Threats affecting pkg:brew/gptline

NLTK versions prior to 3.9.3 contain an eval injection vulnerability in the nltk.collocations module. This flaw allows attackers controlling command-line arguments to execute arbitrary Python code by passing unsanitized input to eval() in the __main__ block of collocations.py. The vulnerability arises because command-line arguments are used as suffixes of BigramAssocMeasures without validation, enabling escape from intended attribute lookups and execution of OS commands via the os module. A patch is available to address this issue.

These are all security issues fixed in the python311-nltk-3.10.0rc1-1.1 package on the GA media of openSUSE Tumbleweed.

A vulnerability in the lxml library used by recon-ng allows XML External Entity (XXE) attacks via the default configuration of iterparse() and ETCompatXMLParser(). This enables untrusted XML input to read local files. The issue is addressed in lxml 6.1.0 by changing the default resolve_entities setting to 'internal', preventing local file access. Users can also mitigate by explicitly setting resolve_entities to 'internal' or false.