Yu Sun

**Name of the Vulnerable Software and Affected Versions** Gopeed versions prior to 2.0.0-beta.4 **Description** A path traversal issue exists during archive extraction, allowing attackers to write arbitrary files outside the intended extraction directory. This occurs when users download and extract archives with the AutoExtract feature enabled. Attackers can achieve this by crafting malicious archives containing directory traversal sequences that bypass validation. **Recommendations** Update Gopeed to version 2.0.0-beta.4 or later. Disable the AutoExtract feature as a temporary mitigation measure.

**Name of the Vulnerable Software and Affected Versions** RAGFlow versions prior to 0.27.3 **Description** Authenticated attackers can read arbitrary files by exploiting missing path validation. By providing absolute file paths in the `file path` parameter, users with valid access tokens can access any file the service has permissions to read. This issue affects the 'dev insert chunks from file' and 'dev insert metadata from file' endpoints. Disclosure is limited to files that match the expected JSON structures, which are subsequently written to datasets. **Recommendations** Update RAGFlow to version 0.27.3 or later. As a temporary mitigation, restrict access to the 'dev insert chunks from file' and 'dev insert metadata from file' endpoints or avoid using the `file path` parameter with absolute paths.

**Name of the Vulnerable Software and Affected Versions** nbviewer versions prior to 1.0.2 **Description** A path traversal issue exists in the `can show()` function of the LocalFileHandler. The system uses string-prefix comparison instead of proper path validation, allowing attackers to read files from sibling directories outside the configured root. This occurs when requesting paths that share the root as a textual prefix, which can lead to the disclosure of unintended notebooks and credentials. **Recommendations** Update nbviewer to version 1.0.2 or later. As a temporary workaround, restrict access to the `can show()` function within the LocalFileHandler to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Aix-DB versions 1.0 through 1.2.4 **Description** The software renders markdown with raw HTML enabled into `v-html` bindings without proper sanitization, leading to stored cross-site scripting. This allows attackers to inject malicious HTML and JavaScript through markdown content within chat responses, skill descriptions, or knowledge messages, which then execute in the browsers of users who view the content. **Recommendations** Update Aix-DB to a version later than 1.2.4.

**Name of the Vulnerable Software and Affected Versions** YaCy Search Server versions prior to 1.942 **Description** An XML external entity injection issue exists in the SVG, FreeMind, and OpenSearch parsers because they fail to disable external entity resolution. This allows attackers to publish malicious documents containing DOCTYPE declarations with SYSTEM entities pointing to local files, which enables the crawler to exfiltrate the contents of those files into the searchable index. **Recommendations** Update YaCy Search Server to version 1.942 or later.

**Name of the Vulnerable Software and Affected Versions** Omnivore API (packages/api) versions prior to commit abf53d6 **Description** An authentication bypass exists in the Apple sign-in token verification process. The `decodeAppleToken()` function extracts the `alg` field from the JWT header provided by the user and passes it as the only permitted algorithm to `jwt.verify()`. When using jsonwebtoken v8, which lacks key and algorithm compatibility validation, an attacker can set `alg` to HS256 and sign a forged token using Apple's public RSA key as the HMAC secret. This allows the attacker to bypass signature verification and impersonate any account linked to Apple. **Recommendations** Update Omnivore API (packages/api) to the version containing commit abf53d6.

**Name of the Vulnerable Software and Affected Versions** X-AnyLabeling (affected versions not specified) **Description** The model downloader disables TLS certificate verification by using `ssl. create unverified context()` within the `download with retry()` function in `anylabeling/services/auto labeling/model.py`. This allows an attacker to intercept HTTPS connections and provide malicious content. The `safe check model()` function only validates the file format and does not verify the file's provenance via hashes or signatures. For ONNX targets, an attacker can control the model used for inference. For `.pth` or `.pt` targets used by SAM2 video, YOLOE, UPN, and open vision configurations, the application calls `torch.load()` without the `weights only` parameter, which can lead to arbitrary code execution during the unpickling process on older PyTorch releases. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** telegram-search (affected versions not specified) **Description** A stored cross-site scripting issue exists that allows remote attackers to execute arbitrary JavaScript in the browsers of other users. This occurs when crafted messages containing unsanitized HTML are sent to a shared Telegram group. Specifically, the `highlightKeyword()` function in `MessageList.vue` passes raw message content directly to `v-html` without proper HTML escaping or sanitization. This enables zero-click execution of injected payloads, such as image `onerror` handlers, when victims browse or search for messages. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PapersGPT for Zotero version 0.6.1 **Description** A remote code execution issue exists where arbitrary JavaScript can be executed by returning malicious code from an LLM endpoint. This occurs because the response is passed unsanitized to the `window.eval()` function within `views.ts`. Exploitation can be achieved through prompt injection in PDFs, Man-in-the-Middle (MITM) interception of API requests, or the use of a malicious custom LLM endpoint. Successful exploitation allows arbitrary code execution within Zotero's chrome-privileged context, granting the attacker capabilities to read and write files, execute processes, and access all Zotero data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NetBox version 4.5.8 **Description** An ORM injection exists that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references. This is achieved by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any REST API endpoint. By exploiting the unrestricted queryset used by `WritableNestedSerializer`, attackers can perform boolean-based blind data extraction of sensitive field values and bypass object-level permissions across several application modules, including dcim, ipam, tenancy, virtualization, circuits, and extras. ORM injection is a technique where an attacker manipulates the database queries generated by an Object-Relational Mapper (ORM) to access or modify unauthorized data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FlyEnv versions prior to 4.18.0 **Description** FlyEnv fails to sanitize HTML content originating from markdown rendering and AI chat messages when passed to Vue `v-html` directives. This allows attackers to inject malicious scripts that execute within the Electron renderer process, granting unauthorized access to Node.js APIs and the local filesystem. **Recommendations** Update FlyEnv to version 4.18.0 or later.

**Name of the Vulnerable Software and Affected Versions** unearth versions prior to 0.18.2 **Description** A path traversal issue exists in the `is within directory()` function, which fails to normalize paths before validation. This allows `../` sequences to bypass directory containment checks. An attacker can use malicious tar archives containing symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process. **Recommendations** Update to the version containing commit 6c78164.

**Name of the Vulnerable Software and Affected Versions** SQLBot versions prior to 1.10.0 commit c3f40a5 **Description** The SQText dashboard component renders TinyMCE output using `v-html` without proper sanitization. This allows attackers with permissions to modify dashboard text widget content to inject arbitrary HTML and JavaScript, which then executes in the browser of any user viewing the dashboard. **Recommendations** Update SQLBot to the version containing commit c3f40a5.

**Name of the Vulnerable Software and Affected Versions** OpenCode Studio versions prior to 2.4.4 **Description** Missing authentication allows remote attackers to read arbitrary files within the temp and static/music directories. This is achieved by accessing the 'GET /api/tmp/:tmpFile' and 'GET /api/music/:fileName' endpoints, enabling the retrieval of intermediate audio, video artifacts, and subtitles from other users. Additionally, attackers can delete videos by ID using the 'DELETE /api/short-video/:videoId' endpoint. The vulnerable variables include `tmpFile`, `fileName`, and `videoId`. **Recommendations** Update to version 2.4.4 or later. Restrict access to the 'GET /api/tmp/:tmpFile', 'GET /api/music/:fileName', and 'DELETE /api/short-video/:videoId' endpoints as a temporary mitigation.

**Name of the Vulnerable Software and Affected Versions** BlenderMCP versions prior to commit 30a3308 **Description** A path traversal issue exists in the `download polyhaven asset()` function. This flaw allows attackers to write arbitrary files by injecting traversal sequences into API response include keys. By utilizing Man-in-the-Middle (MITM) attacks or prompt injection, an attacker can provide malicious paths, such as `../../.bashrc`, to overwrite sensitive files and achieve persistent code execution. **Recommendations** Update BlenderMCP to commit 30a3308 or a later version. As a temporary mitigation, restrict the use of the `download polyhaven asset()` function.

**Name of the Vulnerable Software and Affected Versions** Datasets versions prior to 5.01 **Description** A symlink-following issue exists in the `Extractor.extract()` function. Local attackers can write arbitrary files by pre-planting symbolic links (shortcuts that point to another file or directory) at predictable output paths. In shared-cache environments, this allows the redirection of archive extraction to arbitrary filesystem locations, which can lead to the overwriting of sensitive files, privilege escalation, or code execution. **Recommendations** Update to the version containing commit ad2d853. As a temporary mitigation, restrict access to the `Extractor.extract()` function to prevent unauthorized users from triggering archive extractions.

**Name of the Vulnerable Software and Affected Versions** FlashAttention versions prior to 2.8.3.post1 **Description** A symlink attack exists in the `download and copy()` function within hopper/setup.py. The issue occurs because NVIDIA toolchain archives are extracted without validating symlinks or filtering tar members. A local attacker can place a symlink in the predictable cache directory to redirect extracted binaries to a location of their choice, allowing arbitrary file write with the privileges of the victim during the build process. **Recommendations** Update FlashAttention to the version containing commit 0816ef1.

**Name of the Vulnerable Software and Affected Versions** Dify versions prior to 1.16.0-rc1 **Description** A SQL injection issue exists in the MyScale vector store backend. This occurs when unsanitized search parameters are passed to the `search by full text()` function without proper escaping or parameterization. This flaw allows attackers to execute arbitrary SQL commands to read, modify, or delete data within the underlying ClickHouse database. **Recommendations** Update Dify to version 1.16.0-rc1 or later. As a temporary mitigation, restrict access to the `search by full text()` function in the MyScale vector store backend.

**Name of the Vulnerable Software and Affected Versions** Cognee versions prior to 1.2.0 **Description** Improper access control allows unauthenticated attackers to overwrite the global LLM provider configuration. By self-registering an account and calling the '/api/v1/settings' endpoint, which lacks admin or superuser checks, an attacker can exploit the process-wide singleton configuration cache. This enables the redirection of all instance-wide LLM operations to an attacker-controlled endpoint, leading to the exfiltration of prompts, uploaded documents, extracted entities, and knowledge graph content from all users. **Recommendations** Update Cognee to version 1.2.0 or later. Restrict access to the '/api/v1/settings' endpoint to prevent unauthorized configuration changes.

**Name of the Vulnerable Software and Affected Versions** Mem0 versions prior to 0.2.8 **Description** The self-hosted server component contains a missing authorization flaw. The 'POST /configure' endpoint allows the modification of global LLM provider and embedder configurations. While the system verifies authentication via JWT or `X-API-Key`, it fails to validate the caller's role. Consequently, any authenticated user with a distributed API key can redirect all LLM and embedder traffic to a server controlled by an attacker. This malicious configuration is persisted in PostgreSQL and remains active after server restarts, affecting all users and API keys on the instance. **Recommendations** Update to the version containing commit ae7f406. As a temporary workaround, restrict access to the 'POST /configure' endpoint to minimize the risk of exploitation.