Superboy-Zjc

Agenta is an open-source LLMOps platform. In Agenta-API versions prior to 0.48.1, a Python sandbox escape existed in Agenta's custom code evaluator. The platform used RestrictedPython as a sandboxing mechanism for user-supplied evaluator code, but incorrectly whitelisted the `numpy` package as safe within the sandbox. This allowed authenticated users to bypass the sandbox and achieve arbitrary code execution on the API server. The escape path was through `numpy.ma.core.inspect`, which exposes Python's introspection utilities – including `sys.modules` – thereby providing access to unfiltered system-level functionality like `os.system`. The custom code evaluator runs server-side within the API process.

openmcp-client, a VS Code plugin for MCP developers, contains a flaw where a malicious authorization server endpoint can be provisioned by an attacker when a user on a Windows platform connects to an attacker-controlled MCP server. This can lead to an OS command injection attack in the `open()` invocation, potentially compromising the client system.

The vulnerability arises from the core functionality `set property value`, which can be remotely triggered by users by crafting appropriate component requests and feeding in values of the second and third parameters to the vulnerable function, leading to arbitrary changes to the python runtime status. This issue can result in Cross-Site Scripting (XSS), Denial of Service (DoS), and Authentication Bypass attacks in almost every Django-Unicorn-based application. At least five ways of vulnerability exploitation have been observed.

Gradio's Access Control List (ACL) for file paths can be bypassed by altering the letter case of a blocked file or directory path due to the lack of case normalization in the file path validation logic. This issue can lead to unauthorized data access, exposing sensitive information and undermining the integrity of Gradio's security model. On case-insensitive file systems, such as those used by Windows and macOS, this flaw enables attackers to circumvent security restrictions and access sensitive files that should be protected.

A critical remote OS command injection vulnerability has been identified in the LLama Factory training process. This issue arises from improper handling of user input, allowing malicious actors to execute arbitrary OS commands on the host system. The problem is caused by insecure usage of the `Popen` function with `shell=True`, coupled with unsanitized user input. This vulnerability enables attackers to execute arbitrary OS commands on the server, potentially compromise sensitive data or escalate privileges, and deploy malware or create persistent backdoors in the system, significantly increasing the risk of data breaches and operational disruption.