Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)

Summary On Windows builds, Pillow stores EMF and WMF image dimensions without a range check and passes them to the native drawwmf handler. That code sizes its allocation from dimensions truncated into 16-bit header fields but copies the result using the full 32-bit dimensions. A crafted metafile...

Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time

Summary A PNG file with a large eXIf chunk full of repeated 6-byte markers makes Pillow's EXIF parser take seconds of CPU instead of milliseconds. The cost grows with the square of the chunk size, so a normal small-photo-sized file is enough to cause real delay. Details Exif.load in...

Pillow: TarIO negative size field causes infinite CPU-spin loop

Summary TarIO.init does not check that a tar header's size field is positive. A crafted header with a negative size makes it seek backward onto itself. This causes an infinite loop that uses 100% CPU and never returns. Details TarIO.init reads 512-byte tar headers one at a time, looking for a...

Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise

Summary Affected Object and Source Package: Pillow 12.3.0 Source: PyPI sdist pillow-12.3.0.tar.gz SHA-256: 3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce Sink: src/imaging.c:2809:15, xsize += dx Details The code in Pillow 12.3.0 is: c for xsize = 0; text; text++ int dx =...

Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

Summary Pillow's documented PDF append path can spend disproportionate CPU time on a compact malformed PDF page tree. An attacker who can supply an existing PDF to an application that appends an image with Image.save..., format="PDF", append=True can provide a malformed /Pages tree where each lev...

Pillow multi-frame loaders can reuse stale native image storage after mode transitions

Summary Pillow multi-frame image loaders can retain native ImagingCore storage allocated for one frame while changing the Python-side image mode and decoder tiles for a later frame. If frame 0 allocates storage for a narrow mode such as L, and a later frame of the same dimensions switches to a...

Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode

Summary BmpRleDecoder can be forced to allocate gigabytes of memory from a kilobyte-sized crafted BMP file via unbounded growth in the delta escape and absolute mode branches. Affected versions All versions up to and including current HEAD v13.0.0.dev0, commit e7a7ea84 Root cause...

Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS

Summary SpiderImagePlugin's seek bypasses the decompression bomb check, allowing a tiny 1KB crafted SPIDER stack file to trigger a multi-gigabyte allocation on im.load. Affected versions All versions up to and including current HEAD v13.0.0.dev0, commit e7a7ea84 Root cause Image.open runs...

Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)

Summary Pillow's decompression-bomb protection Image.decompressionbombcheck, gated by Image.MAXIMAGEPIXELS is enforced only on the first frame, inside Image.open. For multi-frame formats, seek re-parses the target frame's header and resets self.size. GifImagePlugin and TiffImagePlugin re-run the...

Sentry-Javascript: Middleware Bypass when using Tunnel route

Impact The tunnelRoute option makes the SDK send browser events to a path on your own Next.js server for example /monitoring, where a rewrite forwards them to Sentry to prevent ad blockers from blocking them. To keep those envelope requests from being rejected by your middleware, the SDK skips...

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

Impact A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution RCE when Next.js runs on glibc-based Linux. Workaround Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5. Fresh...

Librsvg: Use-after-free when XML includes have duplicated entities

Librsvg uses libxml2, a C library, to parse XML. When librsvg parses an SVG document which has a nested Xinclude, an XML entity declaration with a duplicate name as an existing one can cause a use-after-free error. While libxml2 is expanding an internal entity, a recursive XInclude can parse...

Next.js: Denial of Service in App Router using Server Actions

Impact Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. Workarounds No workaround exists besides upgrading. Applications using Pages Router or not using...

stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

Summary FlexAssembler, the custom-container assembler shipped in the stream-json package src/core/utils/flex-assembler.js, re-exported at stream-json/utils/flex-assembler.js and stream-json/web/utils/flex-assembler.js, compiles a string or RegExp path filter into a matcher that runs...

PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery

Summary HMACAlgorithm.fromjwk accepts a symmetric kty=oct JWK whose k value is the empty string and returns a zero-length key without raising. When a token is then verified with that key object a PyJWK, or a PyJWK resolved by PyJWKSet / PyJWKClient, the HMAC verifier computes HMACkey=b"",...

Malware in @sudobility/indexer_client

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization

Summary Jupyter Server's gateway WebSocket handler checks that a user is authenticated, but it does not ask the configured Authorizer whether that user may execute kernels. In Jupyter Server 2.0.0 through 2.5.0, enabling GatewayClient.url automatically replaced the normal kernel channel handler...

Malware in @sudobility/shaperouter_client

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @sudobility/wildduck_client

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @sudobility/testomniac_client

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package

A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially...

Malicious code in aanthropic (PyPI)

Source: kam193 47e89f1629f5ff807eed865fd160d61ba0bb37d1a50f82922f4acd48c52d99e0 During installation, package downloads and executes malware. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-semvver Reasons based on the campaign: - Downloads...

Malicious code in 1h1 (PyPI)

Source: kam193 04938e0ebf8781fb6c986fda09db9f4a60c240eb6dc79ab33e6faf7a5589b353 During installation, package downloads and executes malware. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-semvver Reasons based on the campaign: - Downloads...

ammonia: mXSS via MathML `annotation-xml` encoding strip

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser. The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the...

mem0ai Databricks vector store vulnerable to SQL injection

mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vectorstores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert and update string...

Malicious code in net-codec-testmetest (npm)

Source: amazon-inspector 7bf1dbafca56ccfcb849f9ebb80b7a1cdf42007fd12618492620e0f7660476b2 The package has no native source files but ships a binding.gyp whose sole target is type:'none' and whose sources array uses GYP command expansion !env node index.js... to execute index.js during node-gyp...

Malicious code in @conduitops/logview-archive (npm)

Source: amazon-inspector f20036e315be6c5dd925bdedc87120af27adb007a4c2b6653c95cb386acd9009 On install, package.json's postinstall hook runs install.js, which invokes npm install @conduit/[email protected] --registry where the registry URL is stored as a base64+XOR-masked string in lib/toolchain.js...

Malicious code in log-rotate-testmetest (npm)

Source: amazon-inspector 8608133ab1a2f106c095f84116cd25fa141208dbf81ea6fe2331e38a88551a4b The package ships a binding.gyp whose sources field uses GYP command-expansion !env node index.js... with no native source files, causing npm's implicit node-gyp rebuild to execute index.js at install time...

Malicious code in formatting-subtitles (npm)

Source: amazon-inspector 25577370189f57a5678b2f2c45e212abfc79a3675dc7d51581f633e78aba47a6 package.json declares preinstall: sh./prepare.js && exit 0. prepare.js is shaped like JavaScript ending with console.log'hello world' but is executed by /bin/sh, which does not treat /... / as a comment...

Malicious code in simplewave (npm)

Source: amazon-inspector d984cf27dec602e96199a4361b485f0a7c79e2134977a355d42ddb46edd606d0 [email protected] declares a postinstall script in package.json that runs an inline Node command performing an HTTP GET to a subdomain of oast.fun with the installer's os.hostname embedded as the leftmost DNS...

Malicious code in log-sink-testmetest (npm)

log-sink-testmetest 1.0.1 ships the credential stealer of data-pipeline-testmetest 2.0.1 and runs it on npm install without an install script: its binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, which decrypts data.bin and pipes it into Bun. The payload is identical to...

Malicious code in data-pipeline-testmetest (npm)

data-pipeline-testmetest 2.0.1 is a self-spreading credential stealer that runs on npm install without an install script: its binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, an obfuscated loader that decrypts a 939 KB payload and pipes it into Bun downloaded from GitHub...

Malicious code in pixel-map-testmetest (npm)

pixel-map-testmetest 0.0.1 and 0.0.2 ship a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and run it on npm install: their binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, which decrypts data.bin and pipes it into Bun. The package.json poses as an npm...

Malicious code in event-emitter-testmetest (npm)

event-emitter-testmetest was published by npm account testnewtestme2 on 2026-10-21, first to test the delivery chain of data-pipeline-testmetest 2.0.1 and then to ship it. 1.0.6 and 1.0.7 ship an obfuscated index.js loader that decrypts a filler stage and pipes it into Bun with the full...

Malicious code in test-brotli2-testmetest (npm)

test-brotli2-testmetest 1.0.0 ships a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and runs it on npm install: its install script runs node-gyp rebuild, and the binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, an obfuscated loader that decrypts a...

Malicious code in test-brotli-testmetest (npm)

test-brotli-testmetest 1.0.0 ships a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and runs it on npm install: its install script runs node-gyp rebuild, and the binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, an obfuscated loader that decrypts a...

Malicious code in voxweaver (PyPI)

Source: kam193 98de0e1f12e0c4b69583e08c1cd46876975b49c6803d93483c136ee2f6e62f68 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in ttsweaver (PyPI)

Source: kam193 cf25be0936bf389bd4c150fdda0e6801d5916e7d3c386695ece9360dbb39c085 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in vocabblend (PyPI)

Source: kam193 f512985b20dc469ed3bd4e8e382b358fdbffa1153f5fcadb3d6dfeeaeeac84a0 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in ttsprobe (PyPI)

Source: kam193 d041a8df49e0f66f27d5f26370aa9bfee89b0ede347cb57f201f3359713e8c2d This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in voicekit (PyPI)

Source: kam193 963d403cf4d9c68ae8a3047dba639793fc4669e0953662c923c9a1eacb5f5402 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in ttsdock (PyPI)

Source: kam193 cd67309a16135e30efc3aad2f8d234cc48fed3ffdaa4d32b6345cc368963e775 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in vocabbench (PyPI)

Source: kam193 dc5566e2e9fb4803c51425e840aa5d7979e11fc4263d12dc29fedbd472acb5cc This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in ttsflow (PyPI)

Source: kam193 ca06c0d356aef80eb13ae19e8a7e17cacdb0e1d3b1ba0f250387d8b18d110395 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in pipegrip (PyPI)

Source: kam193 69da6e2696ea51627e314534617b3a5507896dd6375f600ae4a71d84ace79609 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in speaksocket (PyPI)

Source: kam193 5045a2695255c6340f6e69b58b13605a27756ccbab63280fb415e755d95be1cd This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in speakbench (PyPI)

Source: kam193 5261cd9950cdef43aa82af72e1a479d8668a37b06d1fce0a6b8ff869e0620ed2 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in modelworks (PyPI)

Source: kam193 cd8881d21166c1b1d9e519b92d85228a8df0520e31bd5a3d6a3606513b66047a This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in phonemeprobe (PyPI)

Source: kam193 e734952ed1638d020205fd4c071007902fd7b0b6671f1aa8eeb0b583efa75a08 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in speechprobe (PyPI)

Source: kam193 d32ccbe0ed7b8e97acb3670d4e50b774d36520ddd91c34367170b7c5e88337e3 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...