Browse All

A vulnerability in the python-utcp library exposed all environment variables (including secrets like API keys and database passwords) to subprocesses because the `_prepare_environment()` function copied the entire host environment. When combined with a command injection flaw (CWE-78, where an attacker can sneak malicious commands into tool arguments), an attacker could steal sensitive credentials like AWS keys, database connection strings, and LLM API keys in a single tool call.

DeepSeek's TUI has a security flaw in its `fetch_url` tool where it blocks direct requests to restricted IP addresses (like cloud metadata endpoints and private networks) but fails to re-check redirect targets. An attacker can bypass this SSRF protection (server-side request forgery, where an AI is tricked into accessing internal systems) by providing a public URL that redirects to a restricted IP, allowing potential theft of cloud credentials and sensitive data on cloud-hosted instances.

Open WebUI has a race condition (TOCTOU, or time-of-check-time-of-use, where a system checks a condition and then uses that information, but the condition can change in between) in its LDAP and OAuth login flows that allows multiple users to become administrators on a fresh installation. When the first user logs in via LDAP or OAuth, the system checks if the database is empty and assigns the admin role before creating the user account, but multiple concurrent login requests can all see an empty database and all become admins. The regular signup method was already fixed with a safer approach, but LDAP and OAuth were never updated with the same fix.

Any authenticated user can permanently delete files owned by other users in Open WebUI when those files are referenced in shared chats, because the authorization check (the code that verifies whether a user should be allowed to perform an action) ignores both the user's identity and the type of operation being requested. File IDs can be discovered by users with read access to knowledge bases (repositories of documents), making this vulnerability practical to exploit.

Open WebUI has a security flaw where authenticated users can access and modify other users' private files by exploiting two endpoints that don't properly check file ownership. In the first case, attackers can inject victim file IDs into their own folders to make the AI read private documents as context. In the second case, attackers can attach victim files to their own knowledge bases (collections of documents used for RAG, retrieval-augmented generation) to read and overwrite those files entirely.

Open WebUI has a vulnerability where the `_validate_collection_access()` function (a security check) only blocks access to collections with specific name prefixes, but knowledge bases use raw UUIDs (unique identifiers) as collection names, so the check skips them entirely. Any logged-in user who knows a private knowledge base's UUID can read its contents or inject fake data into it through the retrieval API endpoints, even though the knowledge API itself correctly blocks that access.

A vulnerability in Amazon SageMaker Python SDK (a tool for building machine learning models on AWS) allows an attacker with write access to S3 (Amazon's cloud storage service) to execute malicious code by replacing model files with a specially crafted pickle file (a Python format for storing objects) that isn't checked for authenticity before being used. This only affects versions before v2.257.2 and v3.8.0, and requires the attacker to already have permission to write to the storage location.