Dilanka Kaushal Hewage

VNote 3.11.0 before 4.12.0 contains an OS command injection vulnerability in its Tasks feature: magic variables such as ${bufferName} and ${selectedText} are substituted into a shell command string without escaping. Attackers can share a notebook containing a note whose filename or text includes shell metacharacters such as $(...), backticks, ; or |, executing commands as the victim when they run a task referencing these variables.

labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read() and read relational() that passes any file with a .p or .pickle extension to pandas.read pickle based on the extension alone. Attackers who supply a crafted data file or relational data archive can execute arbitrary code when a user loads it with these functions.

An infinite loop occurs in the `ccitt fax4 decode size()` function when processing a specially crafted CCITT Group 4 stream. An attacker can cause the calling process to hang and consume full CPU resources by providing an 8-byte G4 stream that lacks an End of File Block (EOFB) to the `ccittfax4 decode()` function or the numcodecs Ccittfax4 codec.

A stack-based buffer overflow exists in the lossless JPEG Define Huffman Table parser within the `decode jpegsof3()` function. This occurs when a crafted lossless JPEG is processed where the DHT symbol counts wrap an 8-bit sum, leading to an overflow of the 32-entry `HufVal` and `HufSz` stack arrays, which results in a process crash.