Threats tagged 'pypi'

MONAILabel server is vulnerable to a denial-of-service and silent inference corruption attack via crafted DICOM files exploiting pydicom's improper validation of Decimal String (DS) and Integer String (IS) values. An unauthenticated attacker can upload malicious DICOM files containing NaN or infinity values in spatial metadata fields, causing the server to crash or produce corrupted AI inference results. This affects MONAILabel versions prior to 1.6.1 and pydicom versions 0.9.7 through 3.0.2. The vulnerability arises because MONAILabel trusts pydicom output without validating these invalid values, and the REST API accepts uploads without authentication by default. A fix is available in MONAILabel 1.6.1.

Ajenti versions prior to 2.2.13 contain a critical remote code execution vulnerability (CVE-2026-27975) that allows unauthenticated users to execute arbitrary code on the affected server. This vulnerability has a CVSS score of 9.8, indicating a high severity with network attack vector, no privileges required, and no user interaction needed. The issue is fixed in version 2.2.13, and users are strongly advised to upgrade to this version promptly to mitigate the risk.

The h13t0ry-hello-demo package on PyPI version 0.1.0 contains malicious code that initiates a reverse shell upon import. This behavior allows an attacker to execute arbitrary commands on the victim's machine, posing a significant security risk.

vLLM versions from 0.16.0 up to but not including 0.32.0 contain a vulnerability in the /v1/responses endpoint. An authenticated user can supply a crafted template in chat_template_kwargs[chat_template] when no server template is configured. This bypasses the intended trust policy and may cause CPU or memory exhaustion due to Jinja template rendering. The issue is resolved in version 0.32.0.

vLLM versions prior to 0.32.0 have a misconfiguration in the OpenAI-compatible server where Starlette CORSMiddleware allows all origins by default. This allows a malicious web page to make cross-origin requests from a victim's browser to an unauthenticated vLLM server on localhost, internal networks, or VPNs, potentially consuming GPU resources and reading responses. The vulnerability does not enable cookie-based CSRF attacks as credentials are disabled by default, and bearer token authentication limits exposure to already authorized callers. The issue is fixed in version 0.32.0.

vLLM versions prior to 0.32.0 contain an off-by-one error in the computation of max_token_id in the hf.py tokenizer module. This flaw allows a pre-tokenized prompt ID equal to the vocabulary size to bypass validation. Under specific conditions involving tensor-parallel size and vocabulary size, this leads to a CUDA device-side assertion failure that terminates the engine. The issue is fixed in version 0.32.0.

vLLM versions prior to 0.32.0 contain a critical vulnerability where attacker-controlled image bytes are passed to Pillow's Image.open without restricting decoder selection. This allows dispatching of malicious EPS payloads that can lead to command execution if the host has a vulnerable Ghostscript (CVE-2024-29510) or denial of service via Pillow vulnerabilities (CVE-2026-59203). The issue is fixed in version 0.32.0.

vLLM versions prior to 0.32.0 contain a vulnerability where an authenticated user can supply forged shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-out deployments with shared-memory multimodal caching enabled, this allows attacker-controlled data to be passed to pickle.loads(), enabling arbitrary Python code execution. This issue is resolved in version 0.32.0.

vLLM versions from 0.19.0 up to but not including 0.32.0 contain a vulnerability where authenticated users can supply a request chat template if no server-side template is configured. This allows a malicious template to be compiled and rendered without execution limits, potentially causing denial of service by blocking response handling or exhausting server memory. Harmony models are not affected. The issue is fixed in version 0.32.0.

The netweavex package on PyPI is a malicious typosquat of the legitimate NetworkX library. It uses a lookalike name and clones the API and module layout to deceive users. Upon import, it executes obfuscated code that decompresses and runs attacker-controlled bytecode, which can download and execute additional malicious scripts. This behavior is characteristic of a PyPI typosquatting dropper designed to compromise the installer's system.

The zagents-framework package on PyPI contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It appears to be a low-risk package resembling pentest tools but with a hidden data exfiltration purpose.

The PyPI package 'changes-lxc-wrapper' is a malicious package that exfiltrates basic host information such as IP address and username upon installation or import. It masquerades under a misleading import namespace 'ca_certificates' that does not match its distribution name. While it does not perform harmful filesystem or network operations beyond data exfiltration, it overrides the install command to execute malicious code during installation.

The claudeopuseni package on PyPI is a malicious Python package that executes attacker-controlled code upon import. It attempts to fetch encrypted payloads from a remote server, decrypts them, and executes them, falling back to a bundled payload if the server is unreachable. The package includes sandbox evasion techniques and runs with the importing user's privileges. During installation, it also uses obfuscated code and steganography to deploy a native extension infostealer that exfiltrates sensitive data to a command-and-control server via the Polygon blockchain. The package name mimics a legitimate product to lure victims.

The claudeopusfile package on PyPI contains malicious code that executes an obfuscated payload during installation. The code uses techniques to hide execution from scanners and includes kill switches to evade sandbox environments. It downloads and runs a staged second payload with installer privileges, which acts as an infostealer exfiltrating sensitive data to a command-and-control server via the Polygon blockchain. The package's advertised functionality does not justify this behavior.

The nebulallm package on PyPI version 1.4.3 is a malicious typosquatting package that executes harmful code during installation. It overrides the install command in setup.py to download and run a JScript script, which subsequently downloads a malicious DLL. This behavior clearly indicates malware intent.

The PyPI package 'zagents-message-bus' contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in its setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.

vLLM versions from 0.20.0 up to but not including 0.30.0 contain a denial of service vulnerability. Remote attackers can crash the engine by sending malformed multimodal metadata to the /inference/v1/generate endpoint. This causes a negative text span in Qwen2.5-VL position construction, terminating the engine. The issue is fixed in version 0.30.0.

vLLM versions from 0.10.2 up to but not including 0.25.0 contain a vulnerability where unauthenticated attackers can cause uncontrolled memory consumption by submitting specially crafted decompression-bomb images. This leads to out-of-memory (OOM) conditions that kill worker processes and cause denial of service. The issue arises because the Nemotron-VL processors globally set Image.MAX_IMAGE_PIXELS to None, disabling limits on image decompression size. A fix is available in version 0.25.0.

vLLM versions from 0.9.2 up to but not including 0.24.0 contain a server-side request forgery (SSRF) vulnerability. This flaw allows API callers to embed a decoded address in the X-Request-Id header, forcing outbound connections. Exploitation can cause a P2pNcclConnector prefill worker to connect to an attacker-controlled host, potentially leaking NCCL unique_id and KV-cache tensors or blocking the worker. The vulnerability is rated high severity with a CVSS score of 8.2. A fix is available in version 0.24.0.

vLLM versions from 0.22.0 up to but not including 0.24.0 contain a denial of service vulnerability. Remote attackers can exploit this flaw by sending specially crafted Generate or GenerateStream requests with output_logprobs enabled and more than 128 output_candidates.token_ids. This triggers a fatal sampler exception in the Rust gRPC frontend, causing the EngineCore to crash and resulting in denial of service. The issue is fixed in version 0.24.0.