biome-text (>=3.0.0, <=3.2.1), farm (>=0.6.2, <=0.8.0) +5 more potentially affected by CVE-2025-1474 via mlflow (1.13.1)

mlflow PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - biome-text =3.0.0, =0.6.2, =0.7.0, =0.0.1, =1.1.0, =1.0.0, =0.4.5.dev2, =0.6.5 Source cves: CVE-2025-1474 Source advisory: OSV:PYSEC-2025-17...

farm-haystack (>=0.10.0, <=1.0.0), kserve (>=0.7.0rc0, <=0.7.0) potentially affected by CVE-2025-1979 via ray (1.5.0)

ray PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - farm-haystack =0.10.0, =0.7.0rc0, =0.7.0 Source cves: CVE-2025-1979 Source advisory: OSV:GHSA-W4RH-FGX7-Q63M...

farm-haystack (>=0.10.0, <=1.0.0), kserve (>=0.7.0rc0, <=0.7.0) potentially affected by CVE-2025-1979 via ray (1.5.0)

ray PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - farm-haystack =0.10.0, =0.7.0rc0, =0.7.0 Source cves: CVE-2025-1979 Source advisory: OSV:PYSEC-2025-23...

CVE-2024-41950

Haystack is an end-to-end LLM framework that allows you to build applications powered by LLMs, Transformer models, vector search and more. Haystack clients that let their users create and run Pipelines from scratch are vulnerable to remote code executions. Certain Components in Haystack use Jinja...

farm (>=0.4.5, <=0.6.1), farm-haystack (>=0.3.0, <=0.6.0) +2 more potentially affected by CVE-2024-27134 via mlflow (1.0.0)

mlflow PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - farm =0.4.5, =0.3.0, =0.0.1a1.dev14, =0.0.1a1.dev15 - mlflow-faculty 0.3.1 Source cves: CVE-2024-27134 Source advisory: OSV:GHSA-QPGC-W4MG-6V92...

biome-text (>=3.0.0, <=3.2.1), farm (>=0.6.2, <=0.8.0) +5 more potentially affected by CVE-2024-27134 via mlflow (1.13.1)

mlflow PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - biome-text =3.0.0, =0.6.2, =0.7.0, =0.0.1, =1.1.0, =1.0.0, =0.4.5.dev2, =0.6.5 Source cves: CVE-2024-27134 Source advisory: OSV:GHSA-QPGC-W4MG-6V92...

farm (>=0.4.5, <=0.6.1), farm-haystack (>=0.3.0, <=0.6.0) +2 more potentially affected by CVE-2024-27134 via mlflow (1.0.0)

mlflow PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - farm =0.4.5, =0.3.0, =0.0.1a1.dev14, =0.0.1a1.dev15 - mlflow-faculty 0.3.1 Source cves: CVE-2024-27134 Source advisory: OSV:PYSEC-2024-224...

allennlp (1.2.0rc1.dev20200923), awca (>=0.0.2, <=0.0.3.2) +9 more potentially affected by CVE-2024-11394 via transformers (3.1.0)

transformers PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp 1.2.0rc1.dev20200923 - awca =0.0.2, =0.2.4, =0.4.8, =1.1.1, =1.1.0.dev202009251125, =2.1.0, =1.0.1, =1.1.0 Source cves:...

allennlp (1.2.0rc1.dev20200923), awca (>=0.0.2, <=0.0.3.2) +9 more potentially affected by CVE-2024-11393 via transformers (3.1.0)

transformers PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp 1.2.0rc1.dev20200923 - awca =0.0.2, =0.2.4, =0.4.8, =1.1.1, =1.1.0.dev202009251125, =2.1.0, =1.0.1, =1.1.0 Source cves:...

Remote Code Execution

Haystack is vulnerable to Remote Code Execution. The vulnerability is due to the use of Jinja2 templates, which can be exploited to run arbitrary code if a user creates and renders a malicious template on the client machine...

Haystack Remote Code Execution Vulnerability

Haystack is an open source NLP framework for interacting with your data using Transformer models and LLMs GPT-4, ChatGPT, etc.. A remote code execution vulnerability exists in Haystack versions prior to 2.3.1, which can be exploited by an attacker to create and present a Jinja2 template on a clie...

GHSA-HX9V-6R9F-W677 Insecure Jinja2 templates rendered in Haystack Components can lead to RCE

Impact Haystack clients that let their users create and run Pipelines from scratch are vulnerable to remote code executions. Certain Components in Haystack use Jinja2 templates, if anyone can create and render that template on the client machine they run any code. Patches The problem has been fix...

bytewax-azure-ai-search (0.1.1) potentially affected by CVE-2024-41950 via haystack-ai (2.2.1)

haystack-ai PYPI version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on haystack-ai and may be impacted: - bytewax-azure-ai-search 0.1.1 Source cves: CVE-2024-41950 Source advisory: OSV:GHSA-HX9V-6R9F-W677...

bytewax-azure-ai-search (0.1.1) potentially affected by CVE-2024-41950 via haystack-ai (2.2.1)

haystack-ai PYPI version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on haystack-ai and may be impacted: - bytewax-azure-ai-search 0.1.1 Source cves: CVE-2024-41950 Source advisory: GHSA-HX9V-6R9F-W677...

Insecure Jinja2 templates rendered in Haystack Components can lead to RCE

Impact Haystack clients that let their users create and run Pipelines from scratch are vulnerable to remote code executions. Certain Components in Haystack use Jinja2 templates, if anyone can create and render that template on the client machine they run any code. Patches The problem has been fix...

CVE-2024-41950

Haystack is an end-to-end LLM framework that allows you to build applications powered by LLMs, Transformer models, vector search and more. Haystack clients that let their users create and run Pipelines from scratch are vulnerable to remote code executions. Certain Components in Haystack use Jinja...

CVE-2024-41950

Haystack is an end-to-end LLM framework that allows you to build applications powered by LLMs, Transformer models, vector search and more. Haystack clients that let their users create and run Pipelines from scratch are vulnerable to remote code executions. Certain Components in Haystack use Jinja...

bytewax-azure-ai-search (0.1.1) potentially affected by CVE-2024-41950 via haystack-ai (2.2.1)

haystack-ai PYPI version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on haystack-ai and may be impacted: - bytewax-azure-ai-search 0.1.1 Source cves: CVE-2024-41950 Source advisory: MEND:CVE-2024-41950...

CVE-2024-41950 Insecure Jinja2 templates rendered in Haystack Components can lead to RCE

Haystack is an end-to-end LLM framework that allows you to build applications powered by LLMs, Transformer models, vector search and more. Haystack clients that let their users create and run Pipelines from scratch are vulnerable to remote code executions. Certain Components in Haystack use Jinja...

CVE-2024-41950 Insecure Jinja2 templates rendered in Haystack Components can lead to RCE

Haystack is an end-to-end LLM framework that allows you to build applications powered by LLMs, Transformer models, vector search and more. Haystack clients that let their users create and run Pipelines from scratch are vulnerable to remote code executions. Certain Components in Haystack use Jinja...