Hugging Face Accelerate Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Accelerate. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27985.

Hugging Face Accelerate Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Accelerate. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27985.

llama-stack-k8s-operator: Llama Stack service exposed across namespaces due to missing NetworkPolicy node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications accelerate: Hugging Face Accelerate: Remote Code Execution via Deserialization of Untrusted Data runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects fonttools: fontTools: Arbitrary file write leading to remote code execution via malicious .designspace file urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion urllib3: urllib3 Streaming API improperly handles highly compressed data github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token github.com/argoproj/argo-workflows: argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links github.com/expr-lang/expr: Expr: Denial of Service via uncontrolled recursion in expression evaluation github.com/kedacore/keda: KEDA: Arbitrary file read vulnerability in Vault authentication aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking