Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

PT-2024-37251 · Imartinez · Privategpt

Name of the Vulnerable Software and Affected Versions: imartinez/privategpt version 0.5.0 Description: An issue exists due to improper handling of the file parameter, allowing attackers to redirect users to a URL specified by user-controlled input without proper validation or sanitization. This c...