Fiona

**Name of the Vulnerable Software and Affected Versions** Xinference versions prior to 2.12.0 **Description** Xinference unconditionally enables Hugging Face remote code execution during model loading. This occurs because six loader call sites pass `trust remote code=True` as a literal or unconditional default. The affected functions include `RerankModel. get tokenizer` in xinference/model/rerank/core.py, `SentenceTransformerRerankModel.load` in xinference/model/rerank/sentence transformers/core.py, `SentenceTransformerEmbeddingModel.load` in xinference/model/embedding/sentence transformers/core.py, `FlagEmbeddingModel.load` in xinference/model/embedding/flag/core.py, and both `PytorchModel. sanitize model config` and `PytorchModel. get components` in xinference/model/llm/transformers/core.py. A user with model launch access can register a model of an unknown type and provide an arbitrary model path. This triggers the ` auto detect type` process and subsequently `AutoTokenizer.from pretrained`, which imports and executes Python code defined in the `auto map` of the model directory's `tokenizer config.json` file. This allows the execution of attacker-supplied code with the privileges of the worker process. **Recommendations** Update to version 2.12.0 or later to ensure all remote code execution sites are gated behind the `allow trust remote code` parameter and the `XINFERENCE TRUST REMOTE CODE` setting.

**Name of the Vulnerable Software and Affected Versions** Datavane TIS version 5.0.0 **Description** An XML external entity (XXE) injection exists when the software processes XML through an unhardened DocumentBuilderFactory with external entities and DTD loading enabled. Authenticated attackers can exploit this by supplying a crafted `taskScript` payload to the 'doEditWorkflow' endpoint. This allows for server-side request forgery (SSRF), where the server is forced to make outbound HTTP requests to attacker-controlled infrastructure, and out-of-band file exfiltration of local files readable by the TIS process user, such as configuration files and Derby database credentials. **Recommendations** Update Datavane TIS version 5.0.0 to a version where the DocumentBuilderFactory is hardened to disable external entities and DTD loading.

**Name of the Vulnerable Software and Affected Versions** MaxKey (affected versions not specified) **Description** An unauthorized access issue exists due to a hard-coded JWT signing secret within the `application-maxkey.properties` file. This allows unauthenticated attackers to forge valid JSON Web Tokens (JWT)—a compact, URL-safe means of representing claims to be transferred between two parties—and authenticate as any user. By utilizing the password-skipped login mechanism, attackers can sign a token with the default secret and submit it to the `/sign/login/jwt/trust` endpoint to obtain an authenticated administrator session, granting access to SSO application configurations and downstream application secrets. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ZenML version 0.94.6 **Description** The CloudpickleMaterializer component contains a flaw that allows remote code execution. An attacker with write access to a shared artifact store can replace a stored `artifact.pkl` file with a crafted cloudpickle payload. This payload uses a malicious ` reduce ` method to execute arbitrary system commands when a user or pipeline materializes the artifact via the unsanitized `cloudpickle.load()` call in `cloudpickle materializer.py`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LAMP Rapid Development Platform versions prior to 5.6.2 commit 84b0c27 **Description** An issue exists in GlueFactory that allows the execution of unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can manipulate the script field through message template endpoints to execute arbitrary Groovy code and operating system commands on the backend server. **Recommendations** Update LAMP Rapid Development Platform to the version containing commit 84b0c27.

**Name of the Vulnerable Software and Affected Versions** SnailJob version 1.7.0 **Description** An authenticated attacker can cause a denial of service by supplying a crafted Zstandard-compressed payload to the `FuryUtil.deserialize` helper. By inflating the `frame content size` field in the frame header and storing a base64-encoded Zstandard payload with an arbitrarily large decompressed size in a retry task argument, the attacker can force the JVM to attempt an unbounded array allocation. This results in an unrecoverable `java.lang.OutOfMemoryError` when the task is processed through the retry-task pipeline, crashing the server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.