Eval Injection

Overview sglang is a SGLang is a fast serving framework for large language models and vision language models. Affected versions of this package are vulnerable to Eval Injection via evaluatefilter, which passes attacker-controlled input to eval. A remote attacker can escape the eval sandbox by...

CVE-2026-111391

SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in evaluatefilter that allows remote attackers to execute Python code by escaping the eval sandbox through re.search globals. Attackers can send a crafted filter expression to the unauthenticated /dumper/configure endpoint when...

CVE-2026-111391: Improper Neutralization of Directives in Dynamically Evaluated Code

SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in evaluatefilter that allows remote attackers to execute Python code by escaping the eval sandbox through re.search globals. Attackers can send a crafted filter expression to the unauthenticated /dumper/configure endpoint when...

sgl-project SGLang Code Injection Vulnerability

The SGLang project from version 0.5.10 to 0.5.22 has a code injection vulnerability. This vulnerability stems from a code injection issue in the evaluatefilter function. Attackers can escape the eval sandbox by using re.search.globals, and can execute Python code. They can also send specially...

PYSEC-2026-3986

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's extra field into Python callables via importstring, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafk...

CVE-2026-91925

Polyaxon through 2.16.4 renders operation specification fields with an unsandboxed Jinja2 environment during server-side run preparation, allowing authenticated users to execute arbitrary code. Attackers can submit runs with Jinja2 payloads in queue, namespace, conditions, presets, or dependencie...

PT-2026-91930

Polyaxon through 2.16.4 renders operation specification fields with an unsandboxed Jinja2 environment during server-side run preparation, allowing authenticated users to execute arbitrary code. Attackers can submit runs with Jinja2 payloads in queue, namespace, conditions, presets, or dependencie...

CVE-2026-91925: Improper Neutralization of Special Elements Used in a Template Engine

Polyaxon through 2.16.4 renders operation specification fields with an unsandboxed Jinja2 environment during server-side run preparation, allowing authenticated users to execute arbitrary code. Attackers can submit runs with Jinja2 payloads in queue, namespace, conditions, presets, or dependencie...

BIT-AIRFLOW-2026-67587 Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget

Apache Airflow's Task SDK rebuilt a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because SyncCallback is itself an Airflow class it passes the default alloweddeserializationclasses allow-list, so tightening that...

Deserialization of Untrusted Data

Overview apache-airflow-task-sdk is a The Apache Airflow Task SDK includes interfaces for Dag authors and Task execution logic for Python. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the deserialization of the Callback object, which reconstructs the...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the awaitinginput. An attacker can execute arbitrary code or terminate the scheduler process by supplying crafted data to the nextkwargs parameter during task execution. Note: This is only exploitabl...

PYSEC-2026-3708

Apache Airflow's Task SDK rebuilt a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because SyncCallback is itself an Airflow class it passes the default alloweddeserializationclasses allow-list, so tightening that...

EUVD-2026-57274

Apache Airflow's Task SDK rebuilt a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because SyncCallback is itself an Airflow class it passes the default alloweddeserializationclasses allow-list, so tightening that...

CVE-2026-67587 Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget

Apache Airflow's Task SDK rebuilt a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because SyncCallback is itself an Airflow class it passes the default alloweddeserializationclasses allow-list, so tightening that...

PT-2026-71126

Name of the Vulnerable Software and Affected Versions Apache Airflow version 3.3.0 Description Insecure deserialization in the Apache Airflow Scheduler allows for arbitrary module import, which can lead to remote code execution. Deserialization is the process of converting a data format back into...

PYSEC-0000-CVE-2026-45360

Apache Airflow's scheduler-side deadline-reference decoder SerializedCustomReference.deserializereference imported and dispatched arbitrary class paths drawn from DAG-author-controlled serialized state without an allowlist or plugin-registry gate. A DAG author whose code reaches the scheduler — t...

CVE-2026-45360

The Apache Airflow scheduler-side deadline-reference decoder, specifically the SerializedCustomReference.deserialize_reference function, is vulnerable to arbitrary class instantiation. The root cause is the lack of an allowlist or plugin-registry gate when importing and dispatching class paths dr...