Python: уязвимости стека · Страница 174

Azure Promptflow Remote Code Execution Vulnerability

Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network.

• Обновитесь до 1.17.2
• Обновитесь до 1.6.0

Arbitrary Code Execution via Crafted Keras Config for Model Loading

The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading.

• Обновитесь до 3.8.0
• Обновитесь до 3.9.0

Remote Code Execution in PlotAI

A vulnerability, that could result in Remote Code Execution (RCE), has been found in PlotAI. Lack of validation of LLM-generated output allows attacker to execute arbitrary Python code. Vendor commented out vulnerable line, further usage of the software requires uncommenting it and thus accepting the risk. The vendor does not plan to release a patch to fix this vulnerability.

• Обновитесь до 0.0.7

Open Asset Import Library Assimp File BaseImporter.cpp ConvertToUTF8 heap-based overflow

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function Assimp::BaseImporter::ConvertToUTF8 of the file BaseImporter.cpp of the component File Handler. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

• Обновитесь до 6.0.2+ds-1

Open Asset Import Library Assimp File ParsingUtils.h GetNextLine stack-based overflow

A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::GetNextLine in the library ParsingUtils.h of the component File Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

• Обновитесь до 6.0.2+ds-1

PyTorch Quantized Sigmoid Module nnq_Sigmoid initialization

A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function nnq_Sigmoid of the component Quantized Sigmoid Module. The manipulation of the argument scale/zero_point leads to improper initialization. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.

PyTorch Tuple torch.ops.profiler._call_end_callbacks_on_jit_fut memory corruption

A vulnerability was found in PyTorch 2.6.0+cu124. It has been declared as critical. Affected by this vulnerability is the function torch.ops.profiler._call_end_callbacks_on_jit_fut of the component Tuple Handler. The manipulation of the argument None leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult.

picklescan - Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch

picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specific bits in the ZIP file headers, an attacker can embed malicious pickle files that remain undetected by PickleScan while still being successfully loaded by PyTorch's torch.load(). This can lead to arbitrary code execution when loading a compromised model.

• Обновитесь до 0.0.23

picklescan ZIP archive manipulation attack leads to crash

picklescan before 0.0.23 is vulnerable to a ZIP archive manipulation attack that causes it to crash when attempting to extract and scan PyTorch model archives. By modifying the filename in the ZIP header while keeping the original filename in the directory listing, an attacker can make PickleScan raise a BadZipFile error. However, PyTorch's more forgiving ZIP implementation still allows the model to be loaded, enabling malicious payloads to bypass detection.

• Обновитесь до 0.0.23

CVE-2025-1979

Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the standard logging. If the redis password is passed as an argument, it will be logged and could potentially leak the password. This is only exploitable if: 1) Logging is enabled; 2) Redis is using password authentication; 3) Those logs are accessible to an attacker, who can reach that redis instance. **Note:** It is recommended that anyone who is running in this configuration should update to the latest version of Ray, then rotate their redis password.

• Обновитесь до 2.43.0

CVE-2025-26699

An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.

• Обновитесь до 1:1.11.11-1ubuntu1.21+esm10
• Обновитесь до 2:2.2.12-1ubuntu0.28
• Обновитесь до 2:3.2.12-2ubuntu1.17
• Обновитесь до 3:3.2.25-0+deb12u1
• Обновитесь до 3:4.2.11-1ubuntu1.6
• Обновитесь до 3:4.2.18-1ubuntu1
• Обновитесь до 3:4.2.20-1
• Обновитесь до 4.2.20
• Обновитесь до 5.0.13
• Обновитесь до 5.1.7

Jinja sandbox breakout through attr filter selecting format method

Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to use the |attr filter to get a reference to a string's pl

• Обновитесь до 2.10-1ubuntu0.18.04.1+esm4
• Обновитесь до 2.10.1-2ubuntu0.5
• Обновитесь до 2.7.2-2ubuntu0.1~esm6
• Обновитесь до 2.8-1ubuntu0.1+esm5
• Обновитесь до 3.0.3-1ubuntu0.4
• Обновитесь до 3.1.2-1+deb12u3
• Обновитесь до 3.1.2-1ubuntu1.3
• Обновитесь до 3.1.6
• Обновитесь до 3.1.6-1

dmlc/dgl Vulnerable to Remote Code Execution by Pickle Deserialization via rpc.recv_request()

### Impact Dgl implements rpc server (start_server() in rpc_server.py) for supporting the RPC communications among different remote users over networks. It relies on pickle serialize and deserialize to pack and unpack network messages. The is a known risk in pickle deserialization functionality that can be used for remote code execution. ### Patches TBD. ### Workarounds When running DGL distributed training and inference (DistDGL) make sure you do not assign public IPs to any instance in the cluster. ### References Issue #7874 ### Reported by Pinji Chen ([cpj24@mails.tsinghua.edu.cn](mailto:cpj24@mails.tsinghua.edu.cn)) from NISL lab (htt

CVE-2025-25362

A Server-Side Template Injection (SSTI) vulnerability in Spacy-LLM v0.7.2 allows attackers to execute arbitrary code via injecting a crafted payload into the template field.

• Обновитесь до 0.7.3

Rembg CORS misconfiguration

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests to the rembg server and thus query any API. Even if authentication were to be enabled, allow_credentials is set to True, which would allow any website to send authenticated cross site requests.

• Обновитесь до 2.0.58

Rembg allows SSRF via /api/remove

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the /api/remove endpoint takes a URL query parameter that allows an image to be fetched, processed and returned. An attacker may be able to query this endpoint to view pictures hosted on the internal network of the rembg server. This issue may lead to Information Disclosure.

• Обновитесь до 2.0.58

Observable Response Discrepancy in flask-appbuilder

Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timing the response time from the server when brute forcing requests to login. This vulnerability is fixed in 4.5.3.

• Обновитесь до 4.5.3

Apache StreamPipes: Resources Permission Escalation

Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. This issue affects Apache StreamPipes: through 0.95.1. Users are recommended to upgrade to version 0.97.0 which fixes the issue.

• Обновитесь до 0.97.0

Mishandling of comma during folding and unicode-encoding of email headers

During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers.

• Обновитесь до 3.10.12-1~22.04.10
• Обновитесь до 3.10.17
• Обновитесь до 3.11.0~rc1-1~22.04.1~esm4
• Обновитесь до 3.11.2-6+deb12u6
• Обновитесь до 3.11.9
• Обновитесь до 3.12.3
• Обновитесь до 3.12.3-1ubuntu0.6
• Обновитесь до 3.13.0a5
• Обновитесь до 3.13.0~b1-1
• Обновитесь до 3.6.9-1~18.04ubuntu1.13+esm5
• Обновитесь до 3.7.5-2ubuntu1~18.04.2+esm6
• Обновитесь до 3.8.0-3ubuntu1~18.04.2+esm5
• Обновитесь до 3.8.10-0ubuntu1~20.04.18+esm1
• Обновитесь до 3.9.23
• Обновитесь до 3.9.5-3ubuntu0~20.04.1+esm5
• Обновитесь до 7.3.18+dfsg-1

Open redirect in CodeChecker web server

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. The CodeChecker web server contains an open redirect vulnerability due to missing protections against multiple slashes after the product name in the URL. This results in bypassing the protections against CVE-2021-28861, leading to the same open redirect pathway. This issue affects CodeChecker: through 6.24.5.

• Обновитесь до 6.24.6