Security Advisories

Axolotl's multipack patch loaded the base model with trust_remote_code hardcoded on, and the guard meant to stop that was skipped because the setting defaulted to None rather than False. A training run whose base_model points at a crafted Hugging Face repository runs that repository's Python.

• Axolotl before 0.19.0

• Axolotl 0.19.0

Only runs that use sample packing, with a base model from a repository the attacker controls.

Train only from base-model repositories you trust.

• 2026-07-24Fix committed
• 2026-09-05Published

Gregory Tan, u9up

• NVD record
• VulnCheck advisory
• Fix commit b62d60b

Headroom's LLM proxy decided whose stored LLM memory a request touched from the x-headroom-user-id header, and nothing tied that header to the caller. Naming another user's ID read or wrote that user's memory.

• Headroom before 0.36.1

• Headroom 0.36.1

Reachable from the network without authentication when the proxy runs from the shipped docker-compose.yml, which listens on 0.0.0.0 and doesn't require HEADROOM_PROXY_TOKEN. The pip-installed proxy binds 127.0.0.1 by default.

Require HEADROOM_PROXY_TOKEN and keep the proxy off networks you don't trust.

• 2026-08-20Fix committed
• 2026-08-21Published

Gregory Tan, u9up

• NVD record
• VulnCheck advisory
• Fix PR #2207

Headroom's LLM proxy let the caller choose the upstream with the x-headroom-base-url header and checked only that it was an http or https URL. Requests reached loopback, private-network and cloud-metadata addresses, the responses came back to the caller, and the caller's Authorization header went to whichever host they named.

• Headroom before 0.36.1

• Headroom 0.36.1

Reachable from the network without authentication when the proxy runs from the shipped docker-compose.yml, which listens on 0.0.0.0 and doesn't require HEADROOM_PROXY_TOKEN. The pip-installed proxy binds 127.0.0.1 by default.

Require HEADROOM_PROXY_TOKEN and keep the proxy off networks you don't trust.

• 2026-08-20Fix committed
• 2026-08-21Published

Gregory Tan, u9up

• NVD record
• VulnCheck advisory
• Fix PR #2207

A notebook could carry an MCP server entry whose command marimo launched as a local process the moment the notebook opened in edit mode, before any cell ran and without authentication.

• marimo before 0.23.15

• marimo 0.23.15

The victim has to open the crafted notebook in edit mode.

Don't open notebooks from sources you don't trust in edit mode.

• 2026-07-23Fix committed
• 2026-08-19Published

Gregory Tan, u9up

• NVD record
• VulnCheck advisory
• Fix commit 1a21bd7

A notebook's PEP 723 metadata could set the AI provider's base_url, and marimo let it override the operator's own setting. The operator's next AI request sent their OPENAI_API_KEY to the attacker's endpoint, with no cell run.

• marimo before 0.23.15

• marimo 0.23.15

The operator has to open the notebook and make an AI request with a provider key set in the environment.

Keep provider API keys out of the environment when you open notebooks you don't trust.

• 2026-07-23Fix committed
• 2026-08-04Published

Gregory Tan, u9up

• NVD record
• VulnCheck advisory
• Fix commit 1a21bd7

The fix for CVE-2023-1313 blocked PHP uploads by file extension and missed .phar and .phtml. A user who can upload assets saves a PHP script under either one, opens its asset link, and runs commands on the server. The maintainer shipped a fix without answering the original huntr report, so huntr could not assign a CVE. Snyk did.

• Cockpit CMS before 2.4.1

• Cockpit CMS 2.4.1

Exploitable only where the web server runs .phar or .phtml files as PHP.

Stop the web server executing PHP from the directory Cockpit stores uploads in, or limit asset uploads to accounts you trust.

• 2023-03-17Fix committed
• 2024-12-16Reported to Snyk
• 2025-02-05Published

Choo Chi Siang

• NVD record
• Snyk advisory
• Fix commit 984ef9a
• Researcher write-up

Cockpit accepted HTML files as assets and served them from its own origin. Anyone who opened such an asset's link ran the script inside it as Cockpit, where it can act with their session.

• Cockpit CMS before 2.6.3

• Cockpit CMS 2.6.3

The attacker needs an account that can upload assets, and the victim has to open the file's link.

Limit asset uploads to accounts you trust.

• 2023-03-13Reported to the maintainer via huntr
• 2023-08-06Fix committed
• 2023-08-18Published

Choo Chi Siang

• NVD record
• huntr report
• Fix commit b8dad5e

The fix for CVE-2023-2752 still let HTML event-handler attributes through, so the answer field could again store script that runs in the browser of anyone who opens the FAQ.

• phpMyFAQ before 3.2.0-beta

• phpMyFAQ 3.2.0-beta, and 3.2.0 as the first stable release

The attacker needs an account that can add or edit FAQs.

Limit FAQ editing to accounts you trust.

• 2023-04-12Reported to the maintainer via huntr
• 2023-04-13Fix committed
• 2023-05-17Published

Choo Chi Siang

• NVD record
• huntr report
• Fix commit 5401ab7

phpMyFAQ saved the answer field of an FAQ entry without sanitising it. A script placed there runs in the browser of anyone who opens the FAQ, with whatever access their session carries.

• phpMyFAQ before 3.2.0-beta

• phpMyFAQ 3.2.0-beta, and 3.2.0 as the first stable release

The attacker needs an account that can add or edit FAQs.

Limit FAQ editing to accounts you trust.

• 2023-04-10Reported to the maintainer via huntr
• 2023-04-11Fix committed
• 2023-05-17Published

Choo Chi Siang

• NVD record
• huntr report
• Fix commit e7599d4

TeamPass's logout endpoint took the user to log out from a request parameter and never checked it against the caller's session. Any logged-in user, however low their role, could end anyone's session, an administrator's included.

• TeamPass before 3.0.0.23

• TeamPass 3.0.0.23

Any authenticated account will do. The default role is enough.

None. Any account can trigger it, so the fix is to upgrade.

• 2023-02-28Reported to the maintainer via huntr
• 2023-03-17Fix committed
• 2023-03-17Published

Choo Chi Siang

• NVD record
• huntr report
• Fix commit 4e06fba

Cockpit's asset manager accepted any file type, PHP scripts included. A user who can upload assets uploads a script, opens its asset link, and runs commands on the server.

• Cockpit CMS before 2.4.1

• Cockpit CMS 2.4.1, which also carries the fix for CVE-2025-1025

The attacker needs an account that can upload assets.

Stop the web server executing PHP from the directory Cockpit stores uploads in, or limit asset uploads to accounts you trust.

• 2023-03-09Reported to the maintainer via huntr
• 2023-03-10Fix committed
• 2023-03-10Published

Choo Chi Siang

• NVD record
• huntr report
• Fix commit becca80