EUVD-2025-30754

Malicious code in bioql PyPI...

CVE-2025-10854

The txtai framework allows the loading of compressed tar files as embedding indices. While the validate function is intended to prevent path traversal vulnerabilities by ensuring safe filenames, it does not account for symbolic links within the tar file. An attacker is able to write a file anywhe...

PT-2025-38714

Name of the Vulnerable Software and Affected Versions txtai affected versions not specified Description The txtai framework permits loading compressed tar files as embedding indices. The validate function, designed to prevent path traversal, does not account for symbolic links within these tar...