Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the path tokenizer in cairosvg/path.py, where the path function uses repeated string splitting on SVG path data, resulting in quadratic time complexity. An attacker can supply an SVG file containin...

Cross-site Scripting (XSS)

Overview enshrined/svg-sanitize is a SVG sanitizer for PHP Affected versions of this package are vulnerable to Cross-site Scripting XSS via the sanitize process. An attacker can execute arbitrary JavaScript in the context of the affected web page by uploading a crafted SVG file that exploits a...

Denial of Service (DoS)

Overview enshrined/svg-sanitize is a SVG sanitizer for PHP Affected versions of this package are vulnerable to Denial of Service DoS through improper case-sensitive handling of attribute names in the processReferences process. An attacker can cause excessive resource consumption by submitting an...

Allocation of Resources Without Limits or Throttling

Overview enshrined/svg-sanitize is a SVG sanitizer for PHP Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the cleanAttributesOnWhitelist process. An attacker can cause the PHP process to crash by uploading a specially crafted SVG file...

Uncaught Exception

Overview music-metadata is a Music metadata parser for Node.js, supporting virtual any audio and tag format. Affected versions of this package are vulnerable to Uncaught Exception via the DSF parser DsfParser when processing a malformed DSF file whose chunk header declares a size smaller than the...

Protection Mechanism Failure

Overview Affected versions of this package are vulnerable to Protection Mechanism Failure via the parseplaylist function. An attacker can access restricted resources by supplying a crafted master playlist that references child playlists using disallowed protocols or non-multimedia local files,...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop via the parseplaylist process. An attacker can exhaust system resources by tricking a user into opening a specially crafted self-referencing playlist, which causes unbounded CPU and I/O consumption. Remediation Upgrade...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop through the ffrtspconnect function in rtsp.c when handling RTSP 3xx redirects without a redirect limit. An attacker can cause the application to enter an endless loop and exhaust CPU resources by controlling an RTSP server...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the ffrtspconnect function in libavformat/rtsp.c when RTSP 3xx redirects are followed without validating the Location URL. An attacker can access internal network resources by hosting a malicious RTSP...

Directory Traversal

Overview decompress-zip is an extracts the contents of the ZIP archive file. Affected versions of this package are vulnerable to Directory Traversal via the extract function in lib/decompress-zip.js, which does not validate that extracted file paths remain within the target directory. An attacker...

Directory Traversal

Overview org.webjars.npm:decompress-zip is an extracts the contents of the ZIP archive file. Affected versions of this package are vulnerable to Directory Traversal via the extract function in lib/decompress-zip.js, which does not validate that extracted file paths remain within the target...

External Control of File Name or Path

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to External Control of File Name or Path via the writemissingweakimports method in src/datamodelcodegenerator/parser/protobuf.py when processing a Protocol Buffers schema file containi...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview handlebars is an extension to the Mustache templating language. Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' via the compiler's handling of pre-parsed AST objects passed to compile or precompile. When a caller supplies a...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview org.webjars.npm:handlebars is an extension to the Mustache templating language. Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' via the compiler's handling of pre-parsed AST objects passed to compile or precompile. When a...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop in the getcurrentfragment process when handling DASH manifests with an empty SegmentTemplate media URL. An attacker can cause the application to enter an infinite loop and exhaust CPU resources by providing a crafted .mpd...

Key Exchange without Entity Authentication

Overview Affected versions of this package are vulnerable to Key Exchange without Entity Authentication via the sftp protocol handler in the libssh integration. An attacker can impersonate trusted servers and intercept sensitive data, such as credentials or media streams, by performing...

Server-side Request Forgery (SSRF)

Overview pydantic-ai-slim is an Agent Framework / shim to use Pydantic with LLMs, slim package Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the webfetchtool process. An attacker can access restricted hosts by supplying a hostname that is normalized...

Server-side Request Forgery (SSRF)

Overview pydantic-ai is an AI Agent Framework, the Pydantic way Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the webfetchtool process. An attacker can access restricted hosts by supplying a hostname that is normalized differently by the resolver,...

Improper Validation of Certificate with Host Mismatch

Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch due to improper certificate validation in the tlsopen process, which skips hostname checks for IP-address hosts. An attacker can intercept and manipulate encrypted connections by...

Use of Uninitialized Resource

Overview Affected versions of this package are vulnerable to Use of Uninitialized Resource in the avdynamichdrplustot35 function when processing HDR10+ metadata. An attacker can access sensitive process memory by supplying crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata, causing...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion through the recursive freeing of linked lists in the avencryptioninitinfofree function. An attacker can cause the process to crash and consume excessive CPU resources by supplying a specially crafted MP4 file...

Inefficient Algorithmic Complexity

Overview pydantic-ai-slim is an Agent Framework / shim to use Pydantic with LLMs, slim package Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the converthtml function in webfetch.py, where processing a deeply nested or adversarially structured HTML...

Inefficient Algorithmic Complexity

Overview pydantic-ai is an AI Agent Framework, the Pydantic way Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the converthtml function in webfetch.py, where processing a deeply nested or adversarially structured HTML document causes unbounded...

Out-of-bounds Read

Overview msgpack5 is an A msgpack v5 implementation for node.js and the browser, with extension points Affected versions of this package are vulnerable to Out-of-bounds Read via incomplete map32 header detection in lib/decoder.js. The SIZES lookup table was missing an entry for the 0xdf map32...

Out-of-bounds Read

Overview org.webjars.npm:msgpack5 is an A msgpack v5 implementation for node.js and the browser, with extension points Affected versions of this package are vulnerable to Out-of-bounds Read via incomplete map32 header detection in lib/decoder.js. The SIZES lookup table was missing an entry for th...

Uncontrolled Recursion

Overview msgpack5 is an A msgpack v5 implementation for node.js and the browser, with extension points Affected versions of this package are vulnerable to Uncontrolled Recursion via the transform method in lib/streams.js, where the decoder recursively calls itself when the chunk buffer still...

Uncontrolled Recursion

Overview org.webjars.npm:msgpack5 is an A msgpack v5 implementation for node.js and the browser, with extension points Affected versions of this package are vulnerable to Uncontrolled Recursion via the transform method in lib/streams.js, where the decoder recursively calls itself when the chunk...

Improper Handling of Syntactically Invalid Structure

Overview msgpack5 is an A msgpack v5 implementation for node.js and the browser, with extension points Affected versions of this package are vulnerable to Improper Handling of Syntactically Invalid Structure via the tryDecode function in lib/decoder.js, which does not reject the reserved...

Improper Handling of Syntactically Invalid Structure

Overview org.webjars.npm:msgpack5 is an A msgpack v5 implementation for node.js and the browser, with extension points Affected versions of this package are vulnerable to Improper Handling of Syntactically Invalid Structure via the tryDecode function in lib/decoder.js, which does not reject the...

Prototype Pollution

Overview msgpack5 is an A msgpack v5 implementation for node.js and the browser, with extension points Affected versions of this package are vulnerable to Prototype Pollution via the msgpack initializer function in index.js when a caller passes an options object. The original code used options =...

Prototype Pollution

Overview org.webjars.npm:msgpack5 is an A msgpack v5 implementation for node.js and the browser, with extension points Affected versions of this package are vulnerable to Prototype Pollution via the msgpack initializer function in index.js when a caller passes an options object. The original code...

Uncontrolled Recursion

Overview msgpack5 is an A msgpack v5 implementation for node.js and the browser, with extension points Affected versions of this package are vulnerable to Uncontrolled Recursion via the decode function in lib/decoder.js, which does not limit the nesting depth of decoded MessagePack structures. An...

Uncontrolled Recursion

Overview org.webjars.npm:msgpack5 is an A msgpack v5 implementation for node.js and the browser, with extension points Affected versions of this package are vulnerable to Uncontrolled Recursion via the decode function in lib/decoder.js, which does not limit the nesting depth of decoded MessagePac...

Inefficient Algorithmic Complexity

Overview msgpack5 is an A msgpack v5 implementation for node.js and the browser, with extension points Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the decode function in lib/decoder.js when processing deeply nested or large streaming container...

Inefficient Algorithmic Complexity

Overview org.webjars.npm:msgpack5 is an A msgpack v5 implementation for node.js and the browser, with extension points Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the decode function in lib/decoder.js when processing deeply nested or large streaming...

Modification of Assumed-Immutable Data (MAID)

Overview msgpack5 is an A msgpack v5 implementation for node.js and the browser, with extension points Affected versions of this package are vulnerable to Modification of Assumed-Immutable Data MAID via the readInt64BE function in lib/decoder.js, which mutates the input buffer in-place when...

Modification of Assumed-Immutable Data (MAID)

Overview org.webjars.npm:msgpack5 is an A msgpack v5 implementation for node.js and the browser, with extension points Affected versions of this package are vulnerable to Modification of Assumed-Immutable Data MAID via the readInt64BE function in lib/decoder.js, which mutates the input buffer...

DNS Rebinding

Overview pydantic-ai-slim is an Agent Framework / shim to use Pydantic with LLMs, slim package Affected versions of this package are vulnerable to DNS Rebinding via insufficient Host header validation in the web UI component Agent.toweb and the clai web command. A malicious website can point a...

DNS Rebinding

Overview pydantic-ai is an AI Agent Framework, the Pydantic way Affected versions of this package are vulnerable to DNS Rebinding via insufficient Host header validation in the web UI component Agent.toweb and the clai web command. A malicious website can point a hostname it controls at a victim'...

Cross-site Request Forgery (CSRF)

Overview pydantic-ai is an AI Agent Framework, the Pydantic way Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the postchat handler in pydanticai/ui/web/api.py, which does not enforce a Content-Type: application/json requirement on the web UI chat endpoint...

Cross-site Request Forgery (CSRF)

Overview pydantic-ai-slim is an Agent Framework / shim to use Pydantic with LLMs, slim package Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the postchat handler in pydanticai/ui/web/api.py, which does not enforce a Content-Type: application/json...

Insertion of Sensitive Information into Log File

Overview pydantic-ai is an AI Agent Framework, the Pydantic way Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the otelmessageparts method in messages.py, where RetryPromptPart content is included in OpenTelemetry traces regardless of the...

Insertion of Sensitive Information into Log File

Overview pydantic-ai-slim is an Agent Framework / shim to use Pydantic with LLMs, slim package Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the otelmessageparts method in messages.py, where RetryPromptPart content is included in...

Allocation of Resources Without Limits or Throttling

Overview pydantic-ai-slim is an Agent Framework / shim to use Pydantic with LLMs, slim package Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the safedownload function in pydanticai/ssrf.py and the webfetch common tool, which impose no...

Allocation of Resources Without Limits or Throttling

Overview pydantic-ai is an AI Agent Framework, the Pydantic way Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the safedownload function in pydanticai/ssrf.py and the webfetch common tool, which impose no upper bound on HTTP response...

Protection Mechanism Failure

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Protection Mechanism Failure due to improper handling of the scheme when processing Set-Cookie headers. An attacker can overwrite, plant, or...

Regular Expression Denial of Service (ReDoS)

Overview pydantic-ai-slim is an Agent Framework / shim to use Pydantic with LLMs, slim package Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the webfetch tool in pydanticai/commontools/webfetch.py, where response body decoding is performed...

Regular Expression Denial of Service (ReDoS)

Overview pydantic-ai is an AI Agent Framework, the Pydantic way Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the webfetch tool in pydanticai/commontools/webfetch.py, where response body decoding is performed synchronously on the event loop usi...

Insertion of Sensitive Information into Log File

Overview pydantic-ai-slim is an Agent Framework / shim to use Pydantic with LLMs, slim package Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the OpenTelemetry instrumentation layer, specifically in recordexception and related span-recordi...

Insertion of Sensitive Information into Log File

Overview pydantic-ai is an AI Agent Framework, the Pydantic way Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the OpenTelemetry instrumentation layer, specifically in recordexception and related span-recording helpers, when the...