`qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code

Summarydeserializing json data using qiskitibmruntime.RuntimeDecoder can be made to execute arbitrary code given a correctly formatted input string DetailsRuntimeDecoder is supposed to be able to deserialize JSON strings containing various special types encoded via RuntimeEncoder. However, one ca...

CVE-2021-47952

python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during...

CVE-2024-10955

A Regular Expression Denial of Service ReDoS vulnerability exists in gaizhenbiao/chuanhuchatgpt, as of commit 20b2e02. The server uses the regex pattern r'+' to parse user input. In Python's default regex engine, this pattern can take polynomial time to match certain crafted inputs. An attacker c...

CVE-2024-10955

Vulnerability summary (CVE-2024-10955) A ReDoS flaw exists in the gaizhenbiao/chuanhuchatgpt server, caused by input parsing with the regex pattern ]+>. In Python’s regex engine, this can degenerate to polynomial time on crafted inputs, enabling an attacker to upload a malicious JSON payload t...