Tanguy Snoeck

**Name of the Vulnerable Software and Affected Versions** Feast versions prior to 0.63.0 **Description** An unsafe deserialization issue exists in the registry server that allows unauthenticated or unauthorized attackers to achieve remote code execution. By sending a crafted gRPC request, an attacker can exploit the `user defined function.body` field of an OnDemandFeatureView spec. This field is base64-decoded and passed to the `dill.loads()` function before any authorization checks occur. This allows the embedding of a malicious serialized Python object with an arbitrary ` reduce ` method to execute OS commands under the privileges of the feast service account. **Recommendations** Update to version 0.63.0 or newer.

**Name of the Vulnerable Software and Affected Versions** Chainlit versions prior to 2.10.1 **Description** An issue exists where unauthenticated attackers can restore and inherit authenticated user sessions. This occurs during WebSocket session restoration when a valid `sessionId` is presented without ownership verification via the 'restore existing session' path. Successful exploitation allows an attacker to assume a victim's permissions and roles, leading to unauthorized access to restricted data and the ability to invoke tools. **Recommendations** Update to version 2.10.1 or later.