Gnsehfvlr

An OS command injection issue exists in the `fill form()`, `dump data fields()`, and `pdftk cmd util()` functions. The software constructs shell commands using paths provided by the caller. An attacker who can control the `pdf path` or `out file` variables can inject shell metacharacters. These characters are interpreted by `subprocess.Popen` when `shell=True` is used, allowing the execution of arbitrary OS commands with the privileges of the Python process.

fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing proto , constructor or prototype key segments. Attackers can pass [ proto ] or [constructor.prototype] table headers or proto .x dotted keys to parse() to pollute all objects, causing denial of service or authorization bypass.

Inefficient regular-expression behavior in `geopy.Point` and the `Point.from string()` function can lead to excessive CPU consumption when processing long, malformed coordinate strings. This issue also affects geocoder reverse methods when they are called with string inputs. An attacker can trigger a denial of service by sending repeated requests containing such strings. The numeric Point constructor is not affected.

The software instantiates classes based on a configuration file without restricting which classes can be named. The `instantiate class` function in `vocos/pretrained.py` uses the `class path` value from the configuration to import a module via ` import ` and resolve an attribute using `getattr`, subsequently calling the result as `args class(*args, **kwargs)` with arguments from the `init args` mapping. Because there is no allowlist to constrain the dotted path, a configuration file can specify any importable callable and its arguments. This issue is reachable through `Vocos.from hparams` for `feature extractor`, `backbone`, and `head` entries, as well as through `Vocos.from pretrained`, which downloads a `config.yaml` from a specified Hugging Face repository. Consequently, loading a model from an untrusted repository allows the repository owner to execute arbitrary code during the loading process.