Today's specials
- criticalpatched Pillow: Argument Injection in Ghostscript call, potentially leading into RCE Pillow (pip) ### Summary `PIL.EpsImagePlugin.Ghostscript()` builds the Ghostscript command line using the input file path (`fp.name`) **without sanitization**, placing it at `-f <infile>`. A filename beginning with `-` is interpreted by Ghostscript as an option, giving command-line argument injection; chainable to RCE (see Impact). Reproduces with Pillow's default…
- criticalpatched Pillow multi-frame loaders can reuse stale native image storage after mode transitions Pillow (pip) ### Summary Pillow multi-frame image loaders can retain native `ImagingCore` storage allocated for one frame while changing the Python-side image `mode` and decoder tiles for a later frame. If frame 0 allocates storage for a narrow mode such as `L`, and a later frame of the same dimensions switches to a wider mode such as `RGB` or `CMYK`, Pillow may…
- criticalpatched Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO Pillow (pip) ``` ============================================================================ Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO Location: src/libImaging/TiffDecode.c:94 in _tiffWriteProc() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ ``` Pillow can write…
- criticalpatched Pillow: Heap buffer overflow in ImagingJpegDecode Pillow (pip) ## Summary `JpegImageFile.draft()` — which `Image.thumbnail()` calls automatically — requests 1/2, 1/4 or 1/8 scaled JPEG output and shrinks `self._size` and the tile extents to match, so `_setimage()` allocates a single-row decode buffer of `ceil(W/s)` samples. `ImagingJpegDecode()` sets `cinfo.scale_num`/`scale_denom`, calls `jpeg_start_decompress()`,…
9 spills in 12 months for PyPI packages
Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.
Past orders
- criticalpatched Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration langflow (pip), langflow-base (pip), lfx (pip) ### Summary Before **Langflow 1.10.3**, the MCP stdio transport launched whatever `command` / `args` a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrapped in `bash -c "exec {command} ..."`. Any user able to reach the MCP server settings ("Settings → MCP Servers → Add MCP Server", `POST/PATCH…
- criticalpatched Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation langflow (pip) ### Summary Langflow's built-in Python interpreter components — `PythonREPLComponent` (Python Interpreter) and the legacy `PythonREPLToolComponent` (Python REPL Tool) — executed arbitrary user- or model-supplied Python code inside flows without effective sandboxing. Because the code ran in-process with the privileges of the Langflow service, any…
- criticalpatched Langflow: Weak Fernet Key via random.seed() langflow (pip) ### Summary Langflow uses Python's `random` module (Mersenne Twister, a non-cryptographic PRNG) seeded with the `SECRET_KEY` to derive the Fernet encryption key for all stored user credentials (API keys, LLM provider secrets, database passwords). When the `SECRET_KEY` is shorter than 32 characters — a common scenario for self-hosted deployments using…
- criticalpatched Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass langflow (pip) ### Summary A vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the `WEBHOOK_AUTH_ENABLE` configuration is set to `False`. This allows a remote attacker who knows a flow's UUID to execute it as if they were the owner,…
- criticalpatched Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain vibe-trading-ai (pip) ### Summary: 5 findings — unauthenticated full-API exposure (F1, lead Critical), read-side authorization gap that persists even with `API_AUTH_KEY` set (F2), unauthenticated file write of `.py`/`.sh`/`.yaml` to a server-returned path (F3), default-permissive CORS that combines with a loopback-only check to grant any browser page on whitelisted localhost…
Follow PyPI packages
RSS: /feed.xml?stack=pypi. JSON: /incidents.json?stack=pypi. Or add it to your usual for delivery.