eisen (0.1.9), eisen-deploy (>=0.0.1, <=0.0.2) +1 more potentially affected by CVE-2024-6577 via torchserve (>=0.0.1b20200409, <=0.7.1)

torchserve PYPI version =0.0.1b20200409, =0.0.1, =0.0.80, =0.1.0 Source cves: CVE-2024-6577 Source advisory: GHSA-XX7C-J7H3-VJCQ...

eisen (0.1.9), eisen-deploy (>=0.0.1, <=0.0.2) +1 more potentially affected by CVE-2024-6577 via torchserve (>=0.0.1b20200409, <=0.7.1)

torchserve PYPI version =0.0.1b20200409, =0.0.1, =0.0.80, =0.1.0 Source cves: CVE-2024-6577 Source advisory: OSV:GHSA-XX7C-J7H3-VJCQ...

llm-toys (0.1.1), tcbench (>=0.0.20, <=0.0.22) +1 more potentially affected by CVE-2024-6829 via aim (>=3.17.4, <=3.19.3)

aim PYPI version =3.17.4, =0.0.20, =0.1.0, =0.5.6 Source cves: CVE-2024-6829 Source advisory: OSV:GHSA-75PX-35P4-QQ6H...

llm-toys (0.1.1), tcbench (>=0.0.20, <=0.0.22) +1 more potentially affected by CVE-2024-6829 via aim (>=3.17.4, <=3.19.3)

aim PYPI version =3.17.4, =0.0.20, =0.1.0, =0.5.6 Source cves: CVE-2024-6829 Source advisory: GHSA-75PX-35P4-QQ6H...

dsipts (>=1.1.5, <=1.1.19), llm-toys (0.1.1) +2 more potentially affected by CVE-2024-6851 via aim (>=3.17.4, <=3.20.1)

aim PYPI version =3.17.4, =1.1.5, =0.0.20, =0.1.0, =0.5.6 Source cves: CVE-2024-6851 Source advisory: OSV:GHSA-MRVR-7493-PFQ3...

llm-toys (0.1.1), tcbench (>=0.0.20, <=0.0.22) +1 more potentially affected by CVE-2024-6483 via aim (>=3.17.4, <=3.19.3)

aim PYPI version =3.17.4, =0.0.20, =0.1.0, =0.5.6 Source cves: CVE-2024-6483 Source advisory: GHSA-P6X3-V6G3-7557...

llm-toys (0.1.1), tcbench (>=0.0.20, <=0.0.22) +1 more potentially affected by CVE-2024-6483 via aim (>=3.17.4, <=3.19.3)

aim PYPI version =3.17.4, =0.0.20, =0.1.0, =0.5.6 Source cves: CVE-2024-6483 Source advisory: OSV:GHSA-P6X3-V6G3-7557...

dsipts (>=1.1.5, <=1.1.19), llm-toys (0.1.1) +2 more potentially affected by CVE-2024-12778 via aim (>=3.17.4, <=3.20.1)

aim PYPI version =3.17.4, =1.1.5, =0.0.20, =0.1.0, =0.5.6 Source cves: CVE-2024-12778 Source advisory: OSV:GHSA-35P3-6J45-PRWM...

dsipts (>=1.1.5, <=1.1.19), llm-toys (0.1.1) +2 more potentially affected by CVE-2024-12778 via aim (>=3.17.4, <=3.20.1)

aim PYPI version =3.17.4, =1.1.5, =0.0.20, =0.1.0, =0.5.6 Source cves: CVE-2024-12778 Source advisory: GHSA-35P3-6J45-PRWM...

dsipts (>=1.1.5, <=1.1.19), llm-toys (0.1.1) +2 more potentially affected by CVE-2024-12777 via aim (>=3.17.4, <=3.20.1)

aim PYPI version =3.17.4, =1.1.5, =0.0.20, =0.1.0, =0.5.6 Source cves: CVE-2024-12777 Source advisory: GHSA-V5PJ-JRPV-H6G2...

dsipts (>=1.1.5, <=1.1.19), llm-toys (0.1.1) +2 more potentially affected by CVE-2024-12777 via aim (>=3.17.4, <=3.20.1)

aim PYPI version =3.17.4, =1.1.5, =0.0.20, =0.1.0, =0.5.6 Source cves: CVE-2024-12777 Source advisory: OSV:GHSA-V5PJ-JRPV-H6G2...

askdoc (0.1.1), chat-with-mlx (>=0.1.6, <=0.1.11) +1 more potentially affected by CVE-2024-12217 via gradio (4.19.2)

gradio PYPI version 4.19.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - askdoc 0.1.1 - chat-with-mlx =0.1.6, =0.1.11 - hugegraph-llm 1.3.0 Source cves: CVE-2024-12217 Source advisory: OSV:GHSA-PRPG-P95C-32FV...

aqueduct-llm (0.0.1), fschat (>=0.1.1, <=0.2.15) +3 more potentially affected by CVE-2024-12217 via gradio (3.23.0)

gradio PYPI version 3.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - aqueduct-llm 0.0.1 - fschat =0.1.1, =0.0.1, =0.0.16 Source cves: CVE-2024-12217 Source advisory: OSV:GHSA-PRPG-P95C-32FV...

PYSEC-2025-244

A vulnerability in the LangChainLLM class of the run-llama/llamaindex repository, version v0.12.5, allows for a Denial of Service DoS attack. The streamcomplete method executes the llm using a thread and retrieves the result via the getresponsegen method of the StreamingGeneratorCallbackHandler...

CVE-2024-8196 Missing Authentication for Critical Function in mintplex-labs/anything-llm

In mintplex-labs/anything-llm v1.5.11 desktop version for Windows, the application opens server port 3001 on 0.0.0.0 with no authentication by default. This vulnerability allows an attacker to gain full backend access, enabling them to perform actions such as deleting all data from the workspace...

CVE-2024-8196 Missing Authentication for Critical Function in mintplex-labs/anything-llm

In mintplex-labs/anything-llm v1.5.11 desktop version for Windows, the application opens server port 3001 on 0.0.0.0 with no authentication by default. This vulnerability allows an attacker to gain full backend access, enabling them to perform actions such as deleting all data from the workspace...

CVE-2024-8196

CVE-2024-8196 affects mintplex-labs/anything-llm v1.5.11 desktop for Windows. The app opens server port 3001 on 0.0.0.0 with no authentication by default, enabling an attacker to gain full backend access and potentially delete all data from the workspace. Connected sources reiterate the same beha...

CVE-2024-8196

In mintplex-labs/anything-llm v1.5.11 desktop version for Windows, the application opens server port 3001 on 0.0.0.0 with no authentication by default. This vulnerability allows an attacker to gain full backend access, enabling them to perform actions such as deleting all data from the workspace...

CVE-2024-8248

A vulnerability in the normalizePath function in mintplex-labs/anything-llm version git 296f041 allows for path traversal, leading to arbitrary file read and write in the storage directory. This can result in privilege escalation from manager to admin. The issue is fixed in version 1.2.2...

CVE-2024-12779

A Server-Side Request Forgery SSRF vulnerability exists in infiniflow/ragflow version 0.12.0. The vulnerability is present in the "POST /v1/llm/addllm" and "POST /v1/conversation/tts" endpoints. Attackers can specify an arbitrary URL as the "apibase" when adding an "OPENAITTS" model, and...