GHSA-RXP7-6HXX-X8Q5 ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

Summary new Address6 and Address6.isValid strip a zone identifier with the pattern /%.$/ before they apply the 45-character length limit. When the string holds many % characters followed by a line terminator, the pattern is retried from every % and each attempt scans to the line terminator before...

GHSA-CG8M-R9F2-5WM2 Black: GitHub Action installs unvalidated required-version from pyproject.toml

Summary The GitHub Action bundled with Black can read the version from tool.black.required-version if usepyproject is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository. Details This is similar to the previous...

GHSA-XW6W-GCFP-CF8M Django REST framework: TokenProxy.delete() reports success and revokes nothing

Summary Deleting an authentication token through TokenProxy silently deletes nothing. The call raises no exception and reports success, the database row survives, and the token keeps authenticating. Any application, admin integration or operational script that revokes credentials by calling .dele...

GHSA-H694-7CP9-M8P3 next.js cache leak across root param values in nested 'use cache' functions

Impact With Cache Components enabled cacheComponents: true, a 'use cache' function that calls another 'use cache' function that reads a root param can be keyed incorrectly when the inner call is served from an existing entry: the enclosing function's cache key then omits that root param. The...

GHSA-G7CR-3P24-7WF7 Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer

============================================================================ Heap buffer overflow writing JPEG comment after ICC profile fills buffer Location: src/libImaging/JpegEncode.c:330 in ImagingJpegEncode Commit: a707c6b21c313880d0771e54965d142dd42358b6...

GHSA-9V9V-9QVF-H2HJ Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)

Summary On Windows builds, Pillow stores EMF and WMF image dimensions without a range check and passes them to the native drawwmf handler. That code sizes its allocation from dimensions truncated into 16-bit header fields but copies the result using the full 32-bit dimensions. A crafted metafile...

GHSA-G4QV-2JXX-769H Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time

Summary A PNG file with a large eXIf chunk full of repeated 6-byte markers makes Pillow's EXIF parser take seconds of CPU instead of milliseconds. The cost grows with the square of the chunk size, so a normal small-photo-sized file is enough to cause real delay. Details Exif.load in...

GHSA-3J72-P6QG-6XP7 Pillow: TarIO negative size field causes infinite CPU-spin loop

Summary TarIO.init does not check that a tar header's size field is positive. A crafted header with a negative size makes it seek backward onto itself. This causes an infinite loop that uses 100% CPU and never returns. Details TarIO.init reads 512-byte tar headers one at a time, looking for a...

GHSA-4RM8-3HMM-39FG Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise

Summary Affected Object and Source Package: Pillow 12.3.0 Source: PyPI sdist pillow-12.3.0.tar.gz SHA-256: 3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce Sink: src/imaging.c:2809:15, xsize += dx Details The code in Pillow 12.3.0 is: c for xsize = 0; text; text++ int dx =...

GHSA-MRFP-P49P-3HF2 Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

Summary Pillow's documented PDF append path can spend disproportionate CPU time on a compact malformed PDF page tree. An attacker who can supply an existing PDF to an application that appends an image with Image.save..., format="PDF", append=True can provide a malformed /Pages tree where each lev...

GHSA-V9PV-5GC8-W2M6 Pillow multi-frame loaders can reuse stale native image storage after mode transitions

Summary Pillow multi-frame image loaders can retain native ImagingCore storage allocated for one frame while changing the Python-side image mode and decoder tiles for a later frame. If frame 0 allocates storage for a narrow mode such as L, and a later frame of the same dimensions switches to a...

GHSA-24RC-8HJ2-V98C Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode

Summary BmpRleDecoder can be forced to allocate gigabytes of memory from a kilobyte-sized crafted BMP file via unbounded growth in the delta escape and absolute mode branches. Affected versions All versions up to and including current HEAD v13.0.0.dev0, commit e7a7ea84 Root cause...

GHSA-G842-9RC4-69PW Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS

Summary SpiderImagePlugin's seek bypasses the decompression bomb check, allowing a tiny 1KB crafted SPIDER stack file to trigger a multi-gigabyte allocation on im.load. Affected versions All versions up to and including current HEAD v13.0.0.dev0, commit e7a7ea84 Root cause Image.open runs...

GHSA-P8HX-V2P6-RP84 Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)

Summary Pillow's decompression-bomb protection Image.decompressionbombcheck, gated by Image.MAXIMAGEPIXELS is enforced only on the first frame, inside Image.open. For multi-frame formats, seek re-parses the target frame's header and resets self.size. GifImagePlugin and TiffImagePlugin re-run the...

GHSA-MCHM-GJX6-7H55 Sentry-Javascript: Middleware Bypass when using Tunnel route

Impact The tunnelRoute option makes the SDK send browser events to a path on your own Next.js server for example /monitoring, where a rewrite forwards them to Sentry to prevent ad blockers from blocking them. To keep those envelope requests from being rejected by your middleware, the SDK skips...

GHSA-CPVR-W4J5-2MPG Librsvg: Use-after-free when XML includes have duplicated entities

Librsvg uses libxml2, a C library, to parse XML. When librsvg parses an SVG document which has a nested Xinclude, an XML entity declaration with a duplicate name as an existing one can cause a use-after-free error. While libxml2 is expanding an internal entity, a recursive XInclude can parse...

GHSA-P3M5-59MP-JV5R Next.js: Denial of Service in App Router using Server Actions

Impact Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. Workarounds No workaround exists besides upgrading. Applications using Pages Router or not using...

GHSA-JJ87-HC4R-JWFW stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

Summary FlexAssembler, the custom-container assembler shipped in the stream-json package src/core/utils/flex-assembler.js, re-exported at stream-json/utils/flex-assembler.js and stream-json/web/utils/flex-assembler.js, compiles a string or RegExp path filter into a matcher that runs...

GHSA-PXH4-856F-4H89 PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery

Summary HMACAlgorithm.fromjwk accepts a symmetric kty=oct JWK whose k value is the empty string and returns a zero-length key without raising. When a token is then verified with that key object a PyJWK, or a PyJWK resolved by PyJWKSet / PyJWKClient, the HMAC verifier computes HMACkey=b"",...

GHSA-354V-3Q48-CV69 Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization

Summary Jupyter Server's gateway WebSocket handler checks that a user is authenticated, but it does not ask the configured Authorizer whether that user may execute kernels. In Jupyter Server 2.0.0 through 2.5.0, enabling GatewayClient.url automatically replaced the normal kernel channel handler...

GHSA-9V8H-QQGM-4M35 Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package

A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially...

GHSA-9JH8-V38H-CVHR ammonia: mXSS via MathML `annotation-xml` encoding strip

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser. The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the...

GHSA-7587-9684-52R6 mem0ai Databricks vector store vulnerable to SQL injection

mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vectorstores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert and update string...

GHSA-CW65-GX24-RC82 virtualenv: Builtin creation follows linked environment directories

Summary The builtin creator accepts existing directory symlinks through ensuredir and writes environment files through those directories. This permits writes outside the requested destination. Anthropic's OSS Scanner reported this as ANT-2026-MUFJEG11 in virtualenv-20261015-005, received on 15...

GHSA-43MP-35Q3-X3FQ virtualenv: Deletion recovery can change a symlink target's mode

Summary The deletion error handler obtains permission bits with lstat but applies them through chmod, which follows symlinks. On an eligible unlink failure this can change permissions outside the destination. Anthropic's OSS Scanner reported this as ANT-2026-UK90QC27 in virtualenv-20261015-005,...

GHSA-C978-59M8-C77V virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax

Summary A destination path supplied to virtualenv can be interpreted as shell syntax by a generated POSIX console launcher. The app-data seeder and pip delegate launcher generation to distlib but supply the interpreter path in a form that does not preserve it as literal data in the shell wrapper...

GHSA-XVH5-G6GV-559V Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags

============================================================================ Memory disclosure and segfault in libtiff encoder via crafted TIFF tags Location: src/encode.c:1014 in PyImagingLibTiffEncoderNew Commit: a707c6b21c313880d0771e54965d142dd42358b6...

GHSA-332P-7HRC-92WF Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO

============================================================================ Heap buffer overflow in tiffWriteProc when saving TIFF to BytesIO Location: src/libImaging/TiffDecode.c:94 in tiffWriteProc Commit: a707c6b21c313880d0771e54965d142dd42358b6...

GHSA-4RR5-89J8-MWWM Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer

Summary Saving an image as TIFF to an in-memory buffer can trigger a heap use-after-free if libtiff rejects a tag at encode time. When TIFFWriteScanline fails, the encoder frees its output buffer but leaves the libtiff handle open. Later, when the encoder object is torn down, TIFFClose flushes...

GHSA-F2G6-542V-9J58 Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle

============================================================================ Infinite loop in PdfParser.rewritepages on page tree Parent cycle Location: src/PIL/PdfParser.py:505 in PdfParser.rewritepages Commit: a707c6b21c313880d0771e54965d142dd42358b6...

GHSA-5XM2-6676-QCP9 Pillow: APNG background disposal allocates full canvas before decompression bomb check

============================================================================ APNG background disposal allocates full canvas before decompression bomb check Location: src/PIL/PngImagePlugin.py:1000 in PngImageFile.seek Commit: a707c6b21c313880d0771e54965d142dd42358b6...

GHSA-GG2R-WVFM-Q9RX Pillow: MSP RLE decoder expands a tiny file into unbounded memory

Summary The MSP RLE decoder expands run-length data into an in-memory buffer with no cap tied to the declared image size. A small file that passes the pixel-count check can force hundreds of megabytes or more of allocation when the application loads pixels. Details The MSP decoder writes each run...

GHSA-JG86-V3JV-HRPM Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)

============================================================================ Quadratic-time DoS in PDF saveall PdfParser.nextobjectid Location: src/PIL/PdfParser.py:629 in nextobjectid Commit: a707c6b21c313880d0771e54965d142dd42358b6...

GHSA-254F-3936-288H Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()

Summary PdfParser's getvalue can recurse without any limit and crash with an uncaught RecursionError. It is reachable through Image.saveim, fp=, format="PDF", append=True when the existing PDF file is attacker-controlled. This is the same class of bug as...

GHSA-XGH8-JP6Q-P5X8 Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes

============================================================================ ReDoS in XbmImagePlugin: 512-byte file stalls Image.open for minutes Location: src/PIL/XbmImagePlugin.py:58 in XbmImageFile.open Commit: a707c6b21c313880d0771e54965d142dd42358b6...

GHSA-RFGQ-Q3W2-PMV2 Pillow: Image.quantize() with empty palette leaks uninitialized stack memory

============================================================================ Image.quantize with empty palette leaks uninitialized stack memory Location: src/libImaging/Palette.c:216 in ImagingPaletteCacheUpdate Commit: a707c6b21c313880d0771e54965d142dd42358b6...

GHSA-74R2-7FF9-MJJ2 Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()

============================================================================ Quadratic GIF comment concatenation allows DoS in Image.open Location: src/PIL/GifImagePlugin.py:266 in GifImageFile.seek Commit: a707c6b21c313880d0771e54965d142dd42358b6...

GHSA-22HG-R758-RRW9 Pillow: Infinite loop in MIC n_frames when the embedded TIFF

============================================================================ Infinite loop in MIC nframes when the embedded TIFF has 3+ IFDs Location: src/PIL/MicImagePlugin.py:86 in MicImageFile.tell Commit: a707c6b21c313880d0771e54965d142dd42358b6...

GHSA-FC9G-5QG7-MF45 Pillow: Quadratic GIF comment copying during save

On Pillow 12.3.0 and upstream main ad277e2761b489681e71b51e91367d46b0ceabb9, a GIF with a long comment makes getglobalheader copy portions of the comment repeatedly when saving, including comments carried over from untrusted images. I suggest provisional Moderate severity for crafted-image CPU...

GHSA-27H8-GF7J-V5HC Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images

============================================================================ NULL dereference in ImagingExpand via rank filters on zero-size images Location: src/libImaging/Filter.c:79 in ImagingExpand Commit: a707c6b21c313880d0771e54965d142dd42358b6...

GHSA-CP9V-662Q-VVX9 Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0

Summary Image.merge checks the mode of every input band except band 0. If band 0 is a single-band I or F image, the native merge routine reads a pixel pointer that is NULL for those modes and the process crashes. The IPTC plugin reaches this from a plain Image.open followed by a load, and IPTC ha...

GHSA-J4M9-6W36-PW47 Pillow: Invalid free in FreeType glyph rendering when a stroker is active

Summary When text is drawn with a non-zero stroke width, Pillow creates a FreeType stroker and then loads each glyph. If FTLoadGlyph fails for a glyph, the cleanup path calls FTDoneGlyph on the glyph variable. That variable is not initialized before the first measurement loop, and in the render...

GHSA-7MWM-GHPF-9VRM Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform

============================================================================ Double free in ImagingScaleAffine on calloc failure via Image.transform Location: src/libImaging/Geometry.c:866 in ImagingScaleAffine Commit: a707c6b21c313880d0771e54965d142dd42358b6...

GHSA-4558-3H8R-V8XP Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size

Summary On main, even with the guard in 9725, it's possible to have these decoders read 1 to 3 bytes past the end of the passed buffer with a suitable width/height. Details ImagingRawDecode and the P;2L / P;4L unpackers disagree about how many bytes a line of data occupies. The raw decoder derive...

GHSA-W889-685W-C8FH Pillow: Argument Injection in Ghostscript call, potentially leading into RCE

Summary PIL.EpsImagePlugin.Ghostscript builds the Ghostscript command line using the input file path fp.name without sanitization, placing it at -f . A filename beginning with - is interpreted by Ghostscript as an option, giving command-line argument injection; chainable to RCE see Impact...

GHSA-5HX5-VPF9-5WCV pypdf: Unvalidated JPEG image data loading

Impact An attacker who uses this vulnerability can craft a PDF which leads to arbitrary image parsers being called. This requires loading an image which claims to use the /DCTDecode filter JPEG data. Users which do not have the optional Pillow dependency installed in their environment are not...

GHSA-XP26-3454-MJGP Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix

Summary The path traversal fix released for GHSA-82fw-gwwq-j7x9 can be bypassed on Windows by using a backslash in the redirect URL pathname. The fixed code joins an attacker-controlled URL pathname with the Vite root using node:path/posix, then passes that string to Vite's file allowlist check. ...

GHSA-3X84-QQ85-FJ65 OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs

Summary Browser CDP discovery could accept blocked WebSocket URLs. In affected versions, a lower-trust caller or configured input path could reach network destinations that should have been blocked by OpenClaw policy. This advisory is scoped to the named feature and configuration. It does not...

GHSA-F2PH-CMG5-WXC8 Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

Summary: A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of...

GHSA-FW47-9C62-H3VW Electron: HID and USB permission checks can be attributed to the wrong origin

Impact For hid and usb permission checks made from an iframe, session.setPermissionCheckHandler was given the top-level frame's origin and details instead of the requesting frame's. Apps that allow these permissions based on origin could grant an embedded frame access intended for the top-level...