Security Digest · page 4 of 5
Critical PyPI advisories (page 4)
451 critical advisories for PyPI packages since October 2023, newest first. Check your project with pip-audit (or: pip show <package>).
- LlamaIndex DuckDBVectorStore vulnerable to SQL injection through ref_doc_id CVE-2025-1750 CVSS 9.8 Critical
llama-index-vector-stores-duckdb>= 0.12.19, < 0.12.21 → fixed in 0.12.21 - Langroid has a Code Injection vulnerability in TableChatAgent CVE-2025-46724 CVSS 9.8 Critical
langroid< 0.53.15 → fixed in 0.53.15 - vLLM Allows Remote Code Execution via PyNcclPipe Communication Service CVE-2025-47277 CVSS 9.8 Critical
vllm>= 0.6.5, < 0.8.5 → fixed in 0.8.5 - Apache IoTDB Vulnerable to Remote Code Execution CVE-2024-24780 CVSS 9.8 Critical
org.apache.iotdb:iotdb-core>= 1.0.0, < 1.3.4 → fixed in 1.3.4;apache-iotdb>= 1.0.0, < 1.3.4 → fixed in 1.3.4 - Browser Use allows bypassing `allowed_domains` by putting a decoy domain in http auth username portion of a URL CVE-2025-47241 CVSS 9.3 Critical
browser-use<= 0.1.44 → fixed in 0.1.45 - vLLM Vulnerable to Remote Code Execution via Mooncake Integration CVE-2025-32444 CVSS 10.0 Critical
vllm>= 0.6.5, < 0.8.5 → fixed in 0.8.5 - h11 accepts some malformed Chunked-Encoding bodies CVE-2025-43859 CVSS 9.1 Critical
h11< 0.16.0 → fixed in 0.16.0 - CVE-2025-24357 Malicious model remote code execution fix bypass with PyTorch < 2.6.0 GHSA-ggpf-24jw-3fcw CVSS 9.8 Critical
vllm< 0.8.0 → fixed in 0.8.0 - PyTorch: `torch.load` with `weights_only=True` leads to remote code execution CVE-2025-32434 CVSS 9.3 Critical
torch< 2.6.0 → fixed in 2.6.0 - TigerVNC accessible via the network and not just via a UNIX socket as intended CVE-2025-32428 CVSS 9.0 Critical
jupyter-remote-desktop-proxy= 3.0.0 → fixed in 3.0.1 - BentoML's runner server Vulnerable to Remote Code Execution (RCE) via Insecure Deserialization CVE-2025-32375 CVSS 9.8 Critical
bentoml>= 1.0.0a1, < 1.4.8 → fixed in 1.4.8 - LNbits Lightning Network Payment System Vulnerable to Server-Side Request Forgery via LNURL Authentication Callback CVE-2025-32013 CVSS 9.3 Critical
lnbits<= 0.12.12 → no fix listed - BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization CVE-2025-27520 CVSS 9.8 Critical
bentoml>= 1.3.4, < 1.4.3 → fixed in 1.4.3 - pgAdmin 4 Vulnerable to Remote Code Execution CVE-2025-2945 CVSS 9.9 Critical
pgadmin4< 9.2 → fixed in 9.2 - pgAdmin 4 Vulnerable to Cross-Site Scripting (XSS) via Query Result Rendering CVE-2025-2946 CVSS 9.1 Critical
pgadmin4< 9.2 → fixed in 9.2 - InvokeAI Deserialization of Untrusted Data vulnerability CVE-2024-12029 CVSS 9.8 Critical
InvokeAI>= 5.3.1, < 5.4.3rc2 → fixed in 5.4.3rc2 - llama-index-packs-finchat SQL Injection vulnerability CVE-2024-12909 CVSS 10.0 Critical
llama-index-packs-finchat<= 0.3.0 → no fix listed - DB-GPT is vulnerable to SQL Injection attacks from unauthenticated users CVE-2024-10835 CVSS 9.1 Critical
dbgpt< 0.7.1 → fixed in 0.7.1 - vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object CVE-2024-9052 CVSS 9.8 Critical
vllm<= 0.8.1 → no fix listed - Horovod Vulnerable to Command Injection CVE-2024-10190 CVSS 9.8 Critical
horovod<= 0.28.1 → no fix listed - AgentScope path traversal vulnerability in save-workflow CVE-2024-8551 CVSS 9.1 Critical
agentscope<= 0.1.1 → no fix listed - DB-GPT Absolute Path Traversal in knowledge/{space_name}/document/upload CVE-2024-10833 CVSS 9.1 Critical
dbgpt< 0.6.2 → fixed in 0.6.2 - DB-GPT Absolute Path Traversal vulnerability CVE-2024-10831 CVSS 9.1 Critical
dbgpt<= 0.6.0 → no fix listed - H2O Deserialization of Untrusted Data Vulnerability CVE-2024-10553 CVSS 9.8 Critical
h2o< 3.46.0.6 → fixed in 3.46.0.6;ai.h2o:h2o-core< 3.46.0.6 → fixed in 3.46.0.6 - vLLM allows Remote Code Execution by Pickle Deserialization via AsyncEngineRPCServer() RPC server entrypoints CVE-2024-9053 CVSS 9.8 Critical
vllm<= 0.6.0 → no fix listed - AgentScope path traversal vulnerability CVE-2024-8537 CVSS 9.1 Critical
agentscope<= 0.1.1 → no fix listed - AgentScope Deserialization Vulnerability CVE-2024-8502 CVSS 9.8 Critical
agentscope<= 0.0.6a3 → no fix listed - BentoML deserialization vulnerability CVE-2024-9070 CVSS 9.8 Critical
bentoml<= 1.4.5 → no fix listed - DB-GPT Arbitrary File Write vulnerability CVE-2024-10901 CVSS 9.1 Critical
dbgpt<= 0.6.3 → no fix listed - Aim External Control of File Name or Path vulnerability CVE-2024-6829 CVSS 9.1 Critical
aim<= 3.19.3 → no fix listed - Kedro deserialization vulnerability CVE-2024-9701 CVSS 9.8 Critical
kedro< 0.19.9 → fixed in 0.19.9 - vLLM Deserialization of Untrusted Data vulnerability CVE-2024-11041 CVSS 9.8 Critical
vllm<= 0.6.2 → no fix listed - Aim path traversal in LockManager.release_locks CVE-2024-8769 CVSS 9.1 Critical
aim>= 3.15.0, <= 3.27.0 → no fix listed - PyTorch Lightning path traversal vulnerability CVE-2024-8019 CVSS 9.1 Critical
pytorch-lightning< 2.4.0 → fixed in 2.4.0 - DB-GPT vulnerable to Arbitrary File Upload with Path Traversal CVE-2024-10902 CVSS 9.1 Critical
dbgpt<= 0.6.0 → no fix listed - LlamaIndex Retrievers Integration: DuckDBRetriever SQL Injection CVE-2024-11958 CVSS 9.8 Critical
llama-index-retrievers-duckdb-retriever< 0.4.0 → fixed in 0.4.0 - InvokeAI Arbitrary File Deletion vulnerability CVE-2024-11042 CVSS 9.1 Critical
InvokeAI< 5.3.0rc1 → fixed in 5.3.0rc1 - vLLM Allows Remote Code Execution via Mooncake Integration CVE-2025-29783 CVSS 9.0 Critical
vllm>= 0.6.5, < 0.8.0 → fixed in 0.8.0 - Qiskit allows arbitrary code execution decoding QPY format versions < 13 CVE-2025-2000 CVSS 9.8 Critical
qiskit-terra>= 0.18.0, <= 0.46.3 → no fix listed;qiskit<= 1.4.1 → fixed in 1.4.2;qiskit= 2.0.0rc1 → fixed in 2.0.0rc2 - PlotAI eval vulnerability CVE-2025-1497 CVSS 9.3 Critical
plotai< 0.0.7 → fixed in 0.0.7 - LTI JupyterHub Authenticator does not properly validate JWT Signature CVE-2023-25574 CVSS 10.0 Critical
jupyterhub-ltiauthenticator= 1.3.0 → fixed in 1.4.0 - PandasAI interactive prompt function Remote Code Execution (RCE) CVE-2024-12366 CVSS 9.8 Critical
pandasai<= 2.4.2 → no fix listed - Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass CVE-2025-24370 CVSS 9.3 Critical
django-unicorn< 0.62.0 → fixed in 0.62.0 - Sentry's improper authentication on SAML SSO process allows user impersonation CVE-2025-22146 CVSS 9.1 Critical
sentry>= 21.12.0, < 25.1.0 → fixed in 25.1.0 - Gradio Blocked Path ACL Bypass Vulnerability CVE-2025-23042 CVSS 9.1 Critical
gradio< 5.11.0 → fixed in 5.11.0 - Rasa Allows Remote Code Execution via Remote Model Loading CVE-2024-49375 CVSS 9.0 Critical
rasa-pro>= 3.10.0, < 3.10.12 → fixed in 3.10.12;rasa-pro>= 3.9.0, < 3.9.16 → fixed in 3.9.16;rasa-pro< 3.8.18 → fixed in 3.8.18; +1 more packages - cobbler allows anyone to connect to cobbler XML-RPC server with known password and make changes CVE-2024-47533 CVSS 9.8 Critical
cobbler>= 3.3.0, < 3.3.7 → fixed in 3.3.7;cobbler>= 3.0.0, < 3.2.3 → fixed in 3.2.3 - codechecker authentication method confusion vulnerability allows logging in as the built-in root user from an external service CVE-2024-10082 CVSS 9.4 Critical
codechecker<= 6.24.1 → fixed in 6.24.2 - codechecker vulnerable to authentication bypass when using specifically crafted URLs CVE-2024-10081 CVSS 9.9 Critical
codechecker< 6.24.2 → fixed in 6.24.2 - Waitress has request processing race condition in HTTP pipelining with invalid first request CVE-2024-49768 CVSS 9.3 Critical
waitress>= 2.0.0, < 3.0.1 → fixed in 3.0.1 - changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution CVE-2024-32651 CVSS 10.0 Critical
changedetection.io<= 0.45.20 → fixed in 0.45.21 - Gradio allows users to access arbitrary files CVE-2024-1728 CVSS 9.2 Critical
gradio< 4.19.2 → fixed in 4.19.2 - LangChain Experimental Eval Injection vulnerability CVE-2024-46946 CVSS 9.3 Critical
langchain-experimental>= 0.1.17, <= 0.3.0 → no fix listed - AutoGPT bypass of the shell commands denylist settings CVE-2024-6091 CVSS 9.3 Critical
agpt<= 0.5.1 → no fix listed - pyload-ng vulnerable to RCE with js2py sandbox escape CVE-2024-39205 CVSS 9.3 Critical
pyload-ng<= 0.5.0b3.dev85 → no fix listed - H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL CVE-2024-45758 CVSS 9.1 Critical
ai.h2o:h2o-core<= 3.46.0.7 → no fix listed;h2o<= 3.46.0.7 → no fix listed - LlamaIndex includes an exec call for `import {cls_name}` CVE-2024-45201 CVSS 9.3 Critical
llama-index-core< 0.10.38 → fixed in 0.10.38 - Django SQL injection vulnerability CVE-2024-42005 CVSS 9.3 Critical
Django>= 5.0, < 5.0.8 → fixed in 5.0.8;Django>= 4.2, < 4.2.15 → fixed in 4.2.15 - TorchServe vulnerable to bypass of allowed_urls configuration CVE-2024-35198 CVSS 9.3 Critical
torchserve< 0.11.0 → fixed in 0.11.0 - Fiona affected by CVE-2023-45853 related to MiniZip madler-zlib GHSA-q5fm-55c2-v6j9 CVSS 9.3 Critical
fiona< 1.10b1 → fixed in 1.10b1 - langchain-experimental vulnerable to Arbitrary Code Execution CVE-2024-21513 CVSS 9.0 Critical
langchain-experimental>= 0, < 0.0.21 → fixed in 0.0.21 - vanna vulnerable to remote code execution caused by prompt injection CVE-2024-5826 CVSS 9.8 Critical
vanna<= 0.6.2 → no fix listed - pytorch-lightning vulnerable to Arbitrary File Write via /v1/runs API endpoint CVE-2024-5980 CVSS 9.1 Critical
lightning<= 2.3.1 → fixed in 2.3.3 - litellm vulnerable to remote code execution based on using eval unsafely CVE-2024-5751 CVSS 9.8 Critical
litellm< 1.40.16 → fixed in 1.40.16 - Remote Code Execution via path traversal bypass in lollms CVE-2024-5443 CVSS 9.8 Critical
lollms>= 5.9.0, < 9.5.1 → fixed in 9.5.1 - Apache Submarine Server Core Incorrect Authorization vulnerability CVE-2024-36265 CVSS 9.1 Critical
org.apache.submarine:submarine-server-core= 0.8.0 → no fix listed;apache-submarine= 0.8.0 → no fix listed - parisneo/lollms Local File Inclusion (LFI) attack CVE-2024-4315 CVSS 9.1 Critical
lollms< 9.5.0 → fixed in 9.5.0 - Jupyter Server Proxy has a reflected XSS issue in host parameter CVE-2024-35225 CVSS 9.6 Critical
jupyter-server-proxy>= 3.0.0, < 3.2.4 → fixed in 3.2.4;jupyter-server-proxy>= 4.0.0, < 4.2.0 → fixed in 4.2.0 - Remote code execution in pytorch lightning CVE-2024-5452 CVSS 9.8 Critical
lightning< 2.3.3 → fixed in 2.3.3 - Remote code execution in mlflow CVE-2024-0520 CVSS 10.0 Critical
mlflow< 2.9.0 → fixed in 2.9.0 - qdrant input validation failure CVE-2024-3829 CVSS 9.8 Critical
qdrant-client< 1.9.0 → fixed in 1.9.0 - Vanna prompt injection code execution CVE-2024-5565 CVSS 9.2 Critical
vanna<= 0.5.5 → no fix listed - Mocodo vulnerable to SQL injection in `/web/generate.php` CVE-2024-35374 CVSS 9.8 Critical
mocodo<= 4.2.6 → fixed in 4.2.7 - PyMySQL SQL Injection vulnerability CVE-2024-36039 CVSS 9.8 Critical
pymysql< 1.1.1 → fixed in 1.1.1 - NASA AIT-Core vulnerable to remote code execution CVE-2024-35059 CVSS 9.8 Critical
ait-core<= 2.5.2 → no fix listed - NASA AIT-Core vulnerable to remote code execution CVE-2024-35057 CVSS 9.3 Critical
ait-core<= 2.5.2 → no fix listed - NASA AIT-Core vulnerable to SQL Injection CVE-2024-35056 CVSS 9.3 Critical
ait-core<= 2.5.2 → no fix listed - NASA AIT-Core vulnerable to remote code execution CVE-2024-35058 CVSS 9.2 Critical
ait-core<= 2.5.2 → no fix listed - ConsoleMe has an Arbitrary File Read Vulnerability via Limited Git command CVE-2024-5023 CVSS 9.6 Critical
consoleme< 1.4.0 → fixed in 1.4.0 - llama-cpp-python vulnerable to Remote Code Execution by Server-Side Template Injection in Model Metadata CVE-2024-34359 CVSS 9.6 Critical
llama-cpp-python>= 0.2.30, <= 0.2.71 → fixed in 0.2.72 - Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service CVE-2024-32874 CVSS 9.3 Critical
frigate< 0.13.2 → fixed in 0.13.2 - pywasm3 contains a heap buffer overflow which leads to segmentation fault CVE-2024-34249 CVSS 9.8 Critical
pywasm3<= 0.5.0 → no fix listed - pywasm3 contains a global buffer overflow which leads to segmentation fault CVE-2024-34252 CVSS 9.8 Critical
pywasm3<= 0.5.0 → no fix listed - CraftBeerPi 4 allows arbitrary code execution CVE-2024-3955 CVSS 9.8 Critical
cbpi4>= 4.0.0.58, < 4.4.1.a1 → fixed in 4.4.1.a1 - python-jose algorithm confusion with OpenSSH ECDSA keys CVE-2024-33663 CVSS 9.3 Critical
python-jose< 3.4.0 → fixed in 3.4.0 - pyLoad allows upload to arbitrary folder lead to RCE CVE-2024-32880 CVSS 9.1 Critical
pyload-ng<= 0.5.0 → no fix listed - Keras code injection vulnerability CVE-2024-3660 CVSS 9.3 Critical
keras< 2.13.1rc0 → fixed in 2.13.1rc0 - llama-index-core Command Injection vulnerability CVE-2024-3271 CVSS 9.8 Critical
llama-index-core< 0.10.24 → fixed in 0.10.24 - Insecure deserialization in BentoML CVE-2024-2912 CVSS 9.8 Critical
bentoml< 1.2.5 → fixed in 1.2.5 - mlflow vulnerable to Path Traversal CVE-2024-3573 CVSS 9.3 Critical
mlflow< 2.10.0 → fixed in 2.10.0 - Directory traversal in zenml CVE-2024-2083 CVSS 9.9 Critical
zenml< 0.55.5 → fixed in 0.55.5 - llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution CVE-2024-3098 CVSS 9.8 Critical
llama-index-core< 0.10.24 → fixed in 0.10.24 - Aim Web API vulnerable to Remote Code Execution CVE-2024-2195 CVSS 9.8 Critical
aim>= 3.0.0, <= 3.25.0 → no fix listed - LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint CVE-2024-2952 CVSS 9.8 Critical
litellm< 1.34.42 → fixed in 1.34.42 - Lektor does not sanitize database path traversal CVE-2024-28335 CVSS 9.3 Critical
Lektor>= 0, < 3.3.11 → fixed in 3.3.11;Lektor>= 3.4.0b1, < 3.4.0b11 → fixed in 3.4.0b11 - Jupyter Server Proxy's Websocket Proxying does not require authentication CVE-2024-28179 CVSS 9.0 Critical
jupyter-server-proxy>= 4.0.0, < 4.1.1 → fixed in 4.1.1;jupyter-server-proxy< 3.2.3 → fixed in 3.2.3 - Whoogle Search Path Traversal vulnerability CVE-2024-22203 CVSS 9.1 Critical
whoogle-search>= 0, < 0.8.4 → fixed in 0.8.4 - Whoogle Search Server-Side Request Forgery vulnerability CVE-2024-22205 CVSS 9.1 Critical
whoogle-search>= 0, < 0.8.4 → fixed in 0.8.4 - pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated user CVE-2024-2044 CVSS 9.4 Critical
pgAdmin4< 8.4 → fixed in 8.4 - PaddlePaddle vulnerable to remote code execution CVE-2024-0917 CVSS 9.8 Critical
paddlepaddle<= 2.6.0 → no fix listed