Gregory Tan

**Name of the Vulnerable Software and Affected Versions** Axolotl versions prior to 0.18.1 **Description** A remote code execution issue exists in the multipack patch path. The security guard is bypassed because the `trust remote code` variable defaults to None instead of False. An attacker can execute arbitrary Python code by providing a malicious Hugging Face model repository as the `base model`, which is then loaded with `trust remote code=True` during the `AutoModelForCausalLM.from pretrained()` function call. **Recommendations** Update Axolotl to version 0.18.1 or later.

**Name of the Vulnerable Software and Affected Versions** Headroom (affected versions not specified) **Description** The LLM proxy allows clients to specify the upstream destination using the `x-headroom-base-url` request header. The functions ` resolve openai upstream base()` in headroom/proxy/handlers/openai.py and ` select passthrough base url()` in headroom/providers/proxy routes.py process this header without validating the destination. This lack of validation for loopback, link-local, or RFC 1918 addresses enables requests to reach internal services and cloud metadata addresses, disclosing their responses to the caller. Additionally, the `Authorization` header is forwarded unchanged to the client-specified host. When deployed using the reference docker-compose.yml with `--host 0.0.0.0` and without a `HEADROOM PROXY TOKEN`, these data-plane routes are exposed to the network without authentication. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Headroom (affected versions not specified) **Description** The LLM proxy derives the memory owner from the `x-headroom-user-id` request header. This header is read directly within `headroom/proxy/handlers/openai.py`, specifically in the chat completion and websocket paths, without verifying the value against the actual caller. Consequently, a client can impersonate another user by providing their identifier to read or write that user's stored LLM memory. Deployments using the reference docker-compose.yml are particularly exposed as they may ship with `--host 0.0.0.0` and no required `HEADROOM PROXY TOKEN`, leaving data-plane routes accessible to the network without authentication. **Recommendations** Update the software to the version that implements the `resolve memory identity` function in `headroom/proxy/identity.py` to ensure the `x-headroom-user-id` header is only honored for loopback or allowlisted callers. Avoid deploying the proxy with `--host 0.0.0.0` without a configured `HEADROOM PROXY TOKEN` to prevent unauthorized network access.

**Name of the Vulnerable Software and Affected Versions** marimo versions prior to 0.23.15 **Description** A code injection flaw exists in the notebook configuration handler. Attackers can execute arbitrary commands by embedding a crafted MCP server entry with a controlled `command` value within a notebook. When the notebook is opened in edit mode, the software launches the specified command as a local subprocess before any notebook cell is executed. This process requires no authentication or cell execution to trigger. Real-world exploitation has been observed where attackers use this method to achieve privilege escalation and lateral movement into connected cloud workloads. **Recommendations** Update marimo to version 0.23.15.

**Name of the Vulnerable Software and Affected Versions** marimo versions prior to 0.23.15 **Description** Configuration injection occurs due to insufficient sanitization in the `sanitize pyproject dict()` function. This allows notebook authors to embed a malicious `base url` within PEP-723 inline script metadata. Because this metadata is merged into the session configuration with higher precedence than the operator's settings, an attacker can exfiltrate API keys. When an operator opens a crafted notebook and initiates an AI request, the system uses the attacker-controlled `base url` while utilizing the operator's `OPENAI API KEY` environment variable for authentication, sending the key to the external endpoint without requiring any cell execution. **Recommendations** Update to version 0.23.15 or later.