github.com/OpenBMB/ChatDev
Submitted 8/4/2026, 10:28:01 AM · Status: ok
Risk grade
F
100 / 100
Findings
315
1 critical49 high255 medium9 low1 info0 on CISA KEV0ATT&CK
Showing 315 of 315 findings
Findings
- FastMCP OpenAPI Provider has an SSRF & Path Traversal VulnerabilitygrypeCVE-2026-32871EPSS 0.9%
- cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timinggrypeCVE-2026-69247
- Denial of Service in pyasn1 via Unbounded RecursiongrypeCVE-2026-30922EPSS 0.8%
- FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy VulnerabilitiesgrypeCVE-2026-27124EPSS 0.2%
- FITS GZIP decompression bomb in PillowgrypeCVE-2026-40192EPSS 0.7%
- js-yaml: YAML merge-key chains can force quadratic CPU consumptiongrypeCVE-2026-59869EPSS 0.4%
- linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker textgrypeCVE-2026-59887EPSS 0.3%
- LinkifyIt#match scan loop has quadratic algorithmic complexitygrypeCVE-2026-48801EPSS 0.3%
- lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local filesgrypeCVE-2026-41066EPSS 0.3%
- MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasksgrypeCVE-2026-52870EPSS 0.2%
- MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principalgrypeCVE-2026-52869EPSS 0.3%
- MCP Python SDK: WebSocket server transport does not support Host/Origin validationgrypeCVE-2026-59950EPSS 0.1%
- Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loadinggrypeCVE-2026-55379EPSS 0.4%
- Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`grypeCVE-2026-55380EPSS 0.4%
- Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loadinggrypeCVE-2026-54059EPSS 0.4%
- Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)grypeCVE-2026-42311EPSS 0.1%
- Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of servicegrypeCVE-2026-59204EPSS 0.4%
- Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`grypeCVE-2026-54060EPSS 0.4%
- Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatchgrypeCVE-2026-59205EPSS 0.4%
- Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()grypeCVE-2026-59200EPSS 0.4%
- Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflowgrypeCVE-2026-59199EPSS 0.4%
- Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`grypeCVE-2026-59197EPSS 0.4%
- Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)grypeCVE-2026-54058EPSS 0.4%
- PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS commentsgrypeCVE-2026-45623EPSS 0.5%
- PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosuregrype
- pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDsgrypeCVE-2026-59884EPSS 0.4%
- pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of servicegrypeCVE-2026-59885EPSS 0.3%
- pyasn1: Uncontrolled resource consumption when converting decoded REAL valuesgrypeCVE-2026-59886EPSS 0.3%
- PyJWT accepts unknown `crit` header extensionsgrypeCVE-2026-32597EPSS 0.3%
- PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowedgrypeCVE-2026-48526EPSS 0.4%
- pypdf: Possible infinite loop for not terminated inline imagesgrypeCVE-2026-59936EPSS 0.3%
- pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)grypeCVE-2026-59935EPSS 0.4%
- python-cryptography: Duplicate self-signed intermediates can cause exponential path-buildinggrypeCVE-2026-69249
- python-multipart has Denial of Service via unbounded multipart part headersgrypeCVE-2026-42561EPSS 0.7%
- python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of servicegrypeCVE-2026-53539EPSS 0.4%
- Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector ListsgrypeCVE-2026-49476EPSS 0.5%
- Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector ParsergrypeCVE-2026-49477EPSS 0.5%
- Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoSgrypeCVE-2026-54283EPSS 0.4%
- Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on WindowsgrypeCVE-2026-48818EPSS 0.4%
- urllib3: Decompression-bomb safeguards bypassed in parts of the streaming APIgrypeCVE-2026-44432EPSS 0.7%
- urllib3: Sensitive headers forwarded across origins in proxied low-level redirectsgrypeCVE-2026-44431EPSS 0.3%
- Vulnerable OpenSSL included in cryptography wheelsgrype
- subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list ansubprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)semgrepfunctions/edge_processor/transformers.py:72
- subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list ansubprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)semgrepfunctions/edge_processor/transformers.py:83
- Image user should not be 'root'Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.trivyfrontend/Dockerfile:0
- js-yaml: js-yaml: Denial of Service via crafted YAML documentsjs-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This i…trivyCVE-2026-59869
- linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerabilitylinkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices inp…trivyCVE-2026-48801
- linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker textlinkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumpt…trivyCVE-2026-59887
- PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure## Vulnerability Details **File**: `lib/previous-map.js` **Line**: 87-98 (`loadFile`), 129-144 (`loadMap`) ### Root Cause PostCSS auto-detects a `/*# sourceMappingURL=... */` comment inside the CSS text it is asked to parse and, unless the caller explicitly passes `map: false`…trivy
- postcss: PostCSS: Information disclosure and denial of service via crafted CSS inputPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferen…trivyCVE-2026-45623
This report is public.