Incorrect Type Conversion or Cast

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Incorrect Type Conversion or Cast via missing validation of multimodal data in the scale-out entrypoint's protocol.py before engine handoff. An...

Improper Handling of Exceptional Conditions

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions via validatetokens in the structured output backend, when a request carrying invalid structured-output...

Authorization Bypass Through User-Controlled Key

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in flashlateinteractionencodequeries and flashlateinteractionencodedocs in...

Uncaught Exception

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Uncaught Exception via the cachesalt parameter in request protocol handlers across multiple entrypoints chat completion, completion, responses,...

Inefficient Algorithmic Complexity

Overview smol-toml is an A small, fast, and correct TOML parser/serializer Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the parseKey function in src/struct.ts, which used the regular expression KEYPARTRE /^a-zA-Z0-9-+ \t$/ to validate bare key...

Arbitrary Argument Injection

Overview nx is a The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration. Affected versions of this package are vulnerable to Arbitrary Argument Injection via unsanitized git revision arguments passed to shell-interpolated execSync calls...

Arbitrary Argument Injection

Overview org.webjars.npm:nx is a The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration. Affected versions of this package are vulnerable to Arbitrary Argument Injection via unsanitized git revision arguments passed to shell-interpolate...

Denial of Service (DoS)

Overview docling is a SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Denial of Service DoS via oversized rowspan/colspan values in table cell...

Denial of Service (DoS)

Overview docling-slim is a Modular version of the Docling package: SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Denial of Service DoS via...

Files or Directories Accessible to External Parties

Overview docling-slim is a Modular version of the Docling package: SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Files or Directories...

Files or Directories Accessible to External Parties

Overview docling is a SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties via the HTML render...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview docling is a SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview docling-slim is a Modular version of the Docling package: SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Improper Handling of Highly...

Directory Traversal

Overview docling is a SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Directory Traversal via the imagereffromodfimage function in...

External Control of File Name or Path

Overview docling-slim is a Modular version of the Docling package: SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to External Control of File Na...

External Control of File Name or Path

Overview docling is a SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to External Control of File Name or Path via the DoclingJSONBackend when...

Exposure of Resource to Wrong Sphere

Overview docling is a SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere via the KserveV2OcrModel class in...

Exposure of Resource to Wrong Sphere

Overview docling-slim is a Modular version of the Docling package: SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Exposure of Resource to Wro...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the collectLocalPaths function in bake/entitlements.go, which did not resolve local OCI layout context paths and collected read-only secret paths from secret.FilePath rather than the resolved source, so neither...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the collectLocalPaths function in bake/entitlements.go, which did not resolve local OCI layout context paths and collected read-only secret paths from secret.FilePath rather than the resolved source, so neither...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection in the GridFS component due to improper neutralization of special elements in query logic. An attacker can access file content beyond the intended target, delete all file chunks in a bucket, or rename unintended files by...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index through malformed LLB op validation in the solver’s SourceOp and DiffOp handling. An attacker can crash buildkitd by submitting a crafted LLB definition with an input/dependency count mismatch. The...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index through malformed LLB op validation in the solver’s SourceOp and DiffOp handling. An attacker can crash buildkitd by submitting a crafted LLB definition with an input/dependency count mismatch. The...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition in the containerd and runc executor run paths. An attacker can make a build succeed, block cleanup, or leave cleanup operating outside the intended rootfs by mutating the injected CA bundl...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index through malformed LLB op validation in the solver’s SourceOp and DiffOp handling. An attacker can crash buildkitd by submitting a crafted LLB definition with an input/dependency count mismatch. The...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index through malformed LLB op validation in the solver’s SourceOp and DiffOp handling. An attacker can crash buildkitd by submitting a crafted LLB definition with an input/dependency count mismatch. The...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition in the containerd and runc executor run paths. An attacker can make a build succeed, block cleanup, or leave cleanup operating outside the intended rootfs by mutating the injected CA bundl...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition in the containerd and runc executor run paths. An attacker can make a build succeed, block cleanup, or leave cleanup operating outside the intended rootfs by mutating the injected CA bundl...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition in the containerd and runc executor run paths. An attacker can make a build succeed, block cleanup, or leave cleanup operating outside the intended rootfs by mutating the injected CA bundl...

Improper Encoding or Escaping of Output

Overview @vue/server-renderer is a @vue/server-renderer Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via isSSRSafeAttrName in packages/shared/src/domAttrConfig.ts, which fails to reject carriage return \r, U+000D characters in attribute names during...

Improper Encoding or Escaping of Output

Overview @vue/server-renderer is a @vue/server-renderer Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via isSSRSafeAttrName in packages/shared/src/domAttrConfig.ts, which fails to reject carriage return \r, U+000D characters in attribute names during...

Directory Traversal

Overview docling is a SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Directory Traversal via the TectonicEngine class in...

Directory Traversal

Overview docling-slim is a Modular version of the Docling package: SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Directory Traversal via the...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview docling is a SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via the HTML backend's...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview docling-slim is a Modular version of the Docling package: SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Time-of-check Time-of-use...

Insertion of Sensitive Information Into Sent Data

Overview docling-slim is a Modular version of the Docling package: SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Insertion of Sensitive...

Insertion of Sensitive Information Into Sent Data

Overview docling is a SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the HTML backend's...

Incorrect Behavior Order

Overview docling-slim is a Modular version of the Docling package: SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Incorrect Behavior Order vi...

Incorrect Behavior Order

Overview docling is a SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Incorrect Behavior Order via loadfromplugins in...

Incorrect Behavior Order: Validate Before Canonicalize

Overview Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize through the Source.Identifier path in source/git/source.go and source/git/identifier.go. An attacker can make a build appear to use a different Git remote URL than the one in the...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via the ReadFile, openUserFile, readRegularFile, and BuildOp.Exec paths in cache/util/fsutil.go, executor/oci/user.go, exporter/attestation/.go, and solver/llbsolver/ops/.go. An attacke...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via the ReadFile, openUserFile, readRegularFile, and BuildOp.Exec paths in cache/util/fsutil.go, executor/oci/user.go, exporter/attestation/.go, and solver/llbsolver/ops/.go. An attacke...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via the ReadFile, openUserFile, readRegularFile, and BuildOp.Exec paths in cache/util/fsutil.go, executor/oci/user.go, exporter/attestation/.go, and solver/llbsolver/ops/.go. An attacke...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via the ReadFile, openUserFile, readRegularFile, and BuildOp.Exec paths in cache/util/fsutil.go, executor/oci/user.go, exporter/attestation/.go, and solver/llbsolver/ops/.go. An attacke...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index due to missing MergeOp input-count validation in the solver/llbsolver/ops merge processing path. An attacker can crash buildkitd by supplying a crafted LLB definition with a malformed MergeOp whose inn...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value due to unbounded file reads in ReadEntrypoint, dockerIgnorePatterns, and NamedContext.load in frontend/dockerui/config.go and frontend/dockerui/namedcontext.go. An attacker can exhaust buildki...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value due to unbounded file reads in ReadEntrypoint, dockerIgnorePatterns, and NamedContext.load in frontend/dockerui/config.go and frontend/dockerui/namedcontext.go. An attacker can exhaust buildki...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value via the Snapshot process in source/containerblob/pull.go. An authenticated client with raw LLB access can upload or reference registry or OCI layout blob data that does not match the claimed...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference due to the ValidateEntitlements function in solver/llbsolver/vertex.go. An attacker can panic the daemon by submitting a build that requests CDI devices when the daemon is started with --cdi-disabled or equivale...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value via unvalidated image layer DiffIDs through the setBlob and snapshot identity handling in cache/blobs.go, cache/metadata.go, and cache/refs.go. An attacker can cause a later build to mount...