Python stack vulnerabilities · Page 132

Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to version 0.18.18, a path traversal vulnerability in the partition_msg function allows an attacker to write or overwrite arbitrary files on the filesystem when processing malicious MSG files with attachments. This issue has been patched in version 0.18.18.

• Update to 0.18.18

Potential denial-of-service vulnerability via repeated headers when using ASGI

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `ASGIRequest` allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Jiyong Yang for reporting this issue.

• Update to 2:3.2.12-2ubuntu1.25
• Update to 3.11.1
• Update to 3:3.2.25-0+deb12u2
• Update to 3:4.2.11-1ubuntu1.14
• Update to 3:4.2.28-0+deb13u1
• Update to 3:4.2.28-1
• Update to 3:5.2.4-1ubuntu2.3
• Update to 4.2.28
• Update to 5.2.11
• Update to 6.0.2

Potential SQL injection via QuerySet.order_by and FilteredRelation

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansion, used in `FilteredRelation`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Solomon Kebede for reporting this issue.

• Update to 3:3.2.25-0+deb12u2
• Update to 3:4.2.11-1ubuntu1.14
• Update to 3:4.2.28-0+deb13u1
• Update to 3:4.2.28-1
• Update to 3:5.2.4-1ubuntu2.3
• Update to 4.2.28
• Update to 5.2.11
• Update to 6.0.2

Potential SQL injection in column aliases via control characters

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet` methods `annotate()`, `aggregate()`, `extra()`, `values()`, `values_list()`, and `alias()`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Solomon Kebede for reporting this issue.

• Update to 1.6.11-0ubuntu1.3+esm10
• Update to 1.8.7-1ubuntu5.15+esm11
• Update to 1:1.11.11-1ubuntu1.21+esm14
• Update to 2:2.2.12-1ubuntu0.29+esm7
• Update to 2:3.2.12-2ubuntu1.25
• Update to 3:3.2.25-0+deb12u2
• Update to 3:4.2.11-1ubuntu1.14
• Update to 3:4.2.28-0+deb13u1
• Update to 3:4.2.28-1
• Update to 3:5.2.4-1ubuntu2.3
• Update to 3:5.2.9-0ubuntu3
• Update to 4.2.28
• Update to 5.2.11
• Update to 6.0.2

Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

• Update to 1.8.7-1ubuntu5.15+esm11
• Update to 1:1.11.11-1ubuntu1.21+esm14
• Update to 2:2.2.12-1ubuntu0.29+esm7
• Update to 2:3.2.12-2ubuntu1.25
• Update to 3:3.2.25-0+deb12u2
• Update to 3:4.2.11-1ubuntu1.14
• Update to 3:4.2.28-0+deb13u1
• Update to 3:4.2.28-1
• Update to 3:5.2.4-1ubuntu2.3
• Update to 3:5.2.9-0ubuntu3
• Update to 4.2.28
• Update to 5.2.11
• Update to 6.0.2

Potential SQL injection via raster lookups on PostGIS

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.

• Update to 1:1.11.11-1ubuntu1.21+esm14
• Update to 2:2.2.12-1ubuntu0.29+esm7
• Update to 2:3.2.12-2ubuntu1.25
• Update to 3:3.2.25-0+deb12u2
• Update to 3:4.2.11-1ubuntu1.14
• Update to 3:4.2.28-0+deb13u1
• Update to 3:4.2.28-1
• Update to 3:5.2.4-1ubuntu2.3
• Update to 4.2.28
• Update to 5.2.11
• Update to 6.0.2

Username enumeration through timing difference in mod_wsgi authentication handler

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. The `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.

• Update to 1.6.11-0ubuntu1.3+esm10
• Update to 1.8.7-1ubuntu5.15+esm11
• Update to 1:1.11.11-1ubuntu1.21+esm14
• Update to 2:2.2.12-1ubuntu0.29+esm7
• Update to 2:3.2.12-2ubuntu1.25
• Update to 3:3.2.25-0+deb12u2
• Update to 3:4.2.11-1ubuntu1.14
• Update to 3:4.2.28-0+deb13u1
• Update to 3:4.2.28-1
• Update to 3:5.2.4-1ubuntu2.3
• Update to 3:5.2.9-0ubuntu3
• Update to 4.2.28
• Update to 5.2.11
• Update to 6.0.2

CVE-2025-70560

Boltz 2.0.0 contains an insecure deserialization vulnerability in its molecule loading functionality. The application uses Python pickle to deserialize molecule data files without validation. An attacker with the ability to place a malicious pickle file in a directory processed by boltz can achieve arbitrary code execution when the file is loaded.

CVE-2025-70559

pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in a location accessible to the application can trigger arbitrary code execution or privilege escalation when the file is loaded by a trusted process. This is caused by an incomplete patch to CVE-2025-64512.

• Update to 20140328+dfsg-1ubuntu0.16.04.1~esm1
• Update to 20140328+dfsg-1ubuntu0.18.04.1~esm1
• Update to 20191020+dfsg-2ubuntu0.1~esm1
• Update to 20220319+dfsg-1ubuntu0.1~esm1
• Update to 20221105+dfsg-1ubuntu0.1~esm1
• Update to 20251230
• Update to 20260107+dfsg-1

Khoj has an IDOR in Notion OAuth Flow Enables Index Poisoning

Khoj is a self-hostable artificial intelligence app. Prior to 2.0.0-beta.23, an IDOR in the Notion OAuth callback allows an attacker to hijack any user's Notion integration by manipulating the state parameter. The callback endpoint accepts any user UUID without verifying the OAuth flow was initiated by that user, allowing attackers to replace victims' Notion configurations with their own, resulting in data poisoning and unauthorized access to the victim's Khoj search index. This attack requires knowing the user's UUID which can be leaked through shared conversations where an AI generated image is present. This vulnerability is fixed in 2.0.0-

vLLM leaks a heap address when PIL throws an error

vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error. vLLM returns this error to the client, leaking a heap address. With this leak, we reduce ASLR from 4 billion guesses to ~8 guesses. This vulnerability can be chained a heap overflow with JPEG2000 decoder in OpenCV/FFmpeg to achieve remote code execution. This vulnerability is fixed in 0.14.1.

• Update to 0.14.1

TLS disabled by default in select aws/sagemaker-python-sdk configurations

Amazon SageMaker Python SDK before v3.1.1 or v2.256.0 disables TLS certificate verification for HTTPS connections made by the service when a Triton Python model is imported, incorrectly allowing for requests with invalid and self-signed certificates to succeed.

• Update to 2.256.0
• Update to 3.1.1

Cleartext transmission of sensitive materials in aws/sagemaker-python-sdk

The Amazon SageMaker Python SDK before v3.2.0 and v2.256.0 includes the ModelBuilder HMAC signing key in the cleartext response elements of the DescribeTrainingJob function. A third party with permissions to both call this API and permissions to modify objects in the Training Jobs S3 output location may have the ability to upload arbitrary artifacts which are executed the next time the Training Job is invoked.

• Update to 2.256.0
• Update to 3.2.0

Limited path traversal when installing wheel archives

When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.

• Update to 26.0
• Update to 26.0+dfsg-1

Unbounded External Image Fetch in Validation Leads to Resource-Exhaustion DoS in huggingface/text-generation-inference

A vulnerability in huggingface/text-generation-inference version 3.3.6 allows unauthenticated remote attackers to exploit unbounded external image fetching during input validation in VLM mode. The issue arises when the router scans inputs for Markdown image links and performs a blocking HTTP GET request, reading the entire response body into memory and cloning it before decoding. This behavior can lead to resource exhaustion, including network bandwidth saturation, memory inflation, and CPU overutilization. The vulnerability is triggered even if the request is later rejected for exceeding token limits. The default deployment configuration, wh

• Update to 3.3.7

Remote Arbitrary File Write with Arbitrary Data in h2oai/h2o-3

A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server. This is achieved by exploiting the `/3/Parse` endpoint to inject attacker-controlled data as the header of an empty file, which is then exported using the `/3/Frames/framename/export` endpoint. The impact of this vulnerability includes the potential for remote code execution and complete access to the system running h2o-3, as attackers can overwrite critical files such as private SSH keys or script files.

Uncontrolled Memory Consumption in run-llama/llama_index

The `SimpleDirectoryReader` component in `llama_index.core` version 0.12.23 suffers from uncontrolled memory consumption due to a resource management flaw. The vulnerability arises because the user-specified file limit (`num_files_limit`) is applied after all files in a directory are loaded into memory. This can lead to memory exhaustion and degraded performance, particularly in environments with limited resources. The issue is resolved in version 0.12.41.

• Update to 0.12.41

Privilege Escalation in mlflow/mlflow

In mlflow version 2.20.3, the temporary directory used for creating Python virtual environments is assigned insecure world-writable permissions (0o777). This vulnerability allows an attacker with write access to the `/tmp` directory to exploit a race condition and overwrite `.py` files in the virtual environment, leading to arbitrary code execution. The issue is resolved in version 3.4.0.

• Update to 3.4.0
• Update to 3.4.0rc0

Improper Access Control in parisneo/lollms

A vulnerability in the `lollms_generation_events.py` component of parisneo/lollms version 5.9.0 allows unauthenticated access to sensitive Socket.IO events. The `add_events` function registers event handlers such as `generate_text`, `cancel_generation`, `generate_msg`, and `generate_msg_from` without implementing authentication or authorization checks. This allows unauthenticated clients to execute resource-intensive or state-altering operations, leading to potential denial of service, state corruption, and race conditions. Additionally, the use of global flags (`lollmsElfServer.busy`, `lollmsElfServer.cancel_gen`) for state management in a m

• Update to 2.0.0
• Update to 2.1.0

CVE-2025-70960

A stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.