Dulwich's porcelain.checkout(paths=[...]) function uses raw os.open calls that follow symlinks, bypassing symlink protections and allowing arbitrary file writes. An attacker can craft a malicious repository with symlinks that cause checkout to overwrite files such as .git/hooks/post-checkout, enabling remote code execution on subsequent git operations. The vulnerability affects Poetry versions from 2.2.0 up to but not including 2.4.2. A patch is available to fix this issue by replacing the raw os.open usage with a safer method that detects symlinks.
Dulwich's stash pop function in version 1.2.7 is vulnerable to a symlink directory traversal that allows an attacker to write arbitrary files outside the repository worktree. This occurs because the function uses os.path.exists() which follows symlinks, enabling writes through malicious intermediate symlinks. An attacker can craft a repository that, when a victim pops a stash, writes attacker-controlled files such as .git/hooks/post-checkout, leading to remote code execution on the victim's machine during subsequent git operations. A patch is available to mitigate this issue by verifying symlink resolution before writing files.
A denial of service (DoS) vulnerability exists in the dulwich library's Pack.resolve_object method. When resolving an OFS_DELTA object with a delta_offset of zero, the method enters an infinite recursive loop due to self-referential offset calculation. This causes CPU exhaustion and process crashes in applications using dulwich for Git packfile operations. The vulnerability affects dulwich versions >=1.2.0 and <2.4.2. A patch is available to explicitly reject delta_offset == 0 and prevent infinite recursion.
Dulwich's filter_branch.py in Poetry versions 2.2.0 up to but not including 2.4.2 contains a symlink directory traversal vulnerability in the CommitFilter._apply_index_filter() function. This occurs because materialized tree entries, including symlinks, persist in the working directory between commits, allowing an attacker to redirect file writes to arbitrary filesystem locations. An attacker can exploit this by crafting a malicious repository that causes filter_branch to write attacker-controlled content to arbitrary locations, potentially achieving remote code execution if writes target .git/hooks/. A fix is available that involves cleaning the working directory between commit iterations or verifying symlinks before writing files.
A use-after-free vulnerability exists in the sqlite3-ruby gem when defining aggregate functions with two or more arguments evaluated over TEXT or BLOB columns. This can cause the Ruby objects holding arguments to be freed prematurely during garbage collection, leading to incorrect objects being passed to the aggregate's step method or a process crash. The vulnerability affects Mailcatcher versions from 0.8.1 up to but not including 0.11.0. The maintainers rate this as medium severity with a CVSS 4.0 score of 6.3. The issue is fixed in sqlite3 gem version 2.9.6 or later.
CVE-2026-104874 is a medium severity memory leak vulnerability in aio-libs/multidict versions 6.7.0 through 6.9.0. It occurs in the items-view union and subtraction operators, where certain references are not properly released, causing unbounded memory growth. This leak can be triggered remotely by supplying crafted HTTP headers or query strings to servers using the affected library. The issue results in increasing resident memory usage until the process is terminated.
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing the page labels of a document with large Roman numerals.
### Patches
This has been fixed in [pypdf==6.17.0](https://github.com/py-pdf/pypdf/releases/tag/6.17.0).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#4047](https://github.com/py-pdf/pypdf/pull/4047).
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires reading a PDF document with long indirect object headers, not terminated by whitespace.
### Patches
This has been fixed in [pypdf==6.18.0](https://github.com/py-pdf/pypdf/releases/tag/6.18.0).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#4055](https://github.com/py-pdf/pypdf/pull/4055).
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the `/ToUnicode` entry of a font with unusually large values, for example during text extraction.
### Patches
This has been fixed in [pypdf==6.18.1](https://github.com/py-pdf/pypdf/releases/tag/6.18.1).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#4071](https://github.com/py-pdf/pypdf/pull/4071).
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the `/Widths` entry of a TrueType or Type1 fonts with unusually large values, for example during text extraction.
### Patches
This has been fixed in [pypdf==6.18.1](https://github.com/py-pdf/pypdf/releases/tag/6.18.1).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#4072](https://github.com/py-pdf/pypdf/pull/4072).
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a partially malformed `/FlateDecode` stream, where the byte-by-byte decompression is used.
### Patches
This has been fixed in [pypdf==6.18.1](https://github.com/py-pdf/pypdf/releases/tag/6.18.1).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#4073](https://github.com/py-pdf/pypdf/pull/4073).
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires updating form field values with flattening enabled, which triggers appearance stream generation.
### Patches
This has been fixed in [pypdf==6.19.0](https://github.com/py-pdf/pypdf/releases/tag/6.19.0).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#4087](https://github.com/py-pdf/pypdf/pull/4087).
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing the embedded files through the dictionary-based API.
### Patches
This has been fixed in [pypdf==6.19.0](https://github.com/py-pdf/pypdf/releases/tag/6.19.0).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#4081](https://github.com/py-pdf/pypdf/pull/4081).
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing the page labels of a document with large alphabetical labels.
### Patches
This has been fixed in [pypdf==6.19.0](https://github.com/py-pdf/pypdf/releases/tag/6.19.0).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#4096](https://github.com/py-pdf/pypdf/pull/4096).
CVE-2026-100689 is a path traversal vulnerability in GitPython's handling of the .gitmodules 'path' field during submodule updates. The vulnerability allows an attacker to specify a relative path with traversal components (e.g., ../../../tmp/escaped) that can cause files to be written outside the intended repository directory. This occurs because the update() method validates only the submodule name but does not apply the existing path containment guard to the path field before creating directories or checking out submodules. The vulnerability affects Snakemake versions >=5.5.3 and <9.27.0, which bundle GitPython 3.1.61. A fix is available in Snakemake 9.27.0.
A vulnerability in Hugging Face Transformers versions 4.49.0 through 5.8.1 allows remote Python files to be written to local disk without user consent when using the GenerativePreTrainedModel.load_custom_generate() function. The function caches a remote module file before performing the trust check, causing attacker-controlled code to be saved persistently even if the user declines to trust it. Execution of this code is blocked by the trust prompt, but the unauthorized files remain on disk and may cause stale cache collisions in future trusted model loads.
Python Tornado versions before 6.5.9 have a path traversal vulnerability in StaticFileHandler. This flaw allows the handler to follow symbolic links inside the static root directory without verifying that the resolved target remains within the static root. An unauthenticated attacker can exploit this by requesting a symlink pointing outside the static directory to read sensitive files accessible to the process user, such as configuration files, private keys, and application secrets. The vulnerability has a CVSS score of 5.9, indicating medium severity.
CVE-2026-103261 is a resource exhaustion vulnerability in Tornado Web server versions prior to 6.5.9. The HTTPServerRequest.__init__ method parses query strings without limiting the number of fields, unlike the POST-body parsing path which enforces a 1000-field limit. An attacker can send a GET request with thousands of query parameters, causing excessive CPU usage and blocking Tornado's single-threaded event loop, resulting in denial of service. This vulnerability affects all Tornado servers and can degrade response times for all clients sharing the same IOLoop. The issue is fixed by adding a field-count limit to query string parsing, consistent with the POST-body limit.