Yunus Aydin

**Name of the Vulnerable Software and Affected Versions** Odysseus versions prior to commit bf325f6 **Description** Authenticated non-admin users can manage server-wide embedding backend configuration because certain endpoint management routes verify session authentication but lack an admin authorization guard. An attacker can provide a controlled URL to overwrite the embedding backend in the endpoint configuration file and process environment. This allows the attacker to intercept all subsequent embedding operations—including chat messages, RAG (Retrieval-Augmented Generation) queries, memory entries, and vault text—which are transmitted in plaintext to the attacker-controlled destination. Alternatively, an attacker can delete the endpoint configuration to cause a denial of service for the embedding service for all users. **Recommendations** Update to the version containing commit bf325f6 or later.

**Name of the Vulnerable Software and Affected Versions** Odysseus versions prior to commit 87babb5 **Description** An issue exists where admin-privileged attackers can perform server-side request forgery (SSRF), a technique used to induce the server to make requests to an unintended location. By supplying arbitrary URLs to the embedding endpoint configuration, attackers can probe internal network resources because the system lacks validation for schemes, hosts, IP ranges, or DNS rebinding. This allows the submission of loopback addresses, RFC 1918 ranges (private IP addresses), or link-local addresses through the embedding endpoint API to partially read responses from internal APIs, cloud instance metadata services, and other hosts reachable from the server. **Recommendations** Update to the version containing commit 87babb5. Restrict access to the embedding endpoint API to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** NLTK (Natural Language Toolkit) versions prior to 3.9.3 **Description** The `nltk.collocations` module contains an eval injection flaw. When `collocations.py` is executed directly, the ` main ` block passes command-line arguments to the `eval()` function as suffixes of `BigramAssocMeasures` without proper sanitization or allowlist validation. This allows an attacker who can control command-line arguments to provide a Python expression that bypasses the intended attribute lookup to execute arbitrary Python code, including operating system commands through the `os` module. **Recommendations** Update NLTK (Natural Language Toolkit) to version 3.9.3 or later.