deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-5ccf-884p-4jjq
Package: open-webui (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: <= 0.3.21
Patched in: unpatched

Summary: Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability

Details:
A Denial of Service (DoS) vulnerability exists in open-webui/open-webui version 0.3.21. This vulnerability affects multiple endpoints, including `/ollama/models/upload`, `/audio/api/v1/transcriptions`, and `/rag/api/v1/doc`. The application processes multipart boundaries without authentication, leading to resource exhaustion. By appending additional characters to the multipart boundary, an attacker can cause the server to parse each byte of the boundary, ultimately leading to service unavailability. This vulnerability can be exploited remotely, resulting in high CPU and memory usage, and rendering the service inaccessible to legitimate users.
GitHub Security Advisory: GHSA-747f-ww56-4q4h
Package: kedro (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 0.19.9
Patched in: 0.19.9

Summary: Kedro deserialization vulnerability

Details:
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized.
GitHub Security Advisory: GHSA-6gmf-2369-c76c
Package: zenml (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
Vulnerable versions: < 0.68.0
Patched in: 0.68.0

Summary: ZenML unauthenticated DoS via Multipart Boundry

Details:
A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending malformed multipart requests with arbitrary characters appended to the end of multipart boundaries. This flaw in the multipart request boundary processing mechanism leads to an infinite loop, resulting in a complete denial of service for all users. Affected endpoints include `/api/v1/login` and `/api/v1/device_authorization`.
GitHub Security Advisory: GHSA-hw8j-hw49-752c
Package: bentoml (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: <= 1.4.5
Patched in: unpatched

Summary: BentoML Denial of Service (DoS) via Multipart Boundary

Details:
BentoML version v1.3.4post1 is vulnerable to a Denial of Service (DoS) attack. The vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. This causes the server to continuously process each character, leading to excessive resource consumption and rendering the service unavailable. The issue is unauthenticated and does not require any user interaction, impacting all users of the service.
GitHub Security Advisory: GHSA-9g44-gwvm-hc44
Package: bentoml (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: <= 1.4.5
Patched in: unpatched

Summary: BentoML deserialization vulnerability

Details:
A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions <=1.3.4.post1. By setting specific parameters, an attacker can execute unauthorized arbitrary code on the server, causing severe harm. The vulnerability is triggered when the args-number parameter is greater than 1, leading to automatic deserialization and arbitrary code execution.
GitHub Security Advisory: GHSA-cj47-qj6g-x7r4
Package: vllm (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-502: Deserialization of Untrusted Data
Vulnerable versions: <= 0.6.0
Patched in: unpatched

Summary: vLLM allows Remote Code Execution by Pickle Deserialization via AsyncEngineRPCServer() RPC server entrypoints

Details:
vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer() RPC server entrypoints. The core functionality run_server_loop() calls the function _make_handler_coro(), which directly uses cloudpickle.loads() on received messages without any sanitization. This can result in remote code execution by deserializing malicious pickle data.
GitHub Security Advisory: GHSA-pgr7-mhp5-fgjp
Package: vllm (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: <= 0.8.1
Patched in: unpatched

Summary: vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object

Details:
vllm-project vllm version 0.6.0 contains a vulnerability in the distributed training API. The function vllm.distributed.GroupCoordinator.recv_object() deserializes received object bytes using pickle.loads() without sanitization, leading to a remote code execution vulnerability.

### Maintainer perspective
Note that vLLM does NOT use the code as described in the report on huntr. The problem only exists if you use these internal APIs in a way that exposes them to a network as described. The vllm team was not involved in the analysis of this report and the decision to assign it a CVE.
GitHub Security Advisory: GHSA-m76r-xqqj-mqmv
Package: quivr-core (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: <= 0.0.14
Patched in: unpatched

Summary: Quivr unauthenticated Denial of Service (DoS) via Multipart Boundary

Details:
A Denial of Service (DoS) vulnerability in the file upload feature of stangirard/quivr v0.0.298 allows unauthenticated attackers to cause excessive resource consumption by appending characters to the end of a multipart boundary in an HTTP request. This leads to the server continuously processing each character, rendering the service unavailable and impacting all users.
GitHub Security Advisory: GHSA-38mg-wm59-g64x
Package: composio-core (PIP)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection'), CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 0.4.4
Patched in: unpatched

Summary: composio allows Server-Side Request Forgery (SSRF) in BROWSERTOOL

Details:
A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.4. This vulnerability allows an attacker to read the contents of any file in the system by exploiting the BROWSERTOOL_GOTO_PAGE and BROWSERTOOL_GET_PAGE_DETAILS actions.
GitHub Security Advisory: GHSA-5cpq-9538-jm2j
Package: gradio (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: <= 5.22.0
Patched in: unpatched

Summary: Gradio DOS in multipart boundry while uploading the file

Details:
A vulnerability in the file upload process of gradio-app/gradio version @gradio/video@0.10.2 allows for a Denial of Service (DoS) attack. An attacker can append a large number of characters to the end of a multipart boundary, causing the system to continuously process each character and issue warnings. This can render Gradio inaccessible for extended periods, disrupting services and causing significant downtime.
GitHub Security Advisory: GHSA-4rqf-8pfm-p36r
Package: mlflow (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-29: Path Traversal: '..filename'
Vulnerable versions: < 2.17.0rc0
Patched in: 2.17.0rc0

Summary: MLflow has a Local File Read/Path Traversal in dbfs

Details:
A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. When users configure and use the dbfs service, concatenating the URL directly into the file protocol results in an arbitrary file read vulnerability. This issue occurs because only the path part of the URL is checked, while parts such as query and parameters are not handled. The vulnerability is triggered if the user has configured the dbfs service, and during usage, the service is mounted to a local directory.
GitHub Security Advisory: GHSA-qvg9-vp87-h3hr
Package: composio-core (PIP)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 0.4.2
Patched in: unpatched

Summary: composio Server-Side Request Forgery (SSRF) vulnerability

Details:
A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.2, specifically in the /api/actions/execute/WEBTOOL_SCRAPE_WEBSITE_CONTENT endpoint. This vulnerability allows an attacker to read files, access AWS metadata, and interact with local services on the system.
GitHub Security Advisory: GHSA-g5pg-73fc-hjwq
Package: litellm (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-117: Improper Output Neutralization for Logs
Vulnerable versions: < 1.44.12
Patched in: 1.44.12

Summary: LiteLLM Reveals Portion of API Key via a Logging File

Details:
In berriai/litellm before version 1.44.12, the `litellm/litellm_core_utils/litellm_logging.py` file contains a vulnerability where the API key masking code only masks the first 5 characters of the key. This results in the leakage of almost the entire API key in the logs, exposing a significant amount of the secret key. The issue affects version v1.44.9.
GitHub Security Advisory: GHSA-fjcf-3j3r-78rp
Package: litellm (PIP)
Severity: HIGH (CVSS 8.1)
CWE: CWE-266: Incorrect Privilege Assignment, CWE-285: Improper Authorization
Vulnerable versions: < 1.61.15
Patched in: 1.61.15

Summary: LiteLLM Has an Improper Authorization Vulnerability

Details:
An improper authorization vulnerability exists in the main-latest version of BerriAI/litellm. When a user with the role 'internal_user_viewer' logs into the application, they are provided with an overly privileged API key. This key can be used to access all the admin functionality of the application, including endpoints such as '/users/list' and '/users/get_users'. This vulnerability allows for privilege escalation within the application, enabling any account to become a PROXY ADMIN.
GitHub Security Advisory: GHSA-879v-fggm-vxw2
Package: litellm (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-1230: Exposure of Sensitive Information Through Metadata
Vulnerable versions: <= 1.52.1
Patched in: unpatched

Summary: LiteLLM Has a Leakage of Langfuse API Keys

Details:
In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error occurs while parsing team settings. This vulnerability exposes sensitive information, including langfuse_secret and langfuse_public_key, which can provide full access to the Langfuse project storing all requests.
GitHub Security Advisory: GHSA-4qcx-jx49-6qrh
Package: aim (PIP)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-29: Path Traversal: '..filename'
Vulnerable versions: >= 3.15.0, <= 3.27.0
Patched in: unpatched

Summary: Aim  path traversal in LockManager.release_locks

Details:
A vulnerability in the `LockManager.release_locks` function in aimhubio/aim (commit bb76afe) allows for arbitrary file deletion through relative path traversal. The `run_hash` parameter, which is user-controllable, is concatenated without normalization as part of a path used to specify file deletion. This vulnerability is exposed through the `Repo._close_run()` method, which is accessible via the tracking server instruction API. As a result, an attacker can exploit this to delete any arbitrary file on the machine running the tracking server.
GitHub Security Advisory: GHSA-j9rw-qm5f-r8xm
Package: agentscope (PIP)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-23: Relative Path Traversal
Vulnerable versions: <= 0.1.1
Patched in: unpatched

Summary: AgentScope path traversal vulnerability in save-workflow

Details:
A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix. This vulnerability allows an attacker to read and write arbitrary JSON files on the filesystem, potentially leading to the exposure or modification of sensitive information such as configuration files, API keys, and hardcoded passwords.
GitHub Security Advisory: GHSA-6mf6-7j75-2m6f
Package: agentscope (PIP)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 0.1.1
Patched in: unpatched

Summary: AgentScope stored cross-site scripting (XSS) vulnerability

Details:
A stored cross-site scripting (XSS) vulnerability exists in modelscope/agentscope, as of the latest commit 21161fe on the main branch. The vulnerability occurs in the view for inspecting detailed run information, where a user-controllable string (run ID) is appended and rendered as HTML. This allows an attacker to execute arbitrary JavaScript code in the context of the user's browser.
GitHub Security Advisory: GHSA-c4cc-w454-4634
Package: agentscope (PIP)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-29: Path Traversal: '..filename'
Vulnerable versions: <= 0.1.1
Patched in: unpatched

Summary: AgentScope path traversal vulnerability

Details:
A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete-workflow endpoint, allowing an attacker to delete arbitrary files from the filesystem. This issue arises due to improper input validation, enabling the attacker to manipulate file paths and delete sensitive files outside of the intended directory.
GitHub Security Advisory: GHSA-9w5h-67gf-xvv8
Package: agentscope (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: <= 0.0.6a3
Patched in: unpatched

Summary: AgentScope Deserialization Vulnerability

Details:
A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution (RCE) via deserialization of untrusted data using the dill library. The issue occurs in the AgentServerServicer.create_agent method, where serialized input is deserialized using dill.loads, enabling an attacker to execute arbitrary commands on the server.
GitHub Security Advisory: GHSA-6v28-q95m-93qr
Package: agentscope (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-73: External Control of File Name or Path
Vulnerable versions: <= 0.0.4
Patched in: unpatched

Summary: AgentScope directory traversal vulnerability in /read-examples

Details:
A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4. An attacker can exploit this vulnerability to read any local JSON file by sending a crafted POST request to the /read-examples endpoint.
GitHub Security Advisory: GHSA-75v5-6885-59f9
Package: agentscope (PIP)
Severity: HIGH (CVSS 7.4)
CWE: CWE-346: Origin Validation Error
Vulnerable versions: <= 0.0.4
Patched in: unpatched

Summary: AgentScope Cross-Origin Resource Sharing (CORS) vulnerability

Details:
A Cross-Origin Resource Sharing (CORS) vulnerability exists in modelscope/agentscope version v0.0.4. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can lead to unauthorized data access, information disclosure, and potential further exploitation, thereby compromising the integrity and confidentiality of the system.
GitHub Security Advisory: GHSA-f4hc-q562-cc5r
Package: agentscope (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 0.0.4
Patched in: unpatched

Summary: AgentScope Path Traversal in /api/file

Details:
A path traversal vulnerability exists in modelscope/agentscope version v.0.0.4. The API endpoint `/api/file` does not properly sanitize the `path` parameter, allowing an attacker to read arbitrary files on the server.
GitHub Security Advisory: GHSA-r229-5wgf-f28g
Package: aim (PIP)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-284: Improper Access Control, CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
Vulnerable versions: >= 3.0.0, <= 3.22.0
Patched in: unpatched

Summary: Aim Improper Access Control

Details:
In version 3.22.0 of aimhubio/aim, the AimQL query language uses an outdated version of the safer_getattr() function from RestrictedPython. This version does not protect against the str.format_map() method, allowing an attacker to leak server-side secrets or potentially gain unrestricted code execution. The vulnerability arises because str.format_map() can read arbitrary attributes of Python objects, enabling attackers to access sensitive variables such as os.environ. If an attacker can write files to a known location on the Aim server, they can use str.format_map() to load a malicious .dll/.so file into the Python interpreter, leading to unrestricted code execution.
GitHub Security Advisory: GHSA-rvgh-pr46-x7gg
Package: gradio (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 4.38.0, <= 5.0.0-beta.2
Patched in: unpatched

Summary: Gradio Vulnerable to Denial of Service (DoS) via Crafted HTTP Request

Details:
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the gradio-app/gradio repository, affecting the gr.Datetime component. The affected version is git commit 98cbcae. The vulnerability arises from the use of a regular expression `^(?:\s*now\s*(?:-\s*(\d+)\s*([dmhs]))?)?\s*$` to process user input. In Python's default regex engine, this regular expression can take polynomial time to match certain crafted inputs. An attacker can exploit this by sending a crafted HTTP request, causing the gradio process to consume 100% CPU and potentially leading to a Denial of Service (DoS) condition on the server.
GitHub Security Advisory: GHSA-7xmc-vhjp-qv5q
Package: gradio (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-475: Undefined Behavior for Input to API
Vulnerable versions: >= 4.0.0, <= 5.0.0b2
Patched in: unpatched

Summary: Gradio Vulnerable to Denial of Service (DoS) via Crafted Zip Bomb

Details:
A vulnerability in the dataframe component of gradio-app/gradio (version git 98cbcae) allows for a zip bomb attack. The component uses pd.read_csv to process input values, which can accept compressed files. An attacker can exploit this by uploading a maliciously crafted zip bomb, leading to a server crash and causing a denial of service.
GitHub Security Advisory: GHSA-pgfv-gvc5-prfg
Package: gradio (PIP)
Severity: HIGH (CVSS 8.2)
CWE: CWE-29: Path Traversal: '..filename'
Vulnerable versions: >= 4.0.0, <= 5.0.0b2
Patched in: unpatched

Summary: Gradio Vulnerable to Arbitrary File Deletion

Details:
A path traversal vulnerability exists in the Gradio Audio component of gradio-app/gradio, as of version git 98cbcae. This vulnerability allows an attacker to control the format of the audio file, leading to arbitrary file content deletion. By manipulating the output format, an attacker can reset any file to an empty file, causing a denial of service (DOS) on the server.
GitHub Security Advisory: GHSA-g48v-3p35-88jr
Package: h2o (PIP)
Severity: HIGH (CVSS 8.2)
CWE: CWE-73: External Control of File Name or Path
Vulnerable versions: >= 3.10.4.1, <= 3.46.0
Patched in: unpatched

Summary: H2O Vulnerable to Arbitrary File Overwrite

Details:
In h2oai/h2o-3 version 3.46.0, the `/99/Models/{name}/json` endpoint allows for arbitrary file overwrite on the target server. The vulnerability arises from the `exportModelDetails` function in `ModelsHandler.java`, where the user-controllable `mexport.dir` parameter is used to specify the file path for writing model details. This can lead to overwriting files at arbitrary locations on the host system.
GitHub Security Advisory: GHSA-5c8j-g96x-cj78
Package: h2o (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-1088: Synchronous Access of Remote Resource without Timeout
Vulnerable versions: >= 3.2.0.1, <= 3.46.0
Patched in: unpatched

Summary: H2O Vulnerable to Denial of Service (DoS) via `HEAD` Request

Details:
A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a `HEAD` request to verify the existence of a specified resource without setting a timeout. An attacker can exploit this by sending multiple requests to an attacker-controlled server that hangs, causing the application to block and become unresponsive to other requests.
GitHub Security Advisory: GHSA-p2vc-m5fv-9w9m
Package: h2o (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: <= 3.46.1
Patched in: unpatched

Summary: H2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint

Details:
A vulnerability in the `/3/ImportFiles` endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service. The endpoint takes a single GET parameter, `path`, which can be recursively set to reference itself. This leads the server to repeatedly call its own endpoint, eventually filling up the request queue and leaving the server unable to handle other requests.
GitHub Security Advisory: GHSA-6w62-3jvj-mfj6
Package: h2o (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
Vulnerable versions: >= 3.32.1.2, <= 3.46.0.2
Patched in: unpatched

Summary: H2O Vulnerable to Denial of Service (DoS) via Large GZIP Parsing

Details:
In h2oai/h2o-3 version 3.46.0.2, a vulnerability exists where uploading and repeatedly parsing a large GZIP file can cause a denial of service. The server becomes unresponsive due to memory exhaustion and a large number of concurrent slow-running jobs. This issue arises from the improper handling of highly compressed data, leading to significant data amplification.
GitHub Security Advisory: GHSA-53gh-p8jc-7rg8
Package: litellm (PIP)
Severity: HIGH (CVSS 8.8)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'), CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 1.40.3.dev2, <= 1.40.12
Patched in: unpatched

Summary: LiteLLM Vulnerable to Remote Code Execution (RCE)

Details:
BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the 'post_call_rules' configuration, where a callback function can be added. The provided value is split at the final '.' mark, with the last part considered the function name and the remaining part appended with the '.py' extension and imported. This allows an attacker to set a system method, such as 'os.system', as a callback, enabling the execution of arbitrary commands when a chat response is processed.
GitHub Security Advisory: GHSA-47f6-5p7h-5f3h
Package: h2o (PIP)
Severity: HIGH (CVSS 7.1)
CWE: CWE-36: Absolute Path Traversal
Vulnerable versions: >= 3.32.1.1, <= 3.46.0
Patched in: unpatched

Summary: H2O Vulnerable to Arbitrary File Overwrite via File Export

Details:
In h2oai/h2o-3 version 3.46.0, the endpoint for exporting models does not restrict the export location, allowing an attacker to export a model to any file in the server's file structure, thereby overwriting it. This vulnerability can be exploited to overwrite any file on the target server with a trained model file, although the content of the overwrite is not controllable by the attacker.