Security Advisory

This page gives an overview of the already known vulnerabilities of the different components we deliver. Those vulnerabilities have been automatically detected and reported by scanning both the code and the dependencies using CodeQL and Docker Scout.

Report a vulnerability

In order for the vulnerability reports to reach maintainers as soon as possible, the preferred way is to use the Report a vulnerability button on the Security tab in the respective GitHub repository. It creates a private communication channel between the reporter and the maintainers.

If you are absolutely unable to or have strong reasons not to use GitHub reporting workflow, please reach out to the maintainers at contact[at]defensive-lab.agency, providing all relevant information. The more details you provide, the easier it will be for us to triage and fix the issue.

Please refer to our Vulnerability Disclosure Policy.

Vulnerabilities in dependencies

Component	Severity	Rule / Vulnerability
colander	HIGH	CVE-2025-24928
colander	HIGH	CVE-2024-56171
colander	HIGH	CVE-2022-49043
colander-companion	HIGH	Incomplete multi-character sanitization
colander-companion	HIGH	Incomplete URL scheme check
colander-companion	HIGH	Incomplete URL scheme check
pirogue-evidence-collector	HIGH	Clear-text logging of sensitive information
playwright-rest-api	HIGH	CVE-2023-4863: Out-of-bounds Write
playwright-rest-api	HIGH	CVE-2024-27983
playwright-rest-api	HIGH	CVE-2024-1135: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
playwright-rest-api	HIGH	CVE-2023-50447: Improper Control of Generation of Code ('Code Injection')
playwright-rest-api	HIGH	CVE-2018-20225: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
playwright-rest-api	HIGH	CVE-2024-24762: Uncontrolled Resource Consumption
playwright-rest-api	HIGH	CVE-2024-24762: Uncontrolled Resource Consumption
playwright-rest-api	HIGH	CVE-2023-44271: Uncontrolled Resource Consumption
playwright-rest-api	HIGH	GHSA-56pw-mpj4-fxww
threatr	HIGH	CVE-2024-24680: Allocation of Resources Without Limits or Throttling
threatr	HIGH	CVE-2022-49043
threatr	HIGH	CVE-2024-53908: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
threatr	HIGH	CVE-2024-6345: Improper Control of Generation of Code ('Code Injection')
threatr	HIGH	CVE-2024-39614: Improper Handling of Length Parameter Inconsistency
threatr	HIGH	CVE-2024-39330: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
threatr	HIGH	CVE-2024-38875: Improper Handling of Length Parameter Inconsistency
threatr	CRITICAL	CVE-2024-42005: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Detected vulnerabilities

PiRogueToolSuite/colander
HIGH CVE-2025-24928

Date of analysis: 2025-04-07T09:08:45Z
Rule: CVE-2025-24928
Reference: refs/heads/main #711a1d41a9036ba8461be80d778244160c1d71b8
Location: Dockerfile

Details:

  Vulnerability   : CVE-2025-24928                                                                                    
      Severity        : HIGH                                                                                              
      Package         : pkg:deb/debian/libxml2@2.9.14%2Bdfsg-1.3~deb12u1?os_distro=bookworm&os_name=debian&os_version=12  
      Affected range  : >=2.9.14+dfsg-1.3~deb12u1                                                                         
      Fixed version   : not fixed                                                                                         
      EPSS Score      : 0.000070                                                                                          
      EPSS Percentile : 0.004000

PiRogueToolSuite/colander
HIGH CVE-2024-56171

Date of analysis: 2025-04-07T09:08:45Z
Rule: CVE-2024-56171
Reference: refs/heads/main #711a1d41a9036ba8461be80d778244160c1d71b8
Location: Dockerfile

Details:

  Vulnerability   : CVE-2024-56171                                                                                    
      Severity        : HIGH                                                                                              
      Package         : pkg:deb/debian/libxml2@2.9.14%2Bdfsg-1.3~deb12u1?os_distro=bookworm&os_name=debian&os_version=12  
      Affected range  : >=2.9.14+dfsg-1.3~deb12u1                                                                         
      Fixed version   : not fixed                                                                                         
      EPSS Score      : 0.000070                                                                                          
      EPSS Percentile : 0.003150

PiRogueToolSuite/colander
HIGH CVE-2022-49043

Date of analysis: 2025-04-07T09:08:45Z
Rule: CVE-2022-49043
Reference: refs/heads/main #711a1d41a9036ba8461be80d778244160c1d71b8
Location: Dockerfile

Details:

  Vulnerability   : CVE-2022-49043                                                                                    
      Severity        : HIGH                                                                                              
      Package         : pkg:deb/debian/libxml2@2.9.14%2Bdfsg-1.3~deb12u1?os_distro=bookworm&os_name=debian&os_version=12  
      Affected range  : >=2.9.14+dfsg-1.3~deb12u1                                                                         
      Fixed version   : not fixed                                                                                         
      EPSS Score      : 0.000240                                                                                          
      EPSS Percentile : 0.050990

PiRogueToolSuite/colander-companion
HIGH Incomplete multi-character sanitization

correctness external/cwe/cwe-020 external/cwe/cwe-080 external/cwe/cwe-116 security
Date of analysis: 2024-12-18T10:21:24Z
Rule: js/incomplete-multi-character-sanitization
Reference: refs/heads/main #202904f85e65b12a266effe6d34973cbddf4c361
Location: app/lib/single-file.js

Details:

This string may still contain ../, which may cause a path injection vulnerability.

PiRogueToolSuite/colander-companion
HIGH Incomplete URL scheme check

correctness external/cwe/cwe-020 external/cwe/cwe-184 security
Date of analysis: 2024-12-18T10:21:24Z
Rule: js/incomplete-url-scheme-check
Reference: refs/heads/main #202904f85e65b12a266effe6d34973cbddf4c361
Location: app/lib/single-file.js

Details:

This check does not consider data: and vbscript:.

PiRogueToolSuite/colander-companion
HIGH Incomplete URL scheme check

correctness external/cwe/cwe-020 external/cwe/cwe-184 security
Date of analysis: 2024-12-18T10:21:24Z
Rule: js/incomplete-url-scheme-check
Reference: refs/heads/main #202904f85e65b12a266effe6d34973cbddf4c361
Location: app/lib/single-file.js

Details:

This check does not consider data: and vbscript:.

PiRogueToolSuite/pirogue-evidence-collector
HIGH Clear-text logging of sensitive information

external/cwe/cwe-312 external/cwe/cwe-359 external/cwe/cwe-532 security
Date of analysis: 2024-11-29T06:58:33Z
Rule: py/clear-text-logging-sensitive-data
Reference: refs/heads/main #68014586c5a9e05e2e99083011be8197c6a79817
Location: pirogue_evidence_collector/entrypoints/pirogue_file_drop.py

Details:

This expression logs sensitive data (secret) as clear text.

PiRogueToolSuite/playwright-rest-api
HIGH CVE-2023-4863: Out-of-bounds Write

Date of analysis: 2024-04-19T17:09:29Z
Rule: CVE-2023-4863
Reference: refs/heads/main #6ad107e479047c45dd7cabfb363b0e619e30a711
Location: /usr/local/lib/python3.10/dist-packages/Pillow-9.5.0.dist-info/METADATA

Details:

  Vulnerability   : CVE-2023-4863                                 
      Severity        : HIGH                                          
      Package         : pkg:pypi/pillow@9.5.0                         
      Affected range  : <10.0.1                                       
      Fixed version   : 10.0.1                                        
      CVSS Score      : 8.8                                           
      CVSS Vector     : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H  
      EPSS Score      : 0.490950                                      
      EPSS Percentile : 0.974660

PiRogueToolSuite/playwright-rest-api
HIGH CVE-2024-27983

Date of analysis: 2024-04-19T17:09:29Z
Rule: CVE-2024-27983
Reference: refs/heads/main #6ad107e479047c45dd7cabfb363b0e619e30a711
Location: /usr/local/lib/python3.10/dist-packages/playwright/driver/node

Details:

  Vulnerability   : CVE-2024-27983            
      Severity        : HIGH                      
      Package         : pkg:generic/node@20.11.0  
      Affected range  : >=20.0.0,<20.12.1         
      Fixed version   : 20.12.1                   
      EPSS Score      : 0.000430                  
      EPSS Percentile : 0.082100

PiRogueToolSuite/playwright-rest-api
HIGH CVE-2024-1135: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Date of analysis: 2024-04-19T17:09:29Z
Rule: CVE-2024-1135
Reference: refs/heads/main #6ad107e479047c45dd7cabfb363b0e619e30a711
Location: /usr/local/lib/python3.10/dist-packages/gunicorn-20.1.0.dist-info/METADATA

Details:

  Vulnerability   : CVE-2024-1135                                 
      Severity        : HIGH                                          
      Package         : pkg:pypi/gunicorn@20.1.0                      
      Affected range  : <22.0.0                                       
      Fixed version   : 22.0.0                                        
      CVSS Score      : 8.2                                           
      CVSS Vector     : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N  
      EPSS Score      : 0.000430                                      
      EPSS Percentile : 0.082100

PiRogueToolSuite/playwright-rest-api
HIGH CVE-2023-50447: Improper Control of Generation of Code ('Code Injection')

Date of analysis: 2024-04-19T17:09:29Z
Rule: CVE-2023-50447
Reference: refs/heads/main #6ad107e479047c45dd7cabfb363b0e619e30a711
Location: /usr/local/lib/python3.10/dist-packages/Pillow-9.5.0.dist-info/METADATA

Details:

  Vulnerability   : CVE-2023-50447                                
      Severity        : HIGH                                          
      Package         : pkg:pypi/pillow@9.5.0                         
      Affected range  : <10.2.0                                       
      Fixed version   : 10.2.0                                        
      CVSS Score      : 8.1                                           
      CVSS Vector     : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H  
      EPSS Score      : 0.000740                                      
      EPSS Percentile : 0.309840

PiRogueToolSuite/playwright-rest-api
HIGH CVE-2018-20225: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Date of analysis: 2024-04-19T17:09:29Z
Rule: CVE-2018-20225
Reference: refs/heads/main #6ad107e479047c45dd7cabfb363b0e619e30a711
Location: /root/.local/share/virtualenv/wheel/3.10/image/1/CopyPipInstall/pip-24.0-py3-none-any/pip-24.0.dist-info/METADATA

Details:

  Vulnerability   : CVE-2018-20225                                
      Severity        : HIGH                                          
      Package         : pkg:pypi/pip@24.0                             
      Affected range  : >=0                                           
      Fixed version   : not fixed                                     
      CVSS Score      : 7.8                                           
      CVSS Vector     : CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H  
      EPSS Score      : 0.001120                                      
      EPSS Percentile : 0.441280

PiRogueToolSuite/playwright-rest-api
HIGH CVE-2024-24762: Uncontrolled Resource Consumption

Date of analysis: 2024-04-19T17:09:29Z
Rule: CVE-2024-24762
Reference: refs/heads/main #6ad107e479047c45dd7cabfb363b0e619e30a711
Location: /usr/local/lib/python3.10/dist-packages/fastapi-0.95.1.dist-info/METADATA

Details:

  Vulnerability   : CVE-2024-24762                                
      Severity        : HIGH                                          
      Package         : pkg:pypi/fastapi@0.95.1                       
      Affected range  : <=0.109.0                                     
      Fixed version   : 0.109.1                                       
      CVSS Score      : 7.5                                           
      CVSS Vector     : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H  
      EPSS Score      : 0.001240                                      
      EPSS Percentile : 0.464090

PiRogueToolSuite/playwright-rest-api
HIGH CVE-2024-24762: Uncontrolled Resource Consumption

Date of analysis: 2024-04-19T17:09:29Z
Rule: CVE-2024-24762
Reference: refs/heads/main #6ad107e479047c45dd7cabfb363b0e619e30a711
Location: /usr/local/lib/python3.10/dist-packages/starlette-0.26.1.dist-info/METADATA

Details:

  Vulnerability   : CVE-2024-24762                                
      Severity        : HIGH                                          
      Package         : pkg:pypi/starlette@0.26.1                     
      Affected range  : <=0.36.1                                      
      Fixed version   : 0.36.2                                        
      CVSS Score      : 7.5                                           
      CVSS Vector     : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H  
      EPSS Score      : 0.001240                                      
      EPSS Percentile : 0.464090

PiRogueToolSuite/playwright-rest-api
HIGH CVE-2023-44271: Uncontrolled Resource Consumption

Date of analysis: 2024-04-19T17:09:29Z
Rule: CVE-2023-44271
Reference: refs/heads/main #6ad107e479047c45dd7cabfb363b0e619e30a711
Location: /usr/local/lib/python3.10/dist-packages/Pillow-9.5.0.dist-info/METADATA

Details:

  Vulnerability   : CVE-2023-44271                                
      Severity        : HIGH                                          
      Package         : pkg:pypi/pillow@9.5.0                         
      Affected range  : <10.0.0                                       
      Fixed version   : 10.0.0                                        
      CVSS Score      : 7.5                                           
      CVSS Vector     : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H  
      EPSS Score      : 0.000550                                      
      EPSS Percentile : 0.214920

PiRogueToolSuite/playwright-rest-api
HIGH GHSA-56pw-mpj4-fxww

Date of analysis: 2024-04-19T17:09:29Z
Rule: GHSA-56pw-mpj4-fxww
Reference: refs/heads/main #6ad107e479047c45dd7cabfb363b0e619e30a711
Location: /usr/local/lib/python3.10/dist-packages/Pillow-9.5.0.dist-info/METADATA

Details:

  Vulnerability  : GHSA-56pw-mpj4-fxww    
      Severity       : HIGH                   
      Package        : pkg:pypi/pillow@9.5.0  
      Affected range : <10.0.1                
      Fixed version  : 10.0.1

PiRogueToolSuite/threatr
HIGH CVE-2024-24680: Allocation of Resources Without Limits or Throttling

Date of analysis: 2025-02-10T14:42:55Z
Rule: CVE-2024-24680
Reference: refs/heads/main #41f0dbfa0c6e09e032e7cd45324715c1ca9af957
Location: /usr/local/lib/python3.10/site-packages/Django-4.2.8.dist-info/METADATA

Details:

  Vulnerability   : CVE-2024-24680                                                   
      Severity        : HIGH                                                             
      Package         : pkg:pypi/django@4.2.8                                            
      Affected range  : >=4.2,<4.2.10                                                    
      Fixed version   : 4.2.10                                                           
      CVSS Score      : 8.2                                                              
      CVSS Vector     : CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N  
      EPSS Score      : 0.000960                                                         
      EPSS Percentile : 0.420000

PiRogueToolSuite/threatr
HIGH CVE-2022-49043

Date of analysis: 2025-02-10T14:42:55Z
Rule: CVE-2022-49043
Reference: refs/heads/main #41f0dbfa0c6e09e032e7cd45324715c1ca9af957
Location: Dockerfile

Details:

  Vulnerability   : CVE-2022-49043                                                                                    
      Severity        : HIGH                                                                                              
      Package         : pkg:deb/debian/libxml2@2.9.14%2Bdfsg-1.3~deb12u1?os_distro=bookworm&os_name=debian&os_version=12  
      Affected range  : >=2.9.14+dfsg-1.3~deb12u1                                                                         
      Fixed version   : not fixed                                                                                         
      EPSS Score      : 0.000430                                                                                          
      EPSS Percentile : 0.114650

PiRogueToolSuite/threatr
HIGH CVE-2024-53908: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Date of analysis: 2025-02-10T14:42:55Z
Rule: CVE-2024-53908
Reference: refs/heads/main #41f0dbfa0c6e09e032e7cd45324715c1ca9af957
Location: /usr/local/lib/python3.10/site-packages/Django-4.2.8.dist-info/METADATA

Details:

  Vulnerability   : CVE-2024-53908                                                       
      Severity        : HIGH                                                                 
      Package         : pkg:pypi/django@4.2.8                                                
      Affected range  : >=4.2,<4.2.17                                                        
      Fixed version   : 4.2.17                                                               
      CVSS Score      : 7.2                                                                  
      CVSS Vector     : CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U  
      EPSS Score      : 0.000450                                                             
      EPSS Percentile : 0.178150

PiRogueToolSuite/threatr
HIGH CVE-2024-6345: Improper Control of Generation of Code ('Code Injection')

Date of analysis: 2024-09-21T09:52:18Z
Rule: CVE-2024-6345
Reference: refs/heads/main #41f0dbfa0c6e09e032e7cd45324715c1ca9af957
Location: /usr/local/lib/python3.10/site-packages/setuptools-65.5.1.dist-info/METADATA

Details:

  Vulnerability   : CVE-2024-6345                                                    
      Severity        : HIGH                                                             
      Package         : pkg:pypi/setuptools@65.5.1                                       
      Affected range  : <70.0.0                                                          
      Fixed version   : 70.0.0                                                           
      CVSS Score      : 7.5                                                              
      CVSS Vector     : CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N  
      EPSS Score      : 0.000430                                                         
      EPSS Percentile : 0.114650

PiRogueToolSuite/threatr
HIGH CVE-2024-39614: Improper Handling of Length Parameter Inconsistency

Date of analysis: 2024-09-21T09:52:18Z
Rule: CVE-2024-39614
Reference: refs/heads/main #41f0dbfa0c6e09e032e7cd45324715c1ca9af957
Location: /usr/local/lib/python3.10/site-packages/Django-4.2.8.dist-info/METADATA

Details:

  Vulnerability   : CVE-2024-39614                                                   
      Severity        : HIGH                                                             
      Package         : pkg:pypi/django@4.2.8                                            
      Affected range  : >=4.2,<4.2.14                                                    
      Fixed version   : 4.2.14                                                           
      CVSS Score      : 8.7                                                              
      CVSS Vector     : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N  
      EPSS Score      : 0.000450                                                         
      EPSS Percentile : 0.178150

PiRogueToolSuite/threatr
HIGH CVE-2024-39330: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Date of analysis: 2024-09-21T09:52:18Z
Rule: CVE-2024-39330
Reference: refs/heads/main #41f0dbfa0c6e09e032e7cd45324715c1ca9af957
Location: /usr/local/lib/python3.10/site-packages/Django-4.2.8.dist-info/METADATA

Details:

  Vulnerability   : CVE-2024-39330                                                   
      Severity        : HIGH                                                             
      Package         : pkg:pypi/django@4.2.8                                            
      Affected range  : >=4.2,<4.2.14                                                    
      Fixed version   : 4.2.14                                                           
      CVSS Score      : 8.7                                                              
      CVSS Vector     : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N  
      EPSS Score      : 0.000450                                                         
      EPSS Percentile : 0.178150

PiRogueToolSuite/threatr
HIGH CVE-2024-38875: Improper Handling of Length Parameter Inconsistency

Date of analysis: 2024-09-21T09:52:18Z
Rule: CVE-2024-38875
Reference: refs/heads/main #41f0dbfa0c6e09e032e7cd45324715c1ca9af957
Location: /usr/local/lib/python3.10/site-packages/Django-4.2.8.dist-info/METADATA

Details:

  Vulnerability   : CVE-2024-38875                                                   
      Severity        : HIGH                                                             
      Package         : pkg:pypi/django@4.2.8                                            
      Affected range  : >=4.2,<4.2.14                                                    
      Fixed version   : 4.2.14                                                           
      CVSS Score      : 8.7                                                              
      CVSS Vector     : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N  
      EPSS Score      : 0.000450                                                         
      EPSS Percentile : 0.178150

PiRogueToolSuite/threatr
CRITICAL CVE-2024-42005: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CRITICAL
Date of analysis: 2024-09-21T09:52:18Z
Rule: CVE-2024-42005
Reference: refs/heads/main #41f0dbfa0c6e09e032e7cd45324715c1ca9af957
Location: /usr/local/lib/python3.10/site-packages/Django-4.2.8.dist-info/METADATA

Details:

  Vulnerability   : CVE-2024-42005                                                   
      Severity        : CRITICAL                                                         
      Package         : pkg:pypi/django@4.2.8                                            
      Affected range  : >=4.2,<4.2.15                                                    
      Fixed version   : 4.2.15                                                           
      CVSS Score      : 9.3                                                              
      CVSS Vector     : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N  
      EPSS Score      : 0.000520                                                         
      EPSS Percentile : 0.233540

PiRogue Tool Suite

Title here

Security Advisory

Report a vulnerability

Vulnerabilities in dependencies

Detected vulnerabilities