Supply chain vulnerabilities

TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop

OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation

vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts

vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m

vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages

vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds

SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the password

SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers

SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers

SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf

SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers

SiYuan: getEncryptedNotebookStatus discloses names and current lock/unlock state of all encrypted notebooks to anonymous readers

SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns

SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers

SurrealDB: Writes in a PERMISSIONS clause bypass table permissions

SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path

CodeWhale: Project config `allow_shell` override enables arbitrary shell command execution via cloned repository

CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)

CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval

CodeWhale: SSRF‌ bypass - TOCTOU on DNS failure for DNS pinning

CodeWhale: js_execution leaks parent environment to model context via missing env scrub

CodeWhale: Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval

CodeWhale: exec_shell_interact sends LLM-controlled input to a running shell without an approval prompt (privilege escalation)

CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository

CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes

SurrealDB allows bypass of deny-net flags via DNS resolution

SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)

SiYuan: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking

SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath

SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents

SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents

SiYuan: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents

SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode)

SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel

SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode)

SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy