vLLM versions after 0.24.0 and before 0.31.0 have a memory exhaustion vulnerability in the MOSS-Audio model serving component. This flaw arises because the system caches a processor for every distinct mm_processor_kwargs value in an unbounded dictionary. Unauthenticated attackers can exploit this by sending distinct or oversized mel_config values to the /tokenize endpoint, bypassing API key protections, leading to host memory exhaustion and crashing the API process. The vulnerability is fixed in version 0.31.0.
A command injection vulnerability exists in the virtualenv tool for Python prior to version 21.14.4. The issue arises from improper escaping of environment names in the bash activate script, which zsh also sources. This allows an attacker to execute arbitrary commands in the user's shell prompt when using zsh with PROMPT_SUBST enabled. The vulnerability is fixed in version 21.14.4.
CVE-2026-113776 is an OS command injection vulnerability in pypa virtualenv versions from 20.26.6 up to but not including 21.14.2. The issue arises from the way ViaTemplateActivator.instantiate_template() replaces placeholders in activation templates, allowing crafted values in environment paths or prompts to break out of quoting and execute arbitrary commands when activating the environment. This affects activation scripts for bash, fish, xonsh, and activate_this.py. The vulnerability is fixed in version 21.14.2.
A command injection vulnerability exists in pypa virtualenv versions prior to 21.14.2. The issue arises because FishActivator inherits a quoting method that uses POSIX shlex.quote(), which is incompatible with the fish shell's interpretation of backslashes and single quotes. An attacker can craft environment variables such as the path, --prompt, or VIRTUALENV_PROMPT containing a backslash before a quote to break out of the fish literal and execute arbitrary commands when the user sources activate.fish. This vulnerability is fixed in version 21.14.2.
A path traversal vulnerability (CWE-22) exists in djust versions from 0.9.0 up to but not including 1.0.10, 1.1.0 up to 1.1.7, 1.2.0.dev0 up to 1.2.4, and 1.3.0.dev0 up to 1.3.0rc8. The vulnerability occurs in the find_handlers_for_template MCP tool, which accepts an absolute template path and reads files without restricting access to the project or configured template directories. This allows a local MCP client to use the tool as a file existence and readability oracle and extract certain substrings from readable files. The issue is fixed in versions 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8.
The hijok-lampam package on PyPI is identified as malicious due to its use of fake HTTP-downloaded dependencies intended to track downloads. It serves no legitimate purpose beyond this tracking behavior and is associated with dependency confusion tactics. The package version 1.0.0 is affected. There is no evidence of active exploitation in the wild.
The trijigo-kalip package on PyPI version 1.0.0 contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It appears to be a low-risk package resembling pentest or research tools but with a hidden data exfiltration purpose.
Pillow's EPS image loader allows Ghostscript to render images at a scaled size that exceeds Pillow's decompression bomb limit. This occurs because the decompression bomb check is only applied to the unscaled image size declared in the EPS file, not the scaled size requested by the application. As a result, an attacker can cause Ghostscript to generate very large temporary files, consuming excessive disk space and CPU resources. The vulnerability affects Pillow versions from 2.3.0 up to but not including 13.0.0. A patch is available to address this issue.
The PyPI package 'jiklpo-tsunari-kay' version 1.0.0 is identified as containing malicious code that uses fake HTTP-downloaded dependencies to track downloads. The package appears to have no legitimate purpose beyond this tracking behavior. It is categorized as a low-harm potential package, resembling typical pentest or research tools but with malicious intent related to dependency confusion.
The hijiko-pilaka package on PyPI is identified as malicious due to its use of fake HTTP-downloaded dependencies designed to track downloads. It serves no legitimate purpose beyond this tracking behavior.
The PyPI package 'facewareretargeter' is identified as malicious due to its use of fake HTTP-downloaded dependencies designed to track downloads without any legitimate purpose. It appears to be a dependency confusion attack vector, masquerading as a typical pentest or research package but with low direct harm potential.
CVE-2026-113725 is an OS command injection vulnerability in the bash activate script of pypa virtualenv versions prior to 21.14.7. The vulnerability arises because the environment name used in the PS1 prompt is not properly escaped for both passes bash makes over PS1, allowing specially crafted environment names containing backslash and command substitution sequences to execute arbitrary commands in the user's shell. This affects users who source the activate script of an environment with an attacker-controlled name. The issue is fixed in version 21.14.7.
The uv software versions before 0.13.4 include a bundled CA root certificate 'emSign ECC Root CA - G3' whose intermediate CA keys have been compromised. This allows an attacker with access to these keys to issue fraudulent certificates trusted by uv, enabling potential man-in-the-middle (MITM) attacks. Version 0.13.4 removes this root from the trusted bundle, mitigating the risk.
Certifi versions before 2026.10.18 include the emSign ECC Root CA - G3 root certificate, whose eight eMudhra intermediate CA certificates have compromised private keys and have been revoked. An attacker with these keys can issue valid-looking certificates for any hostname, potentially intercepting or modifying TLS traffic for clients trusting the certifi bundle, including popular Python tools. Certifi 2026.10.18 removed all emSign roots, and 2026.10.19 restored only unaffected emSign roots. Users should upgrade to 2026.10.19 or later and rebuild container images that include certifi.
The semvver package on PyPI version 1.0.0 contains malicious code that downloads and executes a remote binary during installation. The setup.py script fetches an executable from a Cloudflare Workers domain without verification and runs it as a detached background process, enabling arbitrary code execution on the installer's system. The package itself has no legitimate functionality, indicating it is a typosquatting malware dropper.
The 'semveer' package on PyPI is a malicious typosquatting package that downloads and executes malware during installation. It uses a setup.py install hook to fetch a remote payload from an unrelated host without verification and runs it as a detached process. The package name closely mimics the legitimate 'semver' package, aiming to trick users into installing it.
The semmver package on PyPI is a typosquatting malicious package that executes attacker-controlled code during installation. Its setup.py downloads and runs an unverified binary from a suspicious external URL, leading to remote code execution on the installer's machine.
The semverr package on PyPI is a malicious typosquatting package that executes malware during installation. It downloads an unverified binary from an anonymous Cloudflare Workers URL and runs it silently on the victim's system. The package has no legitimate functionality and is designed to evade detection by swallowing errors during the download and execution process.
The PyPI package 'research-probe-6150c1c915' version 0.1.0 contains malicious code that automatically executes on every Python interpreter startup via a .pth file. This code collects environment variables, enumerates process command lines, and queries Google Cloud Platform (GCP) instance metadata endpoints to harvest service account OAuth tokens and other sensitive credential material. The collected data is stored in world-readable locations on the local filesystem, enabling any local user to access potentially sensitive cloud credentials. This behavior indicates reconnaissance and credential exfiltration activity targeting cloud environments.
The pafex package on PyPI version 2.3 is part of a malicious campaign involving embedded pickle files that execute arbitrary code during unpickling. This leads to persistence via a PTH file and downloads further payloads, although the final payload analyzed was a stub. The package is used as a dependency to deliver malicious code that can execute remote commands and exfiltrate files.