deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-xr7v-m9px-q4qj
Package: metagpt (PIP)
Severity: MODERATE (CVSS 7.3)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: <= 0.8.2
Patched in: unpatched

Summary: MetaGPT has an eval injection in metagpt/strategy/tot.py

Details:
A vulnerability was identified in FoundationAgents MetaGPT up to 0.8.2. This affects the function generate_thoughts of the file metagpt/strategy/tot.py of the component Tree-of-Thought Solver. The manipulation leads to code injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
GitHub Security Advisory: GHSA-w287-wwhf-95vv
Package: metagpt (PIP)
Severity: LOW (CVSS 4.3)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: <= 0.8.2
Patched in: unpatched

Summary: MetaGPT has an eval injection via a cross-site request forgery attack

Details:
A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. The impacted element is the function evaluateCode of the file metagpt/environment/minecraft/mineflayer/index.js of the component Mineflayer HTTP API. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
GitHub Security Advisory: GHSA-h7wm-ph43-c39p
Package: scrapy (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 0.7, <= 2.15.0
Patched in: unpatched

Summary: Scrapy denial of service vulnerability

Details:
Scrapy 1.4 allows remote attackers to cause a denial of service (memory consumption) via large files because arbitrarily many files are read into memory, which is especially problematic if the files are then individually written in a separate thread to a slow storage resource, as demonstrated by interaction between dataReceived (in core/downloader/handlers/http11.py) and S3FilesStore.
GitHub Security Advisory: GHSA-527g-3w9m-29hv
Package: mitmproxy (PIP)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Vulnerable versions: <= 12.2.1
Patched in: 12.2.2

Summary: mitmproxy has an LDAP Injection

Details:
### Impact
In mitmproxy 12.2.1 and below, the builtin LDAP proxy authentication does not correctly sanitize the username when querying the LDAP server. This allows a malicious client to bypass authentication.

Only mitmproxy instances using the `proxyauth` option with LDAP are affected. This option is not enabled by default.

### Patches

The vulnerability has been fixed in mitmproxy 12.2.2 and above.

### Acknowledgements

We thank Yue (Knox) Liu (@yueyueL) for responsibly disclosing this vulnerability to the mitmproxy team.

### Timeline

- **2025-12-08**: Received initial report. 
- **2025-12-09**: Verified report and confirmed receipt.
- **2026-01-02**: Informed researcher that patch will be part of the next regular patch release.
- **2026-04-12**: Published patch release and advisory.
GitHub Security Advisory: GHSA-whj4-6x5x-4v2j
Package: pillow (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 10.3.0, < 12.2.0
Patched in: 12.2.0

Summary: FITS GZIP decompression bomb in Pillow

Details:
### Impact
Pillow did not limit the amount of GZIP-compressed data read when decoding a FITS image, making it vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation).

### Patches
The amount of data read is now limited to the necessary amount.
Fixed in Pillow 12.2.0 (PR #9521).

### Workarounds
Avoid Pillow >= 10.3.0, < 12.2.0
Only open [specific image formats](https://pillow.readthedocs.io/en/stable/releasenotes/8.0.0.html#image-open-add-formats-parameter), excluding FITS.
GitHub Security Advisory: GHSA-6w46-j5rx-g56g
Package: pytest (PIP)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-379: Creation of Temporary File in Directory with Insecure Permissions
Vulnerable versions: < 9.0.3
Patched in: 9.0.3

Summary: pytest has vulnerable tmpdir handling

Details:
pytest through 9.0.2 on UNIX relies on directories with the `/tmp/pytest-of-{user}` name pattern, which allows local users to cause a denial of service or possibly gain privileges.
GitHub Security Advisory: GHSA-8wrq-fv5f-pfp2
Package: lollms (PIP)
Severity: CRITICAL (CVSS 9.6)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.2.0
Patched in: 2.2.0

Summary: parisneo/lollms vulnerable to stored XSS in the social feature

Details:
A Stored Cross-Site Scripting (XSS) vulnerability was identified in the social feature of parisneo/lollms, affecting the latest version prior to 2.2.0. The vulnerability exists in the `create_post` function within `backend/routers/social/__init__.py`, where user-provided content is directly assigned to the `DBPost` model without sanitization. This allows attackers to inject and store malicious JavaScript, which is executed in the browsers of users viewing the Home Feed, including administrators. This can lead to account takeover, session hijacking, and wormable attacks. The issue is resolved in version 2.2.0.
GitHub Security Advisory: GHSA-4phw-6824-6cfp
Package: keystone (PIP)
Severity: LOW (CVSS 3.5)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 14.0.0, < 26.1.1
Patched in: 26.1.1

Summary: OpenStack Keystone: Restricted application credentials can create EC2 credentials

Details:
An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application credential to call the EC2 credential creation API, an authenticated user with only a reader role may obtain an EC2/S3 credential that carries the full set of the parent user's S3 permissions, effectively bypassing the role restrictions imposed on the application credential. Only deployments that use restricted application credentials in combination with the EC2/S3 compatibility API (swift3 / s3api) are affected.
GitHub Security Advisory: GHSA-m5gr-86j6-99jp
Package: gramps-webapi (PIP)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 1.6.0, <= 3.11.0
Patched in: 3.11.1

Summary: gramps-webapi: Zip Slip Path Traversal in Media Archive Import

Details:
## Summary

A path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem.

## Details

When importing media archives as ZIP file, `MediaImporter._check_disk_space_and_extract()` in `gramps_webapi/api/media_importer.py` called `zipfile.extractall()` without validating ZIP entry names. Python's `zipfile` module does not sanitize entry names containing `../` sequences, allowing extraction to paths outside the target directory.

Only users with **owner permission** can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators.

For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:

- **SQLite family tree + local media**: An attacker can overwrite another tree's database file or media files, leading to cross-tree data corruption or replacement.
- **Postgres family tree + S3 media**: No persistent tree data is stored on the local filesystem,  so cross-tree impact is eliminated. The remaining risk is overwriting volume-mounted files such as the application config file.
- **Postgres family tree + S3 media + environment-variable-only config**: No persistent files of  value are present on the local filesystem. Impact is limited to writes to ephemeral container storage, which are lost on woker restart.

## Fix

ZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import.
GitHub Security Advisory: GHSA-3crg-w4f6-42mx
Package: pypdf (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Vulnerable versions: < 6.10.0
Patched in: 6.10.0

Summary: pypdf: Manipulated XMP metadata entity declarations can exhaust RAM

Details:
### Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata.

### Patches
This has been fixed in [pypdf==6.10.0](https://github.com/py-pdf/pypdf/releases/tag/6.10.0).

### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#3724](https://github.com/py-pdf/pypdf/pull/3724).
GitHub Security Advisory: GHSA-wp29-qmvj-frvp
Package: metagpt (PIP)
Severity: MODERATE (CVSS 7.3)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Vulnerable versions: <= 0.8.1
Patched in: 0.8.2

Summary: FoundationAgents MetaGPT vulnerable to os command injection via the Terminal.run_command

Details:
A vulnerability has been found in FoundationAgents MetaGPT up to 0.8.1. This issue affects the function Terminal.run_command in the library metagpt/tools/libs/terminal.py. The manipulation leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The identifier of the patch is d04ffc8dc67903e8b327f78ec121df5e190ffc7b. Applying a patch is the recommended action to fix this issue.
GitHub Security Advisory: GHSA-qw5f-qpq5-ppfg
Package: metagpt (PIP)
Severity: MODERATE (CVSS 7.3)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Vulnerable versions: <= 0.8.1
Patched in: unpatched

Summary: FoundationAgents MetaGPT vulnerable to OS Command Injection in metagpt/utils/common.py

Details:
A vulnerability was found in FoundationAgents MetaGPT up to 0.8.1. Impacted is the function get_mime_type of the file metagpt/utils/common.py. The manipulation results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through a pull request but has not reacted yet.
GitHub Security Advisory: GHSA-fcc8-4q7h-wvwc
Package: metagpt (PIP)
Severity: MODERATE (CVSS 7.3)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Vulnerable versions: <= 0.8.1
Patched in: unpatched

Summary: FoundationAgents MetaGPT vulnerable to OS Command Injection in metagpt/tools/libs/terminal.py

Details:
A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.1. The affected element is the function Bash.run in the library metagpt/tools/libs/terminal.py. This manipulation causes os command injection. The attack is possible to be carried out remotely. The project was informed of the problem early through a pull request but has not reacted yet.
GitHub Security Advisory: GHSA-3ghp-8r47-4gj4
Package: metagpt (PIP)
Severity: MODERATE (CVSS 7.3)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: <= 0.8.1
Patched in: unpatched

Summary: FoundationAgents MetaGPT vulnerable to eval injection

Details:
A flaw has been found in FoundationAgents MetaGPT up to 0.8.1. This vulnerability affects the function ActionNode.xml_fill of the file metagpt/actions/action_node.py of the component XML Handler. Executing a manipulation can lead to improper neutralization of directives in dynamically evaluated code. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through a pull request but has not reacted yet.
GitHub Security Advisory: GHSA-8647-755q-fw9p
Package: ajenti.plugin.core (PIP)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-287: Improper Authentication, CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Vulnerable versions: <= 0.111
Patched in: 0.112

Summary: ajenti.plugin.core has race conditions in 2FA

Details:
### Impact

If the 2FA was activated, it was possible during a short moment after the authentication of an user to bypass its authentication.

### Patches

This is fixed in the version 0.112. Users should upgrade to this version as soon as possible.
GitHub Security Advisory: GHSA-3mcx-6wxm-qr8v
Package: ajenti.plugin.core (PIP)
Severity: CRITICAL (CVSS 7.5)
CWE: CWE-287: Improper Authentication
Vulnerable versions: < 0.112
Patched in: 0.112

Summary: ajenti.plugin.core has password bypass when 2FA is activated

Details:
### Impact

If the 2FA was activated, it was possible to bypass the password authentication

### Patches

This is fixed in the version 0.112. Users should upgrade to this version as soon as possible.
GitHub Security Advisory: GHSA-pjjw-68hj-v9mw
Package: uv (PIP)
Severity: LOW (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 0.11.5
Patched in: 0.11.6

Summary: uv vulnerable to arbitrary file deletion through RECORD entries

Details:
## Impact

Wheel RECORD entries can contain relative paths that traverse outside of the wheel’s installation prefix. In versions 0.11.5 and earlier of uv, these wheels were not rejected on installation and the RECORD was respected without validation on uninstall.

uv uses the RECORD to determine files to remove on uninstall. Consequently, a malicious or malformed wheel could induce deletion of arbitrary files outside of the wheel’s installation prefix on uninstall.

uv does not use the RECORD file to determine wheel file paths. Invalid RECORD entries cannot be used to create or modify files in arbitrary locations.

Standards-compliant Python packaging tooling does not produce RECORD files that exhibit this behavior; an attacker must manually manipulate the RECORD. A user must install *and* uninstall the malformed wheel to be affected. An attack must guess the depth of the installation prefix path in order to target system files.

Absolute paths in RECORD files are not allowed by the specification and, when present, uv always treats them as rooted in the wheel’s installation prefix. Absolute paths cannot be used to delete arbitrary files.

Only files can be deleted, attempts to delete a directory via an invalid RECORD entry will fail.

## Patches

Versions [0.11.6](https://github.com/astral-sh/uv/releases/tag/0.11.6) and newer of uv address the validation gap above, by [removing invalid entries from RECORD files on wheel installation](https://github.com/astral-sh/uv/pull/18943) and [ignoring RECORD paths that would escape the installation prefix on uninstall](https://github.com/astral-sh/uv/pull/18942).

## Workarounds

Users are advised to upgrade to 0.11.6 or newer to address this advisory.

Users should experience no breaking changes as a result of the patch above.
GitHub Security Advisory: GHSA-c92r-g8j5-vhcx
Package: apache-airflow (PIP)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-613: Insufficient Session Expiration
Vulnerable versions: >= 3.0.0, < 3.2.0
Patched in: 3.2.0

Summary: Apache Airflow: JWT token still valid after logout

Details:
When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+



Users are recommended to upgrade to version 3.2.0, which fixes this issue.
GitHub Security Advisory: GHSA-vc46-vw85-3wvm
Package: PraisonAI (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: <= 4.5.138
Patched in: 4.5.139

Summary: PraisonAI has critical RCE via `type: job` workflow YAML

Details:
`praisonai workflow run <file.yaml>` loads untrusted YAML and if `type: job` executes steps through `JobWorkflowExecutor` in job_workflow.py.

This supports:
- `run:` → shell command execution via `subprocess.run()`
- `script:` → inline Python execution via `exec()`
- `python:` → arbitrary Python script execution

A malicious YAML file can execute arbitrary host commands.

### Affected Code
- workflow.py → `action_run()`
- job_workflow.py → `_exec_shell()`, `_exec_inline_python()`, `_exec_python_script()`

### PoC
Create `exploit.yaml`:

```yaml
type: job
name: exploit
steps:
  - name: write-file
    run: python -c "open('pwned.txt','w').write('owned')"
```

Run:

```bash
praisonai workflow run exploit.yaml
```

### Reproduction Steps
1. Save the YAML above as `exploit.yaml`.
2. Execute `praisonai workflow run exploit.yaml`.
3. Confirm `pwned.txt` appears in the working directory.

### Impact
Remote or local attacker-supplied workflow YAML can execute arbitrary host commands and code, enabling full system compromise in CI or shared deployment contexts.

**Reporter:** Lakshmikanthan K (letchupkt)
GitHub Security Advisory: GHSA-vc46-vw85-3wvm
Package: praisonaiagents (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: <= 1.5.139
Patched in: 1.5.140

Summary: PraisonAI has critical RCE via `type: job` workflow YAML

Details:
`praisonai workflow run <file.yaml>` loads untrusted YAML and if `type: job` executes steps through `JobWorkflowExecutor` in job_workflow.py.

This supports:
- `run:` → shell command execution via `subprocess.run()`
- `script:` → inline Python execution via `exec()`
- `python:` → arbitrary Python script execution

A malicious YAML file can execute arbitrary host commands.

### Affected Code
- workflow.py → `action_run()`
- job_workflow.py → `_exec_shell()`, `_exec_inline_python()`, `_exec_python_script()`

### PoC
Create `exploit.yaml`:

```yaml
type: job
name: exploit
steps:
  - name: write-file
    run: python -c "open('pwned.txt','w').write('owned')"
```

Run:

```bash
praisonai workflow run exploit.yaml
```

### Reproduction Steps
1. Save the YAML above as `exploit.yaml`.
2. Execute `praisonai workflow run exploit.yaml`.
3. Confirm `pwned.txt` appears in the working directory.

### Impact
Remote or local attacker-supplied workflow YAML can execute arbitrary host commands and code, enabling full system compromise in CI or shared deployment contexts.

**Reporter:** Lakshmikanthan K (letchupkt)
GitHub Security Advisory: GHSA-g985-wjh9-qxxc
Package: PraisonAI (PIP)
Severity: HIGH (CVSS 8.4)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection'), CWE-426: Untrusted Search Path
Vulnerable versions: <= 4.5.138
Patched in: 4.5.139

Summary: PraisonAI Vulnerable to RCE via Automatic tools.py Import

Details:
PraisonAI automatically imports `./tools.py` from the current working directory when launching certain components. This includes call.py, tool_resolver.py, and CLI tool-loading paths.

A malicious tools.py placed in the process working directory is executed immediately, allowing arbitrary Python code execution in the host environment.

### Affected Code
- call.py → `import_tools_from_file()`
- tool_resolver.py → `_load_local_tools()`
- tools.py → local tool import flow
- 

### PoC
Create tools.py in the directory where PraisonAI is launched:

```python
# tools.py
import os
os.system("echo pwned > /tmp/pwned.txt")
```

Run any PraisonAI component that loads local tools, for example:

```bash
praisonai workflow run safe.yaml
```

### Reproduction Steps
1. Create a malicious tools.py in the current working directory.
2. Start PraisonAI or invoke a CLI command that loads local tools.
3. Verify that `/tmp/pwned.txt` or the malicious command output exists.

### Impact
An attacker who can place or influence tools.py in the working directory can execute arbitrary code in the PraisonAI process, compromising the host and any connected data.

**Reporter:** Lakshmikanthan K (letchupkt)
GitHub Security Advisory: GHSA-g985-wjh9-qxxc
Package: praisonaiagents (PIP)
Severity: HIGH (CVSS 8.4)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection'), CWE-426: Untrusted Search Path
Vulnerable versions: <= 1.5.139
Patched in: 1.5.140

Summary: PraisonAI Vulnerable to RCE via Automatic tools.py Import

Details:
PraisonAI automatically imports `./tools.py` from the current working directory when launching certain components. This includes call.py, tool_resolver.py, and CLI tool-loading paths.

A malicious tools.py placed in the process working directory is executed immediately, allowing arbitrary Python code execution in the host environment.

### Affected Code
- call.py → `import_tools_from_file()`
- tool_resolver.py → `_load_local_tools()`
- tools.py → local tool import flow
- 

### PoC
Create tools.py in the directory where PraisonAI is launched:

```python
# tools.py
import os
os.system("echo pwned > /tmp/pwned.txt")
```

Run any PraisonAI component that loads local tools, for example:

```bash
praisonai workflow run safe.yaml
```

### Reproduction Steps
1. Create a malicious tools.py in the current working directory.
2. Start PraisonAI or invoke a CLI command that loads local tools.
3. Verify that `/tmp/pwned.txt` or the malicious command output exists.

### Impact
An attacker who can place or influence tools.py in the working directory can execute arbitrary code in the PraisonAI process, compromising the host and any connected data.

**Reporter:** Lakshmikanthan K (letchupkt)
GitHub Security Advisory: GHSA-r7vr-m4jw-r794
Package: apache-airflow (PIP)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-668: Exposure of Resource to Wrong Sphere
Vulnerable versions: >= 3.0.0, < 3.2.0
Patched in: 3.2.0

Summary: Apache Airflow has an authorization bypass in DagRun wait endpoint

Details:
Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavior conflicts with the FAB RBAC model, which treats XCom as a separate protected resource, and with the security model documentation that defines the Viewer role as read-only.

Airflow uses the FAB Auth Manager to manage access control on a per-resource basis. The Viewer role is intended to be read-only by default, and the security model documentation defines Viewer users as those who can inspect DAGs without accessing sensitive execution results.

Users are recommended to upgrade to Apache Airflow 3.2.0 which resolves this issue.