LLM Questionnaire Benchmarking Framework

Pillow: Infinite loop in MIC n_frames when the embedded TIFF

GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution

GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)

Certifi removes GLOBALTRUST root certificate

Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode

Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()

Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images

sqlparse: formatting list of tuples leads to denial of service

fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service

GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE

HuggingFace transformers vulnerable to remote code execution

Werkzeug safe_join() allows Windows special device names

Starlette has possible denial-of-service vector when parsing large files in multipart forms

MLflow: trace API endpoints lack proper authorization validators

Hydra: hydra.utils.instantiate with untrusted config can lead to code execution

GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain

aiohttp: Multiple instances of excessive or unbounded memory/CPU use

Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup

vLLM affected by RCE via auto_map dynamic module loading during model initialization

vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`

pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding

AIOHTTP has CRLF injection through multipart part content type header construction

urllib3 streaming API improperly handles highly compressed data

Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO

sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes

PyTorch susceptible to local Denial of Service

Transformers is vulnerable to ReDoS attack through its DonutProcessor class

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

Sentencepiece has a a heap overflow issue

virtualenv: Xonsh activation literals depend on the script decoding codec

cbor2 has a Denial of Service via Uncontrolled Recursion in cbor2.loads

vLLM is vulnerable to Server-Side Request Forgery (SSRF) through `MediaConnector` class

GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read

Pillow: TarIO negative size field causes infinite CPU-spin loop

vLLM: Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server

GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)

AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS

vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors

GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)

MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem

virtualenv: Deletion recovery can change a symlink target's mode

Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size

dnspython dns.name.from_wire_parser() excessive CPU use

Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)