Superboy-Zjc

**Name of the Vulnerable Software and Affected Versions** Agenta-API versions prior to 0.48.1 **Description** Agenta is an open-source LLMOps platform. In Agenta-API versions prior to 0.48.1, a Python sandbox escape existed in Agenta's custom code evaluator. The platform used RestrictedPython as a sandboxing mechanism for user-supplied evaluator code, but incorrectly whitelisted the `numpy` package as safe within the sandbox. This allowed authenticated users to bypass the sandbox and achieve arbitrary code execution on the API server. The escape path was through `numpy.ma.core.inspect`, which exposes Python's introspection utilities – including `sys.modules` – thereby providing access to unfiltered system-level functionality like `os.system`. The custom code evaluator runs server-side within the API process. **Recommendations** Update to version 0.48.1 or later to resolve the issue. Versions 0.60 and later have removed the RestrictedPython sandbox entirely and replaced it with a different execution model.

**Name of the Vulnerable Software and Affected Versions** openmcp-client versions prior to 0.1.12 **Description** openmcp-client, a VS Code plugin for MCP developers, contains a flaw where a malicious authorization server endpoint can be provisioned by an attacker when a user on a Windows platform connects to an attacker-controlled MCP server. This can lead to an OS command injection attack in the `open()` invocation, potentially compromising the client system. **Recommendations** Update openmcp-client to version 0.1.12.

**Name of the Vulnerable Software and Affected Versions** Django-Unicorn versions prior to 0.62.0 **Description** The vulnerability arises from the core functionality `set property value`, which can be remotely triggered by users by crafting appropriate component requests and feeding in values of the second and third parameters to the vulnerable function, leading to arbitrary changes to the python runtime status. This issue can result in Cross-Site Scripting (XSS), Denial of Service (DoS), and Authentication Bypass attacks in almost every Django-Unicorn-based application. At least five ways of vulnerability exploitation have been observed. **Recommendations** To resolve the issue, upgrade to version 0.62.0 or later. As a temporary workaround, consider blocking paths that start with ` ` to prevent access to **double under (dunder)** or **magic variables/methods**. Additionally, setting a blacklist for restricted paths, such as `RESTRICTED KEYS = (" globals ", " builtins ")`, can help mitigate the vulnerability.

**Name of the Vulnerable Software and Affected Versions** Gradio versions prior to 5.6.0 **Description** Gradio's Access Control List (ACL) for file paths can be bypassed by altering the letter case of a blocked file or directory path due to the lack of case normalization in the file path validation logic. This issue can lead to unauthorized data access, exposing sensitive information and undermining the integrity of Gradio's security model. On case-insensitive file systems, such as those used by Windows and macOS, this flaw enables attackers to circumvent security restrictions and access sensitive files that should be protected. **Recommendations** For Gradio versions prior to 5.6.0, upgrade to version 5.6.0 or later to address the vulnerability. As a temporary workaround, consider normalizing the case of both the requested path and the blocked paths (e.g., convert all paths to lowercase) before evaluating them against the ACL. Restrict access to sensitive files and directories until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** LLama Factory versions <=0.9.0 **Description** A critical remote OS command injection vulnerability has been identified in the LLama Factory training process. This issue arises from improper handling of user input, allowing malicious actors to execute arbitrary OS commands on the host system. The problem is caused by insecure usage of the `Popen` function with `shell=True`, coupled with unsanitized user input. This vulnerability enables attackers to execute arbitrary OS commands on the server, potentially compromise sensitive data or escalate privileges, and deploy malware or create persistent backdoors in the system, significantly increasing the risk of data breaches and operational disruption. **Recommendations** For versions <=0.9.0, avoid using `shell=True` in `Popen`. Instead, pass the command and its arguments as a list to prevent user inputs from being executed as part of a shell command. Update to version 0.9.1, which includes the fix for this vulnerability. As a temporary workaround, consider restricting the usage of the `Popen` function with `shell=True` until the update can be applied.