MPXJ: XXE Vulnerability in MerlinReader

ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file...

OpenCVE: Server-Side Request Forgery (SSRF) in notifications

ImpactOpenCVE contains a Server-Side Request Forgery SSRF vulnerability in the notification testing functionality for both Webhook and Slack integrations.An authenticated user with permission to configure notification channels can trigger test requests to arbitrary HTTPS endpoints. Insufficient...

MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers

ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources...

psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry

SummaryPSDImage.composite and .numpy allocate the output image buffer from the PSD's header geometry width × height × channels × depth, and per-layer rectangles before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte...

Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

SummaryThe Mnemosyne sync server's authentication check decoded JWT bearer tokens but never verified their HMAC-SHA256 signatures. Any well-formed token was accepted, allowing an unauthenticated attacker to impersonate any user and read or modify their sync data.Severity: CriticalCVSS 3.1:...

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

ImpactServices using internationalized non-ASCII domain names are potentially vulnerable to TLS connections made from AnyIO's connecttcp or directly via TLSStream.wrap where the connection has through other means been hijacked and redirected to a malicious server. The attacker would obtain a...

LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading

Summarylmdeploy = latest contains a code injection vulnerability in lmdeploy/pytorch/config.py line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted quantizationconfig.quantdtype value. When a user loads the model with lmdeplo...

AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups

AnyIO 4.14.0 accepts the POSIX extragroups argument on anyio.runprocess and anyio.openprocess, but openprocess forwards the wrong variable to the backend: when extragroups is not None, it assigns kwargs"extragroups" = group instead of extragroups. As a result, callers cannot reliably clear or set...

AnyIO process-pool workers can block indefinitely on undrained stderr

ImpactAnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redirected. Worker code th...

Jupyter Server: 5xx request logging leaks token-bearing Referer header values

SummaryWhen a request returns a 500, jupyterserver/log.py logs a small JSON block of request headers. The Referer header was copied into it as-is, so a token in the Referer URL ended up in the logs in plain text. ImpactAnyone who can read the server logs can pick tokens out of these 500 entries...

Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)

SummaryBefore tokenizing, selectoriter trims leading/trailing whitespace and comments by running two regexes over the whole raw selector with .search. The trailing one, REWSEND = re.compiler'WSC$', is anchored only at the end $, not the start. Because .search retries the pattern at every offset, ...

Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns

Summarysoupsieve compiles CSS selector strings with a set of hand-written regular expressions. The shared IDENTIFIER sub-pattern also embedded in VALUE, and therefore in attribute selectors places two adjacent quantified groups over overlapping character classes: ?:classA|ESC+?:classB|ESC, where...

LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

SummaryLMDeploy's PyTorch DistServe/PD-disaggregation control plane usedrecvpyobj to deserialize messages received through a ZeroMQ PULLsocket. PyZMQ implements recvpyobj using Python pickledeserialization, which can execute arbitrary code while reconstructingan object.The peer address used by th...

vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation

SummaryCurrent vLLM main lets an inference request choose the PyNvVideoCodec GPU video decoder through mediaiokwargs.video.videobackend, but engine GPU memory reservation is computed only from static startup configuration and VLLMVIDEOLOADERBACKEND. If the server starts with the default...

djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

ImpactThe djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling importmodulepath, .... The module is imported — running its top-level code import side effects — before the framework checks that the resolved object is a LiveView subclass and before any...

djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path

ImpactThe WebSocket handlemount and ViewRuntime.buildrequest rebuild an HttpRequest via RequestFactory.get... with no HTTPHOST, so request.gethost defaulted to "testserver" on the live path. Host/subdomain/domain TenantResolvers then misresolved the tenant — None on the live path while the HTTP...

Zope AccessControl vulnerable to information disclosure through Python string `format` and `format_map` functions

ImpactPython's string format functionality allows someone controlling the format string to "read" objects accessible recursively via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy...

vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions

SummaryThe audio decode-duration guard maxdurations, env VLLMMAXAUDIODECODEDURATIONS, default 600s that protects against audio decompression-bomb DoS is wired into only the speech-to-text path /v1/audio/transcriptions. The chat audio path /v1/chat/completions, inputaudio content parts calls the...

sanic chunked trailer request smuggling allows hidden second request execution

DescriptionSanic's HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating 0\r\n chunk. Because of that, attacker-controlled bytes left in the connection buffer after the first chunked request can be interpreted as the start of a new HTTP request on the same...

RestrictedPython vulnerable to sandbox escape via string.Formatter field resolution

ImpactRestrictedPython could allow a sandbox escape when a policy exposes the standard library string module, or otherwise exposes string.Formatter, to restricted code.string.Formatter field resolution methods such as getfield can perform attribute and item traversal internally and return live...

LiteLLM Proxy has server-side request forgery via the `user_config` request parameter

SummaryA server-side request forgery in LiteLLM Proxy lets an authenticated caller redirect theproxy's outbound request to a host of their choosing by smuggling an apibase inside theuserconfig request body, bypassing the existing parameter guard. DetailsLiteLLM Proxy validates request bodies with...

AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

SummaryA malicious SSH server can wedge an AsyncSSH client, and an authenticatedclient can wedge an AsyncSSH server, by sending a channel maximum packetsize of 0 in SSHMSGCHANNELOPENCONFIRMATION server→client orSSHMSGCHANNELOPEN client→server. AsyncSSH stores the peer-supplied valueverbatim with ...

LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy

DescriptionThe LMdeployimplements anrpc server AsyncRPCServer in zmqrpc.pyfor supporting the RPC communications. In its core functionalitycallandresponse, I found it will directly use thepickles.loadsto deserialize the received messages without any sanitization, hence resulting in a remote code...

djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

ImpactFor views that opt into state snapshots, the snapshot statejson embedded in the client page was restored on reconnect as trusted view state with no integrity check. A client could edit the unsigned statejson in their page and return it in the reconnect mount frame to inject arbitrary view...

djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client

ImpactWhen a Django Model instance is assigned to a public view attribute, djust serialized it to the client with no sensitive-field denylist — sending fields such as password the hash, privilege flags e.g. isstaff / issuperuser, tokens, and other PII to the browser. Because exposing model object...

djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session

ImpactThe SSE client→server POST endpoints are @csrfexempt and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a victim-cookie-authenticated SSE session: force the victim's browser to GET the stream URL which creates and mounts a LiveView as the victim and POST...

djust has broken object-level access control (IDOR)

Impactdjust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA urlchange navigation, and c % liverender % embedded child views. An authenticated us...

djust has an authorization bypass on the WebSocket/SSE mount path

ImpactThe live WebSocket transport authorizes a mount via checkviewauth, not Django's View.dispatch chain. As a result, standard Django authorization — LoginRequiredMixin, PermissionRequiredMixin, UserPassesTestMixin, @methoddecoratorloginrequired, name="dispatch", and custom dispatch guards — an...

djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)

ImpactSSE sessions were keyed solely by a client-chosen sessionid with no binding to the authenticated user — a control the WebSocket transport has but that was dropped on SSE. An attacker who learns or a victim who leaks a sessionid could connect to the message endpoint and dispatch event handle...

djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags

ImpactMany djust built-in component template tags djust.components.templatetags. render a developer/user-supplied URL into an href / action attribute, HTML-escaping it with conditionalescape but never validating the URL scheme. HTML escaping prevents attribute breakout but does not neutralize a...

djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

Impactdjust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware, so on the live WebSocket/SSE path getcurrenttenant was always None during mount and every event handler — and the tenant-aware...

ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

SummaryThe dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWORD instead. When the env vars were renamed the bare names were dropped with no fallback, so an operator who...

MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)

SummaryIn SSE/HTTP transport mode, mysqlmcpserver constructs SseServerTransport without passing securitysettings. As a result, the MCP Python SDK's DNS-rebinding protection Origin/Host header validation is disabled; the Starlette application has no CORS or TrustedHost middleware; and the service...

djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG

Impactdjust's observability endpoints expose live view/session state and a remote method-invocation surface evalhandler. The localhost restriction was an opt-in middleware that the documented setup omits; the views themselves enforced only DEBUG. In the misconfigured-but-documented scenario DEBUG...

djust: Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler

Impactdjust.mixins.modelbinding.ModelBindingMixin provides a default updatemodel event handler and is part of the LiveView base MRO, so every LiveView exposes it. It setattrs a view attribute whose name is client-supplied field, gated only by: reject -prefixed names; reject a 14-entry denylist of...

Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

SummaryWhen more than one external tool server is reachable in the same request, a tool call to a server configured for bearer authentication can arrive carrying the calling user's Open WebUI session cookies alongside that server's own key. The cookie jar is built per connection, but the callable...

Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

SummaryAny authenticated user can move one of their own folders under itself, leaving a loop in their folder tree. The re-parent endpoint performed no check that the new parent was not the folder itself or one of its own subfolders, and the folder tree walks did not track which folders they had...

Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value SummaryCalendar events carry a free-form meta object that is stored exactly as submitted, with no validation of the values inside it. The scheduler reads the per-event alert offset out of that object i...

Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

SummaryOpen WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session at...

Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout

SummaryThe OIDC back-channel logout endpoint is unauthenticated by design, because the identity provider calls it without a browser session. Before checking whether the submitted logout token was genuine, the handler fetched the provider's discovery document and its signing keys over the network,...

Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

SummaryA user who is demoted from admin by an identity provider keeps admin-level read and write access to every user's notes, over any Socket.IO connection that was already open when the demotion happened. Open WebUI caches the user's role on the socket at connection time, and the two SSO...

Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends

SummaryThe built-in knowledge search tool returns knowledge bases the calling user has no access to. The tool works out which knowledge bases the caller may read and hands that set to the vector store as a search filter, and that filter is the only access control on the path. Most of the shipped...

Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange

SummaryOpen WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An account whose email domain the login callback would refuse could still obtain a working session through this...

Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite

SummaryOn SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. A subject value containing SQL wildcard characters therefore matches accounts the value was never issued for, and the sign-in binds to whichever account the...

Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader

SummaryWith the Playwright web loader enabled, Open WebUI checks the address behind a user-submitted URL before allowing the request, then handed the request to the browser to perform. The browser resolved the hostname a second time, on its own, and that answer was never checked. An attacker who...

Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion

SummaryExternal knowledge connections are created and owned by administrators, and are shared by every external knowledge base bound to them. Deleting an external knowledge base also removed that connection from the instance configuration, with no check on the caller's role and no check for other...

Hugging Face Transformers downloads custom generation code before trust consent

A vulnerability in Hugging Face Transformers versions 4.49.0, = 5.8.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.loadcustomgenerate. The function fetches and caches a remote module file before performing the required...

Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch

SummaryOpen WebUI fetches user-supplied URLs on the server for RAG URL ingestion and web search, and screens the resolved addresses so internal destinations cannot be reached. That screen decided whether a destination was external by asking Python's standard library whether the address is globall...

Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint

SummaryAny member of a channel who can post to it could also replace the text of a message written by a different member. The channel branch of the chat completions endpoint checked that the caller may write to the channel, and that the targeted message belongs to that channel, but never checked...