Dem000

A vulnerability was determined in SakanaAI text-to-LoRA 0.0.1. Affected by this issue is the function get tokenizer of the file src/hyper llm modulator/utils/model loading.py of the component Checkpoint Loading. Executing a manipulation of the argument base model name or path can lead to path traversal. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

An issue exists in the Qdrant Backend component within the file `indexer/chunker.go`. Improper processing in this file leads to the use of a weak hash, which is a cryptographic hash function that is no longer considered secure against modern attacks. This flaw can be exploited remotely, although the attack is highly complex and difficult to execute.

The Postgres Embedding Cache component contains an issue where the `PostgresStore.LookupByContentHash()` function in the `indexer/chunker.go` file uses a weak hash. A local attacker can manipulate the `content hash` argument to exploit this. The attack is characterized by high complexity and is difficult to execute.

An issue exists in the Static API Key Handler component within the `validateConfig()` function of the `usecases/auth/authentication/apikey/client.go` file. Manipulation of the `StaticApiKey` argument allows for a remote authorization bypass. The attack complexity is high and exploitability is considered difficult.

Improper access controls in the `CollectionRouter.invoke()` function within the `deepsearcher/agent/collection router.py` file allow for remote exploitation. This issue is caused by the manipulation of the `kwargs` argument, which can lead to remote code execution.