hitoshura25/cvefixes huggingface dataset:
CVE-2023-46229 (Python, published 2023-10-19T05:15Z)
Description: value: LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/langchain-ai/langchain
Files changed:
libs/langchain/langchain/document_loaders/recursive_url_loader.py
Commit message: Add security note to recursive url loader (#11934)

Add security note to recursive loader

Vulnerable code:
    """Load all child links from a URL page."""
        prevent_outside: Optional[bool] = True,

Fixed code:
    """Load all child links from a URL page.

    **Security Note**: This loader is a crawler that will start crawling
        at a given URL and then expand to crawl child links recursively.

        Web crawlers should generally NOT be deployed with network access
        to any internal servers.

        Control access to who can submit crawling requests and what network access
        the crawler has.

        While crawling, the crawler may encounter malicious URLs that would lead to a
        server-side request forgery (SSRF) attack.

        To mitigate risks, the crawler by default will only load URLs from the same
        domain as the start URL (controlled via prevent_outside named argument).

        This will mitigate the risk of SSRF attacks, but will not eliminate it.

        For example, if crawling a host which hosts several sites:

        https://some_host/alice_site/
        https://some_host/bob_site/

        A malicious URL on Alice's site could cause the crawler to make a malicious
        GET request to an endpoint on Bob's site. Both sites are hosted on the
        same host, so such a request would not be prevented by default.

        See https://python.langchain.com/docs/security
    """
        prevent_outside: bool = True,
CVE-2024-27444 (Python, published 2024-02-26T16:28Z)
Description: value: langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the __import__, __subclasses__, __builtins__, __globals__, __getattribute__, __bases__, __mro__, or __base__ attribute in Python code. These are not prohibited by pal_chain/base.py.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/langchain-ai/langchain
Files changed:
libs/experimental/langchain_experimental/pal_chain/base.py
Commit message: experimental[patch]: Enhance protection against arbitrary code execution in PALChain (#17091)

- **Description:** Block some ways to trigger arbitrary code execution
bug in PALChain.

---------

Co-authored-by: Eugene Yurtsev <eyurtsev@gmail.com>

Vulnerable code:

Fixed code:
COMMAND_EXECUTION_ATTRIBUTES = [
    "__import__",
    "__subclasses__",
    "__builtins__",
    "__globals__",
    "__getattribute__",
    "__bases__",
    "__mro__",
    "__base__",
]
                if (
                    not code_validations.allow_command_exec
                    and isinstance(node, ast.Attribute)
                    and node.attr in COMMAND_EXECUTION_ATTRIBUTES
                ):
                    raise ValueError(
                        f"Found illegal command execution function "
                        f"{node.attr} in code {code}"
                    )
CVE-2024-3571 (Python, published 2024-04-16T00:15Z)
Description: value: langchain-ai/langchain is vulnerable to path traversal due to improper limitation of a pathname to a restricted directory ('Path Traversal') in its LocalFileStore functionality. An attacker can leverage this vulnerability to read or write files anywhere on the filesystem, potentially leading to information disclosure or remote code execution. The issue lies in the handling of file paths in the mset and mget methods, where user-supplied input is not adequately sanitized, allowing directory traversal sequences to reach unintended directories.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/langchain-ai/langchain
Files changed:
libs/langchain/langchain/storage/file_system.py
libs/langchain/tests/unit_tests/storage/test_filesystem.py
Commit message: langchain(patch): Restrict paths in LocalFileStore cache (#15065)

This PR restricts the paths that can be resolve using the local file system cache so that all paths must be contained within the root path.

Vulnerable code:
        self.root_path = Path(root_path)
        return self.root_path / key

Fixed code:
import os
        self.root_path = Path(root_path).absolute()
        full_path = os.path.abspath(self.root_path / key)
        common_path = os.path.commonpath([str(self.root_path), full_path])
        if common_path != str(self.root_path):
            raise InvalidKeyException(
                f"Invalid key: {key}. Key should be relative to the full path."
                f"{self.root_path} vs. {common_path} and full path of {full_path}"
            )

        return Path(full_path)


def test_catches_forbidden_keys(file_store: LocalFileStore) -> None:
    """Make sure we raise exception on keys that are not allowed; e.g., absolute path"""
    with pytest.raises(InvalidKeyException):
        file_store.mset([("/etc", b"value1")])
    with pytest.raises(InvalidKeyException):
        list(file_store.yield_keys("/etc/passwd"))
    with pytest.raises(InvalidKeyException):
        file_store.mget(["/etc/passwd"])

    # check relative paths
    with pytest.raises(InvalidKeyException):
        list(file_store.yield_keys(".."))

    with pytest.raises(InvalidKeyException):
        file_store.mget(["../etc/passwd"])

    with pytest.raises(InvalidKeyException):
        file_store.mset([("../etc", b"value1")])

    with pytest.raises(InvalidKeyException):
        list(file_store.yield_keys("../etc/passwd"))
CVE-2021-4271 (PHP, published 2022-12-21T19:15Z)
Description: value: A vulnerability was found in panicsteve w2wiki. It has been rated as problematic. Affected by this issue is the function toHTML of the file index.php of the component Markdown Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The name of the patch is 8f1d0470b4ddb1c7699e3308e765c11ed29542b6. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216476.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/panicsteve/w2wiki
Files changed:
index.php
Commit message: Add Markdown sanitization to close XSS vulnerability; credit to Markus Schneider & Marc Clement


Vulnerable code:
 	$inText = preg_replace("/\[\[(.*?)\]\]/", "<a href=\"" . SELF . VIEW . "/\\1\">\\1</a>", $inText);
	$inText = preg_replace("/\{\{(.*?)\}\}/", "<img src=\"" . BASE_URI . "/images/\\1\" alt=\"\\1\" />", $inText);
	$inText = preg_replace("/message:(.*?)\s/", "[<a href=\"message:\\1\">email</a>]", $inText);

Fixed code:
function _handle_links($match)
{
	return "<a href=\"" . SELF . VIEW . "/" . htmlentities($match[1]) . "\">" . htmlentities($match[1]) . "</a>";
}


function _handle_images($match)
{
	return "<img src=\"" . BASE_URI . "/images/" . htmlentities($match[1]) . "\" alt=\"" . htmlentities($match[1]) . "\" />";
}


function _handle_message($match)
{
	return "[<a href=\"message:" . htmlentities($match[1]) . "\">email</a>]";
}


	$inText = preg_replace_callback("/\[\[(.*?)\]\]/", '_handle_links', $inText);
	$inText = preg_replace_callback("/\{\{(.*?)\}\}/", '_handle_images', $inText);
	$inText = preg_replace_callback("/message:(.*?)\s/", '_handle_message', $inText);
CVE-2021-32839 (Python, published 2021-09-20T17:15Z)
Description: value: sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 there is a regular Expression Denial of Service in sqlparse vulnerability. The regular expression may cause exponential backtracking on strings containing many repetitions of '\r\n' in SQL comments. Only the formatting feature that removes comments from SQL statements is affected by this regular expression. As a workaround don't use the sqlformat.format function with keyword strip_comments=True or the --strip-comments command line flag when using the sqlformat command line tool. The issues has been fixed in sqlparse 0.4.2.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/andialbrecht/sqlparse
Files changed:
sqlparse/filters/others.py
tests/test_format.py
Commit message: Optimize regular expression for identifying line breaks in comments.


Vulnerable code:
            m = re.search(r'((\r\n|\r|\n)+) *$', token.value)

Fixed code:
            # Note: The actual value for a line break is replaced by \n
            # in SerializerUnicode which will be executed in the
            # postprocessing state.
            m = re.search(r'((\r|\n)+) *$', token.value)
    def test_strip_comments_preserves_linebreak(self):
        sql = 'select * -- a comment\r\nfrom foo'
        res = sqlparse.format(sql, strip_comments=True)
        assert res == 'select *\nfrom foo'
        sql = 'select * -- a comment\nfrom foo'
        res = sqlparse.format(sql, strip_comments=True)
        assert res == 'select *\nfrom foo'
        sql = 'select * -- a comment\rfrom foo'
        res = sqlparse.format(sql, strip_comments=True)
        assert res == 'select *\nfrom foo'
        sql = 'select * -- a comment\r\n\r\nfrom foo'
        res = sqlparse.format(sql, strip_comments=True)
        assert res == 'select *\n\nfrom foo'
        sql = 'select * -- a comment\n\nfrom foo'
        res = sqlparse.format(sql, strip_comments=True)
        assert res == 'select *\n\nfrom foo'
CVE-2023-30608 (Python, published 2023-04-18T22:15Z)
Description: value: sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This issue was introduced by commit `e75e358`. The vulnerability may lead to Denial of Service (DoS). This issues has been fixed in sqlparse 0.4.4 by commit `c457abd5f`. Users are advised to upgrade. There are no known workarounds for this issue.

Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/andialbrecht/sqlparse
Files changed:
CHANGELOG
sqlparse/keywords.py
tests/test_split.py
Commit message: Remove unnecessary parts in regex for bad escaping.

The regex tried to deal with situations where escaping in the
SQL to be parsed was suspicious.


Vulnerable code:
    (r"'(''|\\\\|\\'|[^'])*'", tokens.String.Single),
    (r'"(""|\\\\|\\"|[^"])*"', tokens.String.Symbol),
    stmts = sqlparse.parse(r"select '\\'; select '\''; select '\\\'';")
    assert len(stmts) == 3

Fixed code:
Notable Changes

* IMPORTANT: This release fixes a security vulnerability in the
  parser where a regular expression vulnerable to ReDOS (Regular
  Expression Denial of Service) was used. See the security advisory
  for details: https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2
  The vulnerability was discovered by @erik-krogh from GitHub
  Security Lab (GHSL). Thanks for reporting!

* Fix regular expressions for string parsing.
    (r"'(''|\\'|[^'])*'", tokens.String.Single),
    (r'"(""|\\"|[^"])*"', tokens.String.Symbol),
    stmts = sqlparse.parse("select '\'; select '\'';")
    assert len(stmts) == 2
CVE-2023-30608 (Python, published 2023-04-18T22:15Z)
Description: value: sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This issue was introduced by commit `e75e358`. The vulnerability may lead to Denial of Service (DoS). This issues has been fixed in sqlparse 0.4.4 by commit `c457abd5f`. Users are advised to upgrade. There are no known workarounds for this issue.

Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/andialbrecht/sqlparse
Files changed:
sqlparse/lexer.py
tests/test_split.py
Commit message: Recognize escaped backslashes within strings

Previously if a single quoted string ended with an escaped backslash,
parsing would not consider the string to be terminated.


Vulnerable code:
            # TODO: Backslash escapes?
            (r"'(''|\\'|[^'])*'", tokens.String.Single),

Fixed code:
            (r"'(''|\\\\|\\'|[^'])*'", tokens.String.Single),
    def test_split_backslash(self):
        stmts = sqlparse.parse(r"select '\\'; select '\''; select '\\\'';")
        self.assertEqual(len(stmts), 3)
CVE-2024-4340 (Python, published 2024-04-30T15:15Z)
Description: value: Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.


Severity: nan (CVSS v3 base score: )
Weakness: CWE-674 \u2014 Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
Repository: https://github.com/andialbrecht/sqlparse
Files changed:
CHANGELOG
sqlparse/sql.py
tests/test_regressions.py
Commit message: Raise SQLParseError instead of RecursionError.


Vulnerable code:
        for token in self.tokens:
            if token.is_group:
                yield from token.flatten()
            else:
                yield token
    assert p.tokens[0].ttype == T.Keyword

Fixed code:
* IMPORTANT: Fixes a potential denial of service attack (DOS) due to recursion
  error for deeply nested statements. Instead of recursion error a generic
  SQLParseError is raised. See the security advisory for details:
  https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-2m57-hf25-phgg
  The vulnerability was discovered by @uriyay-jfrog. Thanks for reporting!
from sqlparse.exceptions import SQLParseError
        try:
            for token in self.tokens:
                if token.is_group:
                    yield from token.flatten()
                else:
                    yield token
        except RecursionError as err:
            raise SQLParseError('Maximum recursion depth exceeded') from err
import sys
from sqlparse.exceptions import SQLParseError
    assert p.tokens[0].ttype == T.Keyword


@pytest.fixture
def limit_recursion():
    curr_limit = sys.getrecursionlimit()
    sys.setrecursionlimit(70)
    yield
    sys.setrecursionlimit(curr_limit)


def test_max_recursion(limit_recursion):
    with pytest.raises(SQLParseError):
        sqlparse.parse('[' * 100 + ']' * 100)
CVE-2021-43785 (TypeScript, published 2021-11-26T19:15Z)
Description: value: @joeattardi/emoji-button is a Vanilla JavaScript emoji picker component. In affected versions there are two vectors for XSS attacks: a URL for a custom emoji, and an i18n string. In both of these cases, a value can be crafted such that it can insert a `script` tag into the page and execute malicious code.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/joeattardi/emoji-button
Files changed:
src/categoryButtons.ts
src/emojiArea.ts
src/preview.ts
src/search.ts
Commit message: Add more HTML escaping


Vulnerable code:
    name.innerHTML =
      this.i18n.categories[category] || defaultI18n.categories[category];
    this.name.innerHTML = emoji.name;
    messageContainer.innerHTML = this.message;

Fixed code:
import escape from 'escape-html';
import escape from 'escape-html';
    name.innerHTML = escape(
      this.i18n.categories[category] || defaultI18n.categories[category]
    );
    this.name.innerHTML = escape(emoji.name);
import escape from 'escape-html';
    messageContainer.innerHTML = escape(this.message);
CVE-2022-3968 (PHP, published 2022-11-13T08:15Z)
Description: value: A vulnerability has been found in emlog and classified as problematic. Affected by this vulnerability is an unknown functionality of the file admin/article_save.php. The manipulation of the argument tag leads to cross site scripting. The attack can be launched remotely. The name of the patch is 5bf7a79826e0ea09bcc8a21f69a0c74107761a02. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-213547.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/emlog/emlog
Files changed:
admin/article_save.php
Commit message: fix:tag xss


Vulnerable code:
$tagstring = isset($_POST['tag']) ? addslashes(trim($_POST['tag'])) : '';

Fixed code:
$tagstring = isset($_POST['tag']) ? strip_tags(addslashes(trim($_POST['tag']))) : '';
CVE-2014-125029 (PHP, published 2023-01-07T22:15Z)
Description: value: A vulnerability was found in ttskch PaginationServiceProvider up to 0.x. It has been declared as critical. This vulnerability affects unknown code of the file demo/index.php of the component demo. The manipulation of the argument sort/id leads to sql injection. Upgrading to version 1.0.0 is able to address this issue. The patch is identified as 619de478efce17ece1a3b913ab16e40651e1ea7b. It is recommended to upgrade the affected component. VDB-217150 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/ttskch/PaginationServiceProvider
Files changed:
demo/index.php
Commit message: avoid sql injection on demo code


Vulnerable code:
    $sort = $request->get('sort', 'id');
    $direction = $request->get('direction', 'asc');
    $sql = "select * from sample order by \"{$sort}\" {$direction}";

Fixed code:
    $sort = $app['db']->quoteIdentifier($request->get('sort', 'id'));
    $direction = $request->get('direction') === 'desc' ? 'DESC' : 'ASC';
    $sql = "select * from sample order by {$sort} {$direction}";
CVE-2021-41087 (Unknown, published 2021-09-21T21:15Z)
Description: value: in-toto-golang is a go implementation of the in-toto framework to protect software supply chain integrity. In affected versions authenticated attackers posing as functionaries (i.e., within a trusted set of users for a layout) are able to create attestations that may bypass DISALLOW rules in the same layout. An attacker with access to trusted private keys, may issue an attestation that contains a disallowed artifact by including path traversal semantics (e.g., foo vs dir/../foo). Exploiting this vulnerability is dependent on the specific policy applied. The problem has been fixed in version 0.3.0.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/in-toto/in-toto-golang
Files changed:
Commit message: Merge pull request from GHSA-vrxp-mg9f-hwf3

Fix handling of wildcards and relative paths

Vulnerable code:

Fixed code:
CVE-2022-0955 (PHP, published 2022-03-24T15:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/data-hub prior to 1.2.4.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/data-hub
Files changed:
src/Controller/ConfigController.php
Commit message: follow up to https://github.com/pimcore/data-hub/pull/462


Vulnerable code:
            'text' => $name,

Fixed code:
            'text' => htmlspecialchars($name),
CVE-2018-20837 (PHP, published 2019-05-09T22:29Z)
Description: value: include/admin/Menu/Ajax.php in Typesetter 5.1 has index.php/Admin/Menu/Ajax?cmd=AddHidden title XSS.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Typesetter/Typesetter
Files changed:
include/admin/Menu/Ajax.php
Commit message: prevent code injection (XSS)

fix for reflected XSS vulnerability spotted by Mithat Gögebakan,
www.netsparker.com


Vulnerable code:
		echo '<input type="text" name="title" maxlength="100" size="50" value="'.htmlspecialchars($_REQUEST['title']).'" class="gpinput full_width" required/>';

Fixed code:
		$new_title = htmlspecialchars($_REQUEST['title']);
		// prevent code injections
		$new_title = str_replace(array('=', '/', '{', '}', ':', ',', ';'), '', $new_title);
		echo '<input type="text" name="title" maxlength="100" size="50" value="'. $new_title .'" class="gpinput full_width" required/>';