chainguard/py3.13-captum

Vulnerabilities (40)

• CVE-2026-2950MedMar 31, 2026
  affected < 0.9.0-r1fixed 0.9.0-r1

  Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker ca

• CVE-2026-33750MedMar 27, 2026
  affected < 0.9.0-r1fixed 0.9.0-r1

  The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process

• CVE-2026-4867HigMar 26, 2026
  affected < 0.9.0-r1fixed 0.9.0-r1

  Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in [email protected] only prevents ambigu

• CVE-2026-27904HigFeb 26, 2026
  affected < 0.9.0-r1fixed 0.9.0-r1

  minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), wh

• CVE-2026-27903HigFeb 26, 2026
  affected < 0.9.0-r1fixed 0.9.0-r1

  minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-a

• CVE-2026-26996HigFeb 20, 2026
  affected < 0.9.0-r1fixed 0.9.0-r1

  minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal charact

• CVE-2024-21538HigNov 8, 2024
  affected < 0.9.0-r1fixed 0.9.0-r1

  Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted

• CVE-2024-4068HigMay 14, 2024
  affected < 0.9.0-r1fixed 0.9.0-r1

  The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program

• CVE-2024-4067MedMay 14, 2024
  affected < 0.9.0-r1fixed 0.9.0-r1

  The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching w

• CVE-2023-44270MedSep 29, 2023
  affected < 0.9.0-r1fixed 0.9.0-r1

  An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be inc

• CVE-2023-26136MedJul 1, 2023
  affected < 0.9.0-r1fixed 0.9.0-r1

  Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

• CVE-2023-28155MedMar 16, 2023
  affected < 0.9.0-r1fixed 0.9.0-r1

  The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintaine

• CVE-2022-3517HigOct 17, 2022
  affected < 0.9.0-r1fixed 0.9.0-r1

  A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

• CVE-2021-43307MedJun 2, 2022
  affected < 0.9.0-r1fixed 0.9.0-r1

  An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method

• CVE-2021-42740CriOct 21, 2021
  affected < 0.9.0-r1fixed 0.9.0-r1

  The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command wi

• CVE-2021-3803HigSep 17, 2021
  affected < 0.9.0-r1fixed 0.9.0-r1

  nth-check is vulnerable to Inefficient Regular Expression Complexity

• CVE-2021-3795HigSep 15, 2021
  affected < 0.9.0-r1fixed 0.9.0-r1

  semver-regex is vulnerable to Inefficient Regular Expression Complexity

• CVE-2021-33623HigMay 28, 2021
  affected < 0.9.0-r1fixed 0.9.0-r1

  The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.

• CVE-2021-23364MedApr 28, 2021
  affected < 0.9.0-r1fixed 0.9.0-r1

  The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

• CVE-2021-23337HigFeb 15, 2021
  affected < 0.9.0-r1fixed 0.9.0-r1

  Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.