# findings

created_at: 2026-02-12 21:47:43
updated_at: 2026-02-14 17:50:10
program: Dify
platform: huntr
repo_url: https://github.com/langgenius/dify
repo_name: dify
title: SSRF via remote file endpoints when SSRF proxy not configured
vuln_type: SSRF
cwe_id: CWE-918
severity: high
confidence: medium
file_path: api/controllers/console/remote_files.py
tool: manual
rule_id: ssrf-no-proxy-validation
status: duplicate
payout_currency: USD
scan_briefing_path: briefings/archive/SCAN_dify_2026-02-12.md
description:
  SSRF protection relies entirely on external Squid proxy. When SSRF_PROXY_*_URL env vars are not configured (common in self-hosted), ssrf_proxy creates plain httpx.Client with zero IP restrictions. Authenticated users can reach internal network via /console/api/remote-files/<url>, workflow HTTP nodes, external knowledge API, and DSL import.

attack_vector:
  GET /console/api/remote-files/http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2F (authenticated console user)

impact:
  Access to cloud metadata (AWS IAM credentials), internal service enumeration, data exfiltration. Could escalate to full infra compromise via IMDS.


created_at: 2026-02-12 21:47:50
updated_at: 2026-02-14 17:50:10
program: Dify
platform: huntr
repo_url: https://github.com/langgenius/dify
repo_name: dify
title: Unsandboxed Jinja2 template execution in code executor
vuln_type: Code Injection
cwe_id: CWE-94
severity: medium
confidence: medium
file_path: api/core/helper/code_executor/jinja2/jinja2_transformer.py
tool: manual
rule_id: jinja2-ssti-sandbox
attack_vector: Create workflow Template Transform node with SSTI payload. Executes within sandbox service.
status: triaged
payout_currency: USD
scan_briefing_path: briefings/archive/SCAN_dify_2026-02-12.md
description:
  Jinja2 templates in workflow template-transform nodes use jinja2.Template() directly (not SandboxedEnvironment). Allows SSTI payloads for arbitrary Python code exec. Runs inside external sandbox service with enable_network=True. Security depends on sandbox isolation quality.

impact:
  Code execution within sandbox. Network access (enable_network=True) could enable lateral movement from sandbox perspective.


created_at: 2026-02-12 21:48:18
updated_at: 2026-02-14 17:50:52
program: MLflow
platform: huntr
repo_url: https://github.com/mlflow/mlflow
repo_name: mlflow
title: Source Validation Bypass via Prompt Tag in CreateModelVersion
vuln_type: path-traversal
cwe_id: CWE-284
severity: medium
confidence: medium
file_path: mlflow/server/handlers.py
tool: manual
rule_id: manual-review
status: draft
report_path: reports/MLflow-FileRead-2026-02-12.md
payout_currency: USD
scan_briefing_path: briefings/archive/SCAN_mlflow_2026-02-12.md
description:
  When creating a model version, adding a tag with key mlflow.prompt.is_prompt bypasses all source validation. The unvalidated source is stored and later used by get_model_version_artifact_handler to serve files, potentially enabling arbitrary file read on the server.

attack_vector:
  POST /api/2.0/mlflow/model-versions/create with prompt tag to bypass source validation, then GET artifact with the poisoned model version source

impact:
  Arbitrary file read on the tracking server host. On default deployments (no auth), any network-reachable client can read server-side files.


created_at: 2026-02-12 21:48:22
updated_at: 2026-02-14 17:50:10
program: LibreChat
platform: huntr
repo_url: https://github.com/danny-avila/LibreChat
repo_name: LibreChat
title: IDOR via userId Override in User Key Update Route
vuln_type: IDOR / Broken Access Control
cwe_id: CWE-639
severity: high
confidence: high
file_path: api/server/routes/keys.js
tool: manual_review
rule_id: spread-operator-override
attack_vector: PUT /api/keys with body {name:"openAI",value:"attacker-key",userId:"<victim_id>"}
impact: Attacker can overwrite any user's stored API keys causing DoS or token harvesting
status: draft
report_path: reports/LibreChat-IDOR-2026-02-12.md
payout_currency: USD
scan_briefing_path: briefings/archive/SCAN_LibreChat_2026-02-12.md
description:
  The spread operator ...req.body after userId: req.user.id allows attacker to override userId in PUT /api/keys, writing API keys to any user's key store.


created_at: 2026-02-12 21:48:25
updated_at: 2026-02-14 17:50:10
program: MLflow
platform: huntr
repo_url: https://github.com/mlflow/mlflow
repo_name: mlflow
title: SSRF via Webhook URL (HTTPS-only default)
vuln_type: ssrf
cwe_id: CWE-918
severity: low
confidence: medium
file_path: mlflow/webhooks/delivery.py
tool: manual
rule_id: manual-review
attack_vector: POST /api/2.0/mlflow/webhooks/create with internal HTTPS URL, then trigger webhook event
status: triaged
payout_currency: USD
scan_briefing_path: briefings/archive/SCAN_mlflow_2026-02-12.md
description:
  The webhook system allows registering arbitrary URLs. URL validation only checks scheme (default HTTPS). No hostname allowlist, no private IP blocking. Server POSTs to user-specified URLs on events.

impact:
  SSRF limited to HTTPS POST requests. Can probe internal services. Low impact due to HTTPS-only and POST-only defaults.


created_at: 2026-02-12 21:48:28
updated_at: 2026-02-14 17:50:10
program: LibreChat
platform: huntr
repo_url: https://github.com/danny-avila/LibreChat
repo_name: LibreChat
title: Password Reset Token Leaked in HTTP Response When Email Not Configured
vuln_type: Account Takeover / Password Reset
cwe_id: CWE-640
severity: critical
confidence: high
file_path: api/server/services/AuthService.js
tool: manual_review
rule_id: token-in-response
impact: Full account takeover on instances without email config including admin accounts
status: draft
report_path: reports/LibreChat-PasswordResetLinkLeak-2026-02-12.md
payout_currency: USD
scan_briefing_path: briefings/archive/SCAN_LibreChat_2026-02-12.md
description:
  When email not configured, requestPasswordReset returns full reset link with token in HTTP response body. Affects self-hosted instances without SMTP/Mailgun.

attack_vector:
  POST /api/auth/requestPasswordReset with {email:"victim@example.com"} returns {link:"...?token=X&userId=Y"}


created_at: 2026-02-12 22:03:31
updated_at: 2026-02-14 17:50:10
program: FastChat
platform: huntr
repo_url: https://github.com/lm-sys/FastChat
repo_name: FastChat
title: SSRF via Worker Registration - Controller accepts arbitrary worker URLs
vuln_type: SSRF
cwe_id: CWE-918
severity: high
confidence: high
file_path: fastchat/serve/controller.py
tool: manual
rule_id: manual-ssrf-register-worker
attack_vector: POST /register_worker with worker_name=http://169.254.169.254/... then trigger via model request
status: duplicate
report_path: reports/FastChat-SSRF-2026-02-12.md
payout_currency: USD
scan_briefing_path: briefings/archive/SCAN_FastChat_2026-02-12.md
description:
  Controller /register_worker endpoint accepts any URL as worker_name with no auth/validation. Attacker registers malicious URL, controller makes HTTP POST requests to it during health checks and request proxying. Full SSRF. [DUPLICATE of CVE-2024-10044]

impact:
  Full SSRF: read cloud metadata, scan internal network, access internal services, potential full cloud account compromise


created_at: 2026-02-12 22:03:38
updated_at: 2026-02-14 17:50:10
program: FastChat
platform: huntr
repo_url: https://github.com/lm-sys/FastChat
repo_name: FastChat
title: SSRF via Image URL Fetching in load_image utility
vuln_type: SSRF
cwe_id: CWE-918
severity: medium
confidence: medium
file_path: fastchat/utils.py
tool: manual
rule_id: manual-ssrf-load-image
attack_vector: Chat completion with image_url pointing to internal service
impact: SSRF via image fetching. Limited exfiltration (PIL parse) but enables port scanning.
status: triaged
payout_currency: USD
scan_briefing_path: briefings/archive/SCAN_FastChat_2026-02-12.md
description:
  load_image fetches arbitrary URLs from user-provided image_url in chat requests. sglang_worker calls load_image(images[i]) with user input. No URL validation.


created_at: 2026-02-12 22:03:43
updated_at: 2026-02-14 17:50:10
program: FastChat
platform: huntr
repo_url: https://github.com/lm-sys/FastChat
repo_name: FastChat
title: Unauthenticated Controller API Endpoints Enable Worker Hijacking
vuln_type: Auth Bypass
cwe_id: CWE-306
severity: high
confidence: medium
file_path: fastchat/serve/controller.py
tool: manual
rule_id: manual-auth-bypass-controller
attack_vector: POST /register_worker with malicious worker that returns poisoned responses
impact: Model response manipulation, internal network info disclosure, DoS
status: duplicate
payout_currency: USD
scan_briefing_path: briefings/archive/SCAN_FastChat_2026-02-12.md
description:
  All controller endpoints have zero authentication. Attacker can register malicious workers, enumerate models/worker addresses, spoof heartbeats, poison model responses.


created_at: 2026-02-12 22:06:47
updated_at: 2026-02-14 17:50:10
program: BentoML
platform: huntr
repo_url: https://github.com/bentoml/BentoML
repo_name: BentoML
title: Unsafe deserialization on runner HTTP endpoint via pickle.loads
vuln_type: Deserialization / RCE
cwe_id: CWE-502
severity: critical
confidence: medium
file_path: src/bentoml/_internal/server/runner_app.py
tool: manual
rule_id: pickle-loads-runner
attack_vector: POST to /<method_name> with args-number:2 header and crafted pickle payload
impact: Remote Code Execution on runner worker process
status: duplicate
payout_currency: USD
scan_briefing_path: briefings/archive/SCAN_BentoML_2026-02-12.md
description:
  Runner server directly calls pickle.loads on raw HTTP request body when args-number header >1. Runner listens on localhost or UDS but reachable via SSRF or k8s pod network.


created_at: 2026-02-12 22:06:55
updated_at: 2026-02-14 17:50:10
program: BentoML
platform: huntr
repo_url: https://github.com/bentoml/BentoML
repo_name: BentoML
title: SSRF protection bypass via race condition in make_safe_connect
vuln_type: SSRF
cwe_id: CWE-918
severity: high
confidence: medium
file_path: src/bentoml/_internal/utils/uri.py
tool: manual
rule_id: ssrf-race-condition
attack_vector: Concurrent requests to file-URL-accepting endpoints; time malicious request in restoration window
impact: SSRF to cloud metadata, internal services; chain with F1/F3 for RCE
status: duplicate
report_path: reports/BentoML-SSRF-2026-02-12.md
payout_currency: USD
scan_briefing_path: briefings/archive/SCAN_BentoML_2026-02-12.md
description:
  make_safe_connect patches uvloop.Loop.create_connection globally then restores in finally block. Concurrent requests create window where protection is removed. Also uvloop-specific.


created_at: 2026-02-12 22:07:01
updated_at: 2026-02-14 17:50:10
program: BentoML
platform: huntr
repo_url: https://github.com/bentoml/BentoML
repo_name: BentoML
title: PickleSerde accessible on non-main dependency service endpoints
vuln_type: Deserialization / RCE
cwe_id: CWE-502
severity: high
confidence: high
file_path: src/_bentoml_impl/server/app.py
tool: manual
rule_id: pickle-serde-dependency
attack_vector: SSRF to dependency service + POST with application/vnd.bentoml+pickle content type
impact: Remote Code Execution on dependency service worker
status: draft
report_path: reports/BentoML-PickleRCE-2026-02-12.md
payout_currency: USD
scan_briefing_path: briefings/archive/SCAN_BentoML_2026-02-12.md
description:
  is_main guard only blocks pickle on entry service. Dependency services accept pickle content type. Reachable via SSRF or k8s network adjacency.


created_at: 2026-02-12 22:07:07
updated_at: 2026-02-14 17:50:10
program: BentoML
platform: huntr
repo_url: https://github.com/bentoml/BentoML
repo_name: BentoML
title: Path traversal in yatai.py tar extraction (missing safe_extract)
vuln_type: Path Traversal
cwe_id: CWE-22
severity: medium
confidence: low
file_path: src/bentoml/_internal/cloud/yatai.py
tool: manual
rule_id: tar-traversal-yatai
attack_vector: Compromised Yatai server serves tar with traversal entries
impact: Arbitrary file write (if pyfilesystem2 doesnt block traversal)
status: triaged
payout_currency: USD
scan_briefing_path: briefings/archive/SCAN_BentoML_2026-02-12.md
description:
  yatai.py tar extraction uses temp_fs.writebytes(member.name) without path validation. Unlike cloud/bento.py which uses safe_extract_tarfile.


created_at: 2026-02-12 22:07:12
updated_at: 2026-02-14 17:50:10
program: RAGFlow
platform: huntr
repo_url: https://github.com/infiniflow/ragflow
repo_name: ragflow
title: Inverted Authorization Check in web_crawl Endpoint
vuln_type: Auth Bypass
cwe_id: CWE-863
severity: high
confidence: high
file_path: api/apps/document_app.py
tool: manual
rule_id: auth-bypass-inverted-check
status: draft
report_path: reports/RAGFlow-AuthBypass-2026-02-12.md
payout_currency: USD
scan_briefing_path: briefings/archive/SCAN_ragflow_2026-02-12.md
description:
  check_kb_team_permission() returns True when authorized but the condition denies when True. Line 86 correctly uses not, line 116 omits it. Allows any authenticated user to web_crawl on others KB.

attack_vector:
  POST /v1/document/web_crawl with kb_id of another users knowledge base. The authenticated user must NOT be a team member of the target KB to gain access.

impact:
  Any authenticated user can crawl arbitrary URLs and store results in any knowledge base they can discover but not their own. Combined with SSRF bypass this enables internal network reconnaissance.


created_at: 2026-02-12 22:07:14
updated_at: 2026-02-14 17:50:10
program: BentoML
platform: huntr
repo_url: https://github.com/bentoml/BentoML
repo_name: BentoML
title: Multiple unsafe pickle.loads in runner container deserialization
vuln_type: Deserialization / RCE
cwe_id: CWE-502
severity: high
confidence: low
file_path: src/bentoml/_internal/runner/container.py
tool: manual
rule_id: pickle-container-deser
attack_vector: Requires SSRF or control of runner responses
impact: RCE via pickle deserialization
status: triaged
payout_currency: USD
scan_briefing_path: briefings/archive/SCAN_BentoML_2026-02-12.md
description:
  pickle.loads in NumpyNdarrayContainer, PandasDataFrameContainer, and remote runner handle. Internal-only traffic between trusted components.


created_at: 2026-02-12 22:07:18
updated_at: 2026-02-14 17:50:10
program: RAGFlow
platform: huntr
repo_url: https://github.com/infiniflow/ragflow
repo_name: ragflow
title: Path Traversal via Server-Controlled Filename in /parse Endpoint
vuln_type: Path Traversal
cwe_id: CWE-22
severity: high
confidence: high
file_path: api/apps/document_app.py
tool: manual
rule_id: path-traversal-filename
status: draft
report_path: reports/RAGFlow-PathTraversal-2026-02-12.md
payout_currency: USD
scan_briefing_path: briefings/archive/SCAN_ragflow_2026-02-12.md
description:
  Filename extracted from HTTP response Content-Disposition header is joined with download_path via os.path.join without sanitization. Malicious server can use traversal payload to read arbitrary files.

attack_vector:
  1) Set up server returning Content-Disposition: attachment; filename=../../../../etc/passwd 2) POST /v1/document/parse with url pointing to it 3) Response contains file contents parsed as document.

impact:
  Arbitrary file read on the server. Attacker can read config files, secrets, source code, database credentials.


created_at: 2026-02-12 22:07:24
updated_at: 2026-02-14 17:50:10
program: RAGFlow
platform: huntr
repo_url: https://github.com/infiniflow/ragflow
repo_name: ragflow
title: SSRF via MCP Server Registration (No URL Validation)
vuln_type: SSRF
cwe_id: CWE-918
severity: high
confidence: high
file_path: api/apps/mcp_server_app.py
tool: manual
rule_id: ssrf-mcp-no-validation
status: draft
report_path: reports/RAGFlow-MCP-SSRF-2026-02-13.md
payout_currency: USD
scan_briefing_path: briefings/archive/SCAN_ragflow_2026-02-12.md
description:
  MCP server create/update endpoints allow registering arbitrary URLs without is_valid_url check. System connects to the provided URL via SSE or HTTP. Attacker can probe internal services.

attack_vector:
  POST /v1/mcp_server/create with url set to http://169.254.169.254/latest/meta-data/ or internal service URLs and server_type streamable_http.

impact:
  Internal network reconnaissance, cloud metadata access, service enumeration, info leakage through error messages.


created_at: 2026-02-12 22:07:31
updated_at: 2026-02-14 17:50:10
program: RAGFlow
platform: huntr
repo_url: https://github.com/infiniflow/ragflow
repo_name: ragflow
title: SSRF via DNS Rebinding in is_valid_url TOCTOU
vuln_type: SSRF
cwe_id: CWE-918
severity: medium
confidence: medium
file_path: api/utils/web_utils.py
tool: manual
rule_id: ssrf-dns-rebinding-toctou
impact: Bypass SSRF protection to access internal services, cloud metadata credentials, internal APIs.
status: triaged
payout_currency: USD
scan_briefing_path: briefings/archive/SCAN_ragflow_2026-02-12.md
description:
  is_valid_url resolves hostname once to check if private, then actual request resolves again. DNS rebinding allows first resolution to pass check with public IP, second to hit internal IP.

attack_vector:
  Set up DNS rebinding service alternating public IP and 169.254.169.254. Call web_crawl or parse. First resolution passes validation, second hits cloud metadata.


created_at: 2026-02-12 22:07:37
updated_at: 2026-02-14 17:50:10
program: RAGFlow
platform: huntr
repo_url: https://github.com/infiniflow/ragflow
repo_name: ragflow
title: Unauthenticated Image/Storage Access via get_image Endpoint
vuln_type: Auth Bypass
cwe_id: CWE-306
severity: medium
confidence: medium
file_path: api/apps/document_app.py
tool: manual
rule_id: unauth-storage-access
status: draft
report_path: reports/RAGFlow-UnauthImageAccess-2026-02-12.md
payout_currency: USD
scan_briefing_path: briefings/archive/SCAN_ragflow_2026-02-12.md
description:
  login_required decorator commented out on /image/<image_id> and /thumbnails endpoints. Allows unauthenticated access to stored files by guessing bucket-name pairs.

attack_vector:
  GET /v1/document/image/{kb_id}-{filename} without authentication. kb_id obtainable from shared datasets or leaked references.

impact:
  Unauthorized access to stored documents and images from any users knowledge base. Cross-tenant data exfiltration.


created_at: 2026-02-13 12:15:49
updated_at: 2026-02-13 12:15:49
program: humand-web
platform: internal
repo_url: https://github.com/HumandDev/humand-web
repo_name: humand-web
title: Hardcoded SCORM Cloud API credentials in source code
vuln_type: Hardcoded Credentials
cwe_id: CWE-798
severity: high
confidence: high
file_path: src/config/api.ts
tool: manual
rule_id: hardcoded-secret
status: triaged
payout_currency: USD
scan_briefing_path: briefings/SCAN_humand-web_2026-02-13.md
description:
  The scormApi axios instance contains a hardcoded Basic Auth header: "Basic NjU3TjRJUllDVDpnVmFSWTJEUExDZ215SUIzeVA2a2tDUmpZcjE4aFJzOUVxMkx2cVdS" which decodes to "657N4IRYCT:gVaRY2DPLCgmyIB3yP6kkCRjYr18hRs9Eq2LvqWR". This is a SCORM Cloud API key and secret, hardcoded in the frontend bundle. Anyone can extract it from the compiled JS and use it to access the SCORM Cloud API directly.

attack_vector:
  Extract credentials from frontend bundle → call SCORM Cloud API v2 as authenticated user → read/modify courses, registrations, learner data

impact:
  Full access to SCORM Cloud account. Attacker can read all courses, learner registrations, and potentially modify training content.


created_at: 2026-02-13 12:15:49
updated_at: 2026-02-13 12:15:49
program: humand-web
platform: internal
repo_url: https://github.com/HumandDev/humand-web
repo_name: humand-web
title: Refresh tokens exposed in URL path parameters for mobile routes
vuln_type: Sensitive Data Exposure
cwe_id: CWE-598
severity: high
confidence: high
file_path: src/routes.tsx
tool: manual
rule_id: token-in-url
status: triaged
payout_currency: USD
scan_briefing_path: briefings/SCAN_humand-web_2026-02-13.md
description:
  Routes /documents-lacomer-mobile/:refreshToken and /requests-banbajio-mobile/:refreshToken embed the refresh token directly in the URL path. Refresh tokens are long-lived credentials that can generate new access tokens. URLs are logged by browsers (history), proxies, web server access logs, Referer headers, and analytics tools.

attack_vector:
  Token leaks via: browser history, Referer header to third-party resources loaded on page, server/proxy logs, analytics platforms (Amplitude/Sentry/Clarity configured in this app), shoulder surfing

impact:
  Account takeover. A leaked refresh token allows an attacker to generate unlimited access tokens and impersonate the user indefinitely until the refresh token is revoked.


created_at: 2026-02-13 12:15:49
updated_at: 2026-02-13 12:15:49
program: humand-web
platform: internal
repo_url: https://github.com/HumandDev/humand-web
repo_name: humand-web
title: Access tokens exposed in URL path for multiple mobile routes
vuln_type: Sensitive Data Exposure
cwe_id: CWE-598
severity: medium
confidence: high
file_path: src/routes.tsx
tool: manual
rule_id: token-in-url
status: triaged
payout_currency: USD
scan_briefing_path: briefings/SCAN_humand-web_2026-02-13.md
description:
  Routes /events-nemak-mobile/:accessToken, /org-chart-mobile/:accessToken/:id, /scorm-courses-mobile/:accessToken, /recognitions-nemak-mobile/:accessToken all embed JWT access tokens in URL path. In scorm/Folders.tsx (line 64-65) the URL token is directly stored to encryptStorage as the active session token.

attack_vector:
  Token leaks via browser history, Referer headers, proxy/server logs, analytics. The Scorm Folders component stores the URL token as the active session.

impact:
  Session hijacking for the duration of the access token validity. Combined with the refresh token exposure, this creates multiple pathways for credential theft.


created_at: 2026-02-13 12:15:49
updated_at: 2026-02-13 12:15:49
program: humand-web
platform: internal
repo_url: https://github.com/HumandDev/humand-web
repo_name: humand-web
title: postMessage handler accepts tokens without origin validation
vuln_type: Improper Origin Validation
cwe_id: CWE-346
severity: medium
confidence: high
file_path: src/hooks/useMobileToken.ts
tool: manual
rule_id: postmessage-no-origin
status: triaged
payout_currency: USD
scan_briefing_path: briefings/SCAN_humand-web_2026-02-13.md
description:
  The useMobileToken hook listens for window "message" events and stores any token where event.data.type === "humand" directly into encryptStorage as the access token. There is no validation of event.origin. Any window that can obtain a reference to this window (e.g. via window.open or iframe) can send a crafted message and overwrite the stored access token.

attack_vector:
  Attacker opens the app in an iframe or via window.open from their malicious page → sends postMessage({type:"humand", token:"attacker-controlled-jwt"}) → victim's session token is replaced with attacker-controlled value

impact:
  Session fixation / token injection. Attacker can set a known token, then use the same token to make authenticated API calls as the victim. Or inject an expired/invalid token to cause DoS.


created_at: 2026-02-13 12:15:49
updated_at: 2026-02-13 12:15:49
program: humand-web
platform: internal
repo_url: https://github.com/HumandDev/humand-web
repo_name: humand-web
title: Multiple Stored XSS sinks via unsanitized dangerouslySetInnerHTML
vuln_type: Cross-Site Scripting (XSS)
cwe_id: CWE-79
severity: high
confidence: medium
file_path: src/components/HTMLBody.tsx
tool: manual
rule_id: xss-dangerouslysetinnerhtml
status: triaged
payout_currency: USD
scan_briefing_path: briefings/SCAN_humand-web_2026-02-13.md
description:
  At least 8 components render server-supplied HTML via dangerouslySetInnerHTML without any sanitization library (no DOMPurify, no sanitize-html). The DOMParser usage in HTMLBody.tsx and FAQDialog.tsx only modifies anchor attributes but does not strip malicious tags/attributes (e.g. onerror, onload, javascript: URIs). Affected files: HTMLBody.tsx (line 67), FAQDialog.tsx (line 58), ShowMoreText.tsx (line 93), RichText.tsx (line 38-39), LibrarySearchItem.tsx (lines 78-80, 122-125), useLibraryInfoDrawer.tsx (line 22), LibraryFullScreen.tsx (line 41), Highlighter.tsx (line 83-84).

attack_vector:
  Attacker creates content with embedded HTML (post body, library content, FAQ, performance review text, search highlights) containing <img src=x onerror=...> or <svg/onload=...> → content stored server-side → rendered without sanitization to all users who view it

impact:
  Stored XSS enables: session hijacking (steal JWT from encryptStorage), account takeover, data exfiltration, phishing, worm propagation across the organization.


created_at: 2026-02-13 12:15:49
updated_at: 2026-02-13 12:15:49
program: humand-web
platform: internal
repo_url: https://github.com/HumandDev/humand-web
repo_name: humand-web
title: EncryptStorage encryption key exposed in committed env files and frontend bundle
vuln_type: Use of Hard-coded Cryptographic Key
cwe_id: CWE-321
severity: medium
confidence: high
file_path: .env.production
tool: manual
rule_id: hardcoded-crypto-key
status: triaged
payout_currency: USD
scan_briefing_path: briefings/SCAN_humand-web_2026-02-13.md
description:
  VITE_ENCRYPT_STORAGE key is committed to .env, .env.development and .env.production. Since this is a Vite app, VITE_ prefixed vars are embedded in the frontend bundle. The encrypt-storage library uses this key to encrypt/decrypt localStorage. Anyone can extract the key from the bundle and decrypt stored tokens (accessToken, refreshToken, sessionId).

attack_vector:
  Extract VITE_ENCRYPT_STORAGE from JS bundle → use encrypt-storage library with same key to decrypt localStorage → extract JWT tokens

impact:
  Renders the "encrypted" storage effectively plaintext for anyone with access to the JS bundle (i.e. any user of the app). While this is somewhat mitigated by the fact that localStorage is already accessible to same-origin scripts, it defeats the purpose of using encrypt-storage and means XSS attacks can trivially extract tokens.


created_at: 2026-02-13 12:15:49
updated_at: 2026-02-13 12:15:49
program: humand-web
platform: internal
repo_url: https://github.com/HumandDev/humand-web
repo_name: humand-web
title: document.domain relaxation to lacomer.com.mx widens XSS attack surface
vuln_type: Improper Access Control
cwe_id: CWE-284
severity: medium
confidence: medium
file_path: src/pages/dashboard/documents/LaComerDocuments.tsx
tool: manual
rule_id: document-domain-relaxation
status: triaged
payout_currency: USD
scan_briefing_path: briefings/SCAN_humand-web_2026-02-13.md
description:
  LaComerDocuments component injects a script that sets document.domain to "lacomer.com.mx". This is a deprecated and dangerous practice that relaxes the Same-Origin Policy, allowing any subdomain of lacomer.com.mx to access the DOM of the Humand app and vice versa.

attack_vector:
  If any subdomain of lacomer.com.mx is compromised or has an XSS vulnerability, it could access the Humand app DOM when this component is loaded, including stored tokens and user data.

impact:
  Widens the attack surface from a single origin to all subdomains of lacomer.com.mx. Any XSS on any lacomer subdomain could pivot to steal Humand session tokens.


created_at: 2026-02-13 12:51:13
updated_at: 2026-02-13 12:51:13
program: humand
platform: internal
repo_url: git@github.com:HumandDev/humand-main-api.git
repo_name: humand-main-api
title: Master Password Bypasses All Authentication
vuln_type: Authentication Bypass
cwe_id: CWE-798
severity: critical
confidence: high
file_path: src/api/modules/auth/business/services/auth.ts
tool: manual
rule_id: auth-master-password
attack_vector: Login endpoint with master password → authenticate as any user on any tenant
status: triaged
payout_currency: USD
scan_briefing_path: briefings/SCAN_humand-main-api_2026-02-13.md
commit_hash: bb975d08cc
description:
  MASTER_PASSWORD env var allows plaintext password comparison that bypasses bcrypt verification for any user. verifyPasswordOfUser checks passwordToCheck === this.masterPassword before bcrypt.compare. Same password is used to create a service user on every instance.

impact:
  Complete authentication bypass for all users across all tenants. Single point of failure for entire platform auth.


created_at: 2026-02-13 12:51:13
updated_at: 2026-02-13 12:51:13
program: humand
platform: internal
repo_url: git@github.com:HumandDev/humand-main-api.git
repo_name: humand-main-api
title: SQL Injection via Sequelize.literal in profileFieldUUID
vuln_type: SQL Injection
cwe_id: CWE-89
severity: high
confidence: high
file_path: src/api/modules/users/business/services/usersService.ts
tool: manual
rule_id: sqli-sequelize-literal
attack_vector: Authenticated admin → craft profileFieldUUID with SQL payload → arbitrary SQL execution
impact: Cross-tenant data access, privilege escalation, full database compromise in multi-tenant SaaS.
status: triaged
payout_currency: USD
scan_briefing_path: briefings/SCAN_humand-main-api_2026-02-13.md
commit_hash: bb975d08cc
description:
  profileFieldUUID URL path parameter interpolated directly into Sequelize.literal() without UUID format validation. validateProfileFieldUUIDPathParam only checks non-empty. Route: DELETE /backoffice/instances/:id/profile-fields/:profileFieldUUID


created_at: 2026-02-13 12:51:13
updated_at: 2026-02-13 12:51:13
program: humand
platform: internal
repo_url: git@github.com:HumandDev/humand-main-api.git
repo_name: humand-main-api
title: Hardcoded Secrets in .env.example
vuln_type: Sensitive Data Exposure
cwe_id: CWE-798
severity: high
confidence: high
file_path: .env.example
tool: manual
rule_id: hardcoded-secrets
attack_vector: Access to git repository → extract keys → forge tokens or make API calls
impact: Token forgery via Firebase/IDP keys, SMS/call sending via Twilio, cursor pagination bypass.
status: triaged
payout_currency: USD
scan_briefing_path: briefings/SCAN_humand-main-api_2026-02-13.md
commit_hash: bb975d08cc
description:
  Real Firebase RSA private key, IDP SAML private key, IDP signing certificate, Twilio credentials (SID+AuthToken), cursor pagination encryption key, and API key salt committed as .env.example - not placeholders.


created_at: 2026-02-13 12:51:13
updated_at: 2026-02-13 12:51:13
program: humand
platform: internal
repo_url: git@github.com:HumandDev/humand-main-api.git
repo_name: humand-main-api
title: Environment Variable Exfiltration via External Endpoints
vuln_type: Information Disclosure
cwe_id: CWE-200
severity: medium
confidence: high
file_path: src/api/services/externalEndpoints.ts
tool: manual
rule_id: env-exfiltration
attack_vector: DB write access (via SQLi) → insert external endpoint → trigger invocation → exfiltrate env vars
impact: Full exfiltration of JWT keys, AWS credentials, database passwords, master password.
status: triaged
payout_currency: USD
scan_briefing_path: briefings/SCAN_humand-main-api_2026-02-13.md
commit_hash: bb975d08cc
description:
  replaceHeadersWithEnv resolves ${VARNAME} patterns in DB-stored external endpoint headers against process.env. Attacker with DB write access can create endpoint with ${JWT_KEY} header → values sent to attacker URL.


created_at: 2026-02-13 12:51:13
updated_at: 2026-02-13 12:51:13
program: humand
platform: internal
repo_url: git@github.com:HumandDev/humand-main-api.git
repo_name: humand-main-api
title: Multiple Sequelize.literal SQL Injection Candidates
vuln_type: SQL Injection
cwe_id: CWE-89
severity: medium
confidence: medium
file_path: src/api/modules/users/business/util/cursorPagination.ts
tool: manual
rule_id: sqli-literal-multiple
attack_vector: Varies per location — needs per-case investigation
impact: Potential arbitrary SQL execution if validation is bypassed.
status: triaged
payout_currency: USD
scan_briefing_path: briefings/SCAN_humand-main-api_2026-02-13.md
commit_hash: bb975d08cc
description:
  Multiple Sequelize.literal() calls interpolate variables: cursorPagination dir param, forms.ts valueToIncrement, slas.ts percentage, taskDAO.ts courseId. Some may be sufficiently validated upstream but patterns are dangerous.


created_at: 2026-02-13 12:51:13
updated_at: 2026-02-13 12:51:13
program: humand
platform: internal
repo_url: git@github.com:HumandDev/humand-main-api.git
repo_name: humand-main-api
title: SSRF via External Endpoints Service
vuln_type: SSRF
cwe_id: CWE-918
severity: medium
confidence: medium
file_path: src/api/services/externalEndpoints.ts
tool: manual
rule_id: ssrf-external-endpoints
attack_vector: Admin/SQLi → modify external endpoint URL → trigger invocation → SSRF
impact: Access to internal services, AWS metadata, cloud credentials.
status: triaged
payout_currency: USD
scan_briefing_path: briefings/SCAN_humand-main-api_2026-02-13.md
commit_hash: bb975d08cc
description:
  External endpoints service makes HTTP requests to DB-stored URLs. Combined with SQLi or admin access, attacker can target internal network (AWS metadata 169.254.169.254, localhost services, gRPC endpoints).


created_at: 2026-02-13 12:51:13
updated_at: 2026-02-13 12:51:13
program: humand
platform: internal
repo_url: git@github.com:HumandDev/humand-main-api.git
repo_name: humand-main-api
title: CSS Injection via Unrestricted style Attribute in Sanitizer
vuln_type: CSS Injection
cwe_id: CWE-79
severity: low
confidence: medium
file_path: src/api/middlewares/classTransformers/sanitize.ts
tool: manual
rule_id: css-injection-style
attack_vector: Submit content with malicious style attributes → exfiltrate data via CSS
impact: CSS-based data exfiltration, phishing via visual manipulation.
status: triaged
payout_currency: USD
scan_briefing_path: briefings/SCAN_humand-main-api_2026-02-13.md
commit_hash: bb975d08cc
description:
  HTML sanitizer allows style attribute on all elements ('*': ['style']). Enables CSS-based data exfiltration via background-image:url(...) and visual deception attacks.


created_at: 2026-02-13 20:13:03
updated_at: 2026-02-13 20:13:03
program: DB-GPT
platform: huntr
repo_url: https://github.com/eosphoros-ai/DB-GPT
repo_name: DB-GPT
title: Arbitrary SQL Execution via Chart Editor Submit (No Sanitization, No Auth)
vuln_type: SQL Injection
cwe_id: CWE-89
severity: high
confidence: high
file_path: packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/editor/api_editor_v1.py
tool: manual
status: draft
report_path: reports/DB-GPT-SQLi-2026-02-13.md
payout_currency: USD
scan_briefing_path: briefings/SCAN_DB-GPT_2026-02-13.md
description:
  POST /api/v1/chart/editor/submit passes user-supplied new_sql directly to db_conn.query_ex() without sanitize_sql(). No auth on editor routes. Unlike /v1/editor/sql/run which has sanitization, this endpoint is unprotected.

attack_vector:
  POST /api/v1/chart/editor/submit with body containing new_sql with arbitrary SQL. Requires valid conv_uid with chart history.

impact:
  Full database compromise - read/modify/delete data in any connected datasource. MySQL: LOAD DATA INFILE. PostgreSQL: COPY FROM PROGRAM.


created_at: 2026-02-13 20:13:07
updated_at: 2026-02-13 20:13:07
program: DB-GPT
platform: huntr
repo_url: https://github.com/eosphoros-ai/DB-GPT
repo_name: DB-GPT
title: RCE via Python eval() on PDF Table Content During Knowledge Base Ingestion
vuln_type: Code Injection
cwe_id: CWE-95
severity: critical
confidence: high
file_path: packages/dbgpt-ext/src/dbgpt_ext/rag/knowledge/pdf.py
tool: manual
impact: Full RCE on server with DB-GPT process privileges. Shell access.
status: draft
report_path: reports/DB-GPT-PDFEvalRCE-2026-02-13.md
payout_currency: USD
scan_briefing_path: briefings/SCAN_DB-GPT_2026-02-13.md
description:
  PDFProcessor stores table rows as str(list) then passes them to eval() to reconstruct lists. Crafted PDF table cells inject arbitrary Python code executed during knowledge base document processing.

attack_vector:
  Upload malicious PDF with table cell containing Python code payload. Triggers on knowledge base ingestion when PDF tables are processed.


created_at: 2026-02-13 20:13:10
updated_at: 2026-02-13 20:13:10
program: DB-GPT
platform: huntr
repo_url: https://github.com/eosphoros-ai/DB-GPT
repo_name: DB-GPT
title: Stored SQL Injection via get_editor_chart_info
vuln_type: SQL Injection
cwe_id: CWE-89
severity: high
confidence: medium
file_path: packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/editor/service.py
tool: manual
impact: Full database compromise via stored SQL injection.
status: draft
report_path: reports/DB-GPT-SQLi-2026-02-13.md
payout_currency: USD
scan_briefing_path: briefings/SCAN_DB-GPT_2026-02-13.md
description:
  get_editor_chart_info runs stored chart_sql from conversation history via conn.run() without sanitization. Attacker stores malicious SQL via chart_editor_submit then triggers via chart info endpoint.

attack_vector:
  Step 1: Store malicious SQL via /api/v1/chart/editor/submit. Step 2: Trigger via /api/v1/editor/chart/info.


created_at: 2026-02-13 20:13:14
updated_at: 2026-02-13 20:13:14
program: DB-GPT
platform: huntr
repo_url: https://github.com/eosphoros-ai/DB-GPT
repo_name: DB-GPT
title: Sandbox Code Execution Security Bypass via Blocklist Evasion
vuln_type: Security Bypass
cwe_id: CWE-184
severity: critical
confidence: high
file_path: packages/dbgpt-sandbox/src/dbgpt_sandbox/sandbox/execution_layer/utils.py
tool: manual
attack_vector: POST /execute with code using from os import system to bypass blocklist.
impact: RCE on host machine via sandbox escape.
status: draft
report_path: reports/DBGPT-SandboxBlocklistBypassRCE-2026-02-14.md
payout_currency: USD
scan_briefing_path: briefings/SCAN_DB-GPT_2026-02-13.md
description:
  Local sandbox uses string-matching blocklist trivially bypassed via from X import Y syntax, getattr, or string concat. No OS-level sandboxing. /execute endpoint has no auth.


created_at: 2026-02-13 23:50:39
updated_at: 2026-02-14 17:50:10
program: ComfyUI
platform: huntr
repo_url: https://github.com/comfyanonymous/ComfyUI
repo_name: ComfyUI
title: Unsafe deserialization via LoadTrainingDataset node (RCE)
vuln_type: Unsafe Deserialization
cwe_id: CWE-502
severity: critical
confidence: high
file_path: comfy_extras/nodes_dataset.py
tool: manual
impact: Remote Code Execution - full server compromise
status: draft
report_path: reports/ComfyUI-TorchLoadRCE-2026-02-13.md
payout_currency: USD
scan_briefing_path: briefings/SCAN_ComfyUI_2026-02-13.md
description:
  torch.load() without weights_only=True in LoadTrainingDataset.execute() allows arbitrary code execution via crafted .pkl files. folder_name parameter has no path traversal validation, enabling attacker to load malicious serialized files from arbitrary directories. SaveTrainingDataset has same path traversal issue for write primitive.

attack_vector:
  POST /prompt with LoadTrainingDataset node, folder_name=../../tmp/evil containing crafted shard_0000.pkl


created_at: 2026-02-13 23:50:42
updated_at: 2026-02-14 17:50:10
program: ComfyUI
platform: huntr
repo_url: https://github.com/comfyanonymous/ComfyUI
repo_name: ComfyUI
title: Path traversal in model preview endpoint
vuln_type: Path Traversal
cwe_id: CWE-22
severity: medium
confidence: medium
file_path: app/model_manager.py
tool: manual
attack_vector: GET /experiment/models/preview/checkpoints/0/../../../../path/to/image
impact: Limited arbitrary image file read from filesystem
status: triaged
payout_currency: USD
scan_briefing_path: briefings/SCAN_ComfyUI_2026-02-13.md
description:
  The /experiment/models/preview endpoint takes a filename parameter with {filename:.*} pattern that matches path traversal sequences. No commonpath/abspath validation before os.path.join. Allows reading arbitrary image files on filesystem via glob + Image.open, re-encoded as WEBP.


created_at: 2026-02-13 23:51:35
updated_at: 2026-02-13 23:51:35
program: stable-diffusion-webui
platform: huntr
repo_url: https://github.com/AUTOMATIC1111/stable-diffusion-webui
repo_name: stable-diffusion-webui
title: SSRF via redirect bypass in decode_base64_to_image
vuln_type: SSRF
cwe_id: CWE-918
severity: high
confidence: medium
file_path: modules/api/api.py
tool: manual
attack_vector: POST /sdapi/v1/txt2img with init_images URL that 302-redirects to cloud metadata
impact: Read internal network resources, cloud metadata credentials
status: triaged
payout_currency: USD
scan_briefing_path: briefings/SCAN_sdwebui_2026-02-13.md
description:
  verify_url checks IP is global but requests.get follows redirects to internal resources. DNS rebinding also possible.


created_at: 2026-02-13 23:51:38
updated_at: 2026-02-13 23:51:38
program: stable-diffusion-webui
platform: huntr
repo_url: https://github.com/AUTOMATIC1111/stable-diffusion-webui
repo_name: stable-diffusion-webui
title: SSRF in refresh_available_extensions via urllib.request.urlopen
vuln_type: SSRF
cwe_id: CWE-918
severity: high
confidence: high
file_path: modules/ui_extensions.py
tool: manual
attack_vector: Extensions > Available tab, change URL to file:///etc/passwd or internal endpoint, click Load
impact: Full SSRF: local file read, internal network probe, cloud metadata access
status: triaged
payout_currency: USD
scan_briefing_path: briefings/SCAN_sdwebui_2026-02-13.md
description:
  User-controlled URL passed directly to urllib.request.urlopen with no SSRF protection. Supports file:// protocol for local file read.


created_at: 2026-02-14 15:12:19
updated_at: 2026-02-14 15:12:19
program: SuperAGI
platform: huntr
repo_url: https://github.com/TransformerOptimus/SuperAGI
repo_name: SuperAGI
title: RCE via eval() on LLM output in agent task processing
vuln_type: RCE
cwe_id: CWE-95
severity: critical
confidence: high
file_path: superagi/agent/output_handler.py
tool: manual
impact: Full RCE on SuperAGI server as application user.
status: draft
report_path: reports/SuperAGI-EvalRCE-2026-02-13.md
payout_currency: USD
scan_briefing_path: briefings/SCAN_SuperAGI_2026-02-13.md
description:
  LLM responses passed directly to eval() after minimal JSON cleaning in TaskOutputHandler.handle(), ReplaceTaskOutputHandler.handle(), and QueueStepHandler._process_reply(). Prompt injection via goals/instructions or web content the agent reads can cause arbitrary Python execution. Distinct from CVE-2024-9439.

attack_vector:
  Create agent with prompt injection in goals. LLM returns malicious Python instead of JSON array. Also: indirect injection via attacker-controlled web content agent browses.


created_at: 2026-02-14 15:12:24
updated_at: 2026-02-14 15:12:24
program: SuperAGI
platform: huntr
repo_url: https://github.com/TransformerOptimus/SuperAGI
repo_name: SuperAGI
title: RCE via eval() on database-stored agent configuration values
vuln_type: RCE
cwe_id: CWE-95
severity: high
confidence: high
file_path: superagi/models/agent_execution_config.py
tool: manual
impact: RCE as application user. Any authenticated user can run arbitrary code.
status: triaged
payout_currency: USD
scan_briefing_path: briefings/SCAN_SuperAGI_2026-02-13.md
description:
  Agent config values (goal, instruction, constraints) stored as strings in DB and eval()d when fetched. Separate from CVE-2024-9439 which was template update endpoint. These are in Agent.eval_agent_config() and AgentExecutionConfiguration.eval_agent_config(). Also agent_template controller lines 251,466.

attack_vector:
  POST /api/agent/create with goal containing __import__('os').system('id'). Config stored in DB, eval()d on every fetch.


created_at: 2026-02-14 15:12:27
updated_at: 2026-02-14 15:12:27
program: SuperAGI
platform: huntr
repo_url: https://github.com/TransformerOptimus/SuperAGI
repo_name: SuperAGI
title: Path Traversal in file upload via unsanitized filename
vuln_type: Path Traversal
cwe_id: CWE-22
severity: high
confidence: high
file_path: superagi/controllers/resources.py
tool: manual
impact: Arbitrary file write on server filesystem. Can overwrite app code or plant webshells.
status: draft
report_path: reports/SuperAGI-PathTraversal-2026-02-13.md
payout_currency: USD
scan_briefing_path: briefings/SCAN_SuperAGI_2026-02-13.md
description:
  Upload endpoint uses file.filename directly in os.path.join() without sanitization. name param checked for extension but file.filename from multipart is used for actual path. os.path.join with ../.. traverses out of save_directory.

attack_vector:
  curl -X POST /api/resources/add/1 -F "file=@payload.txt;filename=../../evil.py" -F "name=legit.txt" -F "size=100" -F "type=text"


created_at: 2026-02-14 15:12:31
updated_at: 2026-02-14 15:12:31
program: SuperAGI
platform: huntr
repo_url: https://github.com/TransformerOptimus/SuperAGI
repo_name: SuperAGI
title: SSRF via user-controlled webhook URL with no validation
vuln_type: SSRF
cwe_id: CWE-918
severity: medium
confidence: medium
file_path: superagi/helper/webhook_manager.py
tool: manual
attack_vector: POST /api/webhooks/add with url=http://169.254.169.254/latest/meta-data/iam/security-credentials/
impact: Cloud metadata access, internal service discovery, credential theft from IAM roles.
status: triaged
payout_currency: USD
scan_briefing_path: briefings/SCAN_SuperAGI_2026-02-13.md
description:
  Users register arbitrary webhook URLs via /api/webhooks/add. No URL validation, no SSRF protections. Server POSTs to user URL on agent status change. Headers also user-controlled.


created_at: 2026-02-14 15:12:34
updated_at: 2026-02-14 15:12:34
program: SuperAGI
platform: huntr
repo_url: https://github.com/TransformerOptimus/SuperAGI
repo_name: SuperAGI
title: RCE via eval() on Redis-stored task completion data
vuln_type: RCE
cwe_id: CWE-95
severity: high
confidence: medium
file_path: superagi/agent/task_queue.py
tool: manual
impact: RCE on SuperAGI server.
status: triaged
payout_currency: USD
scan_briefing_path: briefings/SCAN_SuperAGI_2026-02-13.md
description:
  Completed task data in Redis eval()d when retrieved via get_completed_tasks() and get_last_task_details(). LLM response text stored as str(dict) can be crafted via prompt injection to execute code on retrieval.

attack_vector:
  Indirect prompt injection via web content agent reads, causing malicious str(dict) stored in Redis that executes on eval().


created_at: 2026-02-14 22:59:28
updated_at: 2026-02-14 22:59:28
program: OpenUI
platform: huntr
repo_url: https://github.com/wandb/openui
repo_name: openui
title: Predictable LiteLLM master key due to incorrect string interpolation
vuln_type: Hardcoded Credentials / Auth Bypass
cwe_id: CWE-798
severity: high
confidence: high
file_path: backend/openui/config.py
tool: manual
status: draft
report_path: reports/OpenUI-LiteLLM-MasterKey-2026-02-14.md
payout_currency: USD
scan_briefing_path: briefings/SCAN_OpenUI_2026-02-14.md
commit_hash: f9d8f0e30e1efe2a21bbefffba33bcf6b4e12dc7
description:
  When LITELLM_MASTER_KEY is unset, OpenUI sets it to the literal string "sk-{SESSION_KEY}" (missing f-string interpolation), making the LiteLLM master key predictable/constant across deployments that rely on defaults.

attack_vector:
  If LiteLLM proxy is reachable (e.g., internal cluster/sidecar exposure), attacker authenticates using known master key and gains proxy capabilities.

impact:
  Unauthorized access to LiteLLM proxy can allow misuse of upstream model credentials, internal network access depending on proxy configuration, and cost/abuse of hosted LLM backends.

notes:
  Needs confirmation of deployment reachability/exposure for port 4000; still a high-signal config/auth bug.


created_at: 2026-02-14 23:01:08
updated_at: 2026-02-14 23:01:08
program: OpenUI
platform: huntr
repo_url: https://github.com/wandb/openui
repo_name: openui
title: Unauthenticated share creation allows arbitrary S3 object writes
vuln_type: Improper Access Control
cwe_id: CWE-284
severity: medium
confidence: high
file_path: backend/openui/server.py
tool: manual
status: draft
report_path: reports/OpenUI-UnauthShareWrite-2026-02-14.md
payout_currency: USD
scan_briefing_path: briefings/SCAN_OpenUI_2026-02-14.md
commit_hash: f9d8f0e30e1efe2a21bbefffba33bcf6b4e12dc7
description:
  The share creation endpoint POST /v1/share/{id} does not require authentication and writes attacker-controlled content to S3 at key {id}.json. The share retrieval endpoint GET /v1/share/{id} is also unauthenticated.

attack_vector:
  Remote attacker can POST crafted ShareRequest payloads to create/overwrite share objects and then retrieve them. By repeating with many ids/payloads, attacker can abuse storage/cost; by overwriting known ids, attacker can poison shared links.

impact:
  Storage/cost DoS, content poisoning of shared artifacts, and potential downstream client-side impact depending on how shared HTML is rendered.

notes:
  Confirm whether share creation is intended to be publicly writable; if not, require session/auth and/or per-share write token.


created_at: 2026-02-15 15:27:10
updated_at: 2026-02-15 15:27:10
program: ComfyUI
platform: huntr
repo_url: https://github.com/comfyanonymous/ComfyUI
repo_name: ComfyUI
title: Multi-user mode cross-user access via comfy-user header spoofing
vuln_type: Improper Access Control
cwe_id: CWE-639
severity: high
confidence: high
file_path: app/user_manager.py
tool: manual
status: draft
report_path: reports/ComfyUI-MultiUser-HeaderImpersonation-2026-02-15.md
payout_currency: USD
scan_briefing_path: briefings/ADDENDUM_ComfyUI_2026-02-15.md
description:
  In --multi-user mode, get_request_user_id() trusts attacker-controlled comfy-user header. GET /users enumerates all user IDs. No authentication anywhere in stack.


# scan_log

scanned_at: 2026-02-12 21:48:03
repo_url: https://github.com/langgenius/dify
repo_name: dify
program: Dify
tool: manual-review
briefing_path: briefings/SCAN_dify_2026-02-12.md
notes:
  semgrep/trufflehog blocked by sandbox. Manual code review of RCE/SSRF/SQLi/auth/path-traversal attack surfaces.


scanned_at: 2026-02-12 21:48:30
repo_url: https://github.com/mlflow/mlflow
repo_name: mlflow
program: MLflow
tool: manual
briefing_path: /Users/sebas/Code/bug-bounty/briefings/SCAN_mlflow_2026-02-12.md
notes:
  semgrep/trufflehog could not run due to sandbox restrictions. Manual code review of server handlers, auth, SQL stores, artifacts, webhooks, gateway, scorers, jobs.


scanned_at: 2026-02-12 21:48:41
repo_url: https://github.com/danny-avila/LibreChat
repo_name: LibreChat
program: LibreChat
tool: manual_review+trufflehog
briefing_path: briefings/SCAN_LibreChat_2026-02-12.md
notes:
  semgrep blocked by sandbox. Manual review focused on auth/IDOR/SSRF/XSS/path traversal/NoSQL injection.


scanned_at: 2026-02-12 22:03:58
repo_url: https://github.com/lm-sys/FastChat
repo_name: FastChat
program: FastChat
tool: manual-review
briefing_path: /Users/sebas/Code/bug-bounty/briefings/SCAN_FastChat_2026-02-12.md
notes:
  Bash denied for semgrep/trufflehog. Full manual code review. 3 real findings: SSRF via register_worker (high/high), SSRF via load_image (med/med), auth bypass on controller (high/med).


scanned_at: 2026-02-13 23:51:00
repo_url: https://github.com/comfyanonymous/ComfyUI
repo_name: ComfyUI
program: ComfyUI
tool: manual_review
briefing_path: /Users/sebas/Code/bug-bounty/briefings/SCAN_ComfyUI_2026-02-13.md
notes:
  1 critical (unsafe deser RCE), 1 medium (path traversal preview endpoint). Semgrep skipped (failing on large repos).


scanned_at: 2026-02-14 15:12:08
repo_url: https://github.com/zylon-ai/private-gpt
repo_name: privategpt
program: privategpt
tool: manual_review
briefing_path: briefings/SCAN_privategpt_2026-02-13.md
notes:
  v0.6.2. All known CVEs fixed. No new vulns found. Clean codebase - no dangerous patterns, safe YAML loading, tempfile-based ingestion.


scanned_at: 2026-02-14 22:59:34
repo_url: https://github.com/wandb/openui
repo_name: openui
program: OpenUI
tool: semgrep+trufflehog+manual
briefing_path: briefings/SCAN_OpenUI_2026-02-14.md
notes:
  Semgrep required network to fetch registry rules; most findings were template/false positives. One high-signal LiteLLM master key default bug triaged.


