Romain-Deperne

Manifests in deployments/aio/community/ and deployments/cli/community/ use fixed, publicly known default values for `SECRET KEY` and `LIVE SERVER SECRET KEY` that remain active if not overridden. While the setup.sh script randomizes secrets for the development Docker Compose path, it does not do so for aio and cli community deployments. An attacker with knowledge of `SECRET KEY` can forge Django-signed values to compromise sessions or accounts. Additionally, knowledge of `LIVE SERVER SECRET KEY` allows for the bypass of live-service authentication on affected community deployments.

A path traversal issue exists in the `confluence upload attachment` tool. The `file path` variable is passed directly to the `open()` function without proper validation, allowing a caller to read arbitrary files accessible by the server process. These files can then be exfiltrated by uploading them to an attacker-controlled Confluence host. In default `streamable-http` transport deployments, the server binds to `0.0.0.0` without authentication, which may allow remote exploitation. This issue is a read-side counterpart to a previous arbitrary file write flaw.

The `NumpyReader` class contains an unsafe deserialization issue. It unconditionally uses the `numpy.load` function with the `allow pickle=True` parameter when processing `.npy` and `.npz` files. This allows an attacker to provide a specially crafted `.npy` file containing pickle payloads, which can lead to arbitrary code execution when the file is loaded through the standard data pipeline. Deserialization is the process of converting a data format back into an object, and unsafe deserialization occurs when untrusted data is used to instantiate objects without proper validation.

Database backup handling for MongoDB collection names fails to fully validate shell metacharacters. This allows a highly privileged attacker with the ability to configure backup inputs to perform command injection.

Dokploy is a self-hostable Platform as a Service (PaaS). A command injection issue exists in the `deleteRegistry()` function within the `packages/server/src/services/registry.ts` file. The application executes a docker logout command using the `registryUrl` variable without proper shell escaping, allowing for the execution of arbitrary commands when a crafted `registryUrl` is provided.

Stored cross-site scripting occurs in VRF display pages when fields obtained via SNMP polling are rendered without proper sanitization. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP responses, which then executes in the browser of any user accessing VRF-related pages. The affected variables are `mplsVpnVrfDescription`, `vrf name`, and `mplsVpnVrfRouteDistinguisher`.

XSRF protection inappropriately treated requests containing the `Sec-Fetch-Mode: no-cors` header as same-origin requests, allowing the bypass of XSRF checks. This affects HTTP form endpoints, such as '/hub/spawn' and '/hub/accept-share', while the JSON API remains unaffected. An attacker could trigger a server spawn or, if permitted to share server access, force a user to accept a share and gain access to the attacker's server.

DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers construct SQL WHERE clauses by interpolating dynamic partition key values into queries without escaping. A user with the `Add Dynamic Partitions` permission can create a partition key that injects arbitrary SQL, which executes against the target database backend using the I/O manager's credentials. This issue only affects deployments using dynamic partitions; pipelines using static or time-window partitions are not impacted.

The PENS (Package Exchange Notification Services) plugin endpoint ''public/plugin/Pens/pens.php'' is accessible without authentication. It accepts a user-controlled `package-url` parameter that the server fetches using curl without filtering private or internal IP addresses, enabling Server-Side Request Forgery (SSRF). SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unexpected destination. An attacker can use this to probe internal network services, access cloud metadata endpoints to steal IAM credentials and sensitive instance metadata, or trigger state-changing operations on internal services via the `receipt` and `alerts` callback parameters.

The file 'public/main/inc/ajax/install.ajax.php' is accessible without authentication on fully installed instances because it lacks the inclusion of the global.inc.php file, which handles authentication and installation checks. The `test mailer` action accepts an arbitrary Symfony Mailer DSN string via POST data to connect to a specified SMTP server. This allows an unauthenticated attacker to perform Server-Side Request Forgery (SSRF), a technique where the server is induced to make requests to internal network resources, via the SMTP protocol. This can be used to turn the server into an open email relay for phishing and spam, or to disclose internal network topology and running services through error responses from failed connections.

Name of the Vulnerable Software and Affected Versions Plunk versions prior to 0.8.0 Description Plunk, an email platform built on AWS SES, had a CRLF header injection issue in the SESService.ts component. User-provided data for `from.name`, `subject`, custom header keys/values, and attachment filenames was directly included in raw MIME messages without proper sanitization. An authenticated API user could inject arbitrary email headers, such as Bcc or Reply-To, by embedding carriage return/line feed characters into these fields, potentially enabling silent email forwarding, reply redirection, or sender spoofing. Recommendations Update to version 0.8.0 or later.

The `ollamaStartupProbeScript()` function in KubeAI constructs a shell command string using `fmt.Sprintf` with unsanitized model URL components (`ref`, `modelParam`). This command is executed via `bash -c` as a Kubernetes startup probe. An attacker who can create or update `Model` custom resources can inject arbitrary shell commands that execute inside model server pods. The `parseModelURL()` function uses a regular expression that allows shell metacharacters in the `ref` component and does not sanitize the `modelParam` query parameter. This allows for command injection through the model URL or the `?model=` query parameter. Successful exploitation could lead to arbitrary command execution within the model server pods, potentially allowing for data exfiltration, compromise of the model serving infrastructure, and lateral movement within a multi-tenant Kubernetes cluster.

Graphiti, a framework for building and querying temporal context graphs for AI agents, had a Cypher injection issue in shared search-filter construction for non-Kuzu backends. Attacker-controlled label values provided through `SearchFilters.node labels` were directly concatenated into Cypher label expressions without validation. In MCP deployments, this was exploitable through direct untrusted access to the Graphiti MCP server and through prompt injection against an LLM client that could be induced to call `search nodes` with attacker-controlled `entity types` values. The MCP server mapped `entity types` to `SearchFilters.node labels`, which then reached the vulnerable Cypher construction path. Affected backends included Neo4j, FalkorDB, and Neptune. Kuzu was not affected because it used parameterized label handling. Successful exploitation could allow arbitrary Cypher execution within the privileges of the configured graph database connection, potentially enabling unauthorized data access, modification, or deletion, and bypassing logical group isolation. The issue also involved a separate, narrower issue in fulltext search query construction for unvalidated `group ids`.