LiteLLM versions prior to 1.95.0 contain a vulnerability allowing an authenticated user with internal_user_viewer privileges to read arbitrary local files via a crafted vertex_ai_credentials value. This occurs because the request-body safety blocklist missed the alias vertex_ai_credentials, enabling file read access that can disclose sensitive environment variables and escalate privileges. The issue is fixed in version 1.95.0.
LiteLLM versions from 1.65.5 up to but not including 1.85.0 contain a reflected cross-site scripting (XSS) vulnerability in the /sso/debug/callback endpoint. This endpoint reflects identity-provider-controlled fields into an inline script block without properly escaping HTML context characters, allowing an attacker to inject malicious JavaScript. The vulnerability can be exploited by an attacker with an account on the configured identity provider to execute scripts in the proxy origin, potentially leading to full admin account takeover.
GitPython versions up to 3.1.62 contain a vulnerability in the Head.checkout() method that allows an attacker to cause an arbitrary file read via a specially crafted branch name. The flaw arises because the positional branch name argument is not properly sanitized and is passed directly to the git checkout command without a separator, enabling injection of options such as --pathspec-from-file to read files like /etc/passwd. This issue is an incomplete fix of previous advisories and affects all published releases up to 3.1.62. A fix is available in version 3.2.0.
GitPython's Submodule.move() API does not properly handle symbolic links in intermediate path components, allowing an attacker controlling a Git repository with a symlinked submodule path to cause the submodule to be moved outside the parent repository's worktree. This leads to an integrity violation where repository content is relocated to an attacker-chosen directory outside the expected location, corrupting the parent repository's index and configuration. The issue affects GitPython versions prior to 3.2.0 and requires the application to explicitly call Submodule.move() on a path under the symlink. No code execution or confidentiality impact is demonstrated.
GitPython's Remote.pull() method improperly handles the positional refspec argument, allowing an attacker to inject a --upload-pack option that bypasses the unsafe-option guard. This leads to arbitrary command execution with the privileges of the calling process when using local-path or SSH transports. The vulnerability is fixed in version 3.2.0.
GitPython versions prior to 3.2.0 have security weaknesses in three command wrapper methods—ls_remote, merge_base, and IndexFile.move—that omit checks for unsafe protocols and options. This omission allows potential command injection or remote code execution (RCE) when interacting with maliciously crafted git URLs or arguments, particularly if the underlying git transport policy permits unsafe protocols like 'ext'. The vulnerability is confirmed on the main branch as of 2026-09-21 and affects versions before 3.2.0. A fix is available in version 3.2.0.
GitPython versions prior to 3.2.0 have a vulnerability in the handling of the separate_git_dir parameter during repository cloning. This flaw allows environment variable expansion from attacker-controlled .gitmodules submodule names, leading to leakage of environment variable values. The expanded values are exposed persistently on disk as directory names and in debug-level logs, potentially disclosing sensitive environment variables.
GitPython versions prior to 3.2.0 contain a vulnerability in the parse_actor_and_date() function due to a regex pattern that causes quadratic backtracking on malformed author, committer, or tagger identity lines. This results in CPU exhaustion when processing crafted commit or tag objects with malformed identity lines lacking valid epoch or timezone information. The issue was fixed in version 3.2.0 by modifying the regex to prevent overlapping matches and eliminate the backtracking.
An authenticated user with internal_user privileges in LiteLLM can escalate to proxy_admin and execute arbitrary commands on the host. The vulnerability arises because the proxy uses the same encryption key for sealing secrets and minting session tokens, allowing an attacker to forge admin credentials via a crafted API key request. Versions >=1.91.0 and certain earlier versions with EXPERIMENTAL_UI_LOGIN=true are affected. Patches are available in versions 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0rc2. Mitigation includes upgrading to a fixed version or disabling EXPERIMENTAL_UI_LOGIN as a temporary workaround.
The msgpack-python C extension has a memory leak vulnerability when deserialization rejects a map key with strict_map_key validation enabled (default). This leak occurs because the decoded map value is not released on key validation failure, causing unbounded memory growth and potential denial of service. Additionally, the streaming Unpacker API may suffer from use-after-free issues due to stale parser-stack references. The issue affects msgpack versions prior to 1.2.3 and has been fixed in 1.2.3.
The WekaClassifier component in NLTK improperly handles caller-controlled model file paths by passing them directly to the weka Java VM without validating them against NLTK's path security enforcement. This allows an attacker to specify arbitrary file paths for model saving and loading, enabling arbitrary file writes and reads outside the intended data root directories. This vulnerability bypasses the pathsec containment measures introduced in a prior advisory (CVE-2026-81726) and affects NLTK versions prior to 3.10.4.
Authlib versions prior to 1.9.0 contain a critical signature verification bypass vulnerability in the JsonWebSignature.deserialize_json() method. This flaw allows an attacker to submit a JSON Web Signature (JWS) object with an empty signatures array, which the method incorrectly accepts as valid without verifying any signature or requiring a cryptographic key. This leads to a complete authentication bypass where attacker-crafted payloads are accepted as legitimately signed.
Pylint versions prior to 4.0.9 use pickle serialization for caching stats in the PYLINT_HOME directory. This allows an attacker with write access to the cache directory to craft malicious pickle files that execute arbitrary code when pylint loads the cache. The vulnerability is fixed in pylint 4.0.9, which stores the cache as JSON instead of pickle. Until upgrading, users should ensure PYLINT_HOME is not set to a shared or group-writable directory.
vLLM versions prior to 0.32.0 contain a resource exhaustion vulnerability in the P2P secondary tier management. An API client can submit many unique peer addresses that never establish connections, causing vLLM to retain sessions and ZeroMQ sockets indefinitely. This leads to exhaustion of the ZeroMQ context socket quota, raising a ZMQError that terminates the EngineCore and shuts down the API server. The vulnerability allows denial of service without requiring privileged access or internal listener connectivity. A fix is available in vLLM 0.32.0.
Rembg versions prior to 2.0.82 have an unauthenticated vulnerability in the /api/remove endpoint that allows attackers to inject malicious SAM models via the extras.sam_model parameter. This enables path traversal and placement of crafted ONNX models that read arbitrary local files and encode their contents into returned PNG images. The flaw allows disclosure of any file accessible by the rembg process, including sensitive files like /etc/passwd. The issue is fixed in version 2.0.82.
Twisted's DNS client UDP transport (twisted.names.dns.DNSDatagramProtocol) accepts DNS responses based solely on matching the 16-bit transaction ID without validating the source address. This allows an attacker able to send UDP packets to the resolver's port to inject forged DNS responses, enabling off-path DNS response spoofing or cache poisoning. The standard client mitigates this risk by using per-query random source ports, increasing entropy, but the missing source address validation remains a security gap. This affects all versions prior to 26.10.0rc1, where the issue is fixed.
fpdf2 versions from 2.5.0 up to but not including 2.8.8 contain a vulnerability where nested SVG <use> references cause exponential growth in memory and CPU usage during PDF image processing. This can lead to resource exhaustion and process failure with a MemoryError. The issue arises from deep-copying referenced SVG graphics trees, allowing a crafted small SVG to consume excessive resources without external dependencies or special configurations.
fpdf2 versions prior to 2.8.8 implicitly load external HTTP(S) URLs and local filesystem image paths when rendering content via its image and HTML/SVG rendering APIs. This can lead to outbound network requests or local file access attempts if untrusted input controls image references. The vulnerability may enable Server-Side Request Forgery (SSRF) and limited local file access depending on the content. A fix is available in version 2.8.8.
Agno versions prior to 2.3.24 contain a critical arbitrary code execution vulnerability due to unsafe use of Python's eval() on the field_type parameter in FunctionCall inputs. This flaw allows attackers who can influence field_type to execute arbitrary Python code within the Agno process, impacting confidentiality, integrity, and availability. The vulnerability is fixed in version 2.3.24 and later. No safe workaround exists other than upgrading or ensuring no untrusted input reaches the vulnerable parameter.
OAuthLib versions from 3.3.0 up to but not including 4.0.0 contain a vulnerability in the device code grant workflow (RFC 8628). The token endpoint does not properly validate the device_code parameter, allowing an attacker who knows a valid client ID for a public client configured for device workflow to obtain a bearer token without a valid device_code. This flaw arises because the DeviceCodeGrant.validate_token_request method lacks proper device_code validation. The issue is fixed in version 4.0.0.