Today's specials
- criticalpatched Pillow: Argument Injection in Ghostscript call, potentially leading into RCE Pillow (pip) ### Summary `PIL.EpsImagePlugin.Ghostscript()` builds the Ghostscript command line using the input file path (`fp.name`) **without sanitization**, placing it at `-f <infile>`. A filename beginning with `-` is interpreted by Ghostscript as an option, giving command-line argument injection; chainable to RCE (see Impact). Reproduces with Pillow's default…
- criticalpatched Pillow multi-frame loaders can reuse stale native image storage after mode transitions Pillow (pip) ### Summary Pillow multi-frame image loaders can retain native `ImagingCore` storage allocated for one frame while changing the Python-side image `mode` and decoder tiles for a later frame. If frame 0 allocates storage for a narrow mode such as `L`, and a later frame of the same dimensions switches to a wider mode such as `RGB` or `CMYK`, Pillow may…
- criticalpatched Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO Pillow (pip) ``` ============================================================================ Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO Location: src/libImaging/TiffDecode.c:94 in _tiffWriteProc() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ ``` Pillow can write…
- criticalpatched Pillow: Heap buffer overflow in ImagingJpegDecode Pillow (pip) ## Summary `JpegImageFile.draft()` — which `Image.thumbnail()` calls automatically — requests 1/2, 1/4 or 1/8 scaled JPEG output and shrinks `self._size` and the tile extents to match, so `_setimage()` allocates a single-row decode buffer of `ceil(W/s)` samples. `ImagingJpegDecode()` sets `cinfo.scale_num`/`scale_denom`, calls `jpeg_start_decompress()`,…
0 spills in 2025 for Python
Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.
Past orders
- criticalpatched Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass flowise (npm), flowise-components (npm) ## Summary Flowise <= 3.1.2 CSV Agent and Airtable Agent nodes use a regex-based blocklist (`validatePythonCodeForDataFrame()`) to sanitize LLM-generated Python code before execution in Pyodide. The validator has multiple structural bypasses that allow an attacker to exfiltrate all loaded data to an external server, perform SSRF against internal…
- criticalpatched Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation langflow (pip) ### Summary Langflow's built-in Python interpreter components — `PythonREPLComponent` (Python Interpreter) and the legacy `PythonREPLToolComponent` (Python REPL Tool) — executed arbitrary user- or model-supplied Python code inside flows without effective sandboxing. Because the code ran in-process with the privileges of the Langflow service, any…
- criticalpatched Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain vibe-trading-ai (pip) ### Summary: 5 findings — unauthenticated full-API exposure (F1, lead Critical), read-side authorization gap that persists even with `API_AUTH_KEY` set (F2), unauthenticated file write of `.py`/`.sh`/`.yaml` to a server-returned path (F3), default-permissive CORS that combines with a loopback-only check to grant any browser page on whitelisted localhost…
Follow Python
RSS: /feed.xml?stack=python. JSON: /incidents.json?stack=python. Or add it to your usual for delivery.