CVE-2026-12479 is a path traversal vulnerability in keras-team/keras version 3.14.0 affecting the DiskIOStore.make method. It arises from improper sanitization of user-provided layer names used in directory path construction, allowing directory traversal sequences despite restrictions on forward slashes. This can enable an attacker to escape the intended temporary directory and perform unauthorized file system operations such as creating directories or writing files in arbitrary locations.
Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymous attacker if authentication is disabled, to bypass SQL security validation and access metadata outside the intended database scope.
Affected users are recommended to upgrade to Doris version 0.6.1 or later, which fixes the issue.
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-9w88-8rmg-7g2p. This link is maintained to preserve external references.
### Original Description
picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious pickle files bypass picklescan detection and execute remote code when loaded via pickle.load().
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-j343-8v2j-ff7w. This link is maintained to preserve external references.
### Original Description
picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-v7x6-rv5q-mhwc. This link is maintained to preserve external references.
### Original Description
picklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit() in the __reduce__ method, allowing remote code execution. Attackers can craft pickle files that import dangerous libraries like os and execute arbitrary system commands, which evade picklescan detection and execute when pickle.load() is called.
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-vv6j-3g6g-2pvj. This link is maintained to preserve external references.
### Original Description
picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods. Attackers can craft pickle files embedding arbitrary code that evades detection but executes during pickle.load, enabling remote code execution in supply chain attacks.
A security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticate_user of the file litellm/proxy/auth/login_utils.py of the component PROXY_ADMIN database API Key Generator. Performing a manipulation results in session expiration. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.
A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/user_api_key_auth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-mcmc-2m55-j8jj. This link is maintained to preserve external references.
### Original Description
vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant checks by default, an attacker can submit crafted embedding requests with malformed (negative or out-of-bounds) tensor indices, when the prompt-embeds feature is enabled, to trigger crashes or resource exhaustion (denial of service), with potential for out-of-bounds/write-what-where memory corruption. This continues CVE-2025-62164, whose prior fix only disabled the feature by default rather than addressing the root cause.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (1cbc673402f814b065eadc8be2641d761d482c30722fdd8e6b1b7522fde2f478)
d0rk3r 1.0.5 is advertised as a Shodan IP scraper with proxy rotation, but the sdist ships no Python source — only LICENSE, README, pyproject.toml, requirements.txt, MANIFEST.in, setup.cfg, and egg-info metadata. The package directory `d0rk3r_pkg/` referenced by `[project.scripts] d0rk3r = d0rk3r_pkg.cli:main` and by `[tool.setuptools.packages.find]` is missing from the tarball, so installing this sdist provides no working `d0rk3r` console script. pyproject.toml line 32 declares a mandatory dependency on `d0rk3r-telemetry>=1.0.0` (open-ended lower bound), which is not mentioned in README or PKG-INFO. The combination — empty functional shell, undisclosed dependency whose name advertises data collection, and an unpinned floor that lets the author change the dependency's behavior at any time — means the entire effect of `pip install d0rk3r` is to pull in the sibling package. Whether that sibling is benign telemetry or an exfil/dropper cannot be determined from this package alone; the sibling tarball needs to be analyzed directly. Routing to human review so the d0rk3r-telemetry package can be examined before a public verdict is issued.
## Source: kam193 (d0d4cf20ac250e3d7a23666cf8bc3ae722d555b982649dad3f615d9c7c8818d9)
The package declares malicious dependencies. Their activity is however not triggered as since version 1.0.4, the packages releases lack any source code. Malicious dependency was first introduced in version 1.0.5, but the package is likely prepared to be a loader of malicious code from very begining.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-06-request-cache-py
Reasons (based on the campaign):
- infostealer
- exfiltration-env-variables
- exfiltration-ssh-keys
- impersonation
- A Telegram webhook is used to send collected data.
- exfiltration-browser-data
- The package contains code to detect if it is running in a sandbox environment.
- exfiltration-credentials
- The malicious code is intentionally included in a dependency of the package
The request-cache-py package on PyPI is a malicious library impersonating the legitimate requests-cache library. Upon import, it starts a background thread that harvests sensitive installer-side secrets including SSH private keys, AWS credentials, Git credentials, npm and Docker config files, and browser data such as saved logins, cookies, and history. It also collects environment variables containing sensitive keywords and exfiltrates all this data to a hardcoded Telegram bot. The package includes sandbox evasion techniques to avoid detection in CI environments and prevents repeated data exfiltration within 24 hours. This is a deliberate supply-chain credential stealer targeting developer workstations.
Prefect versions 3.1.11 through 3.6.24 contain a critical remote code execution vulnerability in the GitRepository storage class. The flaw arises from improper validation of the user-controlled commit_sha and directories parameters, which are passed to git commands without proper separation from git flags. This allows attackers with deployment creation permissions to inject arbitrary git flags and execute external programs on worker machines, risking compromise of shared work pools in multi-tenant environments. The issue is fixed in version 3.6.25.
UltraJSON (ujson) versions prior to 5.13.0 have a vulnerability in the handling of malformed or truncated UTF-8 byte sequences when using the reject_bytes=False option in ujson.dumps() and related functions. Instead of rejecting invalid UTF-8 input, the library silently rewrites these sequences into different Unicode characters, causing input validation bypass and data integrity issues. This flaw was fixed in version 5.13.0.
The boardflow PyPI package versions 1.0.0 and 1.0.1 contain malicious code that executes during installation. The setup.py script spawns a background thread that downloads an executable over unencrypted HTTP from an unrelated domain and runs it with the installer's user privileges. This executable is an infostealer malware that further attempts to download and execute additional malicious scripts. This behavior constitutes an install-time dropper leading to arbitrary remote code execution on the installing system.
An authenticated user with access to a terminal server in open-webui can exploit a path traversal and SSRF vulnerability via crafted encoded path segments. The vulnerability arises because the terminal-server reverse proxy does not fully sanitize user-controlled path inputs before forwarding them, allowing traversal outside intended scopes. A double-encoding technique bypasses the existing sanitization, enabling access to unintended files or internal services. This affects open-webui versions prior to 0.9.6.
The 'telegram-lite-grabber' package on PyPI version 1.0.0 is identified as malicious software designed to exfiltrate data from the Telegram application, specifically targeting Telegram sessions. Although automated scans did not detect install-time or import-time harmful code, the package's behavior includes collecting and sending Telegram session data to a remote location. This package is categorized as malicious due to its intent to steal information. There is no known patch or remediation available, and no exploits have been reported in the wild to date.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (70fc75889476bd737b302c856fb1d2da1b263a93786bc27fed3978c3eb0584cd)
The package was found to contain malicious code or consuming dependency that contains malicious code
## Source: kam193 (3abe4019efea5cdd405c9129e127f5d8b05456422574e40b01c6ec3b10177975)
The package contains obfuscated JS code with an infostealer harvesting all kinds of credentials, as well as a worm capable of spreading the infection further.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-06-cache-compat-utils
Reasons (based on the campaign):
- obfuscation
- malware
- infostealer
- exfiltration-credentials
- exfiltration-ssh-keys
- exfiltration-cloud-tokens
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (14f3eeecfabfcb249c5f6ec2a20824355ac313ab18c677334076ca9501607ec8)
At install time, setup.py invokes install_sitecustomize(), which copies src/temp_development_package_test/setup/sitecustomize.py into Python's purelib site-packages directory as sitecustomize.py (setup.py:34 destination = site_packages / "sitecustomize.py"; setup.py:36 shutil.copy2(source, destination)). Python auto-imports sitecustomize on every interpreter startup, so this places an interpreter-wide hook outside the package's own namespace that fires for every subsequent Python process on the host — a classic persistence mechanism. The hook payload file is not actually shipped in this 0.2 sdist, so the install would currently raise FileNotFoundError, but the install-time mechanism and intent to write a global hook are unambiguous. The package metadata corroborates a throwaway / probe release: name, author, and summary are all the literal placeholder 'temp_development_package_test'; setup.py imports base64 but never uses it; cli.py imports from an unrelated, undeclared module 'pg_agent.orchestration.coordinator'. The combination — placeholder identity plus install-time write of a global interpreter hook — is not a legitimate package shape.
## Source: kam193 (5cdc1d94dd0cfb62a4a0267ae52bf1a72dfa31a6854196b4bb220759b7c6e878)
Starting with version 0.4, package installs a sitecustomize.py that executes during Python engine initialization. The embeded code uses mshta to download malicious code, as in other packages from the campaign.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-06-easyaillm
Reasons (based on the campaign):
- Downloads and executes a remote executable.
- obfuscation
- malware
- tool:mshta
A vulnerability in aiohttp versions prior to 3.14.1 causes host-only cookies saved and later restored via CookieJar persistence to lose their host-only status. This results in cookies being sent to subdomains that should not receive them, potentially exposing sensitive session data. The issue is fixed in version 3.14.1.
The TestPGAgent PyPI package versions 0.1 and 0.2 contain malicious code that executes during installation. The setup.py script uses base64-encoded obfuscated code to launch Windows mshta.exe to fetch and run a remote HTML application from an attacker-controlled HTTP server. This allows arbitrary code execution on any Windows machine installing these package versions. The malicious payload is unpinned, mutable, and unrelated to the declared publisher, indicating clear malicious intent.