Jiacheng Zhong

**Name of the Vulnerable Software and Affected Versions** comfyanonymous comfyui version 0.3.40 **Description** A vulnerability was found in the function `set attr` of the file `/comfy/utils.py`, which can lead to dynamically-determined object attributes. The attack can be launched remotely, but it has a high complexity and is considered difficult to exploit. The exploit has been disclosed to the public. **Recommendations** For version 0.3.40, consider disabling the `set attr` function in the `/comfy/utils.py` file as a temporary workaround until a patch is available. Restrict access to the `/comfy/utils.py` file to minimize the risk of exploitation. Avoid using the `set attr` function remotely until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Redash versions up to 10.1.0/25.1.0 **Description** A critical issue affects the `run query` function of the `/query runner/python.py` file in the `getattr` Handler component, leading to a sandbox issue. The exploit has been disclosed publicly and may be used. The vendor was contacted about this disclosure but did not respond. **Recommendations** For Redash versions up to 10.1.0/25.1.0, as a temporary workaround, consider disabling the `run query` function until a patch is available. Restrict access to the `/query runner/python.py` file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** gradio-app gradio versions up to 5.29.1 **Description** A problematic vulnerability has been found in the CORS Handler component, specifically affecting the `is valid origin` function. The issue arises from the manipulation of the `localhost aliases` argument, leading to an origin validation error. This vulnerability can be exploited remotely, with a relatively high complexity of attack and difficult exploitability. The exploit has been publicly disclosed. **Recommendations** For versions up to 5.29.1, as a temporary workaround, consider restricting the use of the `is valid origin` function in the CORS Handler component until a patch is available. Additionally, be cautious when using the `localhost aliases` argument to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** aimhubio aim versions up to 3.29.1 **Description** A critical vulnerability was found in the aimhubio aim software. This issue affects the `RestrictedPythonQuery` function of the `/aim/storage/query.py` file in the `run view Object Handler` component. The manipulation of the `Query` argument leads to a sandbox issue, which can be initiated remotely. The exploit has been disclosed to the public. **Recommendations** For aimhubio aim versions up to 3.29.1, as a temporary workaround, consider disabling the `RestrictedPythonQuery` function until a patch is available. Restrict access to the `run view Object Handler` component to minimize the risk of exploitation. Avoid using the `Query` argument in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Azure Command Line Integration (CLI) (affected versions not specified) Description: The issue is related to improper neutralization of special elements used in a command, also known as 'command injection', in Azure Command Line Integration (CLI). This allows an unauthorized attacker to elevate privileges locally. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.