Bofei Chen

A security control bypass exists due to a logic flaw in the `import module class` helper within `sentence transformers/util/misc.py`. The guard condition includes an `or os.path.exists(model name or path)` clause that satisfies the trust gate if the supplied path exists on the local filesystem, ignoring the `trust remote code=False` argument. This allows attackers who can influence the contents of a model directory on disk to place malicious Python files, such as `modeling *.py` referenced via `modules.json`. Consequently, arbitrary code is executed during the import process when an application loads the model using `SentenceTransformer(path, trust remote code=False)`, bypassing the intended security contract.

An unsafe deserialization issue exists in the LoadTrainingDataset node. Unauthenticated remote attackers can execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. The attack involves uploading a malicious `shard *.pkl` file through the POST '/upload/image' endpoint and subsequently queuing a workflow graph via the POST '/prompt' endpoint that references the uploaded file. This process causes `torch.load` to deserialize the payload using ` reduce `, executing arbitrary commands with the privileges of the ComfyUI process user.

Various `FilterExpressionConverter` implementations fail to properly escape keys and values when translating filter expression objects into specific vector store query languages. This improper escaping allows for query injection, which can enable attackers to alter vector store queries, potentially leading to data exposure and tampering.

A deserialization vulnerability exists when decoding a malicious package, which can allow a remote attacker to execute arbitrary code or cause a denial of service. The issue is related to shortcomings in the deserialization mechanism of the Apache Dubbo RPC framework.

SOFARPC is a Java RPC framework. Through a carefully crafted payload, an attacker can achieve JNDI injection or system command execution. The default configuration of the SOFARPC framework uses a blacklist to filter out dangerous classes during the deserialization process. However, the blacklist is not comprehensive, allowing an actor to exploit certain native JDK classes and common third-party packages to construct gadget chains capable of achieving JNDI injection or system command execution attacks.