Threats tagged 'pypi'

Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.109, `AuthInjectionMiddleware.dispatch()` at `http_auth_integration.py:272` unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a `401` response, allowing any network-reachable caller to invoke MCP tools without authentication. When no per-request credential is present, tool handlers fall back to the `META_ACCESS_TOKEN` environment variable, and when the downstream Meta Graph API call fails, `api.py:263–269` serialises the raw `httpx` request URL—including the operator's `access_token` as a query parameter—into the JSON-RPC response body, delivering the credential to the unauthenticated caller. Version 1.0.109 fixes the issue.

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/_font.py function Font._collect_cid_character_widths expands unusually large CID font /W width ranges or excessive width entries during text extraction. This issue is fixed in 6.15.0.

The atlas-internal PyPI package version 1.8.1 contains malicious code that executes during installation. The setup.py script overrides the egg_info command to automatically run code that collects the installer's hostname, current working directory, and OS username. This information is URL-encoded and sent via an HTTP GET request to an attacker-controlled out-of-band server. The package has no legitimate functionality beyond this data exfiltration behavior.

GitPython versions up to 3.1.57 contain a vulnerability where the unsafe git option guard can be bypassed by using the split_single_char_options=False flag combined with a single-character keyword argument. This allows an attacker to smuggle a short option token that leads to arbitrary OS command execution via the git --upload-pack option. The vulnerability affects all guarded methods that forward kwargs and occurs despite the default allow_unsafe_options=False setting. A patch is available to fix this issue.

GitPython versions up to 3.1.57 contain a vulnerability in the config option name validation that allows injection of arbitrary git configuration directives. This occurs because the validator does not reject characters such as '=', '#', or whitespace in option names, enabling attackers to forge directives like core.sshCommand or core.hooksPath. Exploitation can lead to remote code execution on subsequent git operations. A patch is available to address this issue.

GitPython versions prior to 3.1.58 contain a vulnerability where an attacker-controlled submodule name in a cloned repository's .gitmodules file can cause GitPython to create and initialize a Git repository outside the intended working directory. This occurs because GitPython does not validate the submodule name, allowing directory traversal sequences that lead to repository creation at arbitrary filesystem paths during submodule initialization.

GitPython versions prior to 3.1.58 contain a vulnerability in the IndexFile.remove() and Head.checkout() methods. These methods forward arbitrary keyword arguments into git rm and git checkout commands without proper validation. When used with the --pathspec-from-file and --pathspec-file-nul options, this allows an attacker to cause Git to treat the entire contents of a chosen file as a pathspec, leading to the file's contents being leaked in error messages. This results in an arbitrary file read vulnerability disclosed through GitCommandError.stderr.

GitPython versions up to 3.1.57 have a vulnerability in the Repo.init() method where unsafe git options are forwarded without validation. Specifically, the --template option can be exploited by an attacker to plant malicious git hooks that execute arbitrary code during subsequent git operations. This occurs because Repo.init() directly passes kwargs to git init without checking for unsafe options, unlike the clone path which has protections. Exploitation requires the attacker to control the template directory and stage executable hooks. A fix is available that adds unsafe option checks to Repo.init().

GitPython versions up to 3.1.57 contain a vulnerability in the IndexFile.from_tree, reset, and merge_tree methods where unguarded forwarding of git read-tree options allows an attacker to overwrite arbitrary files. The flaw arises because these methods append caller-controlled treeish strings to git read-tree commands without proper unsafe option checks or separators, enabling injection of the --index-output option to specify arbitrary file paths. This leads to arbitrary file overwrite with a valid git-index blob, potentially destroying or corrupting files accessible by the host process.

The cdktn-provider-azurerm package on PyPI is a malicious package impersonating the legitimate HashiCorp cdktf-provider-azurerm by using a single-character substitution in its name and mimicking branding. It forces installation of a malicious base package 'cdktn' that executes attacker-controlled code during import, potentially compromising the installer's Python environment. This package version 17.0.0 is affected. There is no CVSS score or known exploits in the wild reported.

The PyPI package 'speed-hashes' version 0.1.0 is a malicious typosquatting package that executes attacker-controlled code during installation. Its setup.py overrides the install command to decode and execute obfuscated Python code which downloads a remote binary from an untrusted GitHub repository, executes it detached, and exfiltrates cryptocurrency wallet data. This results in remote code execution on the installer's host and potential data theft.

The fast-hashes package version 0.1.0 on PyPI contains malicious code that executes during installation. The setup.py file overrides the install command to decode and execute a base64-encoded payload, which downloads and runs an unverified binary from a third-party GitHub repository. This behavior enables arbitrary code execution on the installer's host. The package is a typosquatting attempt mimicking a popular library and is designed to exfiltrate cryptocurrency wallet data and potentially other sensitive information.

The PyPI package 'idnna' is a malicious typosquatting package impersonating the popular 'idna' library. During installation, it executes obfuscated code that downloads and runs a remote binary from an unrelated GitHub repository. This binary is executed with elevated permissions and is reported to exfiltrate cryptocurrency wallet data and potentially other sensitive information. The malicious behavior triggers automatically upon 'pip install' of affected versions.

The pydanticc package on PyPI is a malicious typosquat of the popular pydantic library. During installation, it executes obfuscated code that downloads and runs a remote executable from an unrelated personal GitHub account. The package contains no legitimate functionality and acts as an install-time dropper, enabling arbitrary remote code execution on the installer's system. It is known to exfiltrate cryptocurrency wallet data and potentially other sensitive information.

The fastapii package on PyPI is a malicious typosquatting package impersonating the popular fastapi library. During installation, it executes obfuscated code that downloads and runs a remote binary on Linux systems. This binary is fetched from an unrelated GitHub account without verification, and the package's real behavior is to drop and execute this payload. The payload reportedly exfiltrates cryptocurrency wallet data and potentially other sensitive information. The malicious activity is triggered only on Linux, allowing it to evade detection on other platforms. The package versions 0.1.1, 0.1.2, 0.2.0, and 0.3.0 are affected.

The PyPI package 'flasq' is a malicious typosquatting artifact that impersonates the popular 'requests' library by using a similar name 'requestss'. During installation, it executes obfuscated code that downloads a binary from an unrelated GitHub account, saves it to /tmp, makes it executable, and runs it detached. This binary is reported to exfiltrate cryptocurrency wallet data and potentially other sensitive information. The malicious behavior is unrelated to the advertised functionality of HTTP client utilities. The affected versions are 0.1.1, 0.1.2, 0.2.0, and 0.3.0.

### Summary Four inline processors in pymdown-extensions contain regular expressions with exponential backtracking. A single untrusted Markdown line under 50 bytes drives `markdown.markdown()` into unbounded CPU on the rendering thread (seconds at ~45 bytes, growing exponentially with each added character). All four fire in the extension's **default configuration** and are reachable through the documented public API. The `caret`/`tilde`/ `betterem` blow-up was introduced by the emphasis-pattern rewrite in PR #2547 (first released in **10.13**, Dec 2024) — earlier releases used a linear `(.+?)` / `([^\s]+?)` content group — and is present through **11.0** (latest); `magiclink`'s host pattern is long-standing and affects effectively all releases. Likely **CWE-1333 (Inefficient Regular Expression Complexity)**. This is a distinct issue from CVE-2025-68142 (ReDoS in `pymdownx.blocks.caption`, `RE_FIG_NUM`, fixed in 10.16.1): different extensions, different regexes, and a different root cause (delimiter-run partition ambiguity rather than a `.`/`\.` typo). ### Details Four regexes share, or closely mirror, a vulnerable shape — an inner group that can partition a run of the delimiter character into `{2,}`-sized pieces in exponentially many ways, wrapped in a lazy `+?` that must fail before the engine can give up: | Extension | Regex | Location (`11.0`) | |---|---|---| | `pymdownx.caret` (superscript `^…^`) | `SUP2` | `pymdownx/caret.py:56` | | `pymdownx.tilde` (subscript `~…~`) | `SUB2` | `pymdownx/tilde.py:55` | | `pymdownx.betterem` (underscore `_…_`) | `SMART_UNDER_EM2` (default) | `pymdownx/betterem.py:93` | | `pymdownx.magiclink` (bare-URL autolink) | `RE_LINK` | `pymdownx/magiclink.py:56` (host at `:59`) | `pymdownx/caret.py:56` (`pymdown-extensions 11.0`): ```python SUP2 = r'(?<!\^)(\^)(?![\^\s])((?:[^\^\s]|\^{2,})+?)(?<![\^\s])(\^)(?!\^)' ``` The content group `(?:[^\^\s]|\^{2,})+?` matches a run of carets only via the `\^{2,}` branch. A run of *k* carets can be split into ≥2-length pieces in exponentially many combinations; when no caret can serve as a valid closing delimiter (the trailing `(?<![\^\s])(\^)` cannot be satisfied), the engine explores every partition before failing. `SUB2` (tilde) and `SMART_UNDER_EM2` (betterem) are the same construct for `~` and `_`. In `betterem` the default `smart_enable='underscore'` routes underscores to `SmartUnderscoreProcessor` → `SMART_UNDER_EM2` (`betterem.py:93`), which is the default-reachable, API-exploitable pattern; the non-smart `UNDER_EM2` (`:69`, used only when `smart_enable` is `asterisk`/`disable`) shares the shape but did not reproduce through the public `markdown.markdown()` pipeline on the tested payload, so a fix and regression test should target `SMART_UNDER_EM2`. `pymdownx/magiclink.py:59` has the analogous ambiguity in the host portion, where overlapping character classes let a run of dots be grouped exponentially: ```python (?:ht|f)tps?://[^_\W][-\w]*(?:\.[-\w.]+)* # host: '\.' and '[-\w.]' inside (?:...)* both match '.' ``` `SUP2`/`SUB2`/`SMART_UNDER_EM2` are applied at each delimiter occurrence via the default `PatternSequenceProcessor` subclasses (`pymdownx/util.py`); `RE_LINK` is applied by `MagiclinkPattern` (registered unconditionally at priority 85). In all four cases, rendering `markdown.markdown(src, extensions=[ext])` on untrusted `src` in default configuration is sufficient to reach the regex. ### PoC Single self-contained script; runs against the pinned release in an ephemeral env. Non-destructive — the input is ordinary Markdown text; the impact is CPU/time (a per-render alarm caps each attempt so the script terminates). ```python import signal import time from importlib.metadata import version import markdown print(f"# pymdown-extensions {version('pymdown-extensions')} / markdown {version('markdown')}") CAP = 5.0 # a single render exceeding this is treated as a hang class Timeout(Exception): pass def render(ext, text): signal.signal(signal.SIGALRM, lambda *_: (_ for _ in ()).throw(Timeout())) signal.setitimer(signal.ITIMER_REAL, CAP) t = time.perf_counter() try: markdown.markdown(text, extensions=[ext]) return time.perf_counter() - t except Timeout: return None finally: signal.setitimer(signal.ITIMER_REAL, 0) # ext -> (malicious builder, benign builder [valid & closed], ramp, hang count) CASES = { "pymdownx.caret": (lambda n: "^a" + "^" * n + "b", lambda n: "^" + "a" * n + "^", [24, 30, 36], 44), "pymdownx.tilde": (lambda n: "~a" + "~" * n + "b", lambda n: "~" + "a" * n + "~", [24, 30, 36], 44), "pymdownx.betterem": (lambda n: "_a" + "_" * n + "b", lambda n: "_" + "a" * n + "_", [24, 30, 36], 44), "pymdownx.magiclink": (lambda n: "http://a" + "." * n + " ", lambda n: "http://" + "a" * n + ".com ", [28, 32, 36], 40), } repro = [] for ext, (evil, benign, ramp, hang) in CASES.

python-hyper h2 versions up to and including 4.4.0 have a vulnerability where HTTP/2 request header blocks containing multiple Host headers are accepted and forwarded to the application. When the consumer downgrades HTTP/2 to HTTP/1.1, this results in two Host header lines in the HTTP/1.1 request, enabling HTTP request smuggling. This issue is resolved in version 4.4.1.

A vulnerability in langgraph's checkpoint saver implementations for Postgres and SQLite allows an authenticated user to access stored items belonging to other tenants or users due to improper namespace scoping. This occurs because hierarchical namespaces are persisted as dot-joined strings and reads are scoped by prefix matching, which can overlap with sibling namespaces or those containing unescaped pattern metacharacters. The issue affects versions prior to 3.1.1 and is fixed in version 3.1.1.

The PyPI package alphalend-layouts (versions 4.0.0, 4.0.1, 4.0.2, and 4.1.0) contains malicious code that exfiltrates sensitive installer-side secrets and private keys related to the Sui blockchain environment. This exfiltration occurs both during package installation and on import, leveraging obfuscated code to evade detection. The stolen data is archived and uploaded to an attacker-controlled GitHub repository using a reconstructed personal access token. The package's stated purpose is unrelated to these malicious activities.