Rasa-cve-exp

Rasa-cve-exp CVE-2021-42556 server-1.py Just run it directly python server-1.py Arbitrary File Upload PUT /model "modelserver":"url":"http://192.168.244.128:5000/stage1","waittimebetweenpulls":0 Effect as follows: CVE-2021-41127 server-1.py Default model name: evilimportmodel.tar.gz Malicious mod...

general-tools (>=0.1.4, <=0.2.1), happymongo-py3 (0.1.2) +3 more potentially affected by CVE-2026-88029 via pymongo (3.7.0)

pymongo PYPI version 3.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - general-tools =0.1.4, =0.1.0, =23.0.3, =23.0.7 Source cves: CVE-2026-88029 Source advisory: OSV:GHSA-8FVV-FGR5-F8CH...

auditorium (>=0.6.1, <=19.1.1), gino-admin (>=0.0.1, <=0.2.1) +9 more potentially affected by CVE-2026-85078 via sanic (19.12.5)

sanic PYPI version 19.12.5 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - auditorium =0.6.1, =0.0.1, =1.5.0, =1.4.0, =1.5.0, =0.0.2, =0.1.0, =0.1.2, =1.7.0, =0.1.0, =0.2.0 Source cves: CVE-2026-85078 Source advisory:...

rasa (>=3.0.0rc1, <=3.0.8), rasa-sdk (>=3.0.0rc1, <=3.1.0) +7 more potentially affected by CVE-2026-85078 via sanic (21.9.3)

sanic PYPI version 21.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - rasa =3.0.0rc1, =3.0.0rc1, =0.1.3, =1.0.0, =0.6.0, =21.1.5.2, =21.1.5.3 Source cves: CVE-2026-85078 Source advisory: OSV:PYSEC-2026-4162...

ax (>=0.43.0, <=0.52.0), convo-nlu (0.1.0) +17 more potentially affected by CVE-2026-85078 via sanic (19.12.2)

sanic PYPI version 19.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - ax =0.43.0, =0.0.4, =0.0.1, =0.1.3, =2024.10.27.post1, =0.23.5, =1.5.0, =0.1.0, =2.6.1, =3.10.2rc3 and more Source cves: CVE-2026-85078 Source...

aiocqhttp-sanic (>=1.2.3a1, <=1.2.3), ax (>=0.39.0, <=0.42.0) +11 more potentially affected by CVE-2026-85078 via sanic (19.3.1)

sanic PYPI version 19.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - aiocqhttp-sanic =1.2.3a1, =0.39.0, =1.4.2rc1, =1.0.0rc1, =0.1.0a1, =0.3.0, =0.1.0, =0.3.0, =0.7.0 Source cves: CVE-2026-85078 Source advisory:...

h2 (>=1.1.0, <=3.0.0), mitmproxy (>=0.18.2, <=0.18.3) +3 more potentially affected by CVE-2026-59980 via hpack (2.3.0)

hpack PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on hpack and may be impacted: - h2 =1.1.0, =0.18.2, =0.9.0, =2.6.1, =3.10.2rc3 Source cves: CVE-2026-59980 Source advisory: OSV:GHSA-8V8H-HG4W-MVQ2...

apartment-browser (0.0.1), docsvault (>=0.1.2, <=0.1.4) +12 more potentially affected by CVE-2026-85078 via sanic (20.9.1)

sanic PYPI version 20.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - apartment-browser 0.0.1 - docsvault =0.1.2, =4.1.0, =0.2.2, =0.1.2, =2.8.7, =0.1.1, =0.0.4, =0.0.6 - sanic-oauthlib 0.2.3 - zillionare-omega 0.6.0...

auditorium (>=0.6.1, <=19.1.1), gino-admin (>=0.0.1, <=0.2.1) +9 more potentially affected by CVE-2026-85078 via sanic (19.12.5)

sanic PYPI version 19.12.5 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - auditorium =0.6.1, =0.0.1, =1.5.0, =1.4.0, =1.5.0, =0.0.2, =0.1.0, =0.1.2, =1.7.0, =0.1.0, =0.2.0 Source cves: CVE-2026-85078 Source advisory:...

aiocqhttp-sanic (>=1.2.3a1, <=1.2.3), ax (>=0.39.0, <=0.42.0) +11 more potentially affected by CVE-2026-85078 via sanic (19.3.1)

sanic PYPI version 19.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - aiocqhttp-sanic =1.2.3a1, =0.39.0, =1.4.2rc1, =1.0.0rc1, =0.1.0a1, =0.3.0, =0.1.0, =0.3.0, =0.7.0 Source cves: CVE-2026-85078 Source advisory:...

ax (>=0.43.0, <=0.52.0), convo-nlu (0.1.0) +17 more potentially affected by CVE-2026-85078 via sanic (19.12.2)

sanic PYPI version 19.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - ax =0.43.0, =0.0.4, =0.0.1, =0.1.3, =2024.10.27.post1, =0.23.5, =1.5.0, =0.1.0, =2.6.1, =3.10.2rc3 and more Source cves: CVE-2026-85078 Source...

askbob (>=0.0.3, <=0.0.4), cde (0.2.0.1) +12 more potentially affected by CVE-2026-85078 via sanic (20.9.0)

sanic PYPI version 20.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - askbob =0.0.3, =0.0.19, =0.1.1, =0.3.26, =0.10.25, =2.2.10, =0.0.1, =0.2.1, =0.2.2 - sanic-sockjs 0.1.0 - sstool-general 0.0.4 - vma-nlu 1.1.6 Source...

rasa (>=3.0.0rc1, <=3.0.8), rasa-sdk (>=3.0.0rc1, <=3.1.0) +7 more potentially affected by CVE-2026-85078 via sanic (21.9.3)

sanic PYPI version 21.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - rasa =3.0.0rc1, =3.0.0rc1, =0.1.3, =1.0.0, =0.6.0, =21.1.5.2, =21.1.5.3 Source cves: CVE-2026-85078 Source advisory: OSV:GHSA-WMJ6-G64G-J7Q5...

rasa-hydra (>=2.6.1, <=3.10.2rc3) potentially affected by CVE-2026-71554 via h2 (3.0.0)

h2 PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on h2 and may be impacted: - rasa-hydra =2.6.1, =3.10.2rc3 Source cves: CVE-2026-71554 Source advisory: OSV:PYSEC-2026-3628...

rasa-hydra (>=2.6.1, <=3.10.2rc3) potentially affected by CVE-2026-71554 via h2 (3.0.0)

h2 PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on h2 and may be impacted: - rasa-hydra =2.6.1, =3.10.2rc3 Source cves: CVE-2026-71554 Source advisory: OSV:GHSA-6HR6-W5QG-QMWG...

Rasa Open Source - Detect

Rasa Open Source, an open-source conversational AI framework used to build chatbots and voice assistants that exposes a REST server default port 5005 for intent parsing and webhook-driven conversations, was detected. Exposed unauthenticated instances may have allowed interaction with the...

rasa-hydra (0.1.2a1) potentially affected by CVE-2026-37737 via sanic-cors (0.9.8)

sanic-cors PYPI version 0.9.8 is affected by a known vulnerability. The following packages have a transitive dependency on sanic-cors and may be impacted: - rasa-hydra 0.1.2a1 Source cves: CVE-2026-37737 Source advisory: OSV:PYSEC-2026-3539...

ax (>=0.39.0, <=0.42.0), pre-assistant (>=0.23.5, <=0.23.16) +4 more potentially affected by CVE-2026-37737 via sanic-cors (0.9.9.post1)

sanic-cors PYPI version 0.9.9.post1 is affected by a known vulnerability. The following packages have a transitive dependency on sanic-cors and may be impacted: - ax =0.39.0, =0.23.5, =1.4.0, =2.6.1, =1.5.0, =0.0.2, =0.0.4 Source cves: CVE-2026-37737 Source advisory: OSV:PYSEC-2026-3539...

purly (>=0.2.0, <=0.2.1.dev4), rasa (>=0.14.0a8, <=1.3.10) +4 more potentially affected by CVE-2026-37737 via sanic-cors (0.9.9.post4)

sanic-cors PYPI version 0.9.9.post4 is affected by a known vulnerability. The following packages have a transitive dependency on sanic-cors and may be impacted: - purly =0.2.0, =0.14.0a8, =0.1.0a1, =0.3.0, =0.3.4 - rasa-print 0.3.1 Source cves: CVE-2026-37737 Source advisory: OSV:PYSEC-2026-3539...

azureml-inference-server-http (>=0.4.9, <=0.5.4), iconrpcserver (>=1.7.0, <=1.7.2) +3 more potentially affected by CVE-2026-37737 via sanic-cors (1.0.1)

sanic-cors PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on sanic-cors and may be impacted: - azureml-inference-server-http =0.4.9, =1.7.0, =3.0.0rc1, =3.0.0rc1, =1.0.5, =1.6.4 Source cves: CVE-2026-37737 Source advisory:...