Jiacheng Zhong

**Name of the Vulnerable Software and Affected Versions** comfyanonymous comfyui version 0.3.40 **Description** A vulnerability was found in the function `set attr` of the file `/comfy/utils.py`, which can lead to dynamically-determined object attributes. The attack can be launched remotely, but it has a high complexity and is considered difficult to exploit. The exploit has been disclosed to the public. **Recommendations** For version 0.3.40, consider disabling the `set attr` function in the `/comfy/utils.py` file as a temporary workaround until a patch is available. Restrict access to the `/comfy/utils.py` file to minimize the risk of exploitation. Avoid using the `set attr` function remotely until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Redash versions up to 10.1.0/25.1.0 **Description** A critical issue affects the `run query` function of the `/query runner/python.py` file in the `getattr` Handler component, leading to a sandbox issue. The exploit has been disclosed publicly and may be used. The vendor was contacted about this disclosure but did not respond. **Recommendations** For Redash versions up to 10.1.0/25.1.0, as a temporary workaround, consider disabling the `run query` function until a patch is available. Restrict access to the `/query runner/python.py` file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** gradio-app gradio versions up to 5.29.1 **Description** A problematic vulnerability has been found in the CORS Handler component, specifically affecting the `is valid origin` function. The issue arises from the manipulation of the `localhost aliases` argument, leading to an origin validation error. This vulnerability can be exploited remotely, with a relatively high complexity of attack and difficult exploitability. The exploit has been publicly disclosed. **Recommendations** For versions up to 5.29.1, as a temporary workaround, consider restricting the use of the `is valid origin` function in the CORS Handler component until a patch is available. Additionally, be cautious when using the `localhost aliases` argument to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** aimhubio aim versions prior to 3.29.1 **Description** A critical issue exists in the run view Object Handler component within the `/aim/storage/query.py` file. The `RestrictedPythonQuery()` function is susceptible to remote manipulation via the `Query` argument, which leads to a sandbox bypass and potentially elevated privileges. This flaw allows an attacker to initiate the attack remotely. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the `RestrictedPythonQuery()` function in the `/aim/storage/query.py` file to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Azure Command Line Integration (CLI) (affected versions not specified) Description: The issue is related to improper neutralization of special elements used in a command, also known as 'command injection', in Azure Command Line Integration (CLI). This allows an unauthorized attacker to elevate privileges locally. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.