Base de CVEs

Tratamento impróprio de referências remotas não confiáveis nas versões do Snowflake CLI anteriores à 3.19 permitiu server-side request forgery. As diretivas !source/!load do leitor de instruções SQL podiam referenciar URLs remotas que eram recuperadas em tempo de execução sem restrição suficiente quanto ao destino da requisição. Ao fornecer conteúdo SQL elaborado processado por um caminho de comando vulnerável, um atacante poderia fazer com que o ambiente da vítima emitisse requisições de saída não previstas para locais de rede internos ou não públicos, e poderia fazer com que conteúdo SQL remoto fosse recuperado e executado no contexto da sessão do usuário vítima. A exploração bem-sucedida exige que a vítima processe conteúdo controlado pelo atacante por meio de um caminho de comando vulnerável e é limitada pelos privilégios disponíveis àquela sessão e ambiente. A correção está disponível no Snowflake CLI versão 3.19, que adiciona uma opção para desabilitar a recuperação de URLs remotas.

In Duck Site before version 1.0.1, the repository has a deploy workflow that runs after the build workflow completes. The build workflow runs on pull requests, while the deploy workflow runs with package-write permissions and deployment secrets. If an attacker can make a pull request build satisfy the deploy workflow’s main branch condition, the deploy job checks out the triggering workflow commit, builds it into a Docker image, pushes it as latest, and triggers Dokploy deployment. This can allow attacker-controlled pull request code to become the deployed production site image without being merged. This issue has been patched in version 1.0.1.

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, the repository has a privileged deploy workflow that runs after the unprivileged build workflow completes. The build workflow runs on pull requests, and the deploy workflow checks out the triggering workflow’s head_sha, builds that code into a Docker image, pushes it as latest, and triggers production deployment. If an attacker can open a pull request from a branch named main, the deploy workflow condition can treat the PR build as deployable and build the attacker-controlled commit in a privileged deployment context. This can result in malicious container deployment and production bot compromise. This issue has been patched in version 1.0.3.

A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the `trust_remote_code` parameter, intended to prevent remote code execution, is overridden by untrusted serialized configuration data in a nested code path. Specifically, when loading a LightGlue model using `AutoModel.from_pretrained()` with `trust_remote_code=False`, the `LightGlueConfig` reads the `trust_remote_code` value from the untrusted `config.json` file and propagates it into nested `AutoConfig.from_pretrained()` calls. This results in the execution of attacker-provided Python modules, even when the victim explicitly disables remote code execution. The vulnerability poses a high risk for environments such as API inference servers, research notebooks, CI/CD pipelines, and model evaluation workers, potentially leading to credential theft, lateral movement, or persistence/backdoor deployment.