Search: development.we

CVE-2025-67732 is a high-severity vulnerability in langgenius' open-source LLM app development platform, Dify, affecting versions prior to 1.11.0. The issue involves exposure of the API key in plaintext on the frontend, allowing non-administrator users to access and reuse it without authorization. This can lead to unauthorized access to third-party services, potentially exhausting service quotas or causing service disruptions. The vulnerability requires no user interaction and can be exploited remotely with low complexity. The flaw impacts confidentiality by exposing sensitive credentials and could indirectly affect availability by depleting service quotas. The vendor fixed the issue in version 1.11.0 by removing API key exposure.

The EmEditor homepage download button was compromised and served malware to users for a period of four days. This incident involved the official download link being manipulated to deliver malicious payloads, potentially infecting users who attempted to download the software during that timeframe. Although no specific affected versions or malware details were disclosed, the attack represents a supply chain compromise risk. The threat was identified through Reddit InfoSec discussions and reported by hackread.com, but with minimal technical details and no known exploits in the wild. European organizations using EmEditor or downloading it during the affected period could have been exposed to malware infection, risking confidentiality and integrity of their systems. Mitigation requires verifying software integrity, using alternative trusted download sources, and monitoring for suspicious activity. Countries with higher EmEditor usage and strong software development sectors, such as Germany, France, and the UK, are more likely to be impacted. Given the ease of exploitation through a trusted website and the potential for malware infection, the severity is assessed as high despite limited technical details. Defenders should prioritize verifying downloads and enhancing endpoint detection capabilities.

Malware#infosecnews#redditGermany+5

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the avrc_vendor_msg() function of the ESP-IDF BlueDroid AVRCP stack, the allocated buffer size was validated using AVRC_MIN_CMD_LEN (20 bytes). However, the actual fixed header data written before the vendor payload exceeds this value. This totals 29 bytes written before p_msg->p_vendor_data is copied. Using the old AVRC_MIN_CMD_LEN could allow an out-of-bounds write if vendor_len approaches the buffer limit. For commands where vendor_len is large, the original buffer allocation may be insufficient, causing writes beyond the allocated memory. This can lead to memory corruption, crashes, or other undefined behavior. The overflow could be larger when assertions are disabled.

A critical vulnerability has been identified in the LangChain Core framework involving serialization injection that can expose sensitive secrets. This flaw allows an attacker to manipulate serialized data inputs, potentially leading to unauthorized access to confidential information. Although no known exploits are currently active in the wild, the vulnerability's critical severity indicates a high risk if weaponized. LangChain is widely used in AI and automation workflows, making this vulnerability particularly impactful for organizations leveraging these technologies. European organizations using LangChain in their AI pipelines or applications could face significant confidentiality breaches. Mitigation requires careful validation and sanitization of serialized inputs and monitoring for suspicious serialization activity. Countries with strong AI development sectors and high adoption of LangChain-based solutions are most at risk. Given the critical nature, ease of exploitation through serialization injection, and potential for widespread data exposure, this vulnerability demands immediate attention from defenders. No official patches or CVSS scores are currently available, underscoring the need for proactive defensive measures.

This threat concerns a method of CSRF (Cross-Site Request Forgery) protection that does not rely on traditional tokens or hidden form fields, as discussed in a recent blog post. CSRF attacks exploit the trust a web application has in a user's browser, causing unauthorized commands to be transmitted. The alternative CSRF protection approach aims to mitigate these attacks without using tokens, which are commonly used but can introduce complexity. While this method may simplify implementation, it requires careful consideration to ensure it does not weaken security. The threat is rated medium severity due to the potential for exploitation if the alternative protection is improperly implemented. No known exploits are currently in the wild, and the discussion level is minimal, indicating early-stage awareness. European organizations using web applications that adopt this novel CSRF protection approach should evaluate their security posture carefully. Mitigation involves thorough testing and validation of the alternative CSRF protection mechanism and maintaining defense-in-depth strategies. Countries with significant web development sectors and high adoption of modern web frameworks may be more impacted. Overall, defenders should be aware of this emerging approach and scrutinize its security implications before deployment.

News#netsec#redditGermany+9

A remote code execution (RCE) vulnerability was discovered in the CurseForge launcher involving an unauthenticated local WebSocket API accessible from the browser. This flaw allowed attackers to execute arbitrary code on the local machine without authentication. The vulnerability has been patched, and no known exploits are currently in the wild. The issue primarily affects users of the CurseForge launcher, a popular mod management tool for games. Due to its local nature and requirement for local access, exploitation complexity is moderate. European organizations using the CurseForge launcher, especially in gaming or software development sectors, could be impacted if the vulnerability is exploited. Mitigation involves applying the official patch promptly and restricting local WebSocket API access. Countries with significant gaming communities and software development industries, such as Germany, France, and the UK, are more likely to be affected. The severity is assessed as medium given the local attack vector and absence of authentication requirements but no remote network exploitation. Defenders should prioritize patching and monitor local WebSocket interfaces for unauthorized access attempts.

Vulnerability#netsec#redditGermany+2

CVE-2025-68696 is a high-severity Server-Side Request Forgery (SSRF) vulnerability affecting httparty versions 0.23.2 and earlier. This flaw allows attackers to make unauthorized requests from the vulnerable server to internal or external systems, potentially exposing sensitive data such as API keys. The vulnerability requires no authentication or user interaction and can be exploited remotely over the network. It has been patched in later versions of httparty. European organizations using vulnerable versions of httparty in their API integrations or web applications face risks of data leakage and internal network reconnaissance. No known exploits are currently reported in the wild, but the ease of exploitation and potential impact warrant immediate remediation. Organizations should upgrade to patched versions and audit internal API usage to mitigate risk. Countries with significant software development sectors and high adoption of Ruby-based tools, such as Germany, the UK, and France, are most likely to be affected.

EPSS 0.3%VulnerabilityCWE-918Germany+2

CVE-2025-14927 is a high-severity remote code execution vulnerability in Hugging Face Transformers version 4.57.0, specifically in the convert_config function. It arises from improper validation of user-supplied strings that are executed as Python code, enabling attackers to execute arbitrary code with the privileges of the current user. Exploitation requires user interaction, specifically converting a malicious checkpoint file. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS score of 7.8. There are no known exploits in the wild yet, but the risk is significant due to the widespread use of Hugging Face Transformers in AI and ML workflows. European organizations using this library in development or production environments are at risk, especially those in countries with strong AI sectors. Mitigation involves avoiding untrusted checkpoint files, applying patches once available, and implementing strict input validation and sandboxing.

CVE-2025-14920 is a high-severity remote code execution vulnerability in the Hugging Face Transformers library, specifically affecting the Perceiver model deserialization process. The flaw arises from improper validation of user-supplied model files, allowing deserialization of untrusted data. Exploitation requires user interaction, such as opening a malicious file or visiting a crafted webpage. Successful exploitation enables attackers to execute arbitrary code with the privileges of the current user. Although no known exploits are reported in the wild, the vulnerability poses significant risks to confidentiality, integrity, and availability. The vulnerability has a CVSS score of 7.8, reflecting its high impact and relatively low complexity to exploit. European organizations using Hugging Face Transformers in AI/ML workflows, especially those processing untrusted or external model files, are at risk. Mitigation involves strict validation of model inputs, restricting model file sources, and applying patches once available. Countries with strong AI development sectors and extensive use of open-source ML frameworks, such as Germany, France, and the UK, are most likely affected.

EPSS 0.4%VulnerabilityCWE-502Germany+2

CVE-2025-14926 is a high-severity code injection vulnerability in Hugging Face Transformers version 4.57.0, specifically in the convert_config function. It allows remote attackers to execute arbitrary Python code by supplying a malicious checkpoint configuration. Exploitation requires user interaction, as the target must convert a crafted checkpoint file. The vulnerability arises from improper validation of user-supplied strings before execution, enabling code execution with the privileges of the current user. Although no known exploits are currently in the wild, the impact on confidentiality, integrity, and availability is high. This vulnerability poses a significant risk to organizations using Hugging Face Transformers for machine learning model management or deployment. European organizations relying on this library, especially in AI research and development sectors, should prioritize patching or mitigating this issue. Countries with strong AI and tech industries, such as Germany, France, the UK, and the Netherlands, are likely to be most affected.

EPSS 0.3%VulnerabilityCWE-94Germany+3

CVE-2025-14921 is a high-severity remote code execution vulnerability in the Hugging Face Transformers library, specifically affecting the Transformer-XL model deserialization process. The flaw arises from improper validation of user-supplied model files, enabling deserialization of untrusted data. Exploitation requires user interaction, such as visiting a malicious webpage or opening a crafted file, allowing attackers to execute arbitrary code with the privileges of the current user. The vulnerability impacts confidentiality, integrity, and availability of affected systems. No known exploits are currently reported in the wild. European organizations using vulnerable versions of Hugging Face Transformers are at risk, especially those integrating Transformer-XL models in their AI workflows. Mitigation involves strict validation of model files, restricting model sources, and applying updates once patches become available. Countries with significant AI development and adoption, such as Germany, France, and the UK, are more likely to be affected due to higher usage of these tools.

EPSS 0.3%VulnerabilityCWE-502Germany+2

Interpol has led a coordinated international law enforcement operation resulting in the decryption of six ransomware strains and the arrest of hundreds of individuals involved in ransomware activities. This action disrupts multiple ransomware campaigns, providing victims with decryption tools and reducing the operational capabilities of cybercriminal groups. The operation highlights the ongoing global effort to combat ransomware threats through collaboration and intelligence sharing. European organizations may benefit from the availability of new decryption tools and reduced ransomware activity. However, the threat of ransomware remains significant, requiring continued vigilance and proactive defense measures. The arrests may temporarily disrupt ransomware operations but do not eliminate the risk entirely. Organizations should leverage threat intelligence updates and apply specific mitigations to reduce ransomware impact. Countries with high ransomware targeting and critical infrastructure are particularly relevant in this context. Overall, this development is a positive step but not a resolution to the ransomware problem.

Malware#infosecnews#redditGermany+9

The Lazarus Group, a well-known state-sponsored threat actor, has embedded a new variant of their BeaverTail malware into developer tools. This campaign involves supply chain compromise tactics targeting software development environments, potentially enabling stealthy espionage and data exfiltration. Although no known exploits in the wild have been reported yet, the medium severity rating reflects the risk posed by this malware variant's capabilities and the strategic targeting of developer tools. European organizations relying on affected developer tools could face risks to intellectual property, source code integrity, and operational continuity. Mitigation requires rigorous supply chain security, including verifying tool integrity, monitoring for anomalous behavior in development environments, and applying strict access controls. Countries with significant software development industries and critical infrastructure, such as Germany, France, the UK, and the Netherlands, are more likely to be targeted. Given the malware's stealth and potential impact on confidentiality and integrity without requiring user interaction, the suggested severity is high. Defenders should prioritize detection and prevention measures focused on developer toolchains to mitigate this emerging threat.

Campaign#infosecnews#redditGermany+6

Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS is installed with world-writable file permissions on sensitive application components, allowing any local user to replace legitimate files with malicious code. When another user launches the application, the malicious code executes with that user's privileges, enabling privilege escalation and unauthorized access to sensitive data. The fix is included starting from the `2.3.7` release.

Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS was configured with overly permissive security entitlements that could bypass macOS Hardened Runtime protections. This configuration allows attackers to inject malicious dynamic libraries into the application process, gaining access to all TCC (Transparency, Consent, and Control) permissions granted to the application. The fix is included starting from the `2.3.7 ` release.

Edge3 Worker RPC RCE on Airflow 2. This issue affects Apache Airflow Providers Edge3: before 2.0.0 - and only if you installed and configured it on Airflow 2. The Edge3 provider support in Airflow 2 has been always development-only and not officially released, however if you installed and configured Edge3 provider in Airflow 2, it implicitly enabled non-public (normally) API which was used to test Edge Provider in Airflow 2 during the development. This API allowed Dag author to perform Remote Code Execution in the webserver context, which Dag Author was not supposed to be able to do. If you installed and configured Edge3 provider for Airflow 2, you should uninstall it and migrate to Airflow 3. The new Edge3 provider versions (>=2.0.0) has minimum version of Airflow set to 3 and the RCE-prone Airflow 2 code is removed, so it should no longer be possible to use the Edge3 provider 2.0.0+ on Airflow 2. If you used Edge Provider in Airflow 3, you are not affected.

TruffleHog, a tool used for detecting secrets in code repositories, has enhanced its capabilities to detect JSON Web Tokens (JWTs) that use public-key signatures and verify their validity or 'liveness'. This update improves the detection of potentially exposed JWTs that could be used maliciously if leaked. While this is a security tool enhancement rather than a direct vulnerability or exploit, it highlights the ongoing risk of JWT exposure in codebases. The detection and verification help organizations identify and remediate exposed tokens before they can be exploited. There are no known exploits in the wild related to this update, and it does not directly introduce new vulnerabilities. European organizations using JWTs in their authentication or authorization systems could benefit from this improved detection to reduce risks associated with leaked tokens. Mitigation involves integrating TruffleHog or similar tools into CI/CD pipelines and secret scanning processes. Countries with significant software development sectors and cloud adoption, such as Germany, France, and the UK, are more likely to be impacted. The suggested severity of this issue is medium, given it is a detection improvement rather than a direct threat or vulnerability.

News#netsec#redditGermany+6

@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Prior to version 0.5.8, the `/__vite_rsc_findSourceMapURL` endpoint in `@vitejs/plugin-rsc` allows unauthenticated arbitrary file read during development mode. An attacker can read any file accessible to the Node.js process by sending a crafted HTTP request with a `file://` URL in the `filename` query parameter. Version 0.5.8 fixes the issue.

From open source libraries to AI-powered coding assistants, speed-driven development is introducing new third-party risks that threat actors are increasingly exploiting. The post From Open Source to OpenAI: The Evolution of Third-Party Risk appeared first on SecurityWeek .

News#rceGermany+5