the post_process_single() function, where a regular expression processes specially crafted input. The issue stems from the regex exhibiting exponential time complexity under certain conditions, leading to excessive backtracking. This can result in significantly high CPU usage and potential application downtime, effectively creating a Denial of Service (DoS) scenario. The affected version is v4.46.3.
GitHub Security Advisory: GHSA-564p-rx2q-4c8v
Package: bentoml (PIP)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: <= 1.3.9
Patched in: unpatched

Summary: BentoML Open Redirect vulnerability

Details:
An open redirect vulnerability in bentoml/bentoml v1.3.9 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This can be exploited for phishing attacks, malware distribution, and credential theft.
GitHub Security Advisory: GHSA-43g4-487m-5q6m
Package: open-webui (PIP)
Severity: HIGH (CVSS 7.6)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 0.3.8
Patched in: unpatched

Summary: Open WebUI Vulnerable to a Session Fixation Attack

Details:
A vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session fixation attack. The session cookie for all users is set with the default `SameSite=Lax` and does not have the `Secure` flag enabled, allowing the session cookie to be sent over HTTP to a cross-origin domain. An attacker can exploit this by embedding a malicious markdown image in a chat, which, when viewed by an administrator, sends the admin's session cookie to the attacker's server. This can lead to a stealthy administrator account takeover, potentially resulting in remote code execution (RCE) due to the elevated privileges of administrator accounts.
GitHub Security Advisory: GHSA-gv26-qw3h-8qvp
Package: open-webui (PIP)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-475: Undefined Behavior for Input to API, CWE-862: Missing Authorization
Vulnerable versions: <= 0.3.8
Patched in: unpatched

Summary: Open WebUI Allows Viewing of Admin Details

Details:
An improper access control vulnerability in open-webui/open-webui v0.3.8 allows an attacker to view admin details. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/auths/admin/details interface to retrieve the first admin (owner) details.
GitHub Security Advisory: GHSA-3p9q-7w63-3f8q
Package: open-webui (PIP)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-29: Path Traversal: '..filename'
Vulnerable versions: <= 0.3.8
Patched in: unpatched

Summary: Open WebUI Allows Arbitrary File Write via the `download_model` Endpoint

Details:
In version 0.3.8 of open-webui/open-webui, an arbitrary file write vulnerability exists in the download_model endpoint. When deployed on Windows, the application improperly handles file paths, allowing an attacker to manipulate the file path to write files to arbitrary locations on the server's filesystem. This can result in overwriting critical system or application files, causing denial of service, or potentially achieving remote code execution (RCE). RCE can allow an attacker to execute malicious code with the privileges of the user running the application, leading to a full system compromise.