GSA Extraction

Pillow: Infinite loop in MIC n_frames when the embedded TIFF

GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution

GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)

Certifi removes GLOBALTRUST root certificate

Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode

Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()

Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images

sqlparse: formatting list of tuples leads to denial of service

fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE

HuggingFace transformers vulnerable to remote code execution

Werkzeug safe_join() allows Windows special device names

Starlette has possible denial-of-service vector when parsing large files in multipart forms

MLflow: trace API endpoints lack proper authorization validators

Hydra: hydra.utils.instantiate with untrusted config can lead to code execution

GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain

aiohttp: Multiple instances of excessive or unbounded memory/CPU use

Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup

NLTK network URL validation permits SSRF to RFC 6598 shared-address-space hosts

pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding

AIOHTTP has CRLF injection through multipart part content type header construction

urllib3 streaming API improperly handles highly compressed data

Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO

Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes

PyTorch susceptible to local Denial of Service

Hugging Face Datasets folder-based builders allow path traversal through file_name metadata

Transformers is vulnerable to ReDoS attack through its DonutProcessor class

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read

NLTK: Corpus Reader Sandbox Bypass

NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure

NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely

Tornado: Unbounded query-string argument count allows event-loop-stalling DoS

UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()

Pillow: TarIO negative size field causes infinite CPU-spin loop

GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)

AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS

GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)

Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem

Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size

Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)

NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite