LLM Testframework

Certifi removes GLOBALTRUST root certificate

fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service

HuggingFace transformers vulnerable to remote code execution

Starlette has possible denial-of-service vector when parsing large files in multipart forms

Hydra: hydra.utils.instantiate with untrusted config can lead to code execution

aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup

vLLM affected by RCE via auto_map dynamic module loading during model initialization

vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`

AIOHTTP has CRLF injection through multipart part content type header construction

urllib3 streaming API improperly handles highly compressed data

PyTorch susceptible to local Denial of Service

Hugging Face Datasets folder-based builders allow path traversal through file_name metadata

Transformers is vulnerable to ReDoS attack through its DonutProcessor class

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

Sentencepiece has a a heap overflow issue

LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

vLLM is vulnerable to Server-Side Request Forgery (SSRF) through `MediaConnector` class

UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()

vLLM: Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server

AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS

vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors

Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m

urllib3 does not control redirects in browsers and Node.js

aiohttp: HTTP/1 Pipelined Requests Queue Without Limit

LiteLLM: Local file read via request-supplied OIDC file references

vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections

LiteLLM: MCP Proxy Has Improper Authentication

aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

Potential Timing Side-Channel Vulnerability in vLLM’s Chunk-Based Prefix Caching

vLLM has RCE In Video Processing

Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer

Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path

LiteLLM: Authentication Bypass via Host Header Injection

Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching

Vulnerable OpenSSL included in cryptography wheels

LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint

PyTorch: `torch.load` with `weights_only=True` leads to remote code execution

AIOHTTP vulnerable to brute-force leak of internal static file path components

Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

virtualenv Has TOCTOU Vulnerabilities in Directory Creation

Denial of service (DoS) via deformation `multipart/form-data` boundary

Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer

XGrammar affected by Denial of Service by infinite recursion grammars

LiteLLM: Arbitrary file write via path traversal in Skills archive extraction