#Python
All CosmicBytez Labs articles tagged #Python, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-105812: AWS Bedrock AgentCore Starter Toolkit Code Injection Flaw
A critical flaw in AWS's Bedrock AgentCore Starter Toolkit lets an authenticated user inject arbitrary code via crafted agent-import configuration values.
- Security
CVE-2026-102268: PyJWT is_pem_format PEM Validation Bypass
A PEM-detection gap in PyJWT lets mutated public-key PEMs slip past its HMAC guard, enabling JWT signature forgery.
- Security
CVE-2026-7808: justhtml HTML Sanitization Bypass (Critical XSS)
Critical XSS in justhtml before 1.16.0. Multiple bypass paths let dangerous content survive sanitization, enabling script injection with no auth required.
- Security
CVE-2026-8445: justhtml Markdown Conversion XSS via Unescaped Angle Brackets
Critical XSS in justhtml <=1.11.0. The to_markdown() function leaves angle brackets unescaped, allowing raw HTML to reach downstream Markdown renderers.
- Security
CVE-2026-5388: Critical XSS Sanitization Bypass in justhtml
justhtml before 1.15.0 has multiple sanitization failures allowing XSS bypass via URL helpers, HTML serialization, and Markdown passthrough.
- Security
CVE-2026-61539: Xinference Llama3 Tool-Call eval() Remote Code Execution
CVSS 10.0: Xinference passes attacker-controlled Llama3 tool-call output directly to eval(), enabling unauthenticated RCE on all versions ≤ 2.5.0.
- Security
CVE-2025-62593: Ray Project Code Injection — DNS Rebinding Enables Unauthenticated RCE
Critical RCE in Anyscale Ray via DNS rebinding attack bypasses User-Agent checks, exposing developer dashboards to unauthenticated job submission.
- Security
CVE-2026-18948: Feast Feature Store RCE via Unsafe Deserialization
A critical CVSS 9.9 vulnerability in the Feast ML feature store allows unauthenticated remote code execution through malicious user-defined functions...
- News
Hugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Code
Three high-severity vulnerabilities in Hugging Face's Diffusers library allow crafted AI model repositories to silently execute arbitrary code when...
- Security
CVE-2026-65321: PyAthena SQL Injection via Improper Quote Escaping
A critical SQL injection vulnerability in PyAthena prior to 3.35.4 allows unauthenticated attackers to inject arbitrary SQL through improper...
- Security
CVE-2026-68770: sentence-transformers Security Control Bypass Enables RCE
A critical logic flaw in sentence-transformers' import_module_class helper allows attackers to bypass trust_remote_code=False and achieve arbitrary code...
- Security
CVE-2026-15062: Critical SQL Injection in Snowflake Snowpark Python SDK
A critical-severity SQL injection vulnerability (CVSS 9.6) in the Snowflake Snowpark Python SDK allows authenticated low-privilege users to execute SQL...
- Security
CVE-2026-33264: Apache Airflow Scheduler RCE via DAG Deserialization
A critical deserialization flaw in Apache Airflow allows malicious DAG authors to execute arbitrary code on the Scheduler and API Server, scoring CVSS...
- News
'Hades' Campaign Against PyPI Puts New Spin on Shai-Hulud
The latest supply chain attacks against PyPI, which hit 37 wheels and 19 code packages, show a continued evolution of the persistent Shai-Hulud software...
- Security
CVE-2026-10042: manga-image-translator RCE via Unsafe Python Deserialization
A critical CVSS 9.8 remote code execution vulnerability in manga-image-translator allows unauthenticated attackers to execute arbitrary commands by...
- Security
CVE-2026-48207: Apache Fury PyFury Deserialization RCE
A critical deserialization vulnerability in Apache Fury's Python library PyFury allows attackers to bypass DeserializationPolicy validation hooks via the...
- Security
CVE-2026-8838 — Amazon Redshift Python Driver RCE via Unsafe Code Execution
The Amazon Redshift Python driver before version 2.1.14 contains a critical vulnerability where the vector_in() function executes arbitrary code received...
- News
PyTorch Lightning and Intercom-client Hit in Supply Chain
Threat actors compromised the popular Python PyPI package 'Lightning' — used for PyTorch model training — pushing malicious versions 2.6.2 and onward to...
- Security
Pipecat AI Framework RCE via LivekitFrameSerializer
A critical vulnerability in Pipecat's optional LivekitFrameSerializer class allows unauthenticated remote code execution in the popular AI voice agent...
- Security
CVE-2026-26210: KTransformers Unsafe Deserialization RCE
KTransformers through version 0.5.3 contains a critical unsafe deserialization vulnerability in its balance_serve backend mode, where an unauthenticated...
- Security
CVE-2026-39987: Marimo Pre-Auth Remote Code Execution
A critical pre-authorization remote code execution vulnerability in Marimo, the open-source reactive Python notebook, allows unauthenticated attackers to...
- Security
CVE-2026-6577: DjangoBlog Missing Authentication in OwnTracks logtracks Endpoint
A missing authentication vulnerability in liangliangyy DjangoBlog up to 2.1.0.0 allows unauthenticated remote attackers to access the logtracks endpoint...
- Security
CVE-2026-6580: DjangoBlog Hard-Coded Cryptographic Key in Amap API Handler
A hard-coded cryptographic key vulnerability in liangliangyy DjangoBlog up to 2.1.0.0 allows remote attackers to exploit the Amap API Call Handler in...
- Security
CVE-2026-39888: PraisonAI Sandbox Escape Enables Remote
A critical sandbox escape vulnerability in PraisonAI's multi-agent framework allows attackers to bypass the Python code execution sandbox, defeating the...
- Security
CVE-2026-32714: Critical SQL Injection in SciTokens
A critical SQL injection vulnerability in the SciTokens Python library allows attackers to manipulate authentication token validation via unsanitized...
- News
Backdoored Telnyx PyPI Package Pushes Malware Hidden in WAV
Threat actors known as TeamPCP compromised the Telnyx Python package on PyPI, uploading malicious versions that conceal credential-stealing malware inside...
- News
New Infinity Stealer Malware Grabs macOS Data via ClickFix
A new info-stealing malware named Infinity Stealer is targeting macOS systems with a Python payload packaged as an executable using the open-source Nuitka...
- News
Supply Chain Attack Hits Widely-Used AI Package, Risking
Malicious versions of LiteLLM — a Python package with 3 million daily downloads present in roughly 36% of cloud environments — were quietly pushed to PyPI...
- News
GlassWorm ForceMemo: Stolen GitHub Tokens Used to Poison
The GlassWorm threat actor has launched a new sub-campaign called ForceMemo, using stolen GitHub tokens to silently force-push malware into hundreds of...
- Security
Critical RCE in Microsoft Semantic Kernel Python SDK
A maximum-severity code injection vulnerability in Microsoft's Semantic Kernel Python SDK allows authenticated attackers to execute arbitrary code through...
- HOWTO
Building Event-Driven Systems with Python asyncio
Design and implement event-driven architectures using Python asyncio. Covers event buses, async task orchestration, graceful shutdown, and real-world...
- HOWTO
Automating Report Generation with Python and Jinja2
Build an automated report generation system using Python, Jinja2 templates, and data extraction from multiple sources. Covers multi-tenant data...
- HOWTO
Python for Security Automation: Essential Scripting
Learn Python security scripting fundamentals including network scanning, log parsing, hash analysis, API integration, and automated threat detection for...