Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

GHSA-f42x-p2mx-hm8r CVE-2026-50558 MODERATE about 3 hours ago

### Summary Penelope versions prior to 0.19.3 extracted tar archives received from remote sessions without validating archive member paths. When u...

pypi

No PRs yet

`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field

GHSA-wjv6-jcfj-mf9r CVE-2026-54654 HIGH about 21 hours ago

### Summary `datamodel-code-generator` is vulnerable to code injection when a developer passes an `--extra-template-data` file whose `comment` val...

pypi

No PRs yet

datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`

GHSA-8359-h9fx-j6v9 CVE-2026-55389 HIGH about 21 hours ago

### Summary `datamodel-code-generator` resolves JSON-Schema `$ref` targets that point at the local filesystem without restricting them to the inpu...

pypi

No PRs yet

`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field

GHSA-386q-5hp3-95m9 CVE-2026-54653 HIGH about 21 hours ago

### Summary `datamodel-code-generator` is vulnerable to code injection when generating Python models from an attacker-controlled JSON Schema, Open...

pypi

No PRs yet

datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding

GHSA-vx7x-vcc2-c44g CVE-2026-55391 HIGH about 21 hours ago

### Summary `datamodel-code-generator`'s anti-SSRF guard validates the resolved IP of a fetch target once and then lets `httpx` perform its own in...

pypi

No PRs yet

`datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data

GHSA-8m8r-38jm-f355 CVE-2026-54656 HIGH about 21 hours ago

### Summary When the Pydantic v2 output mode is in use, `datamodel-code-generator` reads a `validators` array from each model entry in the `--extr...

pypi

No PRs yet

datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)

GHSA-954p-556p-r752 CVE-2026-54690 HIGH about 21 hours ago

### Summary JSON-Schema `$ref` values pointing at HTTP or HTTPS URLs are silently dereferenced by `datamodel-code-generator` with no IP/host valid...

pypi

No PRs yet

datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements

GHSA-5578-w22f-pfx9 CVE-2026-55415 HIGH about 21 hours ago

#### Summary A malicious input schema (OpenAPI / JSON Schema) can execute arbitrary Python code on the machine that **imports** the generated mode...

pypi

No PRs yet

`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description

GHSA-j884-q54q-mmx3 CVE-2026-54621 HIGH about 21 hours ago

### Summary `datamodel-code-generator` is vulnerable to code injection when generating Python models from an attacker-controlled GraphQL schema. A...

pypi

No PRs yet

`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator

GHSA-m34r-v34r-rf9q CVE-2026-54655 HIGH about 21 hours ago

### Summary `datamodel-code-generator` honours a custom `x-python-type` JSON-Schema extension that lets a schema author override the generated Pyth...

pypi

No PRs yet

datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas

GHSA-r5vv-ff45-prp2 CVE-2026-55403 LOW about 21 hours ago

### Summary When `datamodel-code-generator` fetches a remote schema and follows an HTTP redirect, it re-sends the original request headers, includ...

pypi

No PRs yet

datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

GHSA-rfr2-mq9m-x2qx CVE-2026-54691 HIGH about 21 hours ago

### Summary `datamodel-code-generator`'s built-in HTTP fetcher (`http.get_body`) issues an `httpx.GET` against any URL passed to `--url` (or reach...

pypi

No PRs yet

datamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate

GHSA-442q-2j6p-642g CVE-2026-55390 HIGH about 22 hours ago

### Summary When generating models from an XML Schema (`--input-file-type xmlschema`), `datamodel-code-generator` resolves `<xs:include>`, `<xs:im...

pypi

No PRs yet

pytonapi has a Webhook Custom Path Authentication Bypass

GHSA-3fcr-jvgp-7f58 CVE-2026-54635 HIGH 1 day ago

## Webhook Custom Path Authentication Bypass in pytonapi ### Summary `TonapiWebhookDispatcher` in pytonapi 2.2.0 fails to validate the `Authoriza...

pypi

No PRs yet

QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

GHSA-85rg-p3fr-xc2f CVE-2026-54609 HIGH 1 day ago

### Impact The relay's reconnect handler forwards every `RECONNECT_REQUEST` to the host without deduplication or a size cap on the `pendingReconnec...

maven pypi

No PRs yet

AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()

GHSA-j6g5-3hh3-pgw8 CVE-2026-16796 HIGH 5 days ago

### Summary The AWS Bedrock AgentCore Python SDK (bedrock-agentcore) provides tools for building AI agents, including a Code Interpreter client th...

pypi

No PRs yet

libp2p: yamux connection DoS via oversized data frame

GHSA-hmj8-5xmh-5573 HIGH 5 days ago

### Summary The yamux stream multiplexer in py-libp2p does not validate incoming DATA frame lengths against the receive window before reading the f...

pypi

No PRs yet

AWS API MCP Server Security Policy Bypass via Startup Initialization Failure

GHSA-29w2-fq35-v728 CVE-2026-16584 HIGH 5 days ago

## Summary The AWS API MCP Server is an open source Model Context Protocol (MCP) server that enables AI assistants to interact with AWS services an...

pypi

No PRs yet

vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

GHSA-47w6-gwp4-w6vc HIGH 5 days ago

### Impact Edit permission lacks ownership check, so another developer could alter metadata that is later trusted by nodes. Worst they could do i...

pypi

No PRs yet

GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)

GHSA-94p4-4cq8-9g67 HIGH 5 days ago

## Summary The fix for [GHSA-rwj8-pgh3-r573](https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573) stopped `R...

pypi

No PRs yet

open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

GHSA-frvj-c5qp-xj4w CVE-2026-59221 HIGH 5 days ago

AI assistance was used to help inspect the code and prepare this report. ## Summary The fix for GHSA-r2wg-2mcr-66rv is incomplete in v0.9.6 and c...

pypi

No PRs yet

Open WebUI: Arena task endpoints can bypass underlying model access controls

GHSA-m3qf-58wf-w979 CVE-2026-59225 MODERATE 5 days ago

## Summary An authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoin...

pypi

No PRs yet

Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete

GHSA-2xwm-4h2q-ggfx CVE-2026-59212 MODERATE 5 days ago

## Summary Current `main` and `v0.9.6` still allow an authenticated user to turn read-only access to another user's file into write/delete access ...

pypi

No PRs yet

Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)

GHSA-j657-m4c4-24jq CVE-2026-59224 HIGH 5 days ago

## Summary The terminal proxy in `backend/open_webui/routers/terminals.py` forwards the Open WebUI user's identity to the upstream terminal server...

pypi

No PRs yet

Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching

GHSA-qg3f-8x3j-ggf2 CVE-2026-59223 MODERATE 5 days ago

## Summary The administrator-configured `WEB_FETCH_FILTER_LIST` (the allow/block list applied to server-side web fetches: RAG URL ingestion, URL-t...

pypi

No PRs yet

yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

GHSA-6v4j-43gg-vj32 CVE-2026-55404 HIGH 5 days ago

### Summary If the `--write-link`, `--write-url-link` or `--write-desktop-link` options are used with yt-dlp, it may produce output that can lead t...

pypi

No PRs yet

Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials

GHSA-gh7p-78x6-jw6m CVE-2026-59222 MODERATE 5 days ago

### Summary The channel members endpoint serializes and returns **full user models** for channel participants, including settings objects. A norma...

pypi

No PRs yet

Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding

GHSA-73x5-h92w-xc2j CVE-2026-59215 LOW 5 days ago

## Summary A normal authenticated user can read the content of a message in a private channel they do not belong to. `GET /api/v1/channels/{id}/me...

pypi

No PRs yet

Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)

GHSA-3wp3-xxj9-5jqq CVE-2026-59213 LOW 5 days ago

## Summary The `get_all_models` handlers in `routers/openai.py` and `routers/ollama.py` intended to cache their **permission-filtered** model list...

pypi

No PRs yet

Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)

GHSA-7r7x-gjvr-448g CVE-2026-59217 MODERATE 5 days ago

# Open WebUI upload metadata can add files to knowledge bases without write permission ## Summary Open WebUI's file upload background processing ...

pypi

No PRs yet

Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id

GHSA-74h3-cxq7-vc5q CVE-2026-59216 HIGH 5 days ago

## Summary An authenticated low-privilege user can execute arbitrary code-interpreter Python and tools inside **another** user's authenticated ses...

pypi

No PRs yet

Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

GHSA-x2ff-v5v8-m75m CVE-2026-59714 HIGH 5 days ago

## Summary Any authenticated user can overwrite the content of a message in a channel they do not belong to (including private and DM channels) by...

pypi

No PRs yet

Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

GHSA-855v-hq7w-jmjw CVE-2026-59219 HIGH 5 days ago

## Summary With Redis configured, Open WebUI supports JWT revocation: `POST /api/v1/auths/signout` (per-token `jti`) and OIDC back-channel logout ...

pypi

No PRs yet

Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)

GHSA-gmfw-g93r-vg53 CVE-2026-59715 LOW 5 days ago

## Summary The Socket.IO server is configured with `always_connect=True` (lines 78, 91 in `backend/open_webui/socket/main.py`) and the `connect` h...

pypi

No PRs yet

Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission

GHSA-rqj7-6wrp-6g2g CVE-2026-59227 MODERATE 5 days ago

## Summary `POST /api/v1/images/edit` performed no authorization beyond requiring a verified account. Every other image-editing surface in Open We...

pypi

No PRs yet

Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config

GHSA-ffpj-xv5c-p3gw CVE-2026-59220 MODERATE 5 days ago

## Summary Two regexes in `backend/open_webui/utils/middleware.py` that parse `<$skillId|label>` skill-mention tags backtrack in O(n²) on input tha...

pypi

No PRs yet

Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

GHSA-mvx4-532p-xfm9 CVE-2026-59226 LOW 5 days ago

**Title:** Scheduled automations continue after pending-user deactivation and stored model ACL revocation ### Summary Open WebUI documents `pendi...

pypi

No PRs yet

Open WebUI: Account enumeration via observable login timing discrepancy

GHSA-7rw5-9f7q-xj36 CVE-2026-59218 MODERATE 5 days ago

### Summary The `/api/v1/auths/signin` endpoint leaked whether an email address belonged to a registered account through a response-time side chan...

pypi

No PRs yet

Open WebUI: Stored web worker XSS via Pyodide

GHSA-4r2p-27mh-5m22 CVE-2026-59214 HIGH 5 days ago

**Title:** Same-origin Pyodide code execution allows server-side RCE via a shared chat ### Summary Open WebUI runs client-side Python (Pyodide) i...

pypi

No PRs yet

AWS CDK CodeBuild S3 Log Encryption Boolean Inversion

GHSA-464c-974j-9xm6 LOW 5 days ago

## Summary The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework for defining cloud infrastructure in code and ...

go maven npm +2 more

No PRs yet

GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution

GHSA-r9mr-m37c-5fr3 HIGH 5 days ago

## Summary GitPython's `check_unsafe_options` guard (the control introduced by CVE-2026-42215 / GHSA-2f96 and hardened since) can be bypassed for *...

pypi

No PRs yet

GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks

GHSA-6p8h-3wgx-97gf HIGH 5 days ago

## Summary GitPython's `unsafe_git_clone_options` denylist omits `--template`. `git clone --template=<dir>` copies `<dir>/hooks/` into the new repo...

pypi

No PRs yet

GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)

GHSA-fjr4-x663-mwxc HIGH 5 days ago

## Summary `Diffable.diff()` forwards `**kwargs` straight into `diff`/`diff_tree` with **no** `check_unsafe_options` guard. `Diffable` is mixed int...

pypi

No PRs yet

GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)

GHSA-3rp5-jjmw-4wv2 HIGH 5 days ago

### Summary In GitPython `<= 3.1.52`, the config writer neutralizes only CR, LF, and NUL in configuration **names**, but writes section names into...

pypi

No PRs yet

PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path

GHSA-9xwg-3r6f-jcx2 CVE-2026-61632 MODERATE 5 days ago

### Summary The `b64` extension inlines images referenced by `<img src="...">` as base64 data URIs. When resolving the `src` path it joins it onto...

pypi

No PRs yet

AWS CLI: Overly permissive File Permissions

GHSA-wfp6-f47h-hxc3 CVE-2026-13769 MODERATE 5 days ago

### Summary The AWS Command Line Interface (AWS CLI) is a unified tool for managing AWS services from the command line. Certain CLI subcommands wro...

pypi

No PRs yet

ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape

GHSA-p893-rvq9-2xf9 CVE-2026-63632 LOW 5 days ago

### Summary Heap-buffer-overflow READ (16 bytes) in `Gemm_7_6::adapt_gemm_7_6()` (`onnx/version_converter/adapters/gemm_7_6.h:41`) when `ConvertVe...

pypi

No PRs yet

Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False)

GHSA-hhrp-gw25-jr43 CVE-2026-57516 HIGH 5 days ago

## Summary `ray.data.read_webdataset(paths=...)` is a `@PublicAPI(stability="alpha")` reader for WebDataset-format TAR files. Its default `decoder...

pypi

No PRs yet

httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling

GHSA-j5g9-f88f-gfj3 CVE-2026-59939 HIGH 5 days ago

### Summary The `httplib2` HTTP client library performs unbounded decompression of HTTP response bodies encoded with `Content-Encoding: gzip` or `...

pypi

No PRs yet

pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)

GHSA-g867-7843-wf8q CVE-2026-59935 HIGH 6 days ago

### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a ...

pypi

No PRs yet