LMDeploy has an SSRF bypass

### Summary The URL checking logic in lmdeploy has a logical flaw that could be bypassed by attackers, leading to SSRF a

历史摘要 · 未重新核验 · GitHub Advisory

LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading

CVE-2026-33625

### Summary lmdeploy <= latest contains a code injection vulnerability in `lmdeploy/pytorch/config.py` line 620 that al

历史摘要 · 未重新核验 · GitHub Advisory

LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

CVE-2025-66455

## Summary LMDeploy's PyTorch DistServe/PD-disaggregation control plane used `recv_pyobj()` to deserialize messages rec

历史摘要 · 未重新核验 · GitHub Advisory

Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns

CVE-2026-86000

## Summary soupsieve compiles CSS selector strings with a set of hand-written regular expressions. The shared `IDENTIFI

历史摘要 · 未重新核验 · GitHub Advisory

Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)

CVE-2026-85999

## Summary Before tokenizing, `selector_iter` trims leading/trailing whitespace and comments by running two regexes ove

历史摘要 · 未重新核验 · GitHub Advisory

djust: A template binding inherits a context safety grant it never earned (XSS)

A context safety grant was inherited by a template **binding** that never earned it, so rebinding a name the view had ma

历史摘要 · 未重新核验 · GitHub Advisory

djust: Six template-layer defects emit attacker-controlled markup unescaped (XSS)

Five independent defects in djust's template auto-escaping cause attacker-controlled input to be rendered as live markup

历史摘要 · 未重新核验 · GitHub Advisory

Jupyter Server: 5xx request logging leaks token-bearing Referer header values

CVE-2026-86049

### Summary When a request returns a 500, `jupyter_server/log.py` logs a small JSON block of request headers. The Ref

历史摘要 · 未重新核验 · GitHub Advisory

vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions

CVE-2026-57173

### Summary The audio decode-duration guard (`max_duration_s`, env `VLLM_MAX_AUDIO_DECODE_DURATION_S`, default 600s) tha

历史摘要 · 未重新核验 · GitHub Advisory

djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

CVE-2026-61599

### Impact The djust live transport resolves the LiveView to mount from a **client-supplied dotted path** by calling `__

历史摘要 · 未重新核验 · GitHub Advisory

djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path

CVE-2026-61589

### Impact The WebSocket `handle_mount` and `ViewRuntime._build_request` rebuild an `HttpRequest` via `RequestFactory().

历史摘要 · 未重新核验 · GitHub Advisory

djust has broken object-level access control (IDOR)

CVE-2026-61596

### Impact djust's per-object authorization (`get_object` + `has_object_permission`, ADR-017) was enforced on the WebSoc

历史摘要 · 未重新核验 · GitHub Advisory

djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client

CVE-2026-61588

### Impact When a Django `Model` instance is assigned to a **public** view attribute, djust serialized it to the client

历史摘要 · 未重新核验 · GitHub Advisory

djust has an authorization bypass on the WebSocket/SSE mount path

CVE-2026-61594

### Impact The live (WebSocket) transport authorizes a mount via `check_view_auth`, not Django's `View.dispatch()` chain

历史摘要 · 未重新核验 · GitHub Advisory

djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

CVE-2026-61591

### Impact For views that opt into state snapshots, the snapshot `state_json` embedded in the client page was restored o

历史摘要 · 未重新核验 · GitHub Advisory

djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)

CVE-2026-61592

### Impact SSE sessions were keyed solely by a **client-chosen** `session_id` with no binding to the authenticated user

历史摘要 · 未重新核验 · GitHub Advisory

djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags

CVE-2026-61597

### Impact Many djust built-in component template tags (`djust.components.templatetags.*`) render a developer/user-suppl

历史摘要 · 未重新核验 · GitHub Advisory

djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session

CVE-2026-61593

### Impact The SSE client→server POST endpoints are `@csrf_exempt` and the SSE GET stream endpoint had no Origin check,

历史摘要 · 未重新核验 · GitHub Advisory

LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy

CVE-2025-59953

### Description The LMdeploy implements an rpc server (AsyncRPCServer in zmq_rpc.py) for supporting the RPC communicati

历史摘要 · 未重新核验 · GitHub Advisory

djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

CVE-2026-61595

### Impact `djust.tenants` isolation was enforced only on the HTTP path. The current tenant was stored in `threading.loc

历史摘要 · 未重新核验 · GitHub Advisory