Schwachstellen im Stack Python · Seite 122

Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptographic padding oracle vulnerability was identified in the Authlib Python library concerning the implementation of the JSON Web Encryption (JWE) RSA1_5 key management algorithm. Authlib registers RSA1_5 in its default algorithm registry without requiring explicit opt-in, and actively destroys the constant-time Bleichenbacher mitigation that the underlying cryptography library implements correctly. This issue has been patched in version 1.6.9.

• Auf 0.15.5-1ubuntu0.1~esm2 aktualisieren
• Auf 1.2.0-1+deb12u2 aktualisieren
• Auf 1.3.0-1ubuntu0.1~esm2 aktualisieren
• Auf 1.6.7-1ubuntu0.1~esm1 aktualisieren
• Auf 1.6.9 aktualisieren
• Auf 1.6.9-1 aktualisieren

Incomplete control character validation in http.cookies

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().

• Auf 2.7.12-1ubuntu0~16.04.18+esm22 aktualisieren
• Auf 2.7.17-1~18.04ubuntu1.13+esm15 aktualisieren
• Auf 2.7.6-8ubuntu0.6+esm30 aktualisieren
• Auf 3.10.12-1~22.04.16 aktualisieren
• Auf 3.10.21 aktualisieren
• Auf 3.11.16 aktualisieren
• Auf 3.11.2-6+deb12u8 aktualisieren
• Auf 3.12.14 aktualisieren
• Auf 3.13.13 aktualisieren
• Auf 3.13.5-2+deb13u2 aktualisieren
• Auf 3.14.3-4 aktualisieren
• Auf 3.14.4 aktualisieren
• Auf 3.15.0a8 aktualisieren
• Auf 3.4.3-1ubuntu1~14.04.7+esm21 aktualisieren
• Auf 3.5.2-2ubuntu0~16.04.13+esm25 aktualisieren
• Auf 3.5.2-2ubuntu0~16.04.4~14.04.1+esm11 aktualisieren
• Auf 3.6.9-1~18.04ubuntu1.13+esm10 aktualisieren
• Auf 3.7.5-2ubuntu1~18.04.2+esm11 aktualisieren
• Auf 3.8.0-3ubuntu1~18.04.2+esm11 aktualisieren
• Auf 3.8.10-0ubuntu1~20.04.18+esm7 aktualisieren
• Auf 3.9.5-3ubuntu0~20.04.1+esm11 aktualisieren

Authlib JWS JWK Header Injection: Signature Verification Bypass

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any JWS deserialization function, the library extracts and uses the cryptographic key embedded in the attacker-controlled JWT jwk header field. An attacker can sign a token with their own private key, embed the matching public key in the header, and have the server accept the forged token as cryptographically valid — bypassing authentication and authoriz

• Auf 0.15.5-1ubuntu0.1~esm2 aktualisieren
• Auf 1.2.0-1+deb12u2 aktualisieren
• Auf 1.3.0-1ubuntu0.1~esm2 aktualisieren
• Auf 1.6.7-1ubuntu0.1~esm1 aktualisieren
• Auf 1.6.9 aktualisieren
• Auf 1.6.9-1 aktualisieren

AWS API MCP File Access Restriction Bypass

Improper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server versions >= 0.2.14 and < 1.3.9 on all platforms may allow the bypass of intended file access restriction and expose arbitrary local file contents in the MCP client application context. To remediate this issue, users should upgrade to version 1.3.9.

• Auf 1.3.9 aktualisieren

vanna-ai vanna bigquery_vector.py remove_training_data sql injection

A flaw has been found in vanna-ai vanna up to 2.0.2. This impacts the function remove_training_data of the file src/vanna/legacy/google/bigquery_vector.py. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Command Injection in mlflow/mlflow

A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the `mlflow/sagemaker/__init__.py` file at lines 161-167. The vulnerability arises from the direct interpolation of user-supplied container image names into shell commands without proper sanitization, which are then executed using `os.system()`. This allows attackers to execute arbitrary commands by supplying malicious input through the `--container` parameter of the CLI. The issue affects environments where MLflow is used, including development setups, CI/CD pipelines, and cloud deployments.

• Auf 3.8.0rc0 aktualisieren

(SimpleEval) Objects (including modules) can leak dangerous modules through to direct access inside the sandbox.

SimpleEval is a library for adding evaluatable expressions into python projects. Prior to 1.0.5, objects (including modules) can leak dangerous modules through to direct access inside the sandbox. If the objects you've passed in as names to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call. The latest version 1.0.5 has this issue fixed. This vulnerability is fixed in 1.0.5.

• Auf 0.8.7-1ubuntu0.1~esm1 aktualisieren
• Auf 0.9.10-1+deb11u1build0.20.04.1 aktualisieren
• Auf 0.9.11-1ubuntu0.1~esm1 aktualisieren
• Auf 0.9.12-1+deb12u1 aktualisieren
• Auf 0.9.12-1+deb12u1build0.24.04.1 aktualisieren
• Auf 0.9.5-1ubuntu0.1~esm1 aktualisieren
• Auf 1.0.3-1+deb13u1 aktualisieren
• Auf 1.0.3-1+deb13u1build0.25.10.1 aktualisieren
• Auf 1.0.3-1+deb13u1build0.26.04.1 aktualisieren
• Auf 1.0.5 aktualisieren
• Auf 1.0.7-1 aktualisieren

fickling's `platform` module subprocess invocation evades `check_safety()` with `LIKELY_SAFE`

# Our assessment We added `platform` to the blocklist of unsafe modules (https://github.com/trailofbits/fickling/commit/351ed4d4242b447c0ffd550bb66b40695f3f9975). It was not possible to inject extra arguments to `file` without first monkey-patching `platform._follow_symlinks` with the pickle, as it always returns an absolute path. We independently hardened it with https://github.com/trailofbits/fickling/commit/b9e690c5a57ee9cd341de947fc6151959f4ae359 to reduce the risk of obtaining direct module references while evading detection. https://github.com/python/cpython/blob/6d1e9ceed3e70ebc39953f5ad4f20702ffa32119/Lib/platform.py#L687-L695 ```

• Auf 0.1.10 aktualisieren

fickling modules linecache, difflib and gc are missing from the unsafe modules blocklist

# Our analysis As stated in the [project's security policy](https://github.com/trailofbits/fickling/security/policy), we also don't consider `UnusedVariables` bypasses to be security issues. We added several unsafe modules mentioned by the reporter in advisory comments to the blocklist (https://github.com/trailofbits/fickling/commit/7f39d97258217ee2c21a1f5031d4a6d7343eb30d). # Original report Title: UnusedVariables analysis bypass via BUILD opcode Arbitrary File Read through fickling.load() ### Summary Two independent bugs in fickling's AST-based static analysis combine to allow a malicious pickle file to execute arbitrary stdlib functio

• Auf 0.1.10 aktualisieren

CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG has exponential denial of service via recursive <use> element amplification in cairosvg/defs.py. This causes CPU exhaustion from a small input.

• Auf 2.9.0 aktualisieren

PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.

• Auf 1.3.0-1ubuntu0.1+esm1 aktualisieren
• Auf 1.5.3+ds1-1ubuntu0.1+esm1 aktualisieren
• Auf 1.7.1-2ubuntu2.1+esm1 aktualisieren
• Auf 2.10.1-2+deb13u1 aktualisieren
• Auf 2.10.1-2ubuntu0.1 aktualisieren
• Auf 2.12.0 aktualisieren
• Auf 2.12.1-1 aktualisieren
• Auf 2.3.0-1ubuntu0.3 aktualisieren
• Auf 2.6.0-1+deb12u1 aktualisieren
• Auf 2.7.0-1ubuntu0.1 aktualisieren

Black: Arbitrary file writes from unsanitized user input in cache file name

Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.

• Auf 25.1.0-3+deb13u1 aktualisieren
• Auf 26.3.1 aktualisieren
• Auf 26.3.1-1 aktualisieren

Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters

Graphiti is a framework for building and querying temporal context graphs for AI agents. Graphiti versions before 0.28.2 contained a Cypher injection vulnerability in shared search-filter construction for non-Kuzu backends. Attacker-controlled label values supplied through SearchFilters.node_labels were concatenated directly into Cypher label expressions without validation. In MCP deployments, this was exploitable not only through direct untrusted access to the Graphiti MCP server, but also through prompt injection against an LLM client that could be induced to call search_nodes with attacker-controlled entity_types values. The MCP server map

• Auf 0.28.2 aktualisieren

tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.

• Auf 3.10.21 aktualisieren
• Auf 3.11.16 aktualisieren
• Auf 3.11.2-6+deb12u8 aktualisieren
• Auf 3.12.14 aktualisieren
• Auf 3.13.13 aktualisieren
• Auf 3.13.5-2+deb13u1 aktualisieren
• Auf 3.14.3-4 aktualisieren
• Auf 3.14.4 aktualisieren
• Auf 3.15.0a8 aktualisieren

Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite

Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. From 0.21.0 to before 0.23.0, receiving a file (wormhole receive) from a malicious party could result in overwriting critical local files, including ~/.ssh/authorized_keys and .bashrc. This could be used to compromise the receiver's computer. Only the sender of the file (the party who runs wormhole send) can mount the attack. Other parties (including the transit/relay servers) are excluded by the wormhole protocol. This vulnerability is fixed in 0.23.0.

• Auf 0.23.0 aktualisieren

OpenCTI has a Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.8.16, the OpenCTI platform’s data ingestion feature accepts user-supplied URLs without validation and uses the Axios HTTP client with its default configuration (allowAbsoluteUrls: true). This allows attackers to craft requests to arbitrary endpoints, including internal services, because Axios will accept and process absolute URLs. This results in a semi-blind SSRF, as responses may not be fully visible but can still impact internal systems. This vulnerability is fixed in 6.8.16.

• Auf 6.8.16 aktualisieren

ReDoS in multipart 1.3.0 - `parse_options_header()`

multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.

• Auf 1.2.1-2+deb13u1 aktualisieren
• Auf 1.2.1-2+deb13u1build0.25.10.1 aktualisieren
• Auf 1.2.2 aktualisieren
• Auf 1.3.0-3ubuntu0.1 aktualisieren
• Auf 1.3.1 aktualisieren
• Auf 1.3.1-1 aktualisieren

CVE-2026-3989

SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization. An attacker can take advantage of this by providing a malicious .pkl file, which will execute the attackers code on the device running the script.

• Auf 0.5.10 aktualisieren

CVE-2026-3060

SGLang' encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module, which deserializes untrusted data using pickle.loads() without authentication.

• Auf 0.5.10 aktualisieren

CVE-2026-3059

SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker, which deserializes untrusted data using pickle.loads() without authentication.

• Auf 0.5.10 aktualisieren