Malware in @k18k/entrypoint-sdk-linux-x64

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description

Summary On Windows, attacker-controlled content in a wheel's .dist-info/namespacepackages.txt can cause setuptools' legacy wheel installation path to create an init.py outside the requested destinationeggdir. The attacker can influence the destination path, but not the contents of the created fil...

Malware in @k18k/entrypoint-sdk-darwin-x64

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding

Impact fast-uri percent-decodes the scheme component with the legacy global unescape before validating it, so an input whose decoded scheme is a valid but dangerous token is emitted as a live scheme. RFC 3986 section 3.1 does not allow percent-encoding in a scheme, so no RFC or WHATWG parser trea...

fast-uri vulnerable to improper path equivalence in relative reference normalization

Impact fast-uri's normalize and serialize apply RFC 3986 dot-segment removal removedotsegments to the path of a relative-path reference. RFC 3986 section 5.2.4 defines that algorithm only for the merged target path during resolution, not for the reference itself, so applied to the reference it...

fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

Impact fast-uri versions = 2.4.2, = 3.1.3, = 4.0.1, = 4.2.2 can silently rewrite the host of an HTTP-family URL http, https, ws, wss, or any scheme with domainHost: true. For those schemes canonicalizeHost passes the parsed host to the WHATWG URL parser and adopts its .hostname without checking...

fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references

Impact fast-uri's serialize, normalize, and resolve, when called with the non-default option reference: 'suffix' on a reference that has no authority, emit a relative reference whose first path segment contains a bare colon without escaping it. RFC 3986 section 3.3 requires the first segment of a...

FastMCP: Post-transform component authorization is skipped on direct calls

Maintainer assessment and remediation This report is accepted as a FastMCP authorization vulnerability. In supported configurations, a server transform can change the metadata used by a component's authorization policy. Direct lookups previously checked the original component but returned the...

FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server

Maintainer assessment and remediation This report is accepted as a FastMCP credential-binding vulnerability. Affected versions of the OAuth client credentials providers do not expose the authorization-server issuer that owns pre-registered credentials. An untrusted or compromised MCP server can...

vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)

Summary API clients can supply arbitrary mmprocessorkwargs per request. vLLM forwards these values through the multimodal rendering and processing pipeline to Hugging Face and custom image/video processor constructors and calls. Resource-sensitive values such as image size, patch size, patch coun...

SvelteKit: URL redirection to untrusted site via enhanced form submission

Impact Applications using enhanced form actions use:enhance on routes that accept paths beginning with //, such as catch-all routes, may be vulnerable to an open redirect. Patches A fix has been prepared for @sveltejs/kit 3.0.0. Users should upgrade to 3.0.0 or later. The fix preserves leading...

chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

Summary ClientIPFromXFF skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the clie...

odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values

Summary ODF style values are interpolated into style="..." attributes without HTML-escaping in odf-kit's ODS to-HTML renderer odsToHtml. A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute injection — and therefore scri...

pypdf: Possible long runtimes for repeated references to the same missing object

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading relevant parts of a file like their pages where the same, but non-existent indirect object is referenced multiple times. Patches This has been fixed in pypdf==6.21.2. Workarounds If...

pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams. Patches This has been fixed in pypdf==6.21.2. Workarounds If you cannot upgrade yet, consider applying the changes fr...

pypdf: Possible long runtimes for large xref table header limits

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires opening a file with large/wrong upper limits in the xref table. Patches This has been fixed in pypdf==6.21.2. Workarounds If you cannot upgrade yet, consider applying the changes from PR 423...

Tokio: Race condition in `tokio::time::Interval`

Summary On the multi-threaded runtime, there is a race condition between Interval::polltick and the runtime's time driver. This affects Interval only. Sleep and Timeout are not affected. Details In Tokio v1.54.0, a race condition between tokio::time::Interval::polltick including .tick.await and t...

Electron: Mitigation for compromised eMudhra intermediate certificates

Impact A set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS clients. This Electron update adds the same block to both Chromium networking and Node.js tls, https and fetch. On earlier versions, an attacker holding a certificate issued through...

body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body

Impact A single request can crash any application using body-parser with default options. When a request carries a Content-Encoding for example gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream piped with no error listener. A payload of one val...

gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()

Summary In the gix crate, Cache::protectoptions in gix/src/config/cache/access.rs reads the three filesystem path-protection settings core.protectHFS, core.protectNTFS, and gitoxide.core.protectWindows with the unfiltered gixconfig::File::boolean accessor instead of the trust-aware booleanfilter...

Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order

Impact Three issues allowed actions protected by the Authorize attribute to run against records the current user is not authorized for: 1. Out-of-order parameter keys on actions. Authorize resolved a model parameter by its array key, while the action itself received parameters positionally. A...

Echo: X-Real-IP extractor trusts the header value instead of the sending peer

Impact In Echo v5, ExtractIPFromRealIPHeader checked whether the address supplied in X-Real-IP belonged to a trusted range instead of checking the address of the direct network peer. An untrusted client could therefore supply a loopback or private address and have it returned by c.RealIP with the...

Echo: WebSocket proxy can retain connections and handlers after client disconnect

Impact Echo's Proxy middleware could retain a handler, copy goroutines and network connections after a WebSocket client disconnected if the upstream kept its connection open. The raw proxy waited for both copy directions to finish without reliably closing the other connection when one direction...

Echo: Decompress permits unbounded gzip expansion in v4

Impact Echo v4's opt-in Decompress middleware exposed a gzip-decoded request stream without limiting its expanded size. A small compressed request could therefore produce a very large decoded body. Handlers that read or bind that body could consume excessive memory or CPU, and repeated or...

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

Impact Echo's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validating whether the configured upstream accepted it. If the upstream returned an ordinary HTTP response and kept the connection alive, subsequent HTTP requests on that connection were...

Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests

Impact Echo v5's BodyDump middleware captured a bounded prefix, drained the remaining request body while ignoring read errors, and then replaced the body with the captured prefix. With an outer BodyLimit, an unknown-length request such as an HTTP/1.1 chunked request, and a BodyDump capture limit...

Echo: BodyDump captures request and response bodies without size limits in v4

Impact Echo v4's opt-in BodyDump middleware read complete request bodies into memory and retained complete response bodies without a capture limit. A client able to submit large requests to a route using BodyDump could cause large allocations before the application handler ran. Large responses,...

Strands Agents SDK: Exposure of data element to wrong session in the A2A Server

Summary Strands Agents SDK is an open-source SDK, available for Python strands-agents and TypeScript @strands-agents/sdk, for building and running AI agents. An issue exists where, under certain circumstances, the Agent2Agent A2A server shares conversation history across callers with different...

virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)

Summary The bash activator puts the caller-supplied prompt value into PS1 unescaped whenever promptvars is off at activation time, and assumes prompt expansion can never run afterwards. promptvars and posix mode are runtime shell state, not a property of the activation moment: re-enabling prompt...

Mistune: Path Traversal and XSS in Include directive

The Include directive in src/mistune/directives/include.py does not validate that the resolved file path stays within the source directory, allowing path traversal via ../ sequences to read arbitrary files. Additionally, error messages and included file contents are rendered without HTML escaping...

Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH

Summary An infinite-loop vulnerability CWE-835 in the Twisted IMAP4 server lets an authenticated client freeze the whole process with one small command. twisted.mail.imap4.parseNestedParens reads an IMAP literal size with int and never rejects a negative value. A negative size such as -100 drives...

Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer

Summary An unbounded-buffer vulnerability CWE-770 in the Twisted words IRC server lets any unauthenticated remote client exhaust server memory. twisted.words.protocols.irc.IRC.dataReceived appends every received byte to a per-connection buffer and only removes data at a line feed, with no maximum...

Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer

Summary An allocation-without-limits vulnerability CWE-770 in the Twisted conch telnet transport lets any unauthenticated remote peer exhaust server memory over a single connection. When the peer opens a telnet subnegotiation with IAC SB and then streams bytes without ever sending the IAC SE...

Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree

Summary An allocation-without-limits vulnerability in the Twisted XML element stream lets any unauthenticated remote peer exhaust server memory over a single stream. When the peer opens a container element and streams child elements without ever closing the container, every element is materialise...

Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

Summary An incomplete header-value validation CWE-444 in the Twisted HTTP server lets a bare carriage return or line feed in a header value hide a following header from the parser. twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in a header value but not a bare CR or LF, even thoug...

vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine

Summary Multimodal content parts imageurl, videourl, inputaudio, ... accept a user-supplied uuid field that vLLM uses verbatim as the item's cache identity mmhash. The two frontend/engine processor caches P0 "sender" cache in the API process, P1 "receiver" cache in the EngineCore process are...

SvelteKit : XSS via untrusted cache-control header in prerendered page

Impact Applications that prerender pages and use setHeaders to set a cache-control header from an untrusted source are vulnerable to cross-site scripting XSS. SvelteKit inserts the header value into a tag without escaping it. An attacker who can influence this value at prerender time can break ou...

obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes

Summary createentity, linkentities, renameentity, unlinkentities and deleteentity regenerate a memory note's body from SQLite at the computed memory//.md path. When a note already existed at that path and was not owned by the entity being written a hand-authored note, or an orphan left by a...

SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin

Summary installBazaarPlugin and the equivalent endpoints for widgets/icons/templates/themes accept packageName, repoURL, and repoHash as independent request fields with no validation that they refer to the same package. packageName alone determines the install destination; repoURL/repoHash alone...

SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream

Summary Two checks on the same WebSocket request URI parse it differently. The authentication exemption for keepalive sessions matches raw substrings, while the quarantine introduced to contain those sessions reads a parsed query parameter. Because Go's url.Values.Get returns only the first value...

SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden

Summary /api/filetree/authFilePublishAccess is registered with CheckAuth only and is reachable anonymously. It never sets a failure code, so its outcome is signalled entirely by the response message and by whether a Set-Cookie header is present. Those two signals differ across access tiers, which...

Malicious code in jobwharf (PyPI)

Source: kam193 172e672abed0eeea77b62d2a9dea9999b59ff685b952fec68c70e2b227e0bce6 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in slatejob (PyPI)

Source: kam193 779bcb94eecf53cfda39d7bfeb12aac9de072d14b22904a6f7bf55e33c3e5e7f This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in brambletask (PyPI)

Source: kam193 922435cd67a39583e0143229da6822f691940fcea9f4b4b18203faa594a1debc This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in kestreljob (PyPI)

Source: kam193 4a86144582538adae41c5d2f14f22daae1f65ecf9b93cdeb0d82889681af9222 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in larchworker (PyPI)

Source: kam193 87e174c9dc2485263894e4d6c3d1560589659afbfbe9397ca1e1b53fb21d96b3 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in thistlerun (PyPI)

Source: kam193 6c35afe278e655040c47dcca9e63b4ab75c1530880041568e544700daa20e887 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in cobbleload (PyPI)

Source: kam193 9cf9dcc227e75e864e1dffc62bc95b8d0f73dea45b088ed34ab718a8ab87fb08 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in juniperrun (PyPI)

Source: kam193 1fd79c13a84952cbede2a1b1de7ba5d43396a2c95866015cdf73c9ce0d9960f5 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in sedgehaul (PyPI)

Source: kam193 1eccea61ba89da6dd32ddad1e54e70f52c5a2b2c9aeeced8a80e068ef63dccd4 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...