compliance-trestle version 4.0.3 contains an SSRF allowlist bypass vulnerability in its URLSecurityValidator component. The validator attempts to block requests to loopback, link-local, and cloud metadata IP ranges but fails to properly normalize IPv4-mapped IPv6 addresses and does not block the IPv4 unspecified address 0.0.0.0. This allows crafted URLs using these address forms to bypass the validator and reach restricted internal services. The vulnerability affects workflows that fetch OSCAL artifacts referencing such URLs, potentially exposing internal network resources. The issue is fixed in compliance-trestle version 4.1.0.
The telebot-pro package on PyPI is a malicious library that, when instantiated, spawns a background thread to steal Telegram Desktop session data, decrypts local keys, and collects private media files from user directories. It also gathers host information such as hostname, local IP, and WiFi SSID. The stolen data is XOR-obfuscated and exfiltrated via a local HTTP relay to an attacker-controlled Telegram bot. The package name mimics a legitimate Telegram bot API library but performs unauthorized data theft unrelated to Telegram bot functionality.
The 'joule-btp-extension' PyPI package versions 0.1.0, 0.1.1, 0.1.3, 0.1.4, and 0.1.6 contain malicious code that executes during installation. The setup.py script collects sensitive system files and environment variables, reads user files, and exfiltrates this data to a hardcoded attacker URL. It also creates a marker file in the virtual environment's bin directory for persistence and includes code to establish a reverse shell, enabling remote command execution. The package is identified as a proof-of-concept supply-chain attack targeting SAP Joule Desktop on macOS but was publicly uploaded, posing a risk to users who install it.
The euler-sdk package version 1.0.0 on PyPI contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It appears to serve no legitimate purpose beyond this data exfiltration.
The morpho-sdk package version 1.0.0 on PyPI contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.
The dlmm-sdk package on PyPI version 1.0.0 contains malicious code that exfiltrates sensitive environment variables and credential files upon import and installation. It collects secrets related to cloud providers, cryptocurrencies, package registries, and configuration files such as SSH keys and cloud CLI settings. The stolen data is sent to a hardcoded external webhook endpoint. This behavior is disguised as environment diagnostics but is in fact unauthorized data theft.
The PyPI package 'dlmm' version 1.0.0 contains malicious code that exfiltrates basic information such as the host's IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. The package serves no legitimate purpose beyond this data exfiltration.
Feast versions prior to 0.67.0 contain a critical vulnerability due to unsafe deserialization of user-defined functions (UDFs) serialized with the 'dill' library. This flaw allows unauthenticated remote attackers to execute arbitrary code on the feature server under default configurations. Authenticated attackers can also bypass authorization checks to achieve arbitrary code execution on the registry server. The vulnerability enables cross-tenant data access and lateral movement within the system. A fix is available in version 0.67.0.
The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-yandex 4.5.1 or later, which refuses the team-agnostic fall-through for an id that could name a team namespace.
The chaintest package on PyPI version 0.1.0 contains malicious code functioning as a cryptocurrency infostealer. It exfiltrates sensitive data from browsers, including cryptowallet extensions and local storage, as well as standalone applications like password managers and cryptowallets. The malware achieves persistence on different platforms, runs a keylogger that alters copied cryptocurrency addresses to attacker-controlled ones, and can execute remote commands from a command-and-control server. It also exfiltrates SSH keys, installs malicious browser extensions, and shares similarities with a known DPRK-linked campaign.
Keras versions prior to 3.15.0 contain a denial of service vulnerability when loading malicious .keras model files. The flaw arises from the lack of validation on dataset shapes and sizes during model loading, which can lead to unbounded memory allocation and out-of-memory crashes. This vulnerability allows attackers to cause the process to terminate by exhausting system memory. The issue affects machine learning pipelines that load untrusted models and bypasses previous fixes for related vulnerabilities. A patch is available in version 3.15.0.
The pytablute package version 1.0.3 on PyPI contains malicious code that executes upon import or use. This code downloads a secondary malicious script and runs a background process that periodically connects to a remote host to receive and execute further commands. The package is obfuscated and designed to execute remote commands on the victim's machine, indicating clear malicious intent.
The PyPI package 'btcflx' version 0.1.0 is a malicious library that, upon import, searches for Monero cryptocurrency wallet directories on the user's system, terminates related processes to unlock files, archives the wallet data, and exfiltrates it to a hardcoded Telegram bot. The package disguises itself as an HTTP speed-up library, misleading users about its true intent. It also sends status messages about the wallet discovery to the same Telegram bot. This behavior constitutes clear malicious activity aimed at stealing cryptocurrency wallet data.
The PyPI package 'btcflip' version 0.1.0 is a malicious library that, upon import, archives the user's Monero cryptocurrency wallet directory and exfiltrates it to a hardcoded Telegram bot. The package disguises itself as an HTTP speed-up library but contains code that terminates Monero-related processes to release file locks before stealing wallet files. The exfiltration target and wallet paths are obfuscated using base64 encoding. This behavior occurs immediately when the package is imported, making any use of the package a direct compromise of Monero wallet security.
The kotoraka package on PyPI is a malicious package that, upon import, exfiltrates cryptocurrency wallet files from the user's system. It targets Monero wallet directories, terminates related processes to release file locks, archives the wallet data, and uploads it to a Telegram bot using hardcoded credentials. The package falsely declares itself as an HTTP speed-up library, but its actual behavior is data theft triggered immediately on import without user interaction.
The kotanku package on PyPI version 0.1.0 contains malicious code that exfiltrates cryptocurrency wallet files during import. This behavior is part of a campaign identified as 2026-08-kotanku, which uses a Telegram bot for exfiltration. No official patch or remediation guidance is provided. There is no evidence of active exploitation in the wild at this time.
The PyPI package 'cubesat-upstream-driver' version 1.0.1 is a malicious package that masquerades as an upstream driver interface for cubesat orbital command bus but contains no actual driver or telemetry code. Instead, it defines a function that reads sensitive files and environment variables potentially containing secrets or flags, caching and exposing them via its public API. The package does not exfiltrate data by itself but appears designed to harvest secrets for external retrieval. It is likely used in a pentest or CTF-like scenario with low direct harm but poses a risk of secret leakage if integrated into a project.
The PyPI package 'riakcs' versions 0.0.1 and 0.5.0 contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. The package has no legitimate purpose beyond this data exfiltration.
PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization failures that together break workspace isolation. The service layer for issues and projects performs global primary-key lookups without checking workspace ownership, so any authenticated user can read, modify, and delete resources in any workspace just by swapping UUIDs in their API requests. On top of that, every member management endpoint (add, update role, remove) only requires `min_role="member"`, which lets any workspace member promote themselves to owner and kick out the original owner. A low-privilege member of one workspace can steal data from every other workspace and take over any workspace they belong to. Both issues come from the same gap: the route layer pulls `workspace_id` from the URL and verifies membership, but the service layer ignores the workspace scope for resource lookups and ignores the caller's role level for member operations. The `require_workspace_member()` dependency does its job correctly. The problem is that the service layer doesn't use the information it provides. Version 0.1.4 of the PraisonAI Platform API patch the issue.
pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause large memory consumption when pypdf/_cmap.py function parse_bfrange parses unusually large source-code or destination-string tokens in a font /ToUnicode CMap during text extraction. This issue is fixed in 6.15.0.