Mohammedix88

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function to python of the file haystack/backends/elasticsearch backend.py of the component more like this Template Tag Handler. Such manipulation of the argument result class leads to improper neutralization of directives in dynamically evaluated code. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.4.0 is able to address this issue. The name of the patch is eb05f193c9771a68dcc8cfac6674a0d48a52ee9d. It is suggested to upgrade the affected component.

**Name of the Vulnerable Software and Affected Versions** FedML-AI FedML versions prior to 0.9.7 **Description** An unsafe deserialization issue exists within the MQTT+S3 Communication Backend. The problem occurs in the `S3Storage.read model()` function located in the `fedml/core/distributed/communication/s3/remote storage.py` file. By manipulating the `s3 key str` argument, a remote attacker can cause the system to deserialize untrusted data from an attacker-controlled S3 object, potentially leading to remote code execution. Deserialization is the process of converting a serialized format (like a byte stream) back into an object in memory. **Recommendations** Restrict write access to model-storage buckets to ensure only trusted entities can upload artifacts. Verify the integrity of model artifacts before loading them. Isolate workers responsible for loading models. Minimize runtime privileges for model-loading processes. As a temporary mitigation, avoid using the `s3 key str` argument in the `S3Storage.read model()` function with untrusted sources until a patch is available.