Threats tagged 'ghsa-cmmf-wccr-xrrh'

A vulnerability in esmf-sdk-py-aspect-model-loader versions 2.1.2 to 2.2.1 allows the Aspect Model loader to resolve cross-file model references insecurely. It extracts certain components from URNs declared in Turtle files to build directories to scan, which can be manipulated to cause the loader to parse files from arbitrary directories outside the intended model root. This leads to unintended merging of external Turtle files into the model graph.