George Chen

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELM VALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMIN TOKEN is unset, allowing unauthenticated attackers to modify GCP service account keys via POST /serviceKey to redirect billing calls.

Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to modify other tenants' data. Attackers can supply global IDs of StockLocation or Asset entities from different channels to overwrite inventory locations or catalog assets belonging to other tenants without proper channel isolation validation.

MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in DefaultRedirectResolver.hostMatches() that allows remote attackers to hijack OAuth 2.0 authorization codes by supplying a crafted redirect uri whose hostname suffix matches a registered URI without proper dot-boundary anchoring. Attackers who control a domain ending with the registered redirect URI hostname can social-engineer victims into clicking a crafted authorization URL, causing the authorization code to be issued to the attacker-controlled URI and exchanged for an access token granting access to the victim's identity.

Julep contains an insecure direct object reference vulnerability in the get execution details endpoint that allows authenticated tenants to read another tenant's execution data. Attackers can supply arbitrary execution id values to retrieve sensitive execution records including task inputs, outputs, metadata, and temporal task tokens from other tenants.

Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability in the is safe url function that fails to validate hostnames through DNS resolution, allowing attackers to bypass the blocklist. Attackers can supply user-controlled image or audio URLs that resolve to private, loopback, or metadata addresses to reach internal services and exfiltrate credentials.

**Name of the Vulnerable Software and Affected Versions** lakeFS versions prior to 1.83.0 commit 71a45ee **Description** An authentication bypass exists in the '/setup comm prefs' endpoint. This allows unauthenticated attackers to overwrite operator metadata, such as `email`, `name`, and `company`, after the setup process is complete. By sending a POST request to this endpoint, attackers can modify security update preferences, disable security communications, and trigger falsified telemetry events using a legitimate installation ID. **Recommendations** Update lakeFS to the version containing commit 71a45ee. As a temporary mitigation, restrict access to the '/setup comm prefs' endpoint.

**Name of the Vulnerable Software and Affected Versions** Jan versions prior to 0.8.4 **Description** A CORS (Cross-Origin Resource Sharing) misconfiguration in the local API server allows network-adjacent attackers to bypass trusted host restrictions. This occurs because the server replaces user-configured trusted hosts with a wildcard that reflects arbitrary origins with credentials. Attackers on the local network or those using DNS rebinding—a technique that tricks a browser into thinking a malicious site is a trusted one—can access the unauthenticated OpenAI-compatible API to perform inference, enumerate models, invoke MCP tools, and read cross-origin responses. **Recommendations** Update Jan to a version that includes the fix implemented in commit 3e1c1e7.

**Name of the Vulnerable Software and Affected Versions** Datasets versions prior to 5.0.1 **Description** Folder-based dataset builders fail to properly validate the `file name` metadata field before joining it to the dataset directory. This allows attackers to use directory traversal sequences—a technique used to access files and directories outside the intended folder—to read arbitrary local files. These files are then embedded into the output when the `save to disk()` or `push to hub()` functions are called. **Recommendations** Update Datasets to version 5.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** Suna versions prior to 0.9.102 **Description** Broken access control in the message queue API allows authenticated attackers to access and manipulate queue resources of other users due to missing ownership and account isolation checks. This allows attackers to read pending prompt queues for all users, read or delete individual sessions, and inject arbitrary prompts into another user's session queue. Consequently, the background drainer may forward malicious messages to the victim's active AI agent using the victim's credentials and permissions. **Recommendations** Update Suna to version 0.9.102 or later.

**Name of the Vulnerable Software and Affected Versions** Overseerr versions prior to 1.35.1 **Description** An authorization bypass exists in the push subscription API. Authenticated users can list, read, and delete push subscriptions belonging to other users by providing an arbitrary `userId` in the path parameters. This occurs because the affected handlers lack an ownership check, allowing access to user records without the `filteredFields` filter. This can lead to the leak of sensitive data, such as email addresses and `plexId` values. **Recommendations** Update to a version newer than 1.35.0.

**Name of the Vulnerable Software and Affected Versions** Diffusers versions prior to 0.39.1 **Description** A path traversal issue exists in the ` get checkpoint shard files()` function. This allows an attacker to read arbitrary files by providing malicious `weight map` values within the model index JSON. By using absolute paths or `../` sequences in the `weight map` entries, an attacker can escape the intended model directory and access safetensors files located elsewhere during the model loading process. **Recommendations** Update to the version containing commit cee298c or newer.

**Name of the Vulnerable Software and Affected Versions** Fathom Lite versions prior to 1.3.2 **Description** A stored cross-site scripting issue exists in the analytics collection endpoint. Unauthenticated attackers can inject a `javascript:` URI into the Top Pages dashboard by sending a crafted hostname and pathname to the `/collect` endpoint. This occurs because the `parseHostname()` and `parsePathname()` functions do not perform URI scheme validation. Consequently, a `javascript:` hostname and a newline-prefixed pathname can be stored and subsequently rendered as an anchor href in the authenticated dashboard without sanitization. This can lead to session hijacking and full account takeover if an operator clicks the poisoned entry. **Recommendations** Update Fathom Lite to version 1.3.2 or later.

**Name of the Vulnerable Software and Affected Versions** Chatwoot versions prior to 4.16.0 **Description** An authentication bypass exists in the direct uploads controller. This flaw allows unauthenticated attackers to resolve any account and conversation to create arbitrary ActiveStorage blobs within any tenant account. By exploiting the missing authentication checks, attackers can obtain signed PUT URLs to write arbitrary data directly to the application storage backend. **Recommendations** Update to version 4.16.0 or later.

**Name of the Vulnerable Software and Affected Versions** Office-Word-MCP-Server versions prior to 1.1.12 **Description** A path traversal issue exists in the document tools. Attackers who can influence the `filename` argument can read arbitrary .docx files or create and overwrite .docx files outside the intended working directory. This is possible by supplying absolute paths or ../ traversal sequences to document open and save operations, which bypasses the `check file writeable()` and `ensure docx extension()` helpers because they lack base-directory confinement or realpath validation. **Recommendations** Update Office-Word-MCP-Server to version 1.1.12 or later.

**Name of the Vulnerable Software and Affected Versions** CyberPanel versions prior to 1.9.1 commit b198460 **Description** An authorization flaw exists in the `cancelBackupCreation` handler. Authenticated users can exploit this by sending crafted POST requests to terminate backup processes, delete backup archives, corrupt backup status files, and remove database records belonging to other tenants. This is achieved by manipulating the `backupCancellationDomain` and `fileName` parameters. **Recommendations** Update CyberPanel to the version containing commit b198460.

**Name of the Vulnerable Software and Affected Versions** PyTorch torchvision versions prior to 0.28.1 **Description** An out-of-bounds heap read occurs in the GIF decoder's `read from tensor()` callback because an unclamped length is passed to `memcpy`. This allows attackers to use malicious or truncated GIF files to trigger a segmentation fault, leading to a denial of service, or to disclose the contents of adjacent heap memory. **Recommendations** Update PyTorch torchvision to version 0.28.1 or later.

**Name of the Vulnerable Software and Affected Versions** h2oGPT versions prior to 0.2.2 **Description** A path traversal issue exists in the OpenAI-compatible files API. Unauthenticated remote attackers can read, write, and delete arbitrary files accessible to the server process by providing traversal sequences within the bearer token. This occurs because the `get user dir()` function in `openai server/backend utils.py` uses the bearer token string as a path component via `os.path.join` without proper sanitization. Since the default API key is empty, authentication is bypassed. Attackers can use the file content, delete, and upload endpoints to move outside the intended user directory, potentially leading to remote code execution by writing to application-loaded files or startup hooks. **Recommendations** Update h2oGPT to version 0.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** AgentGPT versions prior to 1.0.1 **Description** An authorization bypass exists that allows authenticated users to attach tasks to another user's agent run. This occurs because the `AgentCRUD.create task` and `validate task count` functions use a client-supplied `run id` in the request body to look up the target AgentRun without verifying if the requesting user owns that run. An attacker with a valid `run id` can corrupt task history, exhaust the per-run loop budget, and increase LLM costs for the victim. **Recommendations** Update AgentGPT to version 1.0.1 or later.

SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability in the full-song inference server that allows unauthenticated remote attackers to read and exfiltrate arbitrary files by supplying attacker-controlled filesystem paths through the audio path field of an unauthenticated POST request to the /wav2wav route. Attackers can pass arbitrary server-side paths verbatim to librosa.load, torchaudio.load, and soundfile.write sinks, causing the server to decode and return file contents via the HTTP response body while also writing attacker-specified .wav files to arbitrary locations on the filesystem.

**Name of the Vulnerable Software and Affected Versions** CyberPanel versions prior to 1.9.1 **Description** An insecure direct object reference (IDOR) exists in the IncBackups application's incremental-backup handlers. This occurs because the system uses a globally sequential integer ID for backup jobs without verifying if the requesting user is authorized for that specific domain. Authenticated users can manipulate the `IncJob` variable to access backup metadata, permanently delete backup snapshots, or trigger unauthorized restoration of backup jobs with root privileges. The affected handlers are `deleteBackup()`, `fetchRestorePoints()`, and `restorePoint()`. **Recommendations** Update CyberPanel to a version containing commit b198460.