32 matches found
PYSEC-2026-1552 Litestar and Starlite vulnerable to Path Traversal
Summary Local File Inclusion via Path Traversal in LiteStar Static File Serving A Local File Inclusion LFI vulnerability has been discovered in the static file serving component of LiteStar. This vulnerability allows attackers to exploit path traversal flaws, enabling unauthorized access to...
kiara-plugin-service (>=0.4.0, <=0.4.7), playbacker (>=0.5.0, <=0.7.1) potentially affected by CVE-2024-32982 via starlite (>=1.39.0, <=1.51.10)
starlite PYPI version =1.39.0, =0.4.0, =0.5.0, =0.7.1 Source cves: CVE-2024-32982 Source advisory: OSV:PYSEC-2026-1552...
3lc (>=2.3.84, <=2.6.4), aiocronjob (>=0.6.0, <=0.7.0) +10 more potentially affected by CVE-2024-52581 via starlite (>=1.39.0, <=1.51.16)
starlite PYPI version =1.39.0, =2.3.84, =0.6.0, =0.4.0, =0.5.0, =1.0.0, =0.1.0, =0.1.3, =1.0.0, =0.1.0, =0.8.1 - strawberry-graphql 0.168.0 Source cves: CVE-2024-52581 Source advisory: OSV:PYSEC-2026-1944...
CVE-2023-25578
Starlite is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 1.5.2, the request body parsing in starlite allows a potentially unauthenticated attacker to consume a large amount of CPU time and RAM. The multipart body parser processes an unlimited number of file parts and ...
EUVD-2023-0246
Malicious code in bioql PyPI...
3lc (>=2.3.84, <=2.6.4), aiocronjob (>=0.6.0, <=0.7.0) +10 more potentially affected by CVE-2024-52581 via starlite (>=1.39.0, <=1.51.16)
starlite PYPI version =1.39.0, =2.3.84, =0.6.0, =0.4.0, =0.5.0, =1.0.0, =0.1.0, =0.1.3, =1.0.0, =0.1.0, =0.8.1 - strawberry-graphql 0.168.0 Source cves: CVE-2024-52581 Source advisory: GHSA-GJCC-JVGW-WVWJ...
3lc (>=2.3.84, <=2.6.4), aiocronjob (>=0.6.0, <=0.7.0) +10 more potentially affected by CVE-2024-52581 via starlite (>=1.39.0, <=1.51.16)
starlite PYPI version =1.39.0, =2.3.84, =0.6.0, =0.4.0, =0.5.0, =1.0.0, =0.1.0, =0.1.3, =1.0.0, =0.1.0, =0.8.1 - strawberry-graphql 0.168.0 Source cves: CVE-2024-52581 Source advisory: OSV:GHSA-GJCC-JVGW-WVWJ...
CVE-2024-32982
Litestar and Starlite is an Asynchronous Server Gateway Interface ASGI framework. Prior to 2.8.3, 2.7.2, and 2.6.4, a Local File Inclusion LFI vulnerability has been discovered in the static file serving component of LiteStar. This vulnerability allows attackers to exploit path traversal flaws,...
CVE-2024-32982 Litestar and Starlite affected by Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Litestar and Starlite is an Asynchronous Server Gateway Interface ASGI framework. Prior to 2.8.3, 2.7.2, and 2.6.4, a Local File Inclusion LFI vulnerability has been discovered in the static file serving component of LiteStar. This vulnerability allows attackers to exploit path traversal flaws,...
CVE-2024-32982 Litestar and Starlite affected by Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Litestar and Starlite is an Asynchronous Server Gateway Interface ASGI framework. Prior to 2.8.3, 2.7.2, and 2.6.4, a Local File Inclusion LFI vulnerability has been discovered in the static file serving component of LiteStar. This vulnerability allows attackers to exploit path traversal flaws,...
kiara-plugin-service (>=0.4.0, <=0.4.7), playbacker (>=0.5.0, <=0.7.1) potentially affected by CVE-2024-32982 via starlite (>=1.39.0, <=1.51.10)
starlite PYPI version =1.39.0, =0.4.0, =0.5.0, =0.7.1 Source cves: CVE-2024-32982 Source advisory: MEND:CVE-2024-32982...
CVE-2024-32982
Litestar/Starlite static file serving is affected by a Local File Inclusion (LFI) due to an unsafe path handling implementation in litestar/static_files/base.py. Prior to versions 2.8.3, 2.7.2, and 2.6.4, this path traversal flaw can allow an attacker to access files outside the intended static d...
kiara-plugin-service (>=0.4.0, <=0.4.7), playbacker (>=0.5.0, <=0.7.1) potentially affected by CVE-2024-32982 via starlite (>=1.39.0, <=1.51.10)
starlite PYPI version =1.39.0, =0.4.0, =0.5.0, =0.7.1 Source cves: CVE-2024-32982 Source advisory: GHSA-83PV-QR33-2VCF...
kiara-plugin-service (>=0.4.0, <=0.4.7), playbacker (>=0.5.0, <=0.7.1) potentially affected by CVE-2024-32982 via starlite (>=1.39.0, <=1.51.10)
starlite PYPI version =1.39.0, =0.4.0, =0.5.0, =0.7.1 Source cves: CVE-2024-32982 Source advisory: OSV:GHSA-83PV-QR33-2VCF...
Denial Of Service (DoS)
starlite is vulnerable to Denial of Service DoS attacks. A malicious user is able to consume a large amount of CPU time and RAM because the multipart body parser accepts an unlimited number of file parts and field parts, which can cause the application to crash...
kiara-plugin-service (>=0.4.0, <=0.4.7) potentially affected by CVE-2023-25578 +1 more via starlite (1.39.0)
starlite PYPI version 1.39.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlite and may be impacted: - kiara-plugin-service =0.4.0, =0.4.7 Source cves: CVE-2023-25578, CVE-2024-52581 Source advisory: OSV:GHSA-P24M-863F-FM6Q...
kiara-plugin-service (>=0.4.0, <=0.4.7) potentially affected by CVE-2023-25578 via starlite (1.39.0)
starlite PYPI version 1.39.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlite and may be impacted: - kiara-plugin-service =0.4.0, =0.4.7 Source cves: CVE-2023-25578 Source advisory: GHSA-P24M-863F-FM6Q...
CVE-2023-25578
Starlite is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 1.5.2, the request body parsing in starlite allows a potentially unauthenticated attacker to consume a large amount of CPU time and RAM. The multipart body parser processes an unlimited number of file parts and ...
PYSEC-2023-49
Starlite is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 1.5.2, the request body parsing in starlite allows a potentially unauthenticated attacker to consume a large amount of CPU time and RAM. The multipart body parser processes an unlimited number of file parts and ...
Design/Logic Flaw
Starlite is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 1.5.2, the request body parsing in starlite allows a potentially unauthenticated attacker to consume a large amount of CPU time and RAM. The multipart body parser processes an unlimited number of file parts and ...