Rexpository

The '/v1/responses' endpoint allows an authenticated user to provide a malicious template via the `chat template` variable within `chat template kwargs` when no server template is configured. The `get apply chat template kwargs()` function fails to enforce the `trust request chat template` policy, allowing the request to bypass security controls. This can lead to CPU or memory exhaustion during Jinja rendering, a process used to generate text templates.

Improper input validation in the Rust gRPC converter allows remote attackers to bypass `max logprobs` limits. By sending Generate or GenerateStream requests with oversized or integer-wrapping values in the `CandidateTokens.top n` variable, an attacker can trigger `torch.topk()` failures, which results in the termination of EngineCore.

A decompression bomb issue exists in the AudioMediaIO multimodal path due to the `load audio()` function being called without a `max duration s` decoded-duration limit. Authenticated attackers can exploit this by sending small compressed audio files via the `input audio` or `audio url` parameters in the '/v1/chat/completions' endpoint. These files expand into massive decoded PCM (Pulse Code Modulation, a raw audio format), leading to server memory exhaustion.

Improper input validation in the Rust gRPC Generate and GenerateStream services allows the forwarding of unchecked prompt token IDs to EngineCore. An attacker can submit requests containing out-of-vocabulary `prompt.token ids` values, triggering a fatal embedding lookup failure. This failure terminates EngineCore, resulting in an unhealthy server state.

A denial of service issue exists in the Rust gRPC frontend that allows remote attackers to terminate EngineCore. By sending Generate or GenerateStream requests with `output logprobs` enabled and providing more than 128 `output candidates.token ids`, an attacker can bypass limits and trigger a fatal sampler exception, resulting in an engine crash.

A time-of-check time-of-use (TOCTOU) symlink race occurs when executing a magick script. This allows attackers to bypass the path security policy by swapping a checked path with a symlink during execution, enabling the reading of files that the security policy is intended to block.

An authorization bypass allows authenticated record users to read records in other namespaces or databases. This occurs when attackers switch to a foreign namespace or database and specify a known record id within a `RETURN ... FETCH` query to access another tenant's data, provided that table `PERMISSIONS` allow reads.

A policy bypass exists in the `-script` operation caused by missing checks on file descriptor handling. This allows attackers to close file descriptors that were not opened by the current operation, which enables the circumvention of configured security policies.

A code injection issue exists in the MVG decoder when utilizing a PostScript renderer. An attacker can provide a specially crafted MVG file that, during the decoding process, injects code into the PostScript rendering path.

Code injection is possible in the PostScript coders because certain values are not properly escaped or trimmed during output. This allows attackers to embed arbitrary PostScript code into generated files by providing specially crafted values.

A heap buffer overflow occurs when a crafted call is made to the 'GetVirtualPixels' API. This allows attackers to overwrite heap memory through crafted input, which can lead to a server crash and a resulting denial of service. A heap buffer overflow is a condition where a program writes more data to a heap-allocated memory block than it can hold.

A resource leak occurs when the software processes a crafted magick script, allowing attackers to leave file pointers open. This leads to the leakage of file descriptors, which can exhaust system resources and result in a denial of service.

A denial of service issue exists in the MVG decoder due to a missing limit check. An attacker can provide a specially crafted MVG image that triggers a long-running decoding operation, leading to excessive CPU resource consumption and stalling image processing.

The system clipboard cell-paste path accepts attacker-controlled cell JSON without clearing the `metadata.trusted` attribute. When the `useSystemClipboardForCells` setting is active and `pasteCodeCellsWithoutOutput` is disabled, a pasted code cell can mark HTML output as trusted. This allows the bypass of output sanitization and the execution of scripts within the authenticated JupyterLab origin without requiring the cell to be executed. Markdown and raw cells are not affected as their output is sanitized.

In the PyPI Extension Manager, the `ExtensionHandler.post` function validates extension names during installation but fails to reject option-like values during uninstallation. These values are passed directly to `PyPIExtensionManager.uninstall` and the `python -m pip uninstall` command. An authenticated user with access to the extension API can provide a pip requirements option to force the server to read a local file or fetch an internal URL, where reflected parse errors may reveal the first unparsable line or response content. Additionally, a pip log option can be used to create or corrupt a specific file path with pip-generated log text. This issue requires the PyPI Extension Manager to be enabled and the user to have extension API access.

The software fails to apply the Buffer backing-store ownership invariant to Buffers returned from host builtin modules. When the `zlib` module is exposed via the NodeVM builtin allowlist, the `zlib.deflateSync()` function can return a Buffer backed by the shared small-buffer pool. This allows untrusted guest code to create a full-width view of the `ArrayBuffer` to read and modify bytes from unrelated host buffers, leading to memory disclosure and corruption across the sandbox boundary.

Global Active Memory toggle mutations may omit owner authorization checks. This allows an authorized non-owner external-channel sender to persistently enable or disable Active Memory for the Gateway. Consequently, memory recall for future sessions can be disabled, or global recall can be re-enabled against the owner's expectations. This issue is restricted to persistent global on/off mutations, while session-level controls and read-only status continue to be managed by the existing command policy.

A denial of service issue exists in the Browser extension relay. Unauthenticated network sources can exhaust the pending-authentication capacity by maintaining silent WebSocket upgrades. This action occupies all available pending slots, which prevents paired extensions from completing the Browser Relay Authentication v2 process.

An authorization bypass exists in the `/voice set` endpoint. This allows senders from external channels who are not owners to persist Gateway voice configuration. Attackers with command access can modify the voice used by Talk responses for the configured provider, which compromises configuration integrity. This issue does not expose credentials or grant additional host capabilities.

Persistent memory dreaming mutations omit owner permission checks. An authorized but non-owner external-channel sender can issue the '/dreaming on' and '/dreaming off' commands to enable or disable the Gateway's Memory Core dreaming behavior. This allows an attacker to disable background memory processing or re-enable durable memory promotion against the owner's expectations. The impact on confidentiality, integrity, and availability depends on the stored conversation material and subsequent memory use. Read-only status and help commands are not affected.