LangSmith SDK: Streaming token events bypass output redaction

SummaryThe LangSmith SDK's output redaction controls hideOutputs in JS, hideoutputs in Python do not apply to streaming token events. When an LLM run produces streaming output, each chunk is recorded as a newtoken event containing the raw token value. These events bypass the redaction pipeline...

Apache Airflow: JWT token appearing in logs

JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix.Users are recommended to upgrade to version 3.2.0, which fixes this issue...

MetaGPT affected by server-side request forgery in metagpt/utils/common.py

A security flaw has been discovered in FoundationAgents MetaGPT up to 0.8.2. This impacts the function decodeimage of the file metagpt/utils/common.py. The manipulation of the argument imgurlorb64 results in server-side request forgery. It is possible to launch the attack remotely. The exploit ha...

pypdf has long runtimes for wrong size values in cross-reference and object streams

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large /Size values or object streams with wrong large /N values. PatchesThis has been fixed in pypdf==6.10.1. WorkaroundsIf you cannot upgrade yet, consider...

PraisonAI: Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS

SummaryThe AgentOS deployment platform exposes a GET /api/agents endpoint that returns agent names, roles, and the first 100 characters of agent system instructions to any unauthenticated caller. The AgentOS FastAPI application has no authentication middleware, no API key validation, and defaults...

PraisonAIAgents: Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell Tool

SummaryThe executecommand function in shelltools.py calls os.path.expandvars on every command argument at line 64, manually re-implementing shell-level environment variable expansion despite using shell=False line 88 for security. This allows exfiltration of secrets stored in environment variable...

PraisonAI Vulnerable to Decompression Bomb DoS via Recipe Bundle Extraction Without Size Limits

SummaryThe safeextractall function in PraisonAI's recipe registry validates archive members against path traversal attacks but performs no checks on individual member sizes, cumulative extracted size, or member count before calling tar.extractall. An attacker can publish a malicious recipe bundle...

OpenEXR Makes Use of Uninitialized Memory

SummaryWhile fuzzing openexrexrcheckfuzzer, Valgrind reports a conditional branch depending on uninitialized data inside genericunpack. This indicates a use of uninitialized memory CWE-457. The issue is reproducible with the current OSS-Fuzz harness and a single-file PoC. DetailsEnvironment:-...

pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for CVE-2026-33509)

SummaryThe fix for CVE-2026-33509 GHSA-r7mc-x6x7-cqxx added an ADMINONLYOPTIONS set to block non-admin users from modifying security-critical config options. The storagefolder option is not in this set and passes the existing path restriction because the Flask session directory is outside both...

OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp

SummaryA heap-buffer-overflow OOB read occurs in the istreamnonparallelread function in ImfContextInit.cpp when parsing a malformed EXR file through a memory-mapped IStream. A signed integer subtraction produces a negative value that is implicitly converted to sizet, resulting in a massive length...

LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint

ImpactThe /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to do the following: - Modify proxy configuration and environment variables - Register custom pass-through endpoint handlers pointing to...

Apache Airflow Provider for Databricks: TLS Certificate Verification is Disabled in Databricks Provider K8s Token Exchange

Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipulated or credentials exfiltrated w/o...

MobSF has SQL Injection in its SQLite Database Viewer Utils

DescriptionMobSF's readsqlite function in mobsf/MobSF/utils.py lines 542-566 uses Python string formatting % to construct SQL queries with table names read from a SQLite database's sqlitemaster table. When a security analyst uses MobSF to analyze a malicious mobile application containing a crafte...

pyLoad SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration

SummaryThe setconfigvalue API endpoint allows users with the non-admin SETTINGS permission to modify any configuration option without restriction. The reconnect.script config option controls a file path that is passed directly to subprocess.run in the thread manager's reconnect logic. A SETTINGS...

pypdf has inefficient decoding of array-based streams

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes and/or large memory usage. This requires accessing an array-based stream with lots of entries. PatchesThis has been fixed in pypdf==6.9.1. WorkaroundsIf you cannot upgrade yet, consider applying the changes...

MLflow has a command injection in mlflow/sagemaker/__init__.py

A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the mlflow/sagemaker/init.py file at lines 161-167. The vulnerability arises from the direct interpolation of user-supplied container image names into shell commands without proper sanitization, whic...

RAGAS has an Arbitrary File Read vulnerability

An Arbitrary File Read vulnerability exists in the ImageTextPromptValue class in Exploding Gradients RAGAS v0.2.3 to v0.2.14. The vulnerability stems from improper validation and sanitization of URLs supplied in the retrievedcontexts parameter when handling multimodal inputs...

pypdf vulnerable to inefficient decoding of ASCIIHexDecode streams

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter. PatchesThis has been fixed in pypdf==6.7.5. WorkaroundsIf you cannot upgrade yet, consider applying the changes from PR 3666...

joserfc's PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)

Summary A resource exhaustion vulnerability in joserfc allows an unauthenticated attacker to cause a Denial of Service DoS via CPU exhaustion. When the library decrypts a JSON Web Encryption JWE token using Password-Based Encryption PBES2 algorithms, it reads the p2c PBES2 Count parameter directl...

pypdf: Manipulated FlateDecode XFA streams can exhaust RAM

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the xfa property of a reader or writer and the corresponding stream being compressed using /FlateDecode. PatchesThis has been fixed in pypdf==6.7.3. WorkaroundsIf projects...

pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file. PatchesThis has been fixed in pypdf==6.7.2. WorkaroundsIf users cannot upgrade yet, consider applying the changes from PR 3655...

pypdf has possible long runtimes/large memory usage for large /ToUnicode streams

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction. PatchesThis has been fixed in pypdf==6.7.1. WorkaroundsIf...

pypdf possibly has long runtimes for malformed FlateDecode streams

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a malformed /FlateDecode stream, where the byte-by-byte decompression is used. PatchesThis has been fixed in pypdf==6.7.1. WorkaroundsIf you cannot upgrade yet, consider applying the changes...

LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection

SummaryThe LangSmith SDK's distributed tracing feature is vulnerable to Server-Side Request Forgery via malicious HTTP headers. An attacker can inject arbitrary apiurl values through the baggage header, causing the SDK to exfiltrate sensitive trace data to attacker-controlled endpoints.---...

LlamaIndex vulnerable to data loss through hash collisions in its DocugamiReader class

A vulnerability in the DocugamiReader class of the run-llama/llamaindex repository, up to but excluding version 0.12.41, involves the use of MD5 hashing to generate IDs for document chunks. This approach leads to hash collisions when structurally distinct chunks contain identical text, resulting ...

web2py has an Open Redirect Vulnerability

web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an Open Redirect vulnerability. If this vulnerability is exploited, the user may be redirected to an arbitrary website when accessing a specially crafted URL. As a result, the user may become a victim of a phishing atta...

Azure PromptFlow remote code execution related to Jinja templates

Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network...

pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a character

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if parsecontentstream is executed. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case if the...

Authenticated Local Privilege Escalation vulnerability in Intel Optimization for Tensorflow

Improper buffer restrictions in the IntelR Optimization for Tensorflow software before version 2.12 may allow an authenticated user to potentially enable escalation of privilege via local access...

TensorFlow vulnerable to Out-of-Bounds Read in DynamicStitch

ImpactIf the parameter indices for DynamicStitch does not match the shape of the parameter data, it can trigger an stack OOB read.pythonimport tensorflow as tffunc = tf.rawops.DynamicStitchpara='indices': 0xdeadbeef, 405, 519, 758, 1015, 'data': 110.27793884277344, 120.29475402832031,...

TensorFlow vulnerable to seg fault in `tf.raw_ops.Print`

ImpactWhen the parameter summarize of tf.rawops.Print is zero, the new method SummarizeArray will reference to a nullptr, leading to a seg fault.pythonimport tensorflow as tftf.rawops.Printinput = tf.constant1, 1, 1, 1,dtype=tf.int32, data = False, False, False, False, False, False, False, False,...

TensorFlow vulnerable to segfault when opening multiframe gif

ImpactInteger overflow occurs when 2^31 = numframes height width channels 2^32, for example Full HD screencast of at least 346 frames.pythonimport urllib.requestdat =...

TensorFlow has Null Pointer Error in SparseSparseMaximum

ImpactWhen SparseSparseMaximum is given invalid sparse tensors as inputs, it can give an NPE. pythonimport tensorflow as tftf.rawops.SparseSparseMaximum aindices=1, avalues = 0.1 , ashape = 2, bindices=, bvalues =2 , bshape = 2, PatchesWe have patched the issue in GitHub commit...

TensorFlow has segmentation fault in tfg-translate

ImpactOut-of-bounds access due to mismatched integer type sizes in ValueMap::Manager::GetValueOrCreatePlaceholder. Bug with tfg-translate call to InitMlir. The problem happens with generic functions, as it is already handled for non-generic functions. This is because they, unlike non-generic...

TensorFlow has Floating Point Exception in TensorListSplit with XLA

ImpactFPE in TensorListSplit with XLA pythonimport tensorflow as tffunc = tf.rawops.TensorListSplitpara = 'tensor': 1, 'elementshape': -1, 'lengths': [email protected]=Truedef fuzzjit: y = funcpara return yprintfuzzjit PatchesWe have patched the issue in GitHub commit...

TensorFlow has double free in Fractional(Max/Avg)Pool

Impactnnops.fractionalavgpoolv2 and nnops.fractionalmaxpoolv2 require the first and fourth elements of their parameter poolingratio to be equal to 1.0, as pooling on batch and channel dimensions is not supported.pythonimport tensorflow as tfimport osimport numpy as npfrom tensorflow.python.ops...

TensorFlow has Segfault in Bincount with XLA

ImpactWhen running with XLA, tf.rawops.Bincount segfaults when given a parameter weights that is neither the same shape as parameter arr nor a length-0 tensor.pythonimport tensorflow as tffunc = tf.rawops.Bincountpara='arr': 6, 'size': 804, 'weights': 52, [email protected]=Truedef fuzzjit...

TensorFlow has null dereference on ParallelConcat with XLA

ImpactWhen running with XLA, tf.rawops.ParallelConcat segfaults with a nullptr dereference when given a parameter shape with rank that is not greater than zero.pythonimport tensorflow as tffunc = tf.rawops.ParallelConcatpara = 'shape': 0, 'values': [email protected]=Truedef test: y = funcpa...

Out of bounds write in grappler in Tensorflow

ImpactThe function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. PatchesWe have patched the issue in GitHub commit...

`FractionalMaxPoolGrad` Heap out of bounds read

ImpactIf FractionMaxPoolGrad is given outsize inputs rowpoolingsequence and colpoolingsequence, TensorFlow will crash.pythonimport tensorflow as tftf.rawops.FractionMaxPoolGrad originput = 1, 1, 1, 1, 1, origoutput = 1, 1, 1, outbackprop = 3, 3, 6, rowpoolingsequence = -0x4000000, 1, 1,...

Overflow in `tf.keras.losses.poisson`

Impacttf.keras.losses.poisson receives a ypred and ytrue that are passed through functor::mul in BinaryOp. If the resulting dimensions overflow an int32, TensorFlow will crash due to a size mismatch during broadcast assignment.pythonimport numpy as npimport tensorflow as tftruevalue =...

OpenStack Sushy-Tools and VirtualBMC Improper Preservation of Permissions

An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages removes password protection from the managed libvirt XML domain. NOTE: this only affects an "unsupported, production-like configuration."...

Seg fault in `ndarray_tensor_bridge` due to zero and large inputs

ImpactIf a numpy array is created with a shape such that one element is zero and the others sum to a large number, an error will be raised. E.g. the following raises an error:pythonnp.ones0, 231, 231An example of a proof of concept:pythonimport numpy as npimport tensorflow as tfinputval =...

TensorFlow vulnerable to `CHECK` fail in `ParameterizedTruncatedNormal`

ImpactParameterizedTruncatedNormal assumes shape is of type int32. A valid shape of type int64 results in a mismatched type CHECK fail that can be used to trigger a denial of service attack.pythonimport tensorflow as tfseed = 1618seed2 = 0shape = tf.random.uniformshape=3, minval=-10000,...

TensorFlow vulnerable to `CHECK` fail in `tf.linalg.matrix_rank`

ImpactWhen tf.linalg.matrixrank receives an empty input a, the GPU kernel gives a CHECK fail that can be used to trigger a denial of service attack.pythonimport tensorflow as tfa = tf.constant, shape=0, 1, 1, dtype=tf.float32tf.linalg.matrixranka=a PatchesWe have patched the issue in GitHub commi...

TensorFlow vulnerable to segfault in `SparseBincount`

ImpactIf SparseBincount is given inputs for indices, values, and denseshape that do not make a valid sparse tensor, it results in a segfault that can be used to trigger a denial of service attack.pythonimport tensorflow as tfbinaryoutput = Trueindices = tf.random.uniformshape=, minval=-10000,...

TensorFlow vulnerable to `CHECK` fail in `FractionalMaxPoolGrad`

ImpactFractionalMaxPoolGrad validates its inputs with CHECK failures instead of with returning errors. If it gets incorrectly sized inputs, the CHECK failure can be used to trigger a denial of service attack:pythonimport tensorflow as tfoverlapping = Trueoriginput = tf.constant.453409232,...

TensorFlow vulnerable to segfault in `QuantizedInstanceNorm`

ImpactIf QuantizedInstanceNorm is given xmin or xmax tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack.pythonimport tensorflow as tfoutputrangegiven = Falsegivenymin = 0givenymax = 0varianceepsilon = 1e-05minseparation = 0.001x =...

TensorFlow vulnerable to segfault in `QuantizedAdd`

ImpactIf QuantizedAdd is given mininput or maxinput tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack.pythonimport tensorflow as tfToutput = tf.qint32x = tf.constant140, shape=1, dtype=tf.quint8y = tf.constant26, shape=10, dtype=tf.quint8mi...

TensorFlow vulnerable to `CHECK` failures in `UnbatchGradOp`

ImpactThe UnbatchGradOp function takes an argument id that is assumed to be a scalar. A nonscalar id can trigger a CHECK failure and crash the program.pythonimport numpy as npimport tensorflow as tf id is not scalartf.rawops.UnbatchGradoriginalinput= tf.constant1,batchindex=tf.constant0,0,0 , ,...