Mtholmquist

Authenticated users can perform a server-side request forgery (SSRF), which occurs when a server is tricked into making requests to an unintended location. This issue allows the reading of internal URLs via image-bearing export formats. An attacker can import tasks where the `data.image` variable points to internal services and then export them as YOLO or COCO formats with images to read the responses. Additionally, by spoofing the Host header, an attacker can capture the API token of the organization owner.

The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the from pretrained() method and related paths. When loading a policy's processor configuration from a repository, the library uses the class field within the JSON configuration to dynamically resolve and instantiate Python classes using importlib.import module() and getattr().

Certain endpoints fail to enforce proper authorization checks during document creation. This allows authenticated low-privileged users to send requests to these endpoints to create documents against records that exceed their permitted role, effectively bypassing role-based permission restrictions.

Server-side template injection occurs because user-controlled message fields are not validated before template rendering, which allows expressions to run in an unrestricted context. Authenticated attackers with a common operational role can inject template expressions to read and write arbitrary database data, delete documents, send outbound requests from the server, and send mail from the site.

A heap-based buffer over-read occurs in the `H5Z filter scaleoffset()` function within `src/H5Zscaleoffset.c`. This issue allows an attacker to cause a denial of service resulting in an application crash by using a specially crafted HDF5 file. The flaw exists because the decoder copies `d nelmts` * `size` bytes from a compressed chunk without verifying if the chunk contains the required amount of data when the stored minimum bits match the full precision of the datatype. Both `d nelmts` and `size` are parameters controlled by the attacker within the dataset's filter pipeline message.

An SQL injection issue exists in the Oracle Database node's Delete Table Drop operation. Attackers can inject single quotes into the `table` or `schema` fields to append arbitrary SQL statements. This allows the execution of Data Definition Language (DDL) commands, which modify database structures, or Data Manipulation Language (DML) commands, which modify data, against the connected database using the privileges of the provided credentials.

When executing Node tools under the Node permission model, the inclusion of TailwindCSS in the default `security.exec.allow` list requires a highly permissive configuration, specifically using `--allow-addons`, `--allow-child-process`, and `--allow-worker`. This allows a Node tool invoked during a build to bypass intended restrictions and read or write files outside the project working directory.

The software calculates the size of weight and output heap buffers for a convolutional layer using unchecked 32-bit integer arithmetic based on fields from a `.cfg` file. In the file `src-lib/convolutional layer.cpp`, the variables `l.nweights` and `l.outputs` are computed and passed to `xcalloc`. If the product of the dimensions in the `.cfg` file exceeds `INT MAX`, an integer overflow occurs, resulting in an undersized buffer allocation. Subsequently, the `forward convolutional layer` function re-derives the GEMM (General Matrix Multiply) dimensions using a different operand order, leading to out-of-bounds read and write operations through the undersized buffer. This can be triggered by loading a specially crafted `.cfg` file during inference or training, without requiring a valid `.weights` file. This issue can lead to heap buffer overflow reads in `gemm nn fast()` and glibc allocator metadata corruption.

An integer overflow occurs in the `msgpack unpacker expand buffer` function within `src/unpack.c`, which is accessible via the `msgpack unpacker reserve buffer` API. The function calculates the new buffer size using an unchecked `size t` addition of the requested size and the amount already used. When a request near `SIZE MAX` is made, the addition wraps, causing the loop condition to be satisfied prematurely. Consequently, the allocation is performed at a small pre-wrap size, but the function returns a success status. This leads the caller to believe the requested capacity was reserved, resulting in a heap buffer overflow during subsequent write operations. This issue can be triggered in integrations that pass attacker-influenced lengths to the reservation API, such as length-prefixed streaming transports.