deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-m37h-8r48-2cxj
Package: h2o (PIP)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-749: Exposed Dangerous Method or Function
Vulnerable versions: >= 3.32.1.2, <= 3.46.0
Patched in: unpatched

Summary: H2O Vulnerable to Execution of Arbitrary Files

Details:
In h2oai/h2o-3 version 3.46.0, an endpoint exposing a custom EncryptionTool allows an attacker to encrypt any files on the target server with a key of their choosing. The chosen key can also be overwritten, resulting in ransomware-like behavior. This vulnerability makes it possible for an attacker to encrypt arbitrary files with keys of their choice, making it exceedingly difficult for the target to recover the keys needed for decryption.
GitHub Security Advisory: GHSA-wwr9-4gmr-xvq9
Package: h2o (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 3.30.0.7, <= 3.46.0.1
Patched in: unpatched

Summary: H2O Vulnerable to Denial of Service (DoS) via `/3/Parse` Endpoint

Details:
A vulnerability in the `/3/Parse` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint uses a user-specified string to construct a regular expression, which is then applied to another user-specified string. By sending multiple simultaneous requests, an attacker can exhaust all available threads, leading to a complete denial of service.
GitHub Security Advisory: GHSA-7qq7-pvm9-x8rf
Package: h2o (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 3.30.0.7, <= 3.46.0.1
Patched in: unpatched

Summary: H2O Vulnerable to Denial of Service (DoS) via `/3/ParseSetup` Endpoint

Details:
A vulnerability in the `/3/ParseSetup` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint applies a user-specified regular expression to a user-controllable string. This can be exploited by an attacker to cause inefficient regular expression complexity, leading to the exhaustion of server resources and making the server unresponsive.
GitHub Security Advisory: GHSA-wjpv-64v2-2qpq
Package: h2o (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection'), CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 3.34.0.1, <= 3.46.0.1
Patched in: unpatched

Summary: H2O Vulnerable to Denial of Service (DoS) and File Write

Details:
In h2oai/h2o-3 version 3.46.0.1, the `run_tool` command exposes classes in the `water.tools` package through the `ast` parser. This includes the `XGBoostLibExtractTool` class, which can be exploited to shut down the server and write large files to arbitrary directories, leading to a denial of service.
GitHub Security Advisory: GHSA-h7xg-cmpp-48hf
Package: h2o (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 3.46.0.6
Patched in: 3.46.0.6

Summary: H2O Deserialization of Untrusted Data Vulnerability

Details:
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability exists in the endpoints POST /99/ImportSQLTable and POST /3/SaveToHiveTable, where user-controlled JDBC URLs are passed to DriverManager.getConnection, leading to deserialization if a MySQL or PostgreSQL driver is available in the classpath. This issue is fixed in version 3.46.0.6.
GitHub Security Advisory: GHSA-xqgj-r6xv-9cw4
Package: dask (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Vulnerable versions: <= 2024.8.2
Patched in: unpatched

Summary: Withdrawn Advisory: Dask Vulnerable to Command Injection

Details:
# Withdrawn Advisory
This advisory has been withdrawn because it describes [intended functionality](https://distributed.dask.org/en/stable/limitations.html?highlight=host#security). This link is maintained to preserve external references.

# Original Description

Dask versions <=2024.8.2 contain a vulnerability in the Dask Distributed Server where the use of pickle serialization allows attackers to craft malicious objects. These objects can be serialized on the client side and sent to the server for deserialization, leading to remote command execution and potentially granting full control over the Dask server.
GitHub Security Advisory: GHSA-x3m8-f7g5-qhm7
Package: vllm (PIP)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 0.6.5, < 0.8.0
Patched in: 0.8.0

Summary: vLLM Allows Remote Code Execution via Mooncake Integration

Details:
### Summary
When vLLM is configured to use Mooncake, unsafe deserialization exposed directly over ZMQ/TCP will allow attackers to execute remote code on distributed hosts.

### Details
1. Pickle deserialization vulnerabilities are [well documented](https://docs.python.org/3/library/pickle.html).
2. The [mooncake pipe](https://github.com/vllm-project/vllm/blob/9bebc9512f9340e94579b9bd69cfdc452c4d5bb0/vllm/distributed/kv_transfer/kv_pipe/mooncake_pipe.py#L206) is exposed over the network (by design to enable disaggregated prefilling across distributed environments) using ZMQ over TCP, greatly increasing exploitability. ~~Further, the mooncake integration opens these sockets listening on all interfaces on the host, meaning it can not be configured to only use a private, trusted network.~~

Only `sender_socket` and `receiver_ack` are allowed to be accessed publicly, while the data actually decompressed by `pickle.loads()` comes from [recv_bytes](https://github.com/vllm-project/vllm/blob/9bebc9512f9340e94579b9bd69cfdc452c4d5bb0/vllm/distributed/kv_transfer/kv_pipe/mooncake_pipe.py#L257). Its interface is defined as `self.receiver_socket.connect(f\"tcp://{d_host}:{d_rank_offset + 1}\")`, where `d_host` is `decode_host`, a locally defined address 192.168.0.139,from mooncake.json (https://github.com/kvcache-ai/Mooncake/blob/main/doc/en/vllm-integration-v0.2.md?plain=1#L36).

3. The root problem is [`recv_tensor()`](https://github.com/vllm-project/vllm/blob/9bebc9512f9340e94579b9bd69cfdc452c4d5bb0/vllm/distributed/kv_transfer/kv_pipe/mooncake_pipe.py#L257) calls [`_recv_impl`](https://github.com/vllm-project/vllm/blob/9bebc9512f9340e94579b9bd69cfdc452c4d5bb0/vllm/distributed/kv_transfer/kv_pipe/mooncake_pipe.py#L244) which passes the raw network bytes to `pickle.loads()`. Additionally, it does not appear that there are any controls (network, authentication, etc) to prevent arbitrary users from sending this payload to the affected service.



### Impact
This is a remote code execution vulnerability impacting any deployments using Mooncake to distribute KV across distributed hosts.

### Remediation
This issue is resolved by https://github.com/vllm-project/vllm/pull/14228
GitHub Security Advisory: GHSA-fx47-jpv9-7hxr
Package: aim (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 3.15.0, <= 3.23.0
Patched in: unpatched

Summary: Aim Vulnerable to Denial of Service (DoS)

Details:
In version 3.23.0 of aimhubio/aim, the ScheduledStatusReporter object can be instantiated to run on the main thread of the tracking server, leading to the main thread being blocked indefinitely. This results in a denial of service as the tracking server becomes unable to respond to other requests.
GitHub Security Advisory: GHSA-gw2q-qw9j-rgv7
Package: litellm (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.53.1.dev1
Patched in: 1.53.1.dev1

Summary: LiteLLM Vulnerable to Denial of Service (DoS)

Details:
A vulnerability in BerriAI/litellm, as of commit 26c03c9, allows unauthenticated users to cause a Denial of Service (DoS) by exploiting the use of ast.literal_eval to parse user input. This function is not safe and is prone to DoS attacks, which can crash the litellm Python server.
GitHub Security Advisory: GHSA-mrhh-3ggq-23p2
Package: horovod (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'), CWE-502: Deserialization of Untrusted Data
Vulnerable versions: <= 0.28.1
Patched in: unpatched

Summary: Horovod Vulnerable to Command Injection

Details:
Horovod versions up to and including v0.28.1 are vulnerable to unauthenticated remote code execution. The vulnerability is due to improper handling of base64-encoded data in the `ElasticRendezvousHandler`, a subclass of `KVStoreHandler`. Specifically, the `_put_value` method in `ElasticRendezvousHandler` calls `codec.loads_base64(value)`, which eventually invokes `cloudpickle.loads(decoded)`. This allows an attacker to send a malicious pickle object via a PUT request, leading to arbitrary code execution on the server.
GitHub Security Advisory: GHSA-mgrm-fgjv-mhv8
Package: vllm (PIP)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 0.8.0
Patched in: 0.8.0

Summary: vLLM denial of service via outlines unbounded cache on disk

Details:
### Impact
The [outlines](https://dottxt-ai.github.io/outlines/latest/) library is one of the backends used by vLLM to support structured output (a.k.a. guided decoding). Outlines provides an optional cache for its compiled grammars on the local filesystem. This cache has been on by default in vLLM. Outlines is also available by default through the OpenAI compatible API server.

The affected code in vLLM is [vllm/model_executor/guided_decoding/outlines_logits_processors.py](https://github.com/vllm-project/vllm/blob/53be4a863486d02bd96a59c674bbec23eec508f6/vllm/model_executor/guided_decoding/outlines_logits_processors.py), which unconditionally uses the cache from outlines. vLLM should have this off by default and allow administrators to opt-in due to the potential for abuse.

A malicious user can send a stream of very short decoding requests with unique schemas, resulting in an addition to the cache for each request. This can result in a Denial of Service if the filesystem runs out of space.

Note that even if vLLM was configured to use a different backend by default, it is still possible to choose outlines on a per-request basis using the `guided_decoding_backend` key of the `extra_body` field of the request.

This issue applies to the V0 engine only. The V1 engine is not affected.

### Patches

* https://github.com/vllm-project/vllm/pull/14837

The fix is to disable this cache by default since it does not provide an option to limit its size. If you want to use this cache anyway, you may set the `VLLM_V0_USE_OUTLINES_CACHE` environment variable to `1`.

### Workarounds

There is no way to workaround this issue in existing versions of vLLM other than preventing untrusted access to the OpenAI compatible API server.

### References
GitHub Security Advisory: GHSA-hhm6-jjf4-6pm3
Package: apache-airflow-providers-mysql (PIP)
Severity: MODERATE (CVSS 6.3)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 6.2.0
Patched in: 6.2.0

Summary: Apache Airflow MySQL Provider is Vulnerable to SQL Injection

Details:
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow MySQL Provider.

When user triggered a DAG with dump_sql or load_sql functions they could pass a table parameter from a UI, that could cause SQL injection by running SQL that was not intended.
It could lead to data corruption, modification and others.
This issue affects Apache Airflow MySQL Provider: before 6.2.0.

Users are recommended to upgrade to version 6.2.0, which fixes the issue.
GitHub Security Advisory: GHSA-r8gc-qc2c-c7vh
Package: PostQuantum-Feldman-VSS (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation
Vulnerable versions: <= 0.8.0b2
Patched in: unpatched

Summary: Post-Quantum Secure Feldman's Verifiable Secret Sharing has Inadequate Fault Injection Countermeasures in `secure_redundant_execution`

Details:
**Description:**

The `secure_redundant_execution` function in feldman_vss.py attempts to mitigate fault injection attacks by executing a function multiple times and comparing results. However, several critical weaknesses exist:

1. Python's execution environment cannot guarantee true isolation between redundant executions
2. The constant-time comparison implementation in Python is subject to timing variations
3. The randomized execution order and timing provide insufficient protection against sophisticated fault attacks
4. The error handling may leak timing information about partial execution results

These limitations make the protection ineffective against targeted fault injection attacks, especially from attackers with physical access to the hardware.

**Impact:**

A successful fault injection attack could allow an attacker to:

1. Bypass the redundancy check mechanisms
2. Extract secret polynomial coefficients during share generation or verification
3. Force the acceptance of invalid shares during verification
4. Manipulate the commitment verification process to accept fraudulent commitments

This undermines the core security guarantees of the Verifiable Secret Sharing scheme.

**References:**

*   File: `feldman_vss.py`
*   Function: `secure_redundant_execution`
*   [Fault Attacks](https://en.wikipedia.org/wiki/Fault_attack) - Wikipedia article on fault attacks.
*   Bar-El, H., et al. "The Sorcerer's Apprentice Guide to Fault Attacks" - https://eprint.iacr.org/2004/100.pdf
* CWE-1279: https://cwe.mitre.org/data/definitions/1279.html
* NIST SP 800-90B section on implementation validation


**Remediation:**

Long-term remediation requires reimplementing the security-critical functions in a lower-level language like Rust.

Short-term mitigations:

1. Deploy the software in environments with physical security controls
2. Increase the redundancy count (from 5 to a higher number) by modifying the source code
3. Add external verification of cryptographic operations when possible
4. Consider using hardware security modules (HSMs) for key operations
GitHub Security Advisory: GHSA-6m2c-76ff-6vrf
Package: qiskit (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: = 2.0.0rc1
Patched in: 2.0.0rc2

Summary: Qiskit allows arbitrary code execution decoding QPY format versions < 13

Details:
### Impact

A maliciously crafted QPY file can potentially execute arbitrary-code embedded in the payload without privilege escalation when deserializing QPY formats < 13. A python process calling Qiskit's `qiskit.qpy.load()` function could potentially execute any arbitrary Python code embedded in the correct place in the binary file as part of a specially constructed payload.

### Patches

Fixed in Qiskit 1.4.2 and in Qiskit 2.0.0rc2
GitHub Security Advisory: GHSA-6m2c-76ff-6vrf
Package: qiskit (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: <= 1.4.1
Patched in: 1.4.2

Summary: Qiskit allows arbitrary code execution decoding QPY format versions < 13

Details:
### Impact

A maliciously crafted QPY file can potentially execute arbitrary-code embedded in the payload without privilege escalation when deserializing QPY formats < 13. A python process calling Qiskit's `qiskit.qpy.load()` function could potentially execute any arbitrary Python code embedded in the correct place in the binary file as part of a specially constructed payload.

### Patches

Fixed in Qiskit 1.4.2 and in Qiskit 2.0.0rc2
GitHub Security Advisory: GHSA-6m2c-76ff-6vrf
Package: qiskit-terra (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 0.18.0, <= 0.46.3
Patched in: unpatched

Summary: Qiskit allows arbitrary code execution decoding QPY format versions < 13

Details:
### Impact

A maliciously crafted QPY file can potentially execute arbitrary-code embedded in the payload without privilege escalation when deserializing QPY formats < 13. A python process calling Qiskit's `qiskit.qpy.load()` function could potentially execute any arbitrary Python code embedded in the correct place in the binary file as part of a specially constructed payload.

### Patches

Fixed in Qiskit 1.4.2 and in Qiskit 2.0.0rc2
GitHub Security Advisory: GHSA-3pwp-2fqj-6g2p
Package: qiskit (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: <= 1.4.1
Patched in: unpatched

Summary: Duplicate Advisory: Qiskit allows arbitrary code execution decoding QPY format versions < 13

Details:
# Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-6m2c-76ff-6vrf. This link is maintained to preserve external references.

# Original Description
A maliciously crafted QPY file can potential execute arbitrary-code embedded in the payload without privilege escalation when deserialising QPY formats < 13. A python process calling Qiskit 0.18.0 through 1.4.1's `qiskit.qpy.load()` function could potentially execute any arbitrary Python code embedded in the correct place in the binary file as part of specially constructed payload.
GitHub Security Advisory: GHSA-86w8-vhw6-q9qq
Package: basicsr (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Vulnerable versions: <= 1.4.2
Patched in: unpatched

Summary: XPixelGroup BasicSR Command Injection

Details:
XPixelGroup BasicSR through 1.4.2 might locally allow code execution in contrived situations where "scontrol show hostname" is executed in the presence of a crafted SLURM_NODELIST environment variable.
GitHub Security Advisory: GHSA-59qh-fmm7-3g9q
Package: rembg (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-346: Origin Validation Error
Vulnerable versions: <= 2.0.57
Patched in: unpatched

Summary: Rembg CORS misconfiguration

Details:
Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests to the rembg server and thus query any API. Even if authentication were to be enabled, allow_credentials is set to True, which would allow any website to send authenticated cross site requests.
GitHub Security Advisory: GHSA-r5gx-c49x-h878
Package: rembg (PIP)
Severity: MODERATE (CVSS 7.5)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 2.0.57
Patched in: unpatched

Summary: Rembg allows SSRF via /api/remove

Details:
Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the /api/remove endpoint takes a URL query parameter that allows an image to be fetched, processed and returned. An attacker may be able to query this endpoint to view pictures hosted on the internal network of the rembg server. This issue may lead to Information Disclosure.
GitHub Security Advisory: GHSA-gprr-v9f2-px3c
Package: promptflow-core (PIP)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-653: Improper Isolation or Compartmentalization
Vulnerable versions: < 1.17.2
Patched in: 1.17.2

Summary: Azure PromptFlow remote code execution related to Jinja templates

Details:
Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network.
GitHub Security Advisory: GHSA-gprr-v9f2-px3c
Package: promptflow-tools (PIP)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-653: Improper Isolation or Compartmentalization
Vulnerable versions: < 1.6.0
Patched in: 1.6.0

Summary: Azure PromptFlow remote code execution related to Jinja templates

Details:
Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network.
GitHub Security Advisory: GHSA-48g7-3x6r-xfhp
Package: keras (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 3.0.0, < 3.9.0
Patched in: 3.9.0

Summary: Arbitrary Code Execution via Crafted Keras Config for Model Loading

Details:
### Impact

The Keras `Model.load_model` function permits arbitrary code execution, even with `safe_mode=True`, through a manually constructed, malicious `.keras` archive. By altering the `config.json` file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading.

### Patches

This problem is fixed starting with version `3.9`.

### Workarounds

Only load models from trusted sources and model archives created with Keras.

### References

- https://www.cve.org/cverecord?id=CVE-2025-1550
- https://github.com/keras-team/keras/pull/20751
GitHub Security Advisory: GHSA-5478-v2w6-c6q7
Package: keras (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 3.9.0
Patched in: 3.9.0

Summary: Duplicate Advisory: Keras arbitrary code execution vulnerability

Details:
# Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-48g7-3x6r-xfhp. This link is maintained to preserve external references.

# Original Description

The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading.
GitHub Security Advisory: GHSA-2hmp-5wqg-f24h
Package: plotai (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'), CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 0.0.7
Patched in: 0.0.7

Summary: PlotAI eval vulnerability

Details:
A vulnerability, that could result in Remote Code Execution (RCE), has been found in PlotAI. Lack of validation of LLM-generated output allows attacker to execute arbitrary Python code. PlotAI commented out vulnerable line, further usage of the software requires uncommenting it and thus accepting the risk.