Vulnerabilidades

picklescan anterior a la 0.0.29 no detecta archivos pickle maliciosos que explotan la función idlelib.debugobj.ObjectTreeItem.SetText en métodos reduce. Los atacantes pueden crear archivos pickle con código incrustado que elude la detección de picklescan y ejecuta comandos arbitrarios cuando se llama a pickle.load().

Flowise hasta la versión 2.2.7 contiene una vulnerabilidad de inyección SQL en la API importChatflows. Debido a una validación insuficiente del valor chatflow.id, un usuario autenticado puede proporcionar un archivo de importación JSON manipulado cuyo campo id se concatena sin sanear en una cláusula SQL IN,…

The AI Share & Summarize WordPress plugin before 2.0.4 does not sanitise and escape some of its shortcode attributes before outputting them in a page, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

The Email JavaScript Cloak plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'email' shortcode in all versions up to, and including, 1.03 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with…

rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.42.2, the permission splitter did not conservatively split or reject several shell constructs that Bash treats as command execution boundaries or nested execution. As a result, a command beginning with an allowed prefix such as…

rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.32.0, RTK (Rust Token Killer) improperly trusts project-local configuration files. RTK automatically loads .rtk/filters.toml from the working directory with highest priority and without user notification. An attacker can place a…

@rtk-ai/rtk-rewrite transparently rewrites shell commands executed via OpenClaw's exec tool to their RTK equivalents. In 1.0.0, the @rtk-ai/rtk-rewrite OpenClaw plugin passes attacker-controlled input directly into a shell-backed execSync() template string without shell-safe escaping. JSON.stringify() wraps the value…

Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.9, the Docker API server applied its SSRF destination check to the crawl target URL only, not to the proxy address. An unauthenticated request could supply a proxy pointing at an internal IP and route the browser through it, reaching internal…

Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.8, the Docker API server's SSRF protection (validate_webhook_url / validate_url_destination in deploy/docker/utils.py) used an explicit IPv4/IPv6 CIDR blocklist that missed several address families. An attacker could reach internal services…

Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_eval_expression() function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes (gi_frame, f_back, f_builtins) do NOT start with…

Low‑privileged users could use their Full Name as a vector for a stored XSS attack. The name is included in system‑generated emails, whose content is stored in the details field of the userlog table. An admin user viewing the email content through userlog-details.php would have any malicious JavaScript payload…

picklescan before 1.0.4 fails to block at least seven Python standard library modules (including uuid, _osx_support, _aix_support, _pyrepl.pager, and imaplib) exposing eight functions that provide direct arbitrary command execution. Attackers can craft malicious pickle files importing these unblocked modules to…

Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud metadata, and enumerate…

Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP Server feature due to incomplete command-flag validation and a regex bypass in local file access restrictions. An attacker with a Flowise account of any role, or API access with view/update permissions for chatflows, can…

Crawl4AI before 0.8.7 contains a stored cross-site scripting vulnerability in the monitor dashboard that renders crawl URLs and error messages via innerHTML without escaping. An attacker can submit a crafted crawl request with malicious markup that executes in an operator's browser when viewing the dashboard.

Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints that allows unauthenticated attackers to write files outside the intended directory via symlink and time-of-check-time-of-use (TOCTOU) attacks on the output_path parameter. Remote attackers can exploit insufficient…

picklescan anterior a 0.0.29 no detecta archivos pickle maliciosos utilizando idlelib.autocomplete.AutoComplete.fetch_completions en métodos reduce. Los atacantes pueden incrustar código no detectado en archivos pickle que ejecuta comandos arbitrarios cuando son cargados por las víctimas.

picklescan anterior a 0.0.28 no logra detectar llamadas maliciosas a la función torch.jit.unsupported_tensor_ops.execWrapper incrustadas en archivos pickle. Los atacantes pueden elaborar archivos pickle maliciosos que eluden la detección de picklescan y ejecutan código arbitrario cuando se cargan mediante…

picklescan anterior a 0.0.33 no logra detectar archivos pickle maliciosos que invocan la función numpy.f2py.crackfortran.myeval a través del método reduce. Atacantes pueden elaborar archivos pickle maliciosos incrustando código arbitrario que evade la detección de picklescan y ejecuta código remoto cuando se carga.

picklescan anterior a la versión 0.0.29 no detecta la función profile.Profile.runctx al analizar archivos pickle, lo que permite a los atacantes incrustar código malicioso no detectado. Atacantes remotos pueden crear archivos pickle maliciosos utilizando profile.Profile.runctx en el método reduce para lograr ejecución…

Flowise anterior a la versión 3.0.10 (versiones afectadas 3.0.7 y anteriores) contiene una vulnerabilidad de cambio de correo electrónico no verificado. Un usuario autenticado puede cambiar la dirección de correo electrónico de la cuenta, utilizada como identificador de inicio de sesión y canal de recuperación de…

Traefik anterior a 2.10.5 y 3.0.0-beta4 está afectado por una vulnerabilidad de denegación de servicio en el manejo de solicitudes HTTP/2 heredada de la implementación de HTTP/2 de la biblioteca estándar de Go (CVE-2023-44487 / CVE-2023-39325, la técnica 'Rapid Reset'). Un atacante remoto puede crear y cancelar…

A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters.…

Flowise before 3.1.2 contains an information disclosure vulnerability in the /api/v1/chatflows/apikey/:apikey endpoint. When the keyonly query parameter is omitted (the default), the endpoint returns not only the chatflows bound to the supplied API key but also all chatflows across every workspace that have no API key…

Crawl4AI before 0.8.7 contains a server-side request forgery vulnerability in the /crawl, /crawl/stream, /md, and /llm endpoints that fetch arbitrary user-supplied URLs without validation. Unauthenticated attackers can bypass the internal-address blocklist using IPv6-mapped IPv4 addresses to reach internal services…