LLM Questionnaire Benchmarking Framework

GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution

Certifi removes GLOBALTRUST root certificate

sqlparse: formatting list of tuples leads to denial of service

fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service

GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE

HuggingFace transformers vulnerable to remote code execution

Werkzeug safe_join() allows Windows special device names

Starlette has possible denial-of-service vector when parsing large files in multipart forms

MLflow: trace API endpoints lack proper authorization validators

Hydra: hydra.utils.instantiate with untrusted config can lead to code execution

GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain

Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup

vLLM affected by RCE via auto_map dynamic module loading during model initialization

vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`

AIOHTTP has CRLF injection through multipart part content type header construction

urllib3 streaming API improperly handles highly compressed data

sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes

PyTorch susceptible to local Denial of Service

Transformers is vulnerable to ReDoS attack through its DonutProcessor class

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

Sentencepiece has a a heap overflow issue

cbor2 has a Denial of Service via Uncontrolled Recursion in cbor2.loads

vLLM is vulnerable to Server-Side Request Forgery (SSRF) through `MediaConnector` class

GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read

vLLM: Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server

GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)

AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS

vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors

GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)

MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem

Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint

vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m

urllib3 does not control redirects in browsers and Node.js

aiohttp: HTTP/1 Pipelined Requests Queue Without Limit

GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite

vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections

aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

Potential Timing Side-Channel Vulnerability in vLLM’s Chunk-Based Prefix Caching

vLLM has RCE In Video Processing

Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer

Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path

mlflow Creates of Temporary File in Directory with Insecure Permissions

pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size

Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching