Natan Nehorai

**Name of the Vulnerable Software and Affected Versions** Kimi Code (@moonshot-ai/kimi-code) versions prior to 0.27.0 **Description** The software implements Server-Side Request Forgery (SSRF) hardening using a static hostname and IP-literal denylist within the `assertSafeFetchTarget()` function. However, it fails to resolve DNS or re-validate hosts following HTTP redirects. An attacker capable of influencing a FetchURL call, such as through prompt injection, can provide a crafted public hostname that resolves to a loopback or internal address, or a public URL that redirects to such a target. This allows access to internal network services that the denylist is intended to block. Because FetchURL is part of the default auto-approve tool set, these calls do not require interactive user confirmation in manual mode. **Recommendations** Update Kimi Code (@moonshot-ai/kimi-code) to version 0.27.0 or later.

**Name of the Vulnerable Software and Affected Versions** Pydantic-AI MCP Run Python tool (affected versions not specified) **Description** The Pydantic-AI MCP Run Python tool is configured with an overly permissive Deno sandbox configuration. This allows Python code executed within the sandbox to access the localhost interface of the host system, potentially enabling Server-Side Request Forgery (SSRF) attacks. The project is archived and unlikely to receive a fix. The tool allows the underlying Python code to access the host's localhost interface. This access can be exploited to perform SSRF attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**n8n and Affected Versions** n8n (affected versions not specified) **Description** n8n is affected by a critical Remote Code Execution (RCE) issue within its workflow Expression evaluation system. An authenticated attacker can leverage this to execute arbitrary code with the privileges of the n8n process. This is possible because expressions provided by authenticated users during workflow configuration are evaluated in an execution context that lacks sufficient isolation from the underlying runtime. Successful exploitation could lead to a full compromise of the affected instance, potentially granting unauthorized access to sensitive data, modification of workflows, and execution of system-level operations. Approximately 981,000 services are estimated to be exposed yearly. The issue involves bypassing the Expression sandbox, allowing for the execution of arbitrary JavaScript code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.123.14 n8n versions prior to 2.3.5 n8n versions prior to 2.4.2 **Description** An issue exists in n8n that allows an attacker to bypass the python-task-executor sandbox restrictions. This bypass is achieved through the use of string formatting and exception handling, enabling the execution of arbitrary unrestricted Python code in the underlying operating system. The vulnerability can be exploited by an authenticated user with basic permissions via the Code block. In instances operating under "Internal" execution mode, a full n8n instance takeover is possible. If the instance operates under "External" execution mode, arbitrary code execution occurs within a Sidecar container, reducing the impact. The vulnerability is related to a Python 3.10 error-handling feature that bypasses static analysis. The vulnerability is exploitable through the use of f-strings and the ` traceback ` object. **Recommendations** Update n8n to version 1.123.14 or later. Update n8n to version 2.3.5 or later. Update n8n to version 2.4.2 or later.

**Name of the Vulnerable Software and Affected Versions** Chaos Mesh versions prior to 2.7.3 **Description** The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster. This server provides an API that allows attackers to kill arbitrary processes in any Kubernetes pod, potentially leading to a cluster-wide denial of service. The vulnerability stems from a missing authentication check for a critical function within the Chaos Controller Manager. **Recommendations** Versions prior to 2.7.3 should be updated to version 2.7.3 or later.

**Name of the Vulnerable Software and Affected Versions** Chaos Mesh (affected versions not specified) **Description** A command injection flaw exists in Chaos Mesh’s `cleanTcs` mutation. This flaw allows unauthenticated in-cluster attackers to perform remote code execution across the cluster. The vulnerability is related to OS command injection. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Chaos Controller Manager (affected versions not specified) **Description** The `cleanIptables` mutation is susceptible to OS command injection. This allows unauthenticated in-cluster attackers to potentially execute remote code across the cluster. Attackers may gain root access on Kubernetes nodes through exploitation of this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Weave server (affected versions not specified) **Description** The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin. The issue is being actively exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Guardrails AI (affected versions not specified) **Description** The issue concerns RAIL documents, an XML-based format used by Guardrails AI for enforcing formatting checks on LLM outputs. Users who consume RAIL documents from external sources are at risk of XML External Entity (XXE) attacks, which could lead to the leakage of internal file data through the SYSTEM entity. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Software (affected versions not specified) **Description** The issue is related to command injection when ingesting a remote Kaggle dataset due to a lack of input sanitization in the `ingest kaggle()` API. This allows for potential command injection attacks. The `ingest kaggle()` API endpoint is vulnerable due to insufficient input validation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Vanna library (affected versions not specified) **Description** The Vanna library is affected by a remote code execution issue due to prompt injection. This allows an attacker to alter the prompt function used for visualized results and run arbitrary Python code. The issue arises when external input is allowed to the library's `ask` method with `visualize` set to True, which is the default behavior. This vulnerability has been reportedly exploited in the wild. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** vector-admin (affected versions not specified) **Description** The issue allows a user to register to a vector-admin server while “domain restriction” is active, even when not owning an authorized email address. This is an authentication bypass in vector-admin. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apache CouchDB versions prior to 3.3.3 IBM Cloudant versions prior to 8413 **Description** Design document functions that receive a user HTTP request object may expose authorization or session cookie headers of the user who accesses the document. These design document functions include `list`, `show`, `rewrite`, and `update`. An attacker can leak the session component using an HTML-like output, insert the session as an external resource, or store the credential in a local document with an `update` function. For the attack to succeed, the attacker must be able to insert the design documents into the database and then manipulate a user to access a function from that design document. **Recommendations** For Apache CouchDB versions prior to 3.3.3, upgrade to version 3.3.3 or later. For IBM Cloudant versions prior to 8413, upgrade to version 8413 or later. As a temporary workaround, consider avoiding the use of design documents from untrusted sources that may attempt to access or manipulate request object headers. Restrict access to the vulnerable design document functions `list`, `show`, `rewrite`, and `update` to minimize the risk of exploitation.