Yu Sun

The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify(). Using jsonwebtoken v8 (which does not validate key/algorithm compatibility), an attacker can set alg=HS256 and sign a forged token using Apple's publicly available RSA public key as the HMAC secret, bypassing signature verification and impersonating any Apple-linked account.

X-AnyLabeling's model downloader disabled TLS certificate verification. download with retry in anylabeling/services/auto labeling/model.py built a context with ssl. create unverified context() and passed it to urllib.request.urlopen, so neither the certificate chain nor the hostname was checked on any model download, and models are fetched over HTTPS from the project's release host. Any party positioned to intercept that connection could therefore answer it with content of their own choosing. The response is written to a .part file and moved into place with os.replace, and the only post-download check, safe check model, validates the file's format rather than its provenance: no hash or signature is compared against an expected value. For an ONNX target the substituted file passes onnx.checker.check model and is then used for inference, so the attacker chooses the model that produces the application's annotations. For a .pth or .pt target, which the shipped SAM2 video, YOLOE, UPN and open vision configurations use, the check worker calls torch.load without weights only, so a substituted file is unpickled and executes code of the attacker's choosing on PyTorch releases predating the weights only default.

**Name of the Vulnerable Software and Affected Versions** NetBox version 4.5.8 **Description** An ORM injection exists that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references. This is achieved by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any REST API endpoint. By exploiting the unrestricted queryset used by `WritableNestedSerializer`, attackers can perform boolean-based blind data extraction of sensitive field values and bypass object-level permissions across several application modules, including dcim, ipam, tenancy, virtualization, circuits, and extras. ORM injection is a technique where an attacker manipulates the database queries generated by an Object-Relational Mapper (ORM) to access or modify unauthorized data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PapersGPT for Zotero version 0.6.1 **Description** A remote code execution issue exists where arbitrary JavaScript can be executed by returning malicious code from an LLM endpoint. This occurs because the response is passed unsanitized to the `window.eval()` function within `views.ts`. Exploitation can be achieved through prompt injection in PDFs, Man-in-the-Middle (MITM) interception of API requests, or the use of a malicious custom LLM endpoint. Successful exploitation allows arbitrary code execution within Zotero's chrome-privileged context, granting the attacker capabilities to read and write files, execute processes, and access all Zotero data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** telegram-search (affected versions not specified) **Description** A stored cross-site scripting issue exists that allows remote attackers to execute arbitrary JavaScript in the browsers of other users. This occurs when crafted messages containing unsanitized HTML are sent to a shared Telegram group. Specifically, the `highlightKeyword()` function in `MessageList.vue` passes raw message content directly to `v-html` without proper HTML escaping or sanitization. This enables zero-click execution of injected payloads, such as image `onerror` handlers, when victims browse or search for messages. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FlyEnv versions prior to 4.18.0 **Description** FlyEnv fails to sanitize HTML content originating from markdown rendering and AI chat messages when passed to Vue `v-html` directives. This allows attackers to inject malicious scripts that execute within the Electron renderer process, granting unauthorized access to Node.js APIs and the local filesystem. **Recommendations** Update FlyEnv to version 4.18.0 or later.

**Name of the Vulnerable Software and Affected Versions** unearth versions prior to 0.18.2 **Description** A path traversal issue exists in the `is within directory()` function, which fails to normalize paths before validation. This allows `../` sequences to bypass directory containment checks. An attacker can use malicious tar archives containing symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process. **Recommendations** Update to the version containing commit 6c78164.

**Name of the Vulnerable Software and Affected Versions** SQLBot versions prior to 1.10.0 commit c3f40a5 **Description** The SQText dashboard component renders TinyMCE output using `v-html` without proper sanitization. This allows attackers with permissions to modify dashboard text widget content to inject arbitrary HTML and JavaScript, which then executes in the browser of any user viewing the dashboard. **Recommendations** Update SQLBot to the version containing commit c3f40a5.

**Name of the Vulnerable Software and Affected Versions** OpenCode Studio versions prior to 2.4.4 **Description** Missing authentication allows remote attackers to read arbitrary files within the temp and static/music directories. This is achieved by accessing the 'GET /api/tmp/:tmpFile' and 'GET /api/music/:fileName' endpoints, enabling the retrieval of intermediate audio, video artifacts, and subtitles from other users. Additionally, attackers can delete videos by ID using the 'DELETE /api/short-video/:videoId' endpoint. The vulnerable variables include `tmpFile`, `fileName`, and `videoId`. **Recommendations** Update to version 2.4.4 or later. Restrict access to the 'GET /api/tmp/:tmpFile', 'GET /api/music/:fileName', and 'DELETE /api/short-video/:videoId' endpoints as a temporary mitigation.

BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the download polyhaven asset method that allows attackers to write arbitrary files by injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious paths like '../../.bashrc' to overwrite sensitive files and achieve persistent code execution.

**Name of the Vulnerable Software and Affected Versions** Datasets versions prior to 5.01 **Description** A symlink-following issue exists in the `Extractor.extract()` function. Local attackers can write arbitrary files by pre-planting symbolic links (shortcuts that point to another file or directory) at predictable output paths. In shared-cache environments, this allows the redirection of archive extraction to arbitrary filesystem locations, which can lead to the overwriting of sensitive files, privilege escalation, or code execution. **Recommendations** Update to the version containing commit ad2d853. As a temporary mitigation, restrict access to the `Extractor.extract()` function to prevent unauthorized users from triggering archive extractions.

**Name of the Vulnerable Software and Affected Versions** FlashAttention versions prior to 2.8.3.post1 **Description** A symlink attack exists in the `download and copy()` function within hopper/setup.py. The issue occurs because NVIDIA toolchain archives are extracted without validating symlinks or filtering tar members. A local attacker can place a symlink in the predictable cache directory to redirect extracted binaries to a location of their choice, allowing arbitrary file write with the privileges of the victim during the build process. **Recommendations** Update FlashAttention to the version containing commit 0816ef1.

**Name of the Vulnerable Software and Affected Versions** Dify versions prior to 1.16.0-rc1 **Description** A SQL injection issue exists in the MyScale vector store backend. This occurs when unsanitized search parameters are passed to the `search by full text()` function without proper escaping or parameterization. This flaw allows attackers to execute arbitrary SQL commands to read, modify, or delete data within the underlying ClickHouse database. **Recommendations** Update Dify to version 1.16.0-rc1 or later. As a temporary mitigation, restrict access to the `search by full text()` function in the MyScale vector store backend.

**Name of the Vulnerable Software and Affected Versions** Cognee versions prior to 1.2.0 **Description** Improper access control allows unauthenticated attackers to overwrite the global LLM provider configuration. By self-registering an account and calling the '/api/v1/settings' endpoint, which lacks admin or superuser checks, an attacker can exploit the process-wide singleton configuration cache. This enables the redirection of all instance-wide LLM operations to an attacker-controlled endpoint, leading to the exfiltration of prompts, uploaded documents, extracted entities, and knowledge graph content from all users. **Recommendations** Update Cognee to version 1.2.0 or later. Restrict access to the '/api/v1/settings' endpoint to prevent unauthorized configuration changes.

**Name of the Vulnerable Software and Affected Versions** Mem0 versions prior to 0.2.8 **Description** The self-hosted server component contains a missing authorization flaw. The 'POST /configure' endpoint allows the modification of global LLM provider and embedder configurations. While the system verifies authentication via JWT or `X-API-Key`, it fails to validate the caller's role. Consequently, any authenticated user with a distributed API key can redirect all LLM and embedder traffic to a server controlled by an attacker. This malicious configuration is persisted in PostgreSQL and remains active after server restarts, affecting all users and API keys on the instance. **Recommendations** Update to the version containing commit ae7f406. As a temporary workaround, restrict access to the 'POST /configure' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** MoviePilot (affected versions not specified) **Description** Path traversal exists in the AliPan, U115, and Rclone cloud storage download handlers. The issue occurs because the local destination path is created by concatenating the configured download directory with a filename retrieved from remote cloud API metadata without performing path validation or basename normalization. An attacker controlling a filename returned by a remote cloud storage API can use traversal sequences such as `../` to write downloaded content outside the intended directory, which may lead to the overwriting of arbitrary configuration or plugin files accessible by the application process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AI Tensor Engine for ROCm (AITER) versions prior to 0.1.15 **Description** An unauthenticated remote code execution issue exists in the `MessageQueue.recv()` function within `shm broadcast.py`. This occurs because a ZMQ SUB socket lacks authentication, HMAC, or format validation, allowing remote attackers to execute arbitrary code by sending a malicious pickle payload. Attackers can achieve this by reaching the writer XPUB endpoint on the cluster network or by providing a forged Handle containing an attacker-controlled `remote subscribe addr`. This allows the delivery of a crafted pickle payload that executes code as the inference worker process across every remote reader worker. **Recommendations** Update to a version later than 0.1.14.

**Name of the Vulnerable Software and Affected Versions** F5-TTS versions prior to 1.1.21 **Description** A path traversal issue exists in the finetune Gradio handlers. Unauthenticated attackers can write arbitrary files by providing unsanitized project names that are passed directly to the `os.path.join()` function without validation to ensure the resulting path remains within the intended base directory. By supplying absolute path arguments, such as `/tmp/EVIL`, an attacker can override the base directory and create directories containing attacker-controlled JSON content at any filesystem path writable by the server process. **Recommendations** Update F5-TTS to version 1.1.21 or later.

**Name of the Vulnerable Software and Affected Versions** Banana Slides versions prior to 0.4.0 **Description** The AI service backend contains a path traversal issue in the `generate image()` function. This occurs due to an incomplete path prefix check using `os.path.startswith()` without a trailing separator, which fails to properly confine file access to the intended uploads directory. Unauthenticated attackers can exploit this by providing crafted markdown image references in user-controlled page descriptions. This allows the application to read arbitrary image-format files from sibling directories that share the same prefix as the uploads folder via `PIL Image.open()`. **Recommendations** Update Banana Slides to the version containing commit e8bc490. As a temporary mitigation, restrict the use of the `generate image()` function.

**Name of the Vulnerable Software and Affected Versions** agno version 2.6.5 **Description** A SQL injection issue exists in the ClickHouse vector database backend. Attackers can inject arbitrary SQL expressions by providing malicious metadata keys and values to the `delete by metadata()` function. This is possible due to unsafe f-string interpolation within the `clickhousedb.py` file, which could allow the deletion of all rows, targeting of specific rows, or information extraction using blind or error-based SQL injection techniques. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.