Aviral2642

**Name of the Vulnerable Software and Affected Versions** vLLM versions 0.5.5 through 0.23.1rc0 **Description** Integer truncation of tensor dimensions in GGUF dequantize kernels within `csrc/quantization/gguf/gguf kernel.cu` leads to partial tensor processing. The output tensor is allocated at full size using `torch::empty`, which creates uninitialized memory, but the dequantize CUDA kernel processes only a truncated number of elements because the element count parameter `k` in the `to cuda ggml t` function pointer is defined as a 32-bit `int`. When the product of dimensions `m * n` exceeds `INT MAX`, the truncated value is used as the kernel launch grid size, leaving the remaining portion of the tensor unfilled. In multi-tenant inference deployments, this residual GPU memory may contain tensor data from other users' inference requests, resulting in information disclosure. This issue affects the following functions in `csrc/quantization/gguf/gguf kernel.cu`: - `ggml dequantize()` - `ggml mul mat vec a8()` - `ggml mul mat a8()` - `ggml moe a8()` **Recommendations** Update vLLM to version 0.23.1rc0 or later.

**Name of the Vulnerable Software and Affected Versions** AnythingLLM versions 1.11.1 and earlier **Description** AnythingLLM is an application designed to provide context from content pieces for use with Large Language Models (LLMs). A SQL injection issue exists within the built-in SQL Agent plugin. This allows users who can invoke the agent to execute arbitrary SQL commands on connected databases. The `getTableSchemaSql()` method in the MySQL, PostgreSQL, and MSSQL database connectors constructs SQL queries by directly concatenating the `table name` parameter without proper sanitization or parameterization. **Recommendations** Versions prior to 1.11.1 should be updated.

**Name of the Vulnerable Software and Affected Versions** Langflow versions prior to 1.9.0 **Description** Langflow contains a flaw in the 'POST /api/v1/build public tmp/{flow id}/flow' endpoint that allows unauthenticated remote code execution. The endpoint is designed to build public flows without authentication, but it incorrectly accepts an optional `data` parameter. When this parameter is provided, the system uses attacker-controlled flow data containing arbitrary Python code in node definitions instead of the data stored in the database. This code is processed by the `exec()` function without sandboxing, allowing an attacker to execute shell commands and exfiltrate sensitive information such as API keys, database credentials, and cloud metadata tokens. Real-world incidents have been reported where the Keyhunter botnet exploited this issue to perform LLMjacking by stealing credentials for OpenAI, Anthropic, and AWS. **Recommendations** Update Langflow to version 1.9.0. As a temporary mitigation, restrict access to the 'POST /api/v1/build public tmp/{flow id}/flow' endpoint or ensure the `data` parameter is not processed for unauthenticated requests.