Gnsehfvlr

pypdftk through 0.5 contains an OS command injection vulnerability in fill form(), dump data fields(), and pdftk cmd util() that builds shell commands from caller-supplied paths. Attackers controlling pdf path or out file can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execute OS commands as the Python process.

fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing proto , constructor or prototype key segments. Attackers can pass [ proto ] or [constructor.prototype] table headers or proto .x dotted keys to parse() to pollute all objects, causing denial of service or authorization bypass.

**Name of the Vulnerable Software and Affected Versions** geopy versions prior to 2.5.0 **Description** Inefficient regular-expression behavior in `geopy.Point` and the `Point.from string()` function can lead to excessive CPU consumption when processing long, malformed coordinate strings. This issue also affects geocoder reverse methods when they are called with string inputs. An attacker can trigger a denial of service by sending repeated requests containing such strings. The numeric Point constructor is not affected. **Recommendations** Update to version 2.5.0.

**Name of the Vulnerable Software and Affected Versions** Vocos (affected versions not specified) **Description** The software instantiates classes based on a configuration file without restricting which classes can be named. The `instantiate class` function in `vocos/pretrained.py` uses the `class path` value from the configuration to import a module via ` import ` and resolve an attribute using `getattr`, subsequently calling the result as `args class(*args, **kwargs)` with arguments from the `init args` mapping. Because there is no allowlist to constrain the dotted path, a configuration file can specify any importable callable and its arguments. This issue is reachable through `Vocos.from hparams` for `feature extractor`, `backbone`, and `head` entries, as well as through `Vocos.from pretrained`, which downloads a `config.yaml` from a specified Hugging Face repository. Consequently, loading a model from an untrusted repository allows the repository owner to execute arbitrary code during the loading process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.