44 matches found
CVE-2026-120334
A flaw has been found in deepset-ai farm up to 0.8.0. This impacts the function EmbeddingTokenizer.frompretrained of the file farm/modeling/tokenization.py of the component Tokenizer Loader. Executing a manipulation of the argument vocabfilename can lead to path traversal. The attack may be...
CVE-2026-120335
A vulnerability has been found in deepset-ai farm up to 0.8.0. Affected is the function WordEmbeddingLM.load of the file farm/modeling/languagemodel.py of the component Model Package Loader. The manipulation of the argument embeddingsfilename leads to path traversal. An attack has to be approache...
CVE-2026-120335
A path traversal vulnerability exists in the Model Package Loader component of deepset-ai farm up to version 0.8.0 . The flaw is located in the WordEmbedding_LM.load function within the file farm/modeling/language_model.py, where manipulation of the embeddings_filename argument allows for unautho...
EUVD-2026-115059
A vulnerability has been found in deepset-ai farm up to 0.8.0. Affected is the function WordEmbeddingLM.load of the file farm/modeling/languagemodel.py of the component Model Package Loader. The manipulation of the argument embeddingsfilename leads to path traversal. An attack has to be approache...
CVE-2026-120335 deepset-ai farm Model Package Loader language_model.py WordEmbedding_LM.load path traversal
A vulnerability has been found in deepset-ai farm up to 0.8.0. Affected is the function WordEmbeddingLM.load of the file farm/modeling/languagemodel.py of the component Model Package Loader. The manipulation of the argument embeddingsfilename leads to path traversal. An attack has to be approache...
EUVD-2026-114936
A flaw has been found in deepset-ai farm up to 0.8.0. This impacts the function EmbeddingTokenizer.frompretrained of the file farm/modeling/tokenization.py of the component Tokenizer Loader. Executing a manipulation of the argument vocabfilename can lead to path traversal. The attack may be...
CVE-2026-120334
A path traversal vulnerability exists in deepset-ai farm (versions up to 0.8.0 ) within the Tokenizer Loader component. The flaw specifically affects the EmbeddingTokenizer.from_pretrained function in the farm/modeling/tokenization.py file. An attacker can manipulate the vocab_filename argument t...
CVE-2026-120334 deepset-ai farm Tokenizer Loader tokenization.py EmbeddingTokenizer.from_pretrained path traversal
A flaw has been found in deepset-ai farm up to 0.8.0. This impacts the function EmbeddingTokenizer.frompretrained of the file farm/modeling/tokenization.py of the component Tokenizer Loader. Executing a manipulation of the argument vocabfilename can lead to path traversal. The attack may be...
CVE-2026-120334: deepset-ai farm: A flaw has been found in deepset-ai farm up to 0.8.0
A flaw has been found in deepset-ai farm up to 0.8.0. This impacts the function EmbeddingTokenizer.frompretrained of the file farm/modeling/tokenization.py of the component Tokenizer Loader. Executing a manipulation of the argument vocabfilename can lead to path traversal. The attack may be...
CVE-2026-120335: deepset-ai farm: A vulnerability has been found in deepset-ai farm up to 0.8.0
A vulnerability has been found in deepset-ai farm up to 0.8.0. Affected is the function WordEmbeddingLM.load of the file farm/modeling/languagemodel.py of the component Model Package Loader. The manipulation of the argument embeddingsfilename leads to path traversal. An attack has to be approache...
Prototype Pollution
Overview graphql-upload-minimal is a Minimalistic and developer friendly middleware and an Upload scalar to add support for GraphQL multipart requests file uploads via queries and mutations to various Node.js GraphQL servers. Affected versions of this package are vulnerable to Prototype Pollution...
EUVD-2021-1145
Malware in sbrugna...
EUVD-2021-1150
Malware in sbrugna...
EUVD-2023-1129
Malicious code in bioql PyPI...
CVE-2023-1712
Use of Hard-coded, Security-relevant Constants in GitHub repository deepset-ai/haystack prior to 0.1.30...
Use of hard-coded, security-relevant constants in deepset-ai/haystack
Use of Hard-coded, Security-relevant Constants in GitHub repository deepset-ai/haystack in version 1.15.0 and prior. A patch is available at commit 5fc84904f198de661d5b933fde756aa922bf09f1...
GHSA-W7QG-J435-78QW Use of hard-coded, security-relevant constants in deepset-ai/haystack
Use of Hard-coded, Security-relevant Constants in GitHub repository deepset-ai/haystack in version 1.15.0 and prior. A patch is available at commit 5fc84904f198de661d5b933fde756aa922bf09f1...
CVE-2023-1712
Use of Hard-coded, Security-relevant Constants in GitHub repository deepset-ai/haystack prior to 0.1.30...
CVE-2023-1712
CVE-2023-1712 concerns the GitHub repository deepset-ai/haystack, prior to version 0.1.30, due to the use of hard-coded, security-relevant constants. Public documentation from multiple sources confirms the issue affects haystack versions before 0.1.30 (and related references mention version 1.15....
