deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-v7qw-hx66-4w9x
Package: netbox-data-flows (PIP)
Severity: HIGH (CVSS 8.7)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 1.5.0
Patched in: 1.5.1

Summary: netbox-data-flows has stored XSS in ObjectAlias names rendered inside DataFlow tables

Details:
### Summary
An authenticated user who can create or edit `ObjectAlias` objects can store arbitrary HTML/JavaScript in an alias name. That payload is later rendered unescaped in `DataFlow` table views, causing a stored XSS when another user views the affected page.

### Details
The issue is caused by unsafe HTML generation in the plugin’s custom table column renderer.

Relevant code on `main` (`bf96eac`, same commit as `origin/main` at the time of review):

- `netbox_data_flows/models/objectaliases.py`
  - `ObjectAlias.name` is user-controlled (`CharField`)
  - `ObjectAlias.__str__()` returns `self.name` directly
- `netbox_data_flows/tables/dataflows.py`
  - `DataFlowTable.sources` and `DataFlowTable.destinations` use `ObjectAliasListColumn`
- `netbox_data_flows/tables/columns.py`
  - `ObjectAliasListColumn.render()` calls `object_list_to_string(value.all(), linkify=True)`
- `netbox_data_flows/utils/helpers.py`
  - `object_list_to_string()` builds raw anchor tags with:
    ```python
    mark_safe(separator.join(f'<a href="{o.get_absolute_url()}">{o}</a>' for o in objects))
    ```

The alias text (`{o}`) is inserted into HTML without escaping, then the whole string is marked safe. Because `ObjectAlias.__str__()` returns the user-supplied name, HTML/JS in the alias name is executed in the victim’s browser.

This affects any page rendering `DataFlowTable`, including at least:
- the main Data Flow list page
- model tabs that reuse `DataFlowTable`

### PoC
Environment:
- NetBox with `netbox-data-flows` installed
- No special plugin configuration required

Steps:
1. Log in as a user with permission to create or edit `ObjectAlias` and `DataFlow`.
2. Create a new `ObjectAlias` with the following name:
   ```html
   <img src=x onerror=alert(document.domain)>
   ```
3. Create or edit a `DataFlow` so this alias is present in either `sources` or `destinations`.
4. Log in as another user and open the Data Flow list page in the plugin UI.
5. The JavaScript executes when the table renders the alias list.

A simple path to trigger is the Data Flow list page. Any other page that renders `DataFlowTable` should also be tested.

### Impact
This is a stored cross-site scripting vulnerability.

Impacted users:
- any authenticated user who can view a page rendering the affected `DataFlow` table
- especially higher-privileged NetBox users, because an attacker with lower privileges may target them by planting a malicious alias name

Possible impact:
- session theft
- execution of privileged actions in the victim’s session
- exfiltration of data visible to the victim in NetBox
GitHub Security Advisory: GHSA-6m5f-673f-5vh7
Package: sglang (PIP)
Severity: MODERATE (CVSS 5.6)
CWE: CWE-20: Improper Input Validation, CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: <= 0.5.9
Patched in: unpatched

Summary: SGLang has an Improper Input Validation/Injection Issue

Details:
A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function get_tokenizer of the file python/sglang/srt/utils/hf_transformers_utils.py of the component HuggingFace Transformer Handler. The manipulation results in deserialization. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-xqxw-r767-67m7
Package: mem0ai (PIP)
Severity: LOW (CVSS 6.3)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 2.0.0b2
Patched in: 2.0.0b2

Summary: mem0ai mem0 has an Improper Input Validation Issue

Details:
A vulnerability was found in mem0ai mem0 up to 1.0.11. This affects the function pickle.load/pickle.dump of the file mem0/vector_stores/faiss.py. Performing a manipulation results in deserialization. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The patch is named 62dca096f9236010ca15fea9ba369ba740b86b7a. Applying a patch is the recommended action to fix this issue.
GitHub Security Advisory: GHSA-q9r5-6hrr-9ph7
Package: smolagents (PIP)
Severity: CRITICAL (CVSS 10.0)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: <= 1.23.0
Patched in: unpatched

Summary: Hugging Face smolagents: Unsafe deserialization in Remote Python Executor leads to RCE

Details:
Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face smolagents. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the parsing of pickle data. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28312.
GitHub Security Advisory: GHSA-jxgv-6j54-wwc7
Package: smolagents (PIP)
Severity: LOW (CVSS 6.3)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 1.24.0
Patched in: unpatched

Summary: Hugging Face Smolagents has a Server-Side Request Forgery issue

Details:
A weakness has been identified in huggingface smolagents 1.24.0. Impacted is the function requests.get/requests.post of the component LocalPythonExecutor. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-fqph-j6v6-jvgx
Package: docling-graph (PIP)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect'), CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 1.5.0
Patched in: 1.5.1

Summary: docling-graph has SSRF via Missing Internal IP Validation in URLInputHandler

Details:
### Impact

The `URLInputHandler` class in `docling_graph/core/input/handlers.py` makes HTTP requests to user-supplied URLs without validating whether the target resolves to a private, loopback, or link-local IP address. The `URLValidator` only checks for a valid scheme and non-empty `netloc`, performing no IP-level validation. Additionally, `requests.head()` was called with `allow_redirects=True`, allowing an attacker to redirect requests to internal endpoints via an intermediary URL.

An attacker who can control the `--source` CLI argument or `PipelineConfig.source` API parameter can trigger Server-Side Request Forgery (SSRF) to reach:
- Cloud metadata endpoints (e.g. `169.254.169.254`) to steal IAM credentials
- Internal services on loopback (`127.0.0.1`) or private network ranges (`10.x`, `172.16.x`, `192.168.x`)

This affects deployments where `docling-graph` processes URLs from untrusted input, such as multi-tenant pipelines or server-side automation.

### Patches

The vulnerability is fixed in **v1.5.1**.

Users should upgrade immediately:
```
pip install --upgrade docling-graph
```

The fix adds IP validation via `ipaddress` and `socket.gethostbyname()` before any request is made, blocks private/loopback/link-local/reserved addresses, and disables redirect following (`allow_redirects=False`) with explicit validation of any `Location` header before following it.

### Workarounds

If upgrading is not immediately possible, ensure that **all URLs passed to `URLInputHandler` come exclusively from trusted, internal sources**, never from user-supplied or external input. There is no safe code-level workaround short of applying the patch, as the vulnerability is in the library itself.

### Resources

- [CWE-918: Server-Side Request Forgery](https://cwe.mitre.org/data/definitions/918.html)
- [OWASP SSRF Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)
- [AWS Instance Metadata endpoint](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html)
GitHub Security Advisory: GHSA-mq9q-25hm-g4gp
Package: AstrBot (PIP)
Severity: MODERATE (CVSS 7.3)
CWE: CWE-259: Use of Hard-coded Password
Vulnerable versions: <= 4.16.0
Patched in: unpatched

Summary: AstrBot Makes Use of Hard-coded Password

Details:
A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.16.0. This issue affects some unknown processing of the file astrbot/dashboard/routes/auth.py of the component Dashboard. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-hhq2-3832-xxcv
Package: keystone (PIP)
Severity: HIGH (CVSS 7.9)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 13.0.0, <= 29.0.1
Patched in: unpatched

Summary: OpenStack Keystone has an Incorrect Authorization Issue

Details:
An issue was discovered in OpenStack Keystone 13 through 29. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.
GitHub Security Advisory: GHSA-rmxr-45gj-889w
Package: ironic-python-agent (PIP)
Severity: HIGH (CVSS 8.0)
CWE: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Vulnerable versions: >= 1.0.0, <= 11.5.0
Patched in: unpatched

Summary: OpenStack Ironic Python Agent Includes Functionality from Untrusted Control Sphere

Details:
An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.
GitHub Security Advisory: GHSA-w37p-236h-pfx3
Package: pytorch-lightning (PIP)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-506: Embedded Malicious Code
Vulnerable versions: = 2.6.3
Patched in: unpatched

Summary: Compromise of PyTorch Lightning PyPi Package Versions

Details:
# Security Advisory: Compromise of PyTorch Lightning PyPI Package Versions

**Published:** 2026-04-30  
**Last Updated:** 2026-04-30  

Lightning AI has identified a security incident affecting certain versions of a PyPI package.

## What happened

Lightning AI has determined that one or more released versions of this package have been compromised and include malicious code.

The current investigation indicates that the affected versions have introduced functionality consistent with a credential harvesting mechanism. There is a continuing analysis the scope and behaviour of the code.

At this stage, the root cause of the compromise is still under investigation.

## What versions are affected

Lightning AI is currently working to confirm the exact set of impacted versions.

The following versions are determined as affected, and developers should delete them from their systems:

- `2.6.2`
- `2.6.3`

Lightning AI will update this advisory if the versions impacted by this vulnerability change.

## What you should do immediately

If developers have installed or are running any potentially affected versions on their application:

- Assume the environment may be compromised  
- Immediately rotate all credentials and secrets that may have been exposed, including:  
  - API keys  
  - Access tokens  
  - SSH keys  
  - Service account credentials  
- Rebuild affected systems from a known clean state  
- Pin PyTorch Lightning to version `2.6.1`  
- Review logs for any suspicious or unauthorised activity  

## Actions Lightning AI has taken

- Quarantined malicious versions from PyPI  
- Recommended using version `2.6.1`: https://github.com/Lightning-AI/pytorch-lightning/releases/tag/2.6.1  
- Revoked and rotated all internal credentials associated with our release process  
- Initiated a full investigation into the compromise  

## Ongoing investigation

Lightning AI is actively working to:

- Identify the exact mechanism of compromise  
- Confirm the full set of affected versions  
- Determine the behaviour and impact of the malicious code  
- Assess any downstream impact to users  

Lightning AI will provide updates as soon as more information becomes available.

## Commitment to transparency

Lightning AI takes the security of users and the integrity of the software supply chain extremely seriously.

Lightning AI will continue to share timely and accurate updates as the investigation progresses.

## Contact

If there are any questions or if there are concerns that a consuming project may be impacted, please send an email to:

**security@lightning.ai**
GitHub Security Advisory: GHSA-w37p-236h-pfx3
Package: pytorch-lightning (PIP)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-506: Embedded Malicious Code
Vulnerable versions: = 2.6.2
Patched in: unpatched

Summary: Compromise of PyTorch Lightning PyPi Package Versions

Details:
# Security Advisory: Compromise of PyTorch Lightning PyPI Package Versions

**Published:** 2026-04-30  
**Last Updated:** 2026-04-30  

Lightning AI has identified a security incident affecting certain versions of a PyPI package.

## What happened

Lightning AI has determined that one or more released versions of this package have been compromised and include malicious code.

The current investigation indicates that the affected versions have introduced functionality consistent with a credential harvesting mechanism. There is a continuing analysis the scope and behaviour of the code.

At this stage, the root cause of the compromise is still under investigation.

## What versions are affected

Lightning AI is currently working to confirm the exact set of impacted versions.

The following versions are determined as affected, and developers should delete them from their systems:

- `2.6.2`
- `2.6.3`

Lightning AI will update this advisory if the versions impacted by this vulnerability change.

## What you should do immediately

If developers have installed or are running any potentially affected versions on their application:

- Assume the environment may be compromised  
- Immediately rotate all credentials and secrets that may have been exposed, including:  
  - API keys  
  - Access tokens  
  - SSH keys  
  - Service account credentials  
- Rebuild affected systems from a known clean state  
- Pin PyTorch Lightning to version `2.6.1`  
- Review logs for any suspicious or unauthorised activity  

## Actions Lightning AI has taken

- Quarantined malicious versions from PyPI  
- Recommended using version `2.6.1`: https://github.com/Lightning-AI/pytorch-lightning/releases/tag/2.6.1  
- Revoked and rotated all internal credentials associated with our release process  
- Initiated a full investigation into the compromise  

## Ongoing investigation

Lightning AI is actively working to:

- Identify the exact mechanism of compromise  
- Confirm the full set of affected versions  
- Determine the behaviour and impact of the malicious code  
- Assess any downstream impact to users  

Lightning AI will provide updates as soon as more information becomes available.

## Commitment to transparency

Lightning AI takes the security of users and the integrity of the software supply chain extremely seriously.

Lightning AI will continue to share timely and accurate updates as the investigation progresses.

## Contact

If there are any questions or if there are concerns that a consuming project may be impacted, please send an email to:

**security@lightning.ai**
GitHub Security Advisory: GHSA-5cmv-3rc4-7279
Package: weblate (PIP)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Vulnerable versions: < 5.17.1
Patched in: 5.17.1

Summary: Weblate vulnerable to XSS via crafted Markdown

Details:
### Impact
The Markdown renderer used in user comments and other user-provided content didn't properly sanitize some attributes.

### Patches
* https://github.com/WeblateOrg/weblate/pull/19259

### Workarounds
Even though the attacker might be able to inject code into the HTML, the Weblate's strict CSP should mitigate the risks.

### Acknowlegement
Michal Čihař has identified and fixed this vulnerability.
GitHub Security Advisory: GHSA-gcg5-86jr-f7jg
Package: weblate (PIP)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-203: Observable Discrepancy
Vulnerable versions: < 5.17.1
Patched in: 5.17.1

Summary: Weblate Vulnerable to Private Translation Enumeration via Screenshot API

Details:
### Impact

The screenshots, tasks, and component link API allowed for the enumeration of translations in a project inaccessible to the user.

### Patches
* https://github.com/WeblateOrg/weblate/pull/19258

### Acknowledgement
Weblate thanks Luay for reporting this vulnerability according to the organization's [security issues guideline](https://docs.weblate.org/en/latest/security/issues.html).
GitHub Security Advisory: GHSA-687h-xw6f-q2qw
Package: PlaywrightCapture (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 1.39.6
Patched in: 1.39.6

Summary: Playwright Capture permits access to local files and internal network resources during page capture

Details:
Playwright Capture did not sufficiently restrict navigations and resource requests initiated by rendered pages. An attacker-controlled page could abuse browser-side redirection mechanisms, such as window.location.href, to make the capture process open file:// URLs or request resources hosted on private, loopback, link-local, or otherwise non-public IP addresses. In deployments where PlaywrightCapture processes untrusted URLs, this could allow a remote attacker to perform server-side request forgery against internal services or attempt to access local files from the capture environment. Depending on what capture artifacts are generated and exposed, responses from those resources could potentially be leaked through screenshots, saved page content, logs, or other capture outputs. The patch mitigates the issue by introducing request routing checks that block secondary requests to local files, non-global IP addresses, and .local domains when only_global_lookup is enabled, while still allowing the originally requested capture URL.
GitHub Security Advisory: GHSA-qp2c-xqv6-phh6
Package: django-mdeditor (PIP)
Severity: LOW (CVSS 7.1)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: <= 0.1.20
Patched in: unpatched

Summary: django-mdeditor is Missing Authentication for Critical Function

Details:
All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload malicious files and achieve arbitrary code execution since this endpoint lacks authentication protection and proper sanitisation of file names.
GitHub Security Advisory: GHSA-7f4h-6264-89fr
Package: axonflow (PIP)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-345: Insufficient Verification of Data Authenticity, CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: < 6.7.0
Patched in: 6.7.0

Summary: axonflow-sdk-python: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification

Details:
## Summary

The AxonFlow SDK's `WebhookSubscription` (or equivalent) type did not expose the HMAC-SHA256 signing key returned by the platform's `CreateWebhook` endpoint. Without access to the secret through the typed SDK API, callers had no path to verify the `X-AxonFlow-Signature` header on incoming webhook deliveries. Affected callers had two unsatisfactory options:

1. Skip signature verification entirely — accepting any payload from any source that knew the webhook URL.
2. Hand-parse the raw HTTP JSON response to extract the secret, bypassing the type-safe SDK surface.

This advisory is filed across all four AxonFlow SDKs (Go, Python, TypeScript, Java) because the same defect and the same fix landed in each.

## Affected versions

Versions 6.6.2 and below.

## Impact

A webhook receiver using the SDK's typed API to handle inbound deliveries had no path to authenticate the source of incoming payloads. An attacker who learned the webhook URL — through misconfiguration, log leakage, observable network traffic during setup, or any other discovery channel — could forge webhook deliveries indistinguishable from legitimate ones, causing the receiving application to act on fabricated events (e.g. simulated approval-granted callbacks, simulated policy-decision callbacks, simulated step-completion callbacks).

## Remediation

Upgrade to the patched version listed in Vulnerabilities below. The signing key is now exposed on the `WebhookSubscription` response type returned by `CreateWebhook`. Implementations should:

1. Persist the secret returned by `CreateWebhook` securely (it is only returned once, at create time).
2. On each incoming webhook delivery, compute `HMAC-SHA256(secret, raw_body)` and compare it in constant time against the `X-AxonFlow-Signature` header.
3. Reject any delivery whose signature does not match.

## Credit

Identified by AxonFlow internal security review during the April 2026 quality-freeze epic.
GitHub Security Advisory: GHSA-3jmq-qhg3-f58j
Package: mcpo-simple-server (PIP)
Severity: MODERATE (CVSS 7.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 0.2.0
Patched in: unpatched

Summary: mcpo-simple-server has a Path Traversal issue

Details:
A weakness has been identified in getsimpletool mcpo-simple-server up to 0.2.0. Affected is the function delete_shared_prompt of the file src/mcpo_simple_server/services/prompt_manager/base_manager.py. This manipulation of the argument detail causes relative path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
GitHub Security Advisory: GHSA-7r92-3jgr-r65q
Package: pyquorum (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: < 0.2.1
Patched in: 0.2.1

Summary: pyquorum: Timing side‑channel in mul_mod

Details:
### Impact
The `mul_mod` function implements multiplication via a binary expansion loop whose execution time depends on the Hamming weight of the second operand (the exponent). An attacker who can measure the time of secret‑sharing operations (e.g., via a remote service) could progressively recover the values of shares, ultimately leading to secret reconstruction.

### Patches
https://github.com/svvqt/pyquorum/releases/tag/v0.2.1