MUCGPT

LinkifyIt#match scan loop has quadratic algorithmic complexity

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

Certifi removes GLOBALTRUST root certificate

flatted vulnerable to unbounded recursion DoS in parse() revive phase

Starlette has possible denial-of-service vector when parsing large files in multipart forms

aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

ajv has ReDoS when using `$data` option

LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages

Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup

Undici has an HTTP Request/Response Smuggling issue

AIOHTTP has CRLF injection through multipart part content type header construction

urllib3 streaming API improperly handles highly compressed data

Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning

path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters

markdown-it is has a Regular Expression Denial of Service (ReDoS)

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS

Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

Marshmallow has DoS in Schema.load(many)

Langchain SQL Injection vulnerability

yaml is vulnerable to Stack Overflow via deeply nested YAML collections

urllib3 does not control redirects in browsers and Node.js

Undici has CRLF Injection in undici via `upgrade` option

aiohttp: HTTP/1 Pipelined Requests Queue Without Limit

aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling

@babel/core: Arbitrary File Read via sourceMappingURL Comment

pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size

Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching

Vulnerable OpenSSL included in cryptography wheels

AIOHTTP vulnerable to brute-force leak of internal static file path components

virtualenv Has TOCTOU Vulnerabilities in Directory Creation

Denial of service (DoS) via deformation `multipart/form-data` boundary

langchain-core allows unauthorized users to read arbitrary files from the host file system

glob CLI: Command injection via -c/--cmd executes matches with shell:true

python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service

AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass

aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines

pyasn1 has a DoS vulnerability in decoder

Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

AIOHTTP's unicode processing of header values could cause parsing discrepancies

AIOHTTP vulnerable to denial of service through large payloads

python-multipart: Semicolon treated as querystring field separator enables parameter smuggling

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb