medium · 6.5Maintainer reviewed
AASD-2026-0005
Hugging Face Datasets folder builders permit local file disclosure through metadata path traversal
Hugging Face / Datasets / Folder-based dataset builders and file_name metadata handling
Hugging Face Datasets through 5.0.0 did not adequately constrain the attacker-controlled file_name field used by its imagefolder, audiofolder, videofolder, and pdffolder builders. Loading a crafted local or Hub dataset could read files outside the dataset directory; a later save_to_disk or push_to_hub operation could embed those bytes in exported dataset content.
high · 7.5Maintainer reviewed
AASD-2026-0007
ComfyUI workflow media loaders permit file probing and image disclosure outside the input directory
Comfy Org / ComfyUI / Annotated-file path validation in LoadImage and sibling media-loading nodes
ComfyUI before 0.28.0 did not adequately contain annotated file paths used by LoadImage and related built-in media-loading nodes. An unauthenticated network caller able to submit a crafted workflow to the prompt API could probe files outside the configured input directory and retrieve files that ComfyUI could decode as images through its normal output and view paths.
high · 7.1Maintainer reviewed
AASD-2026-0006
Langflow FAISS namespace reuse exposes and poisons another user's vector content
Langflow / Langflow / FAISS vector-store persistence and namespace isolation
Langflow OSS 1.0.0 through 1.10.1 persisted FAISS indexes without adequately scoping their namespaces to the authenticated user. A low-privilege user who selected another user's namespace could retrieve owner-only vector content and persist attacker-controlled content that influenced later query results.
critical · 9.1Maintainer reviewed
AASD-2026-0003
Dify trace authorization bypass permits cross-tenant AI conversation exfiltration
LangGenius / Dify / Application trace-configuration endpoints
Dify versions before 1.14.2 did not verify tenant ownership when an authenticated editor configured tracing for an application. A caller who obtained another application's internal identifier could enable an attacker-controlled tracing provider for that application, causing prompts and model responses to be copied across the tenant boundary.
high · 7.1Maintainer reviewed
AASD-2026-0001
Open WebUI chat completion bypasses tool authorization
Open WebUI / Open WebUI / chat completion tool and MCP authorization
Open WebUI before 0.8.6 did not consistently verify that a chat-completion API user was authorized to invoke requested local tools or administrator-configured MCP servers. A low-privilege authenticated user could cross the intended tool visibility boundary, and an MCP invocation could use credentials stored by the server for that restricted integration.
medium · 4.8Maintainer reviewed
AASD-2026-0004
NVIDIA Triton model configuration handling permits information disclosure or denial of service
NVIDIA / NVIDIA Triton Inference Server / Triton Server model-configuration processing
NVIDIA Triton Inference Server releases before r26.02 insufficiently constrained a path derived while processing an uploaded model configuration. A network caller able to supply a model configuration to an affected server could cause limited information disclosure or disrupt inference service availability.
high · 8.2Maintainer reviewed
AASD-2026-0002
Gradio gr.load configuration trust enables server-side request forgery
gradio-app / Gradio / gr.load() external Space configuration processing
Gradio versions before 6.6.0 trusted a proxy URL supplied by an externally loaded Space and added its host to the application's proxy allowlist. When an application loaded an attacker-controlled Space with gr.load(), a remote attacker could make requests from the Gradio server to internal or otherwise restricted network resources.
critical · 9.3Maintainer reviewed
AASD-2025-0007
LangChain serialization injection permits secret extraction and trusted-class instantiation
langchain-ai / LangChain / langchain-core dumps(), dumpd(), load(), and loads() serialization path
LangChain Core before 0.3.81 and versions 1.0.0 through 1.2.4 failed to escape user-controlled dictionaries containing internal `lc` markers during serialization. Later deserialization could interpret those dictionaries as trusted LangChain objects, exposing environment secrets or triggering side effects in allowlisted classes.
critical · 9.4Maintainer reviewed
AASD-2025-0004
Ray dashboard browser guard bypass permits developer workstation code execution
ray-project / Ray / Dashboard job submission endpoints and browser-request guard
Ray versions before 2.52.0 relied on a browser User-Agent heuristic to protect unauthenticated dashboard job endpoints. In affected Firefox and Safari workflows, a DNS-rebinding attack could bypass that heuristic after a developer visited attacker-controlled content, allowing commands to execute in the Ray process context.
high · 8.8Maintainer reviewed
AASD-2025-0003
vLLM prompt-embedding deserialization permits memory corruption
vLLM / vLLM / prompt embeddings endpoint
vLLM before 0.11.1 loaded user-supplied prompt embeddings through torch.load without sufficient validation. Crafted sparse tensors could bypass integrity checks and trigger an out-of-bounds write during conversion to a dense tensor, causing a crash and potentially code execution in the inference server.
medium · 5.5Maintainer reviewed
AASD-2025-0008
Keras safe-mode model loading permits local file reads and conditional SSRF
Keras / Keras / StringLookup and IntegerLookup vocabulary loading through IndexLookup
Keras versions before 3.12.0 could resolve attacker-controlled vocabulary paths from StringLookup or IntegerLookup layers while loading a crafted `.keras` archive, even with safe mode enabled. The resulting deserialization side effect could read local files and, when compatible TensorFlow filesystem handlers were installed, request internal or external network resources.
medium · 5.3Maintainer reviewed
AASD-2025-0005
Transformers dynamic module import parsing permits regular-expression denial of service
Hugging Face / Transformers / dynamic_module_utils.py get_imports()
Hugging Face Transformers versions from 4.49.0 through 4.50.x used an inefficient regular expression while discovering imports in dynamically loaded model code. Processing attacker-influenced module text could consume excessive CPU, disrupting model loading, serving, or development pipelines.