critical System graph security Trivy conf 1.00 CVE-2026-45829: chromadb 1.5.9 — uv.lock

chromadb: ChromaDB Python Project: Arbitrary code execution via pre-authentication code injection A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a maliciou…

VulnCve 2026 45829

critical System graph security Skillspector conf 0.60 SkillSpector TT3 (taint) in scripts/openwebui/seed_openwebui.py

with urllib.request.urlopen(req, timeout=timeout) as r: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration. Skill: unknown Rule: TT3 Category: taint Severity: CRITICAL Confidence: 0.60 Remediation: Never send credentials …

scripts/openwebui/seed_openwebui.py:117 Mcp skillTaintTt3

high System graph security Trivy conf 1.00 CVE-2024-23342: ecdsa 0.19.1 — uv.lock

python-ecdsa: vulnerable to the Minerva attack The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm) and ECDH (Elliptic Curve Diffie-Hellma…

VulnCve 2024 23342

high System graph security Trivy conf 1.00 CVE-2026-25087: pyarrow 20.0.0 — uv.lock

apache-arrow: Apache Arrow C++: Denial of Service via Use After Free vulnerability when reading IPC files Use After Free vulnerability in Apache Arrow C++. This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IPC file (but not an IPC stream) wi…

VulnCve 2026 25087

high System graph security Trivy conf 1.00 CVE-2026-41066: lxml 6.0.2 — uv.lock

lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input t…

VulnCve 2026 41066

high System graph security Trivy conf 1.00 CVE-2026-41205: mako 1.3.10 — uv.lock

mako: Mako: Information disclosure via path traversal vulnerability Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two s…

VulnCve 2026 41205

high System graph security Trivy conf 1.00 CVE-2026-44307: mako 1.3.10 — uv.lock

mako: Mako: Information disclosure via directory traversal Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \..\..\ secret.txt) bypasses the directory traversal check in Template.__init__ and the posixpath-based normalization in Templ…

VulnCve 2026 44307

high System graph security Trivy conf 1.00 CVE-2026-44431: urllib3 2.6.3 — uv.lock

urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=Fals…

VulnCve 2026 44431

high System graph security Trivy conf 1.00 CVE-2026-44432: urllib3 2.6.3 — uv.lock

urllib3: urllib3: Denial of Service due to excessive HTTP response decompression urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the respo…

VulnCve 2026 44432

high System graph security Trivy conf 1.00 CVE-2026-45134: langsmith 0.7.22 — uv.lock

LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to LangSmith SDK Python 0.8.0 and JS/TS 0.6.0, the LangSmith SDK's prompt pull methods (pull_prompt / pull_prompt…

VulnCve 2026 45134

high System graph security Trivy conf 1.00 CVE-2026-48818: starlette 0.52.1 — uv.lock

starlette: Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to initia…

VulnCve 2026 48818

high System graph security Trivy conf 1.00 CVE-2026-49476: soupsieve 2.8.3 — uv.lock

python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowi…

VulnCve 2026 49476

high System graph security Trivy conf 1.00 CVE-2026-49477: soupsieve 2.8.3 — uv.lock

soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an att…

VulnCve 2026 49477

high System graph security Trivy conf 1.00 CVE-2026-53539: python-multipart 0.0.27 — uv.lock

python-multipart: Python-Multipart: Denial of Service via crafted form-urlencoded bodies Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it fir…

VulnCve 2026 53539

high System graph security Trivy conf 1.00 CVE-2026-54058: pillow 12.2.0 — uv.lock

Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride small…

VulnCve 2026 54058

high System graph security Trivy conf 1.00 CVE-2026-54059: pillow 12.2.0 — uv.lock

python-pillow: Pillow: Denial of Service via crafted PCF font data Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_chec…

VulnCve 2026 54059

high System graph security Trivy conf 1.00 CVE-2026-54060: pillow 12.2.0 — uv.lock

python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._d…

VulnCve 2026 54060

high System graph security Trivy conf 1.00 CVE-2026-54283: starlette 0.52.1 — uv.lock

starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These …

VulnCve 2026 54283

high System graph security Trivy conf 1.00 CVE-2026-54293: nltk 3.9.4 — uv.lock

nltk: NLTK: Information Disclosure via Path Traversal in `nltk.data.load()` NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Prior to 3.10.0-rc1, nltk.data.load() in NLTK is vulner…

VulnCve 2026 54293

high System graph security Trivy conf 1.00 CVE-2026-55379: pillow 12.2.0 — uv.lock

python-pillow: Pillow: Denial of Service via crafted BDF font file Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompressi…

VulnCve 2026 55379

high System graph security Trivy conf 1.00 CVE-2026-55380: pillow 12.2.0 — uv.lock

python-pillow: Pillow: Denial of Service via crafted GD 2.x image file Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing …

VulnCve 2026 55380

high System graph security Trivy conf 1.00 CVE-2026-59197: pillow 12.2.0 — uv.lock

Pillow: Pillow: Native heap out-of-bounds write Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2…

VulnCve 2026 59197

high System graph security Trivy conf 1.00 CVE-2026-59199: pillow 12.2.0 — uv.lock

Pillow: Pillow: Denial of Service via out-of-bounds write in image processing Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.…

VulnCve 2026 59199

high System graph security Trivy conf 1.00 CVE-2026-59200: pillow 12.2.0 — uv.lock

Pillow: Pillow: Denial of service via crafted PDF stream Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a c…

VulnCve 2026 59200

high System graph security Trivy conf 1.00 CVE-2026-59204: pillow 12.2.0 — uv.lock

Pillow: Pillow: Denial of Service via crafted JPEG2000 image Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 fi…

VulnCve 2026 59204

high System graph security Trivy conf 1.00 CVE-2026-59205: pillow 12.2.0 — uv.lock

Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode …

VulnCve 2026 59205

high System graph security Trivy conf 1.00 CVE-2026-59885: pyasn1 0.6.3 — uv.lock

pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted p…

VulnCve 2026 59885

high System graph security Trivy conf 1.00 CVE-2026-59886: pyasn1 0.6.3 — uv.lock

pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a f…

VulnCve 2026 59886

high System graph security Trivy conf 1.00 CVE-2026-59950: mcp 1.27.2 — uv.lock

MCP Python SDK: WebSocket server transport does not support Host/Origin validation The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes w…

VulnCve 2026 59950

high System graph security Trivy conf 1.00 GHSA-537c-gmf6-5ccf: cryptography 48.0.0 — uv.lock

Vulnerable OpenSSL included in cryptography wheels pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in wheels prior to cryptograph 48.01 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://o…

VulnGhsa 537c gmf6 5ccf

high System graph security Trivy conf 1.00 GHSA-f4xh-w4cj-qxq8: langsmith 0.7.22 — uv.lock

LangSmith SDK TracingMiddleware: Arbitrary server-side file read # Summary An attacker who can send an HTTP request to a server running the LangSmith SDK's `TracingMiddleware` can cause that server to read an arbitrary file from its local filesystem and upload the contents to LangSmith as a trace…

VulnGhsa f4xh w4cj qxq8

high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in scripts/download_models.sh

os.environ['BONSAI_TOKEN'] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: unknown Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys, token…

scripts/download_models.sh:80 Mcp skillData exfilE2

high System graph security Skillspector conf 0.90 SkillSpector SC2 (supply-chain) in AGENTS.md

curl -s http://localhost:8080/props | python Remote code is downloaded and executed. This bypasses code review and could introduce malicious code. Skill: unknown Rule: SC2 Category: supply-chain Severity: HIGH Confidence: 0.90 Remediation: Avoid downloading and executing remote scripts. Use tr…

AGENTS.md:181 Mcp skillSupply chainSc2

high System graph security Skillspector conf 0.80 SkillSpector SC4 (supply-chain) in pyproject.toml

requires-python Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits. Skill: unknown Rule: SC4 Category: supply-chain Severity: HIGH Confidence: 0.80 Remediation: Update the dependency to a patched version that addr…

pyproject.toml:4 Mcp skillSupply chainSc4

high System graph security Skillspector conf 0.75 SkillSpector TM2 (tool-misuse) in .github/workflows/manual-platform-smoke.yml

| sudo Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow. Skill: unknown Rule: TM2 Category: tool-misuse Severity: HIGH Confidence: 0.75 Remediation: Limit tool chaining depth and validate the output of eac…

.github/workflows/manual-platform-smoke.yml:305 Mcp skillTool misuseTm2

high System graph security Skillspector conf 0.75 SkillSpector TM2 (tool-misuse) in scripts/make_kv_bias.sh

&& rm - Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow. Skill: unknown Rule: TM2 Category: tool-misuse Severity: HIGH Confidence: 0.75 Remediation: Limit tool chaining depth and validate the output of each tool be…

scripts/make_kv_bias.sh:138 Mcp skillTool misuseTm2

medium System graph security Trivy conf 1.00 CVE-2026-31826: pypdf 6.7.5 — uv.lock

pypdf: pypdf: Denial of Service due to excessive memory consumption via crafted PDF pypdf is a free and open-source pure-python PDF library. Prior to 6.8.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing a content stream with a rath…

VulnCve 2026 31826

medium System graph security Trivy conf 1.00 CVE-2026-33123: pypdf 6.7.5 — uv.lock

pypdf: pypdf: Denial of Service due to excessive resource consumption from crafted PDF pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.1 allow an attacker to craft a malicious PDF which leads to long runtimes and/or large memory usage. Exploitation requires accessing…

VulnCve 2026 33123

medium System graph security Trivy conf 1.00 CVE-2026-33699: pypdf 6.7.5 — uv.lock

pypdf: pypdf: Denial of Service via crafted PDF in non-strict mode pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attacker can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. This has b…

VulnCve 2026 33699

medium System graph security Trivy conf 1.00 CVE-2026-33936: ecdsa 0.19.1 — uv.lock

python-ecdsa: ecdsa: Denial of Service via crafted DER input The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm) and ECDH (Elliptic Curve…

VulnCve 2026 33936

medium System graph security Trivy conf 1.00 CVE-2026-34450: anthropic 0.86.0 — uv.lock

Claude SDK for Python has Insecure Default File Permissions in Local Filesystem Memory Tool The Claude SDK for Python provides access to the Claude API from Python applications. From version 0.86.0 to before version 0.87.0, the local filesystem memory tool in the Anthropic Python SDK created memor…

VulnCve 2026 34450

medium System graph security Trivy conf 1.00 CVE-2026-34452: anthropic 0.86.0 — uv.lock

Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox Escape The Claude SDK for Python provides access to the Claude API from Python applications. From version 0.86.0 to before version 0.87.0, the async local filesystem memory tool in the Anthropic Python SDK validated t…

VulnCve 2026 34452

medium System graph security Trivy conf 1.00 CVE-2026-34993: aiohttp 3.13.5 — uv.lock

aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load() AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using th…

VulnCve 2026 34993

medium System graph security Trivy conf 1.00 CVE-2026-40260: pypdf 6.7.5 — uv.lock

pypdf: pypdf: Denial of Service due to memory exhaustion via manipulated XMP metadata pypdf is a free and open-source pure-python PDF library. In versions prior to 6.10.0, manipulated XMP metadata entity declarations can exhaust RAM. An attacker who exploits this vulnerability can craft a PDF whic…

VulnCve 2026 40260

medium System graph security Trivy conf 1.00 CVE-2026-41168: pypdf 6.7.5 — uv.lock

pypdf: pypdf: Denial of Service via crafted PDF with oversized streams pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.1 can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong la…

VulnCve 2026 41168

medium System graph security Trivy conf 1.00 CVE-2026-41182: langsmith 0.7.22 — uv.lock

LangSmith SDK: Streaming token events bypass output redaction LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python SDK, the LangSmith SDK's output redaction controls (hideOutputs in JS, hide_…

VulnCve 2026 41182

medium System graph security Trivy conf 1.00 CVE-2026-41312: pypdf 6.7.5 — uv.lock

pypdf: pypdf: Denial of Service due to excessive memory consumption via specially crafted PDF pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires acce…

VulnCve 2026 41312

medium System graph security Trivy conf 1.00 CVE-2026-41313: pypdf 6.7.5 — uv.lock

pypdf: pypdf: Denial of Service via crafted PDF with large trailer /Size value pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to long runtimes. This requires loading a PDF with a large tr…

VulnCve 2026 41313

medium System graph security Trivy conf 1.00 CVE-2026-41314: pypdf 6.7.5 — uv.lock

pypdf: pypdf: Denial of Service via crafted PDF with large image sizes pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires accessing an image using `/…

VulnCve 2026 41314

medium System graph security Trivy conf 1.00 CVE-2026-45409: idna 3.11 — uv.lock

python-idna: idna: Denial of Service via specially crafted long inputs Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as …

VulnCve 2026 45409

medium System graph security Trivy conf 1.00 CVE-2026-47265: aiohttp 3.13.5 — uv.lock

python-aiohttp: AIOHTTP: Information disclosure via improper handling of cookies during cross-origin redirects AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cr…

VulnCve 2026 47265

medium System graph security Trivy conf 1.00 CVE-2026-48155: pypdf 6.7.5 — uv.lock

pypdf: pypdf: Denial of Service via crafted PDF with large character offsets pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large …

VulnCve 2026 48155

medium System graph security Trivy conf 1.00 CVE-2026-48156: pypdf 6.7.5 — uv.lock

pypdf: pypdf: Denial of Service via crafted PDF pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with /W [0 0 0] values and large /Size values. This …

VulnCve 2026 48156

medium System graph security Trivy conf 1.00 CVE-2026-48710: starlette 0.52.1 — uv.lock

starlette: Starlette: Security restriction bypass via malformed HTTP Host header Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the r…

VulnCve 2026 48710

medium System graph security Trivy conf 1.00 CVE-2026-48735: pypdf 6.7.5 — uv.lock

pypdf: pypdf: Denial of Service via crafted PDF with large XMP metadata pypdf is a free and open-source pure-python PDF library. Prior to 6.12.1, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots …

VulnCve 2026 48735

medium System graph security Trivy conf 1.00 CVE-2026-48775: langgraph-checkpoint 4.0.1 — uv.lock

langgraph: langgraph-checkpoint: LangGraph: Arbitrary code execution via insecure deserialization of modified checkpoint bytes LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In versions 4.1.0 and prior, the Js…

VulnCve 2026 48775

medium System graph security Trivy conf 1.00 CVE-2026-48776: langgraph-sdk 0.3.12 — uv.lock

langgraph: langgraph-sdk: LangGraph Python SDK: Unsafe URL path construction leads to unauthorized resource access LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. Versions 0.3.14 and prior have unsafe UR…

VulnCve 2026 48776

medium System graph security Trivy conf 1.00 CVE-2026-48817: starlette 0.52.1 — uv.lock

starlette: Starlette: Information disclosure and unintended method execution via non-standard HTTP methods Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up a…

VulnCve 2026 48817

medium System graph security Trivy conf 1.00 CVE-2026-49460: pypdf 6.7.5 — uv.lock

pypdf: pypdf: Denial of Service via crafted PDF with FlateDecode filter pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filte…

VulnCve 2026 49460

medium System graph security Trivy conf 1.00 CVE-2026-49461: pypdf 6.7.5 — uv.lock

pypdf: pypdf: Denial of Service via crafted PDF with self-referencing form XObject pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting the text of a page which …

VulnCve 2026 49461

medium System graph security Trivy conf 1.00 CVE-2026-54273: aiohttp 3.13.5 — uv.lock

aiohttp: AIOHTTP: Denial of Service via excessive pipelined requests AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able to use pipelined requests to …

VulnCve 2026 54273

medium System graph security Trivy conf 1.00 CVE-2026-54274: aiohttp 3.13.5 — uv.lock

aiohttp: aiohttp: Denial of Service via incomplete websocket frame payloads AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory …

VulnCve 2026 54274

medium System graph security Trivy conf 1.00 CVE-2026-54276: aiohttp 3.13.5 — uv.lock

aiohttp: aiohttp: Information disclosure via DigestAuthMiddleware after cross-origin redirect AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This like…

VulnCve 2026 54276

medium System graph security Trivy conf 1.00 CVE-2026-54277: aiohttp 3.13.5 — uv.lock

aiohttp: aiohttp: Denial of Service via oversized HTTP request lines bypassing max_line_size check AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using…

VulnCve 2026 54277

medium System graph security Trivy conf 1.00 CVE-2026-54278: aiohttp 3.13.5 — uv.lock

aiohttp: aiohttp: Denial of Service due to excessive memory consumption from compressed request body AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one ch…

VulnCve 2026 54278

medium System graph security Trivy conf 1.00 CVE-2026-54530: pypdf 6.7.5 — uv.lock

pypdf: python-pypdf: pypdf: Denial of Service via crafted PDF processing pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires extracting the text in layout mode. This vulnera…

VulnCve 2026 54530

medium System graph security Trivy conf 1.00 CVE-2026-54531: pypdf 6.7.5 — uv.lock

pypdf: pypdf: Denial of Service via crafted PDF with outlines pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with outlines into a writer. This vulnerabil…

VulnCve 2026 54531

medium System graph security Trivy conf 1.00 CVE-2026-54651: pypdf 6.7.5 — uv.lock

pypdf: python-pypdf: pypdf: Denial of Service via crafted PDF pypdf is a free and open-source pure-python PDF library. Prior to 6.13.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer. This vu…

VulnCve 2026 54651

medium System graph security Trivy conf 1.00 CVE-2026-55443: langchain 1.2.10 — uv.lock

LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders LangChain is a framework for building agents and LLM-powered applications. Prior to 1.3.9, several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine t…

VulnCve 2026 55443

medium System graph security Trivy conf 1.00 CVE-2026-55798: pillow 12.2.0 — uv.lock

python-pillow: Pillow: Arbitrary command injection via shell metacharacters in file paths Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result t…

VulnCve 2026 55798

medium System graph security Trivy conf 1.00 CVE-2026-59198: pillow 12.2.0 — uv.lock

Pillow: Pillow: Information disclosure via TGA RLE encoder out-of-bounds read Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copie…

VulnCve 2026 59198

medium System graph security Trivy conf 1.00 CVE-2026-59203: pillow 12.2.0 — uv.lock

Pillow: Pillow: Denial of Service via crafted EPS file Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive, allowing a crafted EPS file to cause Image.open() to seek backwards to t…

VulnCve 2026 59203

medium System graph security Trivy conf 1.00 CVE-2026-59890: setuptools 82.0.1 — uv.lock

setuptools: setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursiv…

VulnCve 2026 59890

medium System graph security Semgrep conf 0.55 dynamic urllib use detected — scripts/openwebui/seed_openwebui.py:117

Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…

scripts/openwebui/seed_openwebui.py:117 SecurityPython

medium System graph security Semgrep conf 0.55 dynamic urllib use detected — scripts/openwebui/tool_weather.py:13

Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…

scripts/openwebui/tool_weather.py:13 SecurityPython

medium System graph security Trivy conf 1.00 GHSA-4xgf-cpjx-pc3j: pydantic-settings 2.13.1 — uv.lock

pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size ### Summary `NestedSecretsSettingsSource` reads secret values from files in a configured `secrets_dir`. When `secrets_nested_subdir=True`, a directory e…

VulnGhsa 4xgf cpjx pc3j

medium System graph security Trivy conf 1.00 GHSA-jm82-fx9c-mx94: pypdf 6.7.5 — uv.lock

pypdf: Missing stream length values ignore defined limits ### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage, as `MAX_DECLARED_STREAM_LENGTH` is sometimes ignored. This requires parsing a content stream without a `/Length` value. ### Patches This…

VulnGhsa jm82 fx9c mx94

medium System graph security Coverage conf 1.00 No auth library detected

The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing.

auth

medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in scripts/openwebui/tool_weather.py

https://api.open-meteo.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: unknown Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.60 Remediation: Verify the destination URL is trusted and necess…

scripts/openwebui/tool_weather.py:43 Mcp skillData exfilE1

medium System graph security Skillspector conf 0.70 SkillSpector E1 (data-exfil) in scripts/start_openwebui.sh

curl -fsS --max-time 1 "http://localhost:$LLAMA_PORT/health" >/dev/null 2>&1; then break fi _tries=$((_tries + 1)) sleep 1 done info Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. M…

scripts/start_openwebui.sh:197 Mcp skillData exfilE1

medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in TOOLS.md

curl -s http://localhost:8080/v1/chat/completions -H "Content-Type: application/json" -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: unknown Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.60 …

TOOLS.md:16 Mcp skillData exfilE1

medium System graph security Skillspector conf 0.85 SkillSpector EA1 (excessive-agency) in OPENWEBUI.md

Tools:* Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution. Skill: unknown Rule: EA1 Category: excessive-agency Severity: MEDIUM Confidence: 0…

OPENWEBUI.md:28 Mcp skillExcessive agencyEa1

medium System graph security Skillspector conf 0.70 SkillSpector PE2 (priv-esc) in .github/workflows/manual-platform-smoke.yml

sudo Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified. Skill: unknown Rule: PE2 Category: priv-esc Severity: MEDIUM Confidence: 0.70 Remediation: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, do…

.github/workflows/manual-platform-smoke.yml:306 Mcp skillPriv escPe2

medium System graph security Skillspector conf 0.70 SkillSpector PE2 (priv-esc) in setup.sh

sudo Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified. Skill: unknown Rule: PE2 Category: priv-esc Severity: MEDIUM Confidence: 0.70 Remediation: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, do…

setup.sh:78 Mcp skillPriv escPe2

medium System graph security Skillspector conf 0.75 SkillSpector TM3 (tool-misuse) in scripts/openwebui/seed_openwebui.py

AUTH=false Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface. Skill: unknown Rule: TM3 Category: tool-misuse Severity: MEDIUM Confidence: 0.75 Remediation: Override unsafe defa…

scripts/openwebui/seed_openwebui.py:122 Mcp skillTool misuseTm3

medium System graph security Skillspector conf 0.75 SkillSpector TM3 (tool-misuse) in scripts/start_openwebui.sh

AUTH=false Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface. Skill: unknown Rule: TM3 Category: tool-misuse Severity: MEDIUM Confidence: 0.75 Remediation: Override unsafe defa…

scripts/start_openwebui.sh:305 Mcp skillTool misuseTm3

low System graph security Trivy conf 1.00 CVE-2025-3000: torch 2.10.0 — uv.lock

A vulnerability classified as critical has been found in PyTorch 2.6.0 ... A vulnerability classified as critical has been found in PyTorch 2.6.0. This affects the function torch.jit.script. The manipulation leads to memory corruption. It is possible to launch the attack on the local host. The exp…

VulnCve 2025 3000

low System graph security Trivy conf 1.00 CVE-2026-4539: pygments 2.19.2 — uv.lock

pygments: Pygments: Denial of Service via inefficient regular expression processing in AdlLexer A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expr…

VulnCve 2026 4539

low System graph security Trivy conf 1.00 CVE-2026-50269: aiohttp 3.13.5 — uv.lock

aiohttp: AIOHTTP: CRLF injection in multipart headers AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the u…

VulnCve 2026 50269

low System graph security Trivy conf 1.00 CVE-2026-53537: python-multipart 0.0.27 — uv.lock

multipart: Python-Multipart: Information disclosure via header parsing discrepancy Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parse_options_header parsed Content-Disposition (and Content-Type) headers with email.message.Message, which transparently applies RFC 22…

VulnCve 2026 53537

low System graph security Trivy conf 1.00 CVE-2026-53538: python-multipart 0.0.27 — uv.lock

python-multipart: Python-Multipart: Information disclosure due to parser differential in form data handling Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. …

VulnCve 2026 53538

low System graph security Trivy conf 1.00 CVE-2026-53540: python-multipart 0.0.27 — uv.lock

python-multipart: Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memory Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound its chunked read of the request…

VulnCve 2026 53540

low System graph security Trivy conf 1.00 CVE-2026-54275: aiohttp 3.13.5 — uv.lock

aiohttp: AIOHTTP: TLS SNI check bypass via connection reuse AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an application makes multiple requests to the sam…

VulnCve 2026 54275

low System graph security Trivy conf 1.00 CVE-2026-54279: aiohttp 3.13.5 — uv.lock

aiohttp: AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their hos…

VulnCve 2026 54279

low System graph security Trivy conf 1.00 CVE-2026-54280: aiohttp 3.13.5 — uv.lock

AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ... AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open f…

VulnCve 2026 54280

low System graph security Trivy conf 1.00 CVE-2026-54282: starlette 0.52.1 — uv.lock

starlette: Starlette: Information disclosure due to improper HTTP request path validation Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}…

VulnCve 2026 54282

low System graph security Skillspector conf 0.70 SkillSpector EA3 (excessive-agency) in LICENSE

not limited to Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface. Skill: unknown Rule: EA3 Category: excessive-agency Severity: LOW Confidence: 0.70 Remediat…

LICENSE:27 Mcp skillExcessive agencyEa3

low System graph security Skillspector conf 0.15 SkillSpector TM1 (tool-misuse) in community-benchmarks/ternary-bonsai/cuda-rtx5060ti-linux.md

rm --gpus all -e CUDA_VISIBLE_DEVICES=$GPU -v "$D":/w nvidia/ Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns). Skill: unknown Rule: TM1 Category: tool-misuse Severity: LOW …

community-benchmarks/ternary-bonsai/cuda-rtx5060ti-linux.md:17 Mcp skillTool misuseTm1

PrismML-Eng/Bonsai-demo

Complete repo analysis