deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-f54f-hr32-586f
Package: browser-use (PIP)
Severity: CRITICAL (CVSS 9.3)
CWE: CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions
Vulnerable versions: <= 0.1.44
Patched in: 0.1.45

Summary: Duplicate Advisory: `allowed_domains` can be bypassed by putting a decoy domain in http auth username portion of a URL

Details:
# Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-x39x-9qw5-ghrf. This link is maintained to preserve external references.

# Original Description
In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is mishandled because userinfo can be placed in the authority component.
GitHub Security Advisory: GHSA-mwfg-948f-2cc5
Package: mobsf (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 4.3.2
Patched in: 4.3.3

Summary: Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload

Details:
**Vulnerable MobSF Versions:**  <= v4.3.2

**CVSS V4.0 Score:** 8.6 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N)

**Details:**
A Stored Cross-Site Scripting (XSS) vulnerability has been identified in MobSF versions ≤ 4.3.2. The vulnerability arises from improper sanitization of user-supplied SVG files during the Android APK analysis workflow.

When an Android Studio project contains a malicious SVG file as an app icon (e.g path, /app/src/main/res/mipmap-hdpi/ic_launcher.svg), and the project is zipped and uploaded to MobSF, the tool processes and extracts the contents without validating or sanitizing the SVG. 

Upcon ZIP extraction this icon file is saved by MobSF to: user/.MobSF/downloads/<filename>.svg

This file becomes publicly accessible via the web interface at:

http://127.0.0.1:8081/download/filename.svg

If the SVG contains embedded JavaScript (e.g., an XSS payload), accessing this URL via a browser leads to the execution of the script in the context of the MobSF user session, resulting in stored XSS.

**Proof Of Concept:**

1. Create a malicious SVG file (ic_launcher.svg) with an embedded XSS payload.

![01](https://github.com/user-attachments/assets/9a89dec2-0671-490d-aba6-f38470bd84ee)

2. Place the file in the Android Studio project directory: /app/src/main/res/mipmap-hdpi/ic_launcher.svg

![02](https://github.com/user-attachments/assets/fc66f659-9f90-4be8-92c3-c5f26e1e11de)

3. Zip the project directory and upload it to MobSF.

![03](https://github.com/user-attachments/assets/a8465037-3b7a-42b7-89cf-5102c27917e7)

4. After the scan, navigate to the "Recent Scans" page in the MobSF web interface and click on the scan entry and open the icon file in a new browser tab.

![04](https://github.com/user-attachments/assets/5355e4d3-89a2-403a-a1a7-f60389fdbb8d)

5. The XSS payload is executed, confirming the vulnerability.

![05](https://github.com/user-attachments/assets/bc1e3493-1ffc-4598-b122-85459a406748)
GitHub Security Advisory: GHSA-9rw2-jf8x-cgwm
Package: flair (PIP)
Severity: MODERATE (CVSS 5.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 0.15.0
Patched in: 0.15.0

Summary: Flair allows arbitrary code execution

Details:
A vulnerability, which was classified as critical, was found in flairNLP flair 0.14.0. Affected is the function ClusteringModel of the file flair\models\clustering.py of the component Mode File Loader. The manipulation leads to code injection. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-vc6m-hm49-g9qg
Package: vllm (PIP)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 0.8.0, < 0.8.5
Patched in: 0.8.5

Summary: phi4mm: Quadratic Time Complexity in Input Token Processing​ leads to denial of service

Details:
### Summary
A critical performance vulnerability has been identified in the input preprocessing logic of the multimodal tokenizer. The code dynamically replaces placeholder tokens (e.g., <|audio_*|>, <|image_*|>) with repeated tokens based on precomputed lengths. Due to ​​inefficient list concatenation operations​​, the algorithm exhibits ​​quadratic time complexity (O(n²))​​, allowing malicious actors to trigger resource exhaustion via specially crafted inputs.

### Details
​​Affected Component​​: input_processor_for_phi4mm function.
https://github.com/vllm-project/vllm/blob/8cac35ba435906fb7eb07e44fe1a8c26e8744f4e/vllm/model_executor/models/phi4mm.py#L1182-L1197

The code modifies the input_ids list in-place using input_ids = input_ids[:i] + tokens + input_ids[i+1:]. Each concatenation operation copies the entire list, leading to O(n) operations per replacement. For k placeholders expanding to m tokens, total time becomes O(kmn), approximating O(n²) in worst-case scenarios.

### PoC
Test data demonstrates exponential time growth:
```python
test_cases = [100, 200, 400, 800, 1600, 3200, 6400]
run_times = [0.002, 0.007, 0.028, 0.136, 0.616, 2.707, 11.854]  # seconds
```
Doubling input size increases runtime by ~4x (consistent with O(n²)).

### Impact
​​Denial-of-Service (DoS):​​ An attacker could submit inputs with many placeholders (e.g., 10,000 
 tokens), causing CPU/memory exhaustion.
Example: 10,000 placeholders → ~100 million operations.


### Remediation Recommendations​
Precompute all placeholder positions and expansion lengths upfront.
Replace dynamic list concatenation with a single preallocated array.
```python
# Pseudocode for O(n) solution
new_input_ids = []
for token in input_ids:
    if token is placeholder:
        new_input_ids.extend([token] * precomputed_length)
    else:
        new_input_ids.append(token)
```
GitHub Security Advisory: GHSA-fpwr-67px-3qhx
Package: transformers (PIP)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: < 4.50.0
Patched in: 4.50.0

Summary: Transformers Regular Expression Denial of Service (ReDoS) vulnerability

Details:
A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file `tokenization_gpt_neox_japanese.py` of the GPT-NeoX-Japanese model. The vulnerability occurs in the SubWordJapaneseTokenizer class, where regular expressions process specially crafted inputs. The issue stems from a regex exhibiting exponential complexity under certain conditions, leading to excessive backtracking. This can result in high CPU usage and potential application downtime, effectively creating a Denial of Service (DoS) scenario. The affected version is v4.48.1 (latest).
GitHub Security Advisory: GHSA-jmjf-mfhm-j3gf
Package: aworld (PIP)
Severity: LOW (CVSS 5.0)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'), CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: <= 0.2.1
Patched in: unpatched

Summary: AWorld OS Command Injection vulnerability

Details:
A vulnerability was found in inclusionAI AWorld up to 8c257626e648d98d793dd9a1a950c2af4dd84c4e. It has been rated as critical. This issue affects the function subprocess.run/subprocess.Popen of the file AWorld/aworld/virtual_environments/terminals/shell_tool.py. The manipulation leads to os command injection. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
GitHub Security Advisory: GHSA-hj4w-hm2g-p6w5
Package: vllm (PIP)
Severity: CRITICAL (CVSS 10.0)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 0.6.5, < 0.8.5
Patched in: 0.8.5

Summary: vLLM Vulnerable to Remote Code Execution via Mooncake Integration

Details:
## Impacted Deployments

**Note that vLLM instances that do NOT make use of the mooncake integration are NOT vulnerable.**

## Description

vLLM integration with mooncake is vaulnerable to remote code execution due to using `pickle` based serialization over unsecured ZeroMQ sockets. The vulnerable sockets were set to listen on all network interfaces, increasing the likelihood that an attacker is able to reach the vulnerable ZeroMQ sockets to carry out an attack.


This is a similar to [GHSA - x3m8 - f7g5 - qhm7](https://github.com/vllm-project/vllm/security/advisories/GHSA-x3m8-f7g5-qhm7), the problem is in

https://github.com/vllm-project/vllm/blob/32b14baf8a1f7195ca09484de[PII_REDACTED]b43c5/vllm/distributed/kv_transfer/kv_pipe/mooncake_pipe.py#L179

Here [recv_pyobj()](https://github.com/zeromq/pyzmq/blob/453f00c5645a3bea40d79f53aa8c47d85038dc2d/zmq/sugar/socket.py#L961) Contains implicit `pickle.loads()`, which leads to potential RCE.
GitHub Security Advisory: GHSA-7mpr-5m44-h73r
Package: markdownify (PIP)
Severity: LOW (CVSS 2.9)
CWE: CWE-1284: Improper Validation of Specified Quantity in Input
Vulnerable versions: < 0.14.1
Patched in: 0.14.1

Summary: markdownify allows large headline prefixes such as <h9999999>, which causes memory consumption

Details:
python-markdownify (aka markdownify) before 0.14.1 allows large headline prefixes such as <h9999999> in addition to <h1> through <h6>. This causes memory consumption.
GitHub Security Advisory: GHSA-4p4h-9gvq-7xfg
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-184: Incomplete List of Disallowed Inputs
Vulnerable versions: < 0.0.25
Patched in: unpatched

Summary: Duplicate Advisory: Picklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate

Details:
# Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-93mv-x874-956g. This link is maintained to preserve external references.

# Original Description

The unsafe globals in Picklescan before 0.0.25 do not include ssl. Consequently, ssl.get_server_certificate can exfiltrate data via DNS after deserialization.
GitHub Security Advisory: GHSA-jfvg-qm4p-473x
Package: lmdeploy (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: <= 0.7.1
Patched in: unpatched

Summary: InternLM LMDeploy code injection vulnerability

Details:
A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been declared as critical. Affected by this vulnerability is the function Open of the file lmdeploy/docs/en/conf.py. The manipulation leads to code injection. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
GitHub Security Advisory: GHSA-ggpf-24jw-3fcw
Package: vllm (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-1395: Dependency on Vulnerable Third-Party Component
Vulnerable versions: < 0.8.0
Patched in: 0.8.0

Summary: CVE-2025-24357 Malicious model remote code execution fix bypass with PyTorch < 2.6.0

Details:
## Description

https://github.com/vllm-project/vllm/security/advisories/GHSA-rh4j-5rhw-hr54 reported a vulnerability where loading a malicious model could result in code execution on the vllm host. The fix applied to specify `weights_only=True` to calls to `torch.load()` did not solve the problem prior to PyTorch 2.6.0.

PyTorch has issued a new CVE about this problem: https://github.com/advisories/GHSA-53q9-r3pm-6pq6

This means that versions of vLLM using PyTorch before 2.6.0 are vulnerable to this problem.
## Background Knowledge
When users install VLLM according to the official manual
![image](https://github.com/user-attachments/assets/d17e0bdb-26f2-46d6-adf6-0b17e5ddf5c7)

But the version of PyTorch is specified in the requirements. txt file
![image](https://github.com/user-attachments/assets/94aad622-ad6d-4741-b772-c342727c58c7)

So by default when the user install VLLM, it will install the PyTorch with version 2.5.1
![image](https://github.com/user-attachments/assets/04ff31b0-aad1-490a-963d-00fda91da47b)

In CVE-2025-24357, weights_only=True was used for patching, but we know this is not secure.
Because we found that using Weights_only=True in pyTorch before 2.5.1 was unsafe

Here, we use this interface to prove that it is not safe.
![image](https://github.com/user-attachments/assets/0d86efcd-2aad-42a2-8ac6-cc96b054c925)


## Fix
update PyTorch version to 2.6.0

## Credit
This vulnerability was found By Ji'an Zhou and Li'shuo Song
GitHub Security Advisory: GHSA-8m57-j273-2qg9
Package: OpenEXR (PIP)
Severity: MODERATE (CVSS 6.5)
Vulnerable versions: < 2.2.1
Patched in: 2.2.1

Summary: OpenEXR invalid read

Details:
In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash.
GitHub Security Advisory: GHSA-qxh9-r8xw-7v99
Package: OpenEXR (PIP)
Severity: HIGH (CVSS 8.8)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 2.2.1
Patched in: 2.2.1

Summary: OpenEXR invalid write

Details:
In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could cause the application to crash or execute arbitrary code.
GitHub Security Advisory: GHSA-pw67-xjhq-389w
Package: pycel (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: <= 1.0b30
Patched in: unpatched

Summary: Pycel allows code injection via a crafted formula

Details:
Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginning with the `=IF(A1=200, eval("__import__('os').system(` substring.
GitHub Security Advisory: GHSA-qw93-h6pf-226x
Package: octoprint (PIP)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-290: Authentication Bypass by Spoofing
Vulnerable versions: <= 1.10.3
Patched in: 1.11.0

Summary: OctoPrint Authenticated Reverse Proxy Page Authentication Bypass

Details:
### Impact

OctoPrint versions up until and including 1.10.3 contain a vulnerability that allows an attacker to bypass the login redirect and directly access the rendered HTML of certain frontend pages. 

The impact on data exposure is minimal because, typically, data is loaded via API requests that correctly enforce user authentication. In the current codebase, cases where data is directly embedded in the page content are rare. However, one notable exception is the authenticated variant of the reverse proxy test page, which displays the IP addresses of configured reverse proxies. 

The primary risk lies in potential future modifications to the codebase that might incorrectly rely on the vulnerable internal functions for authentication checks, leading to security vulnerabilities.

### Patches

The vulnerability has been patched in version 1.11.0.

### Details

An authentication bypass vulnerability exists in the following functions defined in [octoprint/server/util/init.py](https://github.com/OctoPrint/OctoPrint/blob/d79a0d20f3f1c7f2edb56dedda3b70267a937e65/src/octoprint/server/util/__init__.py):

- `require_login`
- `require_login_with`
- `require_fresh_login_with`

By adding the HTTP header `X-Preemptive-Recording: yes` to HTTP requests, these functions allow requests to proceed without redirecting to the login screen, effectively bypassing the login mechanism in the frontend. However, this only grants access to frontend page content, while authenticated API endpoints still enforce proper session validation.

### Credits

This vulnerability was discovered and responsibly disclosed to OctoPrint by Jacopo Tediosi
GitHub Security Advisory: GHSA-pvcp-73cg-6f77
Package: web2py (PIP)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 2.14.5
Patched in: unpatched

Summary: Web2py Reflected XSS vulnerability

Details:
Web2py versions 2.14.5 and below was affected by Reflected XSS vulnerability, which allows an attacker to perform an XSS attack on logged in user (admin).
GitHub Security Advisory: GHSA-445m-27cf-gr3x
Package: Crawl4AI (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 0.4.247
Patched in: unpatched

Summary: Crawl4AI SSRF vulnerability

Details:
Crawl4AI <=0.4.247 is vulnerable to SSRF in /crawl4ai/async_dispatcher.py.
GitHub Security Advisory: GHSA-7xq5-54jp-2mfg
Package: rasa-pro (PIP)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: <= 3.9.17
Patched in: 3.9.20

Summary: Rasa Pro Missing Authentication For Voice Connector APIs

Details:
## Vulnerability
A vulnerability has been identified in Rasa Pro where voice connectors in Rasa Pro do not properly implement authentication even when a token is configured in the `credentials.yml` file. This could allow an attacker to submit voice data to the Rasa Pro assistant from an unauthenticated source.

This impacts the following connectors:

- `audiocodes_stream`
- `genesys`
- `jambonz`

As part of our investigation to resolve this issue, we have also performed a security review of our other voice channel connectors:

- `browser_audio`: Does not support authentication. This is a development channel not intended for production use.
- `twilio_media_streams`, `twilio_voice` and `jambonz`: Authentication is currently not supported by these channels, but our investigation has found a way for us to enable it for these voice channel connectors in a future Rasa Pro release.

## Fix
The issue has been resolved for `audiocodes`, `audiocodes_stream`, and `genesys` connectors. Fixed versions of Rasa Pro have been released for `3.9.20`, `3.10.19`, `3.11.7` and `3.12.6`. Please update to a fixed release.

If you are using one of the affected connectors, we strongly recommend upgrading to a fixed version. For connectors where authentication is not supported (e.g., Twilio), we suggest taking extra caution and considering other compensating controls if applicable.
GitHub Security Advisory: GHSA-7xq5-54jp-2mfg
Package: rasa-pro (PIP)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: >= 3.10.0, <= 3.10.18
Patched in: 3.10.19

Summary: Rasa Pro Missing Authentication For Voice Connector APIs

Details:
## Vulnerability
A vulnerability has been identified in Rasa Pro where voice connectors in Rasa Pro do not properly implement authentication even when a token is configured in the `credentials.yml` file. This could allow an attacker to submit voice data to the Rasa Pro assistant from an unauthenticated source.

This impacts the following connectors:

- `audiocodes_stream`
- `genesys`
- `jambonz`

As part of our investigation to resolve this issue, we have also performed a security review of our other voice channel connectors:

- `browser_audio`: Does not support authentication. This is a development channel not intended for production use.
- `twilio_media_streams`, `twilio_voice` and `jambonz`: Authentication is currently not supported by these channels, but our investigation has found a way for us to enable it for these voice channel connectors in a future Rasa Pro release.

## Fix
The issue has been resolved for `audiocodes`, `audiocodes_stream`, and `genesys` connectors. Fixed versions of Rasa Pro have been released for `3.9.20`, `3.10.19`, `3.11.7` and `3.12.6`. Please update to a fixed release.

If you are using one of the affected connectors, we strongly recommend upgrading to a fixed version. For connectors where authentication is not supported (e.g., Twilio), we suggest taking extra caution and considering other compensating controls if applicable.
GitHub Security Advisory: GHSA-7xq5-54jp-2mfg
Package: rasa-pro (PIP)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: >= 3.11.0, <= 3.11.6
Patched in: 3.11.7

Summary: Rasa Pro Missing Authentication For Voice Connector APIs

Details:
## Vulnerability
A vulnerability has been identified in Rasa Pro where voice connectors in Rasa Pro do not properly implement authentication even when a token is configured in the `credentials.yml` file. This could allow an attacker to submit voice data to the Rasa Pro assistant from an unauthenticated source.

This impacts the following connectors:

- `audiocodes_stream`
- `genesys`
- `jambonz`

As part of our investigation to resolve this issue, we have also performed a security review of our other voice channel connectors:

- `browser_audio`: Does not support authentication. This is a development channel not intended for production use.
- `twilio_media_streams`, `twilio_voice` and `jambonz`: Authentication is currently not supported by these channels, but our investigation has found a way for us to enable it for these voice channel connectors in a future Rasa Pro release.

## Fix
The issue has been resolved for `audiocodes`, `audiocodes_stream`, and `genesys` connectors. Fixed versions of Rasa Pro have been released for `3.9.20`, `3.10.19`, `3.11.7` and `3.12.6`. Please update to a fixed release.

If you are using one of the affected connectors, we strongly recommend upgrading to a fixed version. For connectors where authentication is not supported (e.g., Twilio), we suggest taking extra caution and considering other compensating controls if applicable.
GitHub Security Advisory: GHSA-7xq5-54jp-2mfg
Package: rasa-pro (PIP)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: >= 3.12.0, <= 3.12.5
Patched in: 3.12.6

Summary: Rasa Pro Missing Authentication For Voice Connector APIs

Details:
## Vulnerability
A vulnerability has been identified in Rasa Pro where voice connectors in Rasa Pro do not properly implement authentication even when a token is configured in the `credentials.yml` file. This could allow an attacker to submit voice data to the Rasa Pro assistant from an unauthenticated source.

This impacts the following connectors:

- `audiocodes_stream`
- `genesys`
- `jambonz`

As part of our investigation to resolve this issue, we have also performed a security review of our other voice channel connectors:

- `browser_audio`: Does not support authentication. This is a development channel not intended for production use.
- `twilio_media_streams`, `twilio_voice` and `jambonz`: Authentication is currently not supported by these channels, but our investigation has found a way for us to enable it for these voice channel connectors in a future Rasa Pro release.

## Fix
The issue has been resolved for `audiocodes`, `audiocodes_stream`, and `genesys` connectors. Fixed versions of Rasa Pro have been released for `3.9.20`, `3.10.19`, `3.11.7` and `3.12.6`. Please update to a fixed release.

If you are using one of the affected connectors, we strongly recommend upgrading to a fixed version. For connectors where authentication is not supported (e.g., Twilio), we suggest taking extra caution and considering other compensating controls if applicable.
GitHub Security Advisory: GHSA-2689-cw26-6cpj
Package: whoogle-search (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 0.9.1
Patched in: 0.9.1

Summary: Whoogle allows attackers to execute arbitrary code via supplying a crafted search query

Details:
An issue in the component /models/config.py of Whoogle search v0.9.0 allows attackers to execute arbitrary code via supplying a crafted search query.