---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (004770b4da0c6705f95ef2c8654fd81d37650ffacaad7160041bded02cdb7fbc)
httpz-requests exposes a Telegram bot (`start_bot`, `run_cmd_enc`, `http_request`) whose message handler executes arbitrary shell commands on the host running the package, granting a remote Telegram operator full command execution under the installer's user account. Documented remote commands include arbitrary shell execution (`chalao`, `.sh <command>`, `.py <file>`, `.exec <file>`), destructive filesystem operations (`rm -rf <path>`), single- and bulk-file exfiltration (`take <file>`, `take all`), a full-host backup mode that produces split 50MB archives with `.partNNN` chunking (`get all`), and environment-variable dumping (`.printenv`) — collectively enabling remote theft of filesystem contents and process-environment secrets (cloud, CI, and API credentials). The package is shipped only as compiled Cython `.so` files with no Python source, and self-describes obfuscation features that XOR+base64-encode command strings and disguise execution as `http_request("POST",...)` so plaintext commands do not appear in `ps` or system logs; the Telegram bot token is stored encoded and decoded at runtime by `dec()`. The distribution name `httpz-requests` and import name `httpz_requests` resemble the top-100 PyPI package `requests` while presenting a Telegram remote-shell API instead of an HTTP client, and metadata is unfilled boilerplate (author `Aapka Naam <you@example.com>`, homepage `https://github.com/YOUR_GITHUB_USERNAME/httpz-requests`).
## Source: kam193 (38eff923106836997e28de6d7173a1553da126be230b341fe64f0c4c215769a2)
The package provides Telegram-based remote access to the machine it runs on. It was deliberately created and used to hack other machines, exfiltrate files and credentials. This package automatically ensures persistence and starts a malicious process on import.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-08-httpz-requests
Reasons (based on the campaign):
- files-exfiltration
- rat
- persistence
- uses-telegram-bot
- obfuscation
- native-extension
CVE-2026-68520 is a medium severity vulnerability in the open-source system monitoring tool Glances. Versions prior to 4.5.6 have a flaw in the as_dict_secure() function in glances/config.py, which insufficiently checks option names and inadvertently exposes sensitive information such as public_username and credentials embedded in public_api values. This exposure occurs via unauthenticated GET requests to /api/4/config and /api/4/config/ip endpoints. The issue has been fixed in version 4.5.6.
CVE-2026-68519 is an OS command injection vulnerability in the open-source monitoring tool Glances. Versions prior to 4.5.6 allow execution of shell commands with operators such as redirection, chaining, or pipes when an alert triggers, due to improper handling of the --disable-config-exec flag in GlancesActions.run(). This issue is resolved in version 4.5.6.
CVE-2026-62982 is a high-severity OS command injection vulnerability in the open-source monitoring tool Glances. Versions from 4.5.2 up to but not including 4.5.6 improperly sanitize nested list and dictionary strings in process command line values, allowing malicious pipe characters to be executed via administrator-configured action templates. This flaw is fixed in version 4.5.6.
CVE-2026-68517 is a medium severity vulnerability in the open-source system monitoring tool Glances. Versions prior to 4.5.6 have a permissive cross-domain policy issue in the RESTful API implementation. The vulnerability arises because the CORS origins guard uses exact list equality instead of wildcard membership, allowing a multi-origin list containing a wildcard to retain credentials and expose authenticated API data to untrusted websites. This issue is fixed in version 4.5.6.
CVE-2026-71486 is a medium severity vulnerability in vllm-project vllm versions prior to 0.26.0. It affects the /v1/completions/derender and /v1/chat/completions/derender API endpoints, which accept client-supplied generated output data without enforcing limits on token counts or response sizes. This allows an authenticated API client to cause uncontrolled CPU and memory consumption proportional to the size of the attacker-supplied token data, bypassing normal generation output bounds.
CVE-2026-71491 is a high-severity vulnerability in the Python sqlparse module prior to version 0.6.0. The issue involves uncontrolled resource consumption due to the group_comments function repeatedly rescanning comment-only SQL statements, leading to quadratic CPU usage during parsing and formatting operations. This vulnerability can cause significant performance degradation when processing certain SQL inputs. The issue is fixed in sqlparse version 0.6.0.
CVE-2026-59893 is a high-severity vulnerability in the Python sqlparse module prior to version 0.6.0. The issue involves inefficient regular expression complexity causing quadratic CPU consumption when parsing certain SQL constructs such as unmatched dollar-quoted literals and multiline comments. This can lead to denial of service through excessive CPU usage. The vulnerability is fixed in sqlparse version 0.6.0.
CVE-2026-59894 is a code injection vulnerability in the Python sqlparse module prior to version 0.6.0. The issue occurs in sqlparse/filters/output.py where backslashes before quotes are not properly escaped when using output_format='python' or 'php'. This allows crafted SQL input to terminate the generated string and inject arbitrary Python or PHP code if the generated source is executed or imported downstream. The vulnerability is fixed in version 0.6.0.
CVE-2026-54284 is a high-severity vulnerability in the Python sqlparse module prior to version 0.6.0. The issue arises from inefficient algorithmic complexity during TokenList construction and string conversion, causing quadratic CPU consumption when using sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This inefficiency is due to repeatedly flattening nested token subtrees. The vulnerability is fixed in sqlparse version 0.6.0.
compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the `-o/--output` argument in `trestle author jinja` allows writing files outside the intended workspace. The application does not properly validate, `../`, `..\`, or absolute paths. This allows arbitrary file write to attacker-controlled locations. Versions 3.12.3 and 4.0.3 patch the issue.
CVE-2026-68518 is an OS command injection vulnerability in the open-source system monitoring tool Glances. Versions prior to 4.5.6 improperly sanitize Mustache template variables, allowing attackers to reconstruct shell operators that are executed by the secure_popen() function. This flaw is fixed in version 4.5.6.
The kb-ai package on PyPI contains malicious code that, upon import, starts a background thread to collect system identifiers and sends them to a hardcoded Azure endpoint without user consent. This behavior is described in the package comments as a supply-chain proof-of-concept demonstrating a dependency confusion attack. The package also overrides the install command to execute malicious code during installation. The affected versions are 0.1.0 and 0.1.1.
ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior to 1.0.3, the /admin/gateways/test call site in mcpgateway/admin.py calls validate_gateway_test_url() in mcpgateway/common/validators.py to resolve and reject private, loopback, link-local, and cloud-metadata addresses, but ResilientHttpClient later resolves the original hostname again without binding the validated address. When MCPGATEWAY_ADMIN_API_ENABLED is enabled, an attacker with a database-backed role containing explicit gateways.read permission can use DNS rebinding to return a public address during validation and a private or metadata address during connection, bypassing ssrf_blocked_networks and ssrf_dns_fail_closed because those controls apply only to the validation-time result. The endpoint's allow_admin_bypass=False setting means a bootstrap-only virtual platform-admin identity without a database role is not sufficient. Successful exploitation can reach internal services and cloud metadata, expose cloud credentials, access internal APIs, or probe internal network ports. This issue is fixed in version 1.0.3.
Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's put_file resolved a transfer's destination to a path on the jail host ( + ) and ran mkdir -p and mv there as root on the host. Those commands follow symbolic links, and the path was operated on outside the jail, so a symlink existing inside the jail was followed by the host-side, root-privileged mv. A party controlling content inside a managed jail (the jail's root, or any process able to create a symlink in a directory an Ansible task later writes to) can therefore cause an arbitrary root-owned write on the host, outside the jail — a full jail escape. Arbitrary root-owned host writes are readily escalated to host compromise (e.g. cron, rc.d, authorized_keys). Preconditions for this vulnerability are that the operator runs a copy/template/fetch-style task (anything using put_file) against the jail, and the attacker can place a symlink inside the jail at or above the task's destination before the transfer runs. This issue has been fixed in version 2.0.0.
A denial of service vulnerability exists in the pyasn1 library's BER/CER/DER decoders and encoders when processing OBJECT IDENTIFIER and RELATIVE-OID values. The vulnerability arises from quadratic time complexity relative to the number of arcs in these values, allowing crafted payloads with many arcs to consume excessive CPU time. This affects applications decoding untrusted ASN.1 data such as certificates, LDAP, SNMP, and Kerberos. The issue is fixed in pyasn1 version 0.6.4, which improves the processing to linear time. Users should upgrade to this version or later to mitigate the risk.
Authlib's OAuth 2.0 authorization endpoint in kimi-cli versions prior to 1.6.10, certain 1.7.x versions, and some 2.x versions contains an open redirect vulnerability. This occurs when an unsupported response_type is used along with an attacker-controlled redirect_uri, allowing redirection without client validation or user authentication. The flaw exists because the server returns a redirect response to the supplied redirect_uri before validating the client or redirect URI. This vulnerability has a CVSS score of 5.4 (medium severity) and affects multiple versions as specified. A patch is available to address this issue.
The NLTK FramenetCorpusReader.frame() method contains a path traversal vulnerability that allows an attacker to read arbitrary XML files outside the intended corpus root directory. This occurs because the method constructs file paths from user-supplied frame names without proper containment checks and bypasses the nltk.pathsec sandbox enforcement. The vulnerability affects versions prior to 3.10.0 and certain 1.0.8 versions. A proof-of-concept demonstrates that an attacker can read sensitive XML files outside the corpus root despite strict sandbox enforcement. The vulnerability has a CVSS score of 7.5 (high severity) and a patch is available.
A path traversal vulnerability in the Natural Language Toolkit (NLTK) component NKJPCorpusReader allows an attacker to read arbitrary files outside the intended corpus root directory. This occurs because NKJPCorpusReader constructs file paths via unsafe string concatenation and uses the builtin open() function directly, bypassing NLTK's pathsec sandbox protections even when strict enforcement mode (ENFORCE=True) is enabled. The vulnerability was confirmed in NLTK version 3.9.4 and the current development branch. An attacker controlling the fileids argument can exploit this to read sensitive files outside the corpus root.
CVE-2026-12061 is a Regular Expression Denial of Service (ReDoS) vulnerability in the Natural Language Toolkit (NLTK) ReviewsCorpusReader component used by the gptline product. The vulnerability arises from an unbounded greedy regex pattern in the FEATURES regex, which extracts feature annotations from review lines. When processing a long bracket-less line, the regex causes quadratic backtracking, leading to excessive CPU consumption and hanging the processing thread. This can be exploited by an attacker supplying a crafted review line to cause denial of service without requiring authentication or privileges. A patch is available that bounds the regex to prevent the quadratic behavior while preserving correct extraction on legitimate input.