Threats affecting pkg:brew/flexget

A vulnerability in setuptools on Windows allows a crafted wheel's namespace_packages.txt to cause legacy wheel installation to create an __init__.py file outside the intended installation directory. The file content is fixed and the path is attacker-influenced but requires the target directory to pre-exist. This can lead to unauthorized file creation with the installer's permissions.

A buffer overflow vulnerability exists in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0. This flaw allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, potentially leading to sensitive memory disclosure, denial of service, or arbitrary code execution. Users should update affected Brotli libraries or binaries to fixed versions 1.0.10, 1.1.1, or 1.2.1. The vulnerability is rated critical with a CVSS 9.2 score.

A Regular Expression Denial of Service (ReDoS) vulnerability exists in soupsieve's CSS selector parsing, specifically in the IDENTIFIER and VALUE sub-patterns. The flaw causes quadratic-time regex backtracking when parsing certain crafted selectors that fail to match, such as unterminated attribute values or identifiers followed by invalid characters. This can stall the interpreter for seconds to minutes depending on input size. The vulnerability is exploitable when user-controlled CSS selectors are passed to soupsieve or BeautifulSoup's select methods. Fixed in version 3.19.30 of the affected product.

A Regular Expression Denial of Service (ReDoS) vulnerability exists in soupsieve's whitespace/comment trimming regex RE_WS_END, which is used during CSS selector parsing. The regex is unanchored at the start and uses .search(), causing quadratic time complexity (O(n²)) on valid selectors with long whitespace or comment runs not exactly at the string end. This can cause significant CPU delays (e.g., ~10 seconds for a 20 KB selector). The issue affects soupsieve versions >=3.17.7 and <3.19.30 and is exploitable when user-controlled selectors are passed to soupsieve or BeautifulSoup's select methods. A fix is available in version 3.19.30.

A Unicode normalization mismatch in setuptools' handling of MANIFEST.in exclusions can cause files intended to be excluded from source distributions to be included instead. On macOS APFS and HFS+ filesystems, filenames stored in NFD form do not match exclusion patterns written in NFC form, leading to silent bypass of exclusion rules. This can result in unintended disclosure of private or secret files when publishing to PyPI. The issue affects non-ASCII filenames and is fixed in setuptools version 3.19.27.

A Regular Expression Denial of Service (ReDoS) vulnerability exists in soupsieve's CSS selector parser due to a regex pattern that suffers from catastrophic backtracking when processing attribute selectors with unterminated quoted values. This can cause CPU exhaustion and thread blocking with a payload as small as 300 bytes, leading to significant processing delays. The issue affects applications that compile untrusted CSS selectors using soupsieve or Beautiful Soup's select methods. A fix is available in version 3.19.22.

The soupsieve CSS selector parser used by Beautiful Soup 4 and Flexget allocates unbounded memory when compiling large comma-separated selector lists. An attacker can supply a crafted CSS selector string with many comma-separated items, causing the parser to consume excessive heap memory and leading to denial of service via memory exhaustion. This affects applications that pass user-supplied CSS selectors to soupsieve.compile() or Beautiful Soup's .select()/.select_one() methods. The vulnerability is fixed in Flexget version 3.19.22.

Scrapy versions up to 2.13.3, used in Flexget versions >=3.17.7 and <3.18.21_1, are vulnerable to a denial of service (DoS) attack due to a flaw in the brotli decompression implementation. The existing protection against decompression bombs does not mitigate the brotli variant, allowing remote servers to cause excessive memory consumption and crash clients with less than 80GB of available memory. This vulnerability is fixed in Flexget version 3.18.21_1.