Fiona

NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee() that lets authenticated users access unassigned AI employees by overriding the role-derived filter with a supplied username. Attackers can use the dispatch-sub-agent-task tool to run ungranted AI employees with their tools and permissions, and get-ai-employee to read their prompts and tool configuration.

Authenticated attackers can bypass the `SqlInjectionUtil` keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. This allows for boolean or time-based blind injection—a technique used to extract data from a database by asking true/false questions or measuring response times—via endpoints such as '/sys/dict/getDictItems'. This flaw can be used to extract sensitive database contents, including administrator password hashes from the `sys user` table.

Xinference unconditionally enables Hugging Face remote code execution during model loading. This occurs because six loader call sites pass `trust remote code=True` as a literal or unconditional default. The affected functions include `RerankModel. get tokenizer` in xinference/model/rerank/core.py, `SentenceTransformerRerankModel.load` in xinference/model/rerank/sentence transformers/core.py, `SentenceTransformerEmbeddingModel.load` in xinference/model/embedding/sentence transformers/core.py, `FlagEmbeddingModel.load` in xinference/model/embedding/flag/core.py, and both `PytorchModel. sanitize model config` and `PytorchModel. get components` in xinference/model/llm/transformers/core.py. A user with model launch access can register a model of an unknown type and provide an arbitrary model path. This triggers the ` auto detect type` process and subsequently `AutoTokenizer.from pretrained`, which imports and executes Python code defined in the `auto map` of the model directory's `tokenizer config.json` file. This allows the execution of attacker-supplied code with the privileges of the worker process.

An XML external entity (XXE) injection exists when the software processes XML through an unhardened DocumentBuilderFactory with external entities and DTD loading enabled. Authenticated attackers can exploit this by supplying a crafted `taskScript` payload to the 'doEditWorkflow' endpoint. This allows for server-side request forgery (SSRF), where the server is forced to make outbound HTTP requests to attacker-controlled infrastructure, and out-of-band file exfiltration of local files readable by the TIS process user, such as configuration files and Derby database credentials.

An unauthorized access issue exists due to a hard-coded JWT signing secret within the `application-maxkey.properties` file. This allows unauthenticated attackers to forge valid JSON Web Tokens (JWT)—a compact, URL-safe means of representing claims to be transferred between two parties—and authenticate as any user. By utilizing the password-skipped login mechanism, attackers can sign a token with the default secret and submit it to the `/sign/login/jwt/trust` endpoint to obtain an authenticated administrator session, granting access to SSO application configurations and downstream application secrets.

The CloudpickleMaterializer component contains a flaw that allows remote code execution. An attacker with write access to a shared artifact store can replace a stored `artifact.pkl` file with a crafted cloudpickle payload. This payload uses a malicious ` reduce ` method to execute arbitrary system commands when a user or pipeline materializes the artifact via the unsanitized `cloudpickle.load()` call in `cloudpickle materializer.py`.

An authenticated attacker can cause a denial of service by supplying a crafted Zstandard-compressed payload to the `FuryUtil.deserialize` helper. By inflating the `frame content size` field in the frame header and storing a base64-encoded Zstandard payload with an arbitrarily large decompressed size in a retry task argument, the attacker can force the JVM to attempt an unbounded array allocation. This results in an unrecoverable `java.lang.OutOfMemoryError` when the task is processed through the retry-task pipeline, crashing the server.

An issue exists in GlueFactory that allows the execution of unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can manipulate the script field through message template endpoints to execute arbitrary Groovy code and operating system commands on the backend server.