Sunnyr

A cross-request mask leak exists in the `condense()` function of the InputBatch class. This issue allows remote attackers to constrain the outputs of other clients by leaving stale `allowed token ids` rows. By submitting concurrent constrained generate requests, including through the unauthenticated '/invocations' endpoint, attackers can cause recycled batch slots to apply their token allowlist to the unrestricted requests of other users.

An issue exists in the `nginx.conf` file where the use of the backend-facing `$scheme` variable in the trailing-slash directory redirect allows an on-path network attacker to read or modify documentation content. This occurs when a victim makes an HTTPS request for a slashless directory path; since TLS terminates at the load balancer in front of Nginx, the resulting 301 response redirects the client to a plaintext http:// URL. This affects clients that do not enforce HSTS (HTTP Strict Transport Security), such as scripts that follow redirects and command-line HTTP clients. Browsers with a preloaded HSTS list are not affected due to the .dev top-level domain being preloaded.

Improper neutralization of special elements used in an OS command allows an actor who controls the `project id` or `storage bucket` inputs to execute arbitrary shell commands on the GitHub Actions runner. This occurs because these inputs are interpolated directly into Bash gcloud storage cp commands in several steps via `${{ inputs.* }}` expressions.

The software allows users to build and publish OCI container images from apk packages. A flaw exists in the `UserEntry.Parse` and `GroupEntry.Parse` functions within `pkg/passwd` when reading UID and GID fields from `/etc/passwd` and `/etc/group` entries. The system uses `strconv.Atoi` to convert these fields to `uint32` without performing a range check. On 64-bit platforms, negative values wrap and out-of-range values, such as 4294967296 (2^32), are truncated to 0. An attacker controlling a package installed into the image can provide an entry that appears to be an unprivileged UID or GID but is written into the final image as UID 0 or GID 0 (root). This truncated UID is also utilized when resolving the image's run-as user.