Python runtimes, frameworks and libraries. Newest first.
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
IBM published a security bulletin on Oct 28 2026 for Langflow OSS 1.0.0 through 1.12.8, the open source AI workflow builder. It covers an unauthenticated remote code execution flaw (CVE-2026-110186, CVSS 9.8) that IBM says is exploitable through model context protocol tool enumeration, an incomplete fix of the auto-login security control that allows an authentication bypass (CVE-2026-93680, CVSS 9.8), several authenticated code execution bugs (CVSS 8.8), API key exposure, path traversal, and vulnerable bundled dependencies such as Hono. The fix is to upgrade to Langflow OSS 1.13.0 or later; IBM lists no workarounds. Companion IBM bulletins for Langflow OSS add CVE-2026-104339 (CVSS 9.8, unauthenticated OS command injection leading to code execution) and CVE-2026-107328 (CVSS 9.9, authenticated code injection through eval/exec), with the same upgrade-to-1.13.0 fix. A further IBM bulletin adds CVE-2026-107327 (CVSS 9.9, authenticated code execution due to missing authorization, Langflow OSS 1.0.0 through 1.12.4), and another adds CVE-2026-107329 (CVSS 9.9, authenticated code execution through improper control of code generation, same versions).
Langflow OSSSince Oct 28, 2026
A heap buffer overflow in Pillow's FlashPix (FPX) JPEG-tile decoder lets an attacker run code by getting an application to open a single crafted file with Image.open(). Pillow detects FPX files by their OLE2 content, not their extension, so any service that opens or thumbnails untrusted uploads with the optional olefile package installed can be hit with no user interaction. The advisory includes a working proof of concept (shown on Pillow 12.2.0 with ASLR disabled). Pillow 12.3.0 and earlier are affected; upgrade to 13.0.0. GitHub rates it critical (CVSS 4.0 score 9.2). The same 13.0.0 release (Oct 16) also fixes other critical bugs: CVE-2026-112900, where an EPS filename starting with - or @ is passed to Ghostscript as an option and can lead to code execution (2.6.0 through 12.3.0); CVE-2026-112393, a heap overflow when saving TIFF to BytesIO (public reproducer); and CVE-2026-112403, a JPEG heap overflow with draft()/thumbnail() on libjpeg-turbo 3.x builds.
Pillow (Python imaging library)Since Oct 23, 2026
V12 disclosed 25 flaws in the x402 agent-payment SDKs, three rated critical: the default client had no spending limit (a hostile API could ask for an agent's whole token balance), the TypeScript Solana facilitator accepted token approvals as payments, and the SIWx login helper signed messages for other websites. All three were fixed in the August 18 releases, but no advisory was published, so npm audit and PyPI don't warn. Update @x402/fetch, @x402/axios, @x402/extensions and @x402/svm to 2.23.0 or later.
x402 SDKs (TypeScript @x402/*, Python x402, Go)Since Oct 22, 2026
On Oct 21 2026 attackers compromised LiteLLM’s release pipeline and published malicious litellm==1.107.0 to PyPI (live ~2 hours) plus compromised Docker Hub/GHCR tags (v1.107.0, latest, main-latest, main-stable). The wheels install cook.pth / cook.py / sitecustomize.py that steal cloud, developer and AI-tool credentials at every Python startup and open a remote-code loader. Second LiteLLM compromise of 2026.
LiteLLM (PyPI + official Docker/GHCR images)Since Oct 21, 2026
Node2Shell (CVE-2026-111497, also written Node 2 Shell) is a Brotli decoder out-of-bounds write in Node.js that can let an attacker run code when an app decompresses attacker-controlled Brotli data: Express 5 / body-parser 2.x request bodies sent with Content-Encoding: br, Brotli responses read by fetch(), or node:zlib on untrusted input. OpenAI Codex Security (Khai Tran and Sylvie Mayer) reported it; Node.js fixed it on Oct 21 2026 in 26.12.1, 24.22.1 and 22.23.4, alongside nine other CVEs (TLS hostname/IP bypasses, DNS NUL truncation) and a CA store refresh for the eMudhra incident. On Oct 22 Imperva Red Team, which coined the name Node2Shell, ran code on the official Node.js 24.22.0 image. NVD lists CVSS 4.0 9.2 (critical); Node.js rates it High. End-of-life lines (Node.js 20, 23, 25 and older) get no fix: upgrade to 26.12.1, 24.22.1 or 22.23.4. Bun is fixed in 1.4.4. On Oct 23 Aikido started calling the wider impact HTTP2Shell: the bug sits in Google Brotli itself, so other software that decodes Brotli needs its own update. Envoy published a critical advisory (GHSA-3wvj-j6qm-62mr) for deployments with a Brotli decompressor configured, fixed in 1.40.0, 1.39.3, 1.38.6 and 1.37.8, and Istio has the fix in 1.29.9, 1.30.6 and 1.31.2. On Oct 25 Microsoft shipped fixes for .NET (8.0.33, 9.0.22, 10.0.14, 11 RC3), Visual Studio 2019/2022/2026 and PowerShell 7.4/7.5/7.6. If you can't patch yet, disable Brotli decoding of untrusted data, and restart services or rebuild images after patching. On Oct 26 PHP shipped Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 with Brotli 1.2.1, since the bundled decoder is reachable through cURL when automatic response decompression is on.
Node.jsSince Oct 21, 2026
FoxIO published research (Oct 20 2026) showing that missing or late decoded-header limits in QPACK let a tiny HTTP/3 HEADERS frame expand into huge server memory use (up to ~4000× on Bun). Seven of ten implementations tested were vulnerable; quic-go, Cloudflare quiche, lsquic and Wireshark are patched, while Bun, aioquic/mitmproxy and h3 remained unpatched at publication.
HTTP/3 / QPACK stacks (quic-go, Cloudflare quiche, lsquic, Bun, aioquic, h3, Wireshark, …)Since Oct 20, 2026
Eight eMudhra Global TLS intermediate CA private keys were found to be cryptographically weak / recoverable (researcher report Oct 18). Mozilla, Chrome, Apple and Microsoft blocked the intermediates; eMudhra revoked them Oct 19 and the ECC root was distrusted as a precaution. Downstream runtimes that ship their own trust stores (Go, Node.js, Electron, Python certifi, curl, etc.) needed emergency CA-bundle updates so they stop trusting the compromised chains.
eMudhra / emSign Global TLS intermediates; any client shipping Mozilla-style CA storesSince Oct 18, 2026
Pluto Security found 31 malicious Hugging Face repositories across seven accounts, posing as small Qwen2 test checkpoints, that run attacker Python as soon as they are loaded with trust_remote_code=True. The code installs a fileless peakminer cryptominer disguised as [kworker/u20:1], a watchdog in /tmp/.cch, shell-startup hooks and, in some builds, reverse shells, targeting self-hosted inference servers such as Xinference and GPUStack. After Hugging Face and ModelScope removed the first wave, a second wave of 19 repositories appeared within days; the flagship MENXIANGYU/qwen2-tiny reached 28,412 downloads and scanned clean. Anyone who loaded these models with custom code enabled should treat the host as compromised, check Pluto's indicators, remove persistence and rotate every credential the process could reach.
Malicious Hugging Face model repositories (MENXIANGYU, wjsbg, htt0118, soumikmahato, r1r13 and others) loaded with trust_remote_codeSince Sep 21, 2026
BerriAI LiteLLM
BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. Added to CISA KEV on 2026-09-02.
Between Aug 27 and Sep 9 2026, Cloudflare's GLM-5.3 model on Workers AI (@cf/zai-org/glm-5.3) sometimes answered very long prompts with data from other customers' recent requests to the same model, Cloudflare disclosed on Oct 26. 155 responses were affected, all to prompts longer than 681,280 tokens. Two issues combined: Cloudflare launched the model with a 1,048,576-token context window but a prefill KV cache pool that held only 681,280 tokens, and SGLang, the open-source inference engine it uses, mishandled over-length requests in disaggregated prefill/decode mode. Instead of returning an error, it swapped the prompt for a one-token placeholder, transferred one KV page, and let the decode node attend over stale cache pages still holding earlier users' prompts and partial generations, returning HTTP 200. Researcher Gadi Evron of Knostic reported it via HackerOne on Sep 8; Cloudflare took the model offline on Sep 9, fixed its configuration and engine, and restored it the same day. It found no evidence of deliberate exploitation and says no other Workers AI model was affected, so Cloudflare customers have nothing to do. Anyone running SGLang in disaggregated prefill/decode mode should update to v0.5.22 or later (or backport #36988 and #38935) and check that each node's KV pool is at least as large as the context length.
SGLang inference engine (disaggregated prefill/decode mode); Cloudflare Workers AI GLM-5.3 modelSince Aug 27, 2026
MLflow MLflow
MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body. Added to CISA KEV on 2026-08-19.
Ray-Project Ray
Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari. Added to CISA KEV on 2026-08-17.
IBM Langflow
Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments. Added to CISA KEV on 2026-08-04.
Langflow Langflow
Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations. Added to CISA KEV on 2026-07-21.
Langflow Langflow
Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. Added to CISA KEV on 2026-07-07.
BerriAI LiteLLM
BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host. CISA added CVE-2026-42271, CVE-2026-48710 to the Known Exploited Vulnerabilities catalog on 2026-06-08 based on evidence of active exploitation.
Langflow Langflow
Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints. Added to CISA KEV on 2026-05-21.
BerriAI LiteLLM
BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages. Added to CISA KEV on 2026-05-08.
Langflow Langflow
Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication. Added to CISA KEV on 2026-03-25.
Langflow
Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests. Added to CISA KEV on 2025-05-05.
ultralytics (PyPI)
Attackers compromised the Ultralytics YOLO project's GitHub Actions workflows (by poisoning the Actions cache) and published ultralytics 8.3.41 and 8.3.42 to PyPI with an XMRig cryptominer. They later pushed 8.3.45 and 8.3.46 using a leftover PyPI API token. All four versions were removed. PyPI's analysis credits Trusted Publishing attestations with making the attack auditable.
Apache Superset
Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions. Added to the CISA KEV catalog on 2024-01-08. CVE-2023-27524 was assigned before 2024; the KEV listing came in 2024.
libwebp (Google Chrome and everything that bundles libwebp)
A heap overflow in libwebp's lossless decoder, found by Apple SEAR and Citizen Lab after the BLASTPASS iPhone exploit, was exploited in the wild. Because libwebp is everywhere, browsers, Electron apps and image libraries that bundle it all had to ship updates.
Sparrow v2.5.6 has been released, removing the eMudhra root certificates and upgrading the bundled Tor to meet the client protocols now required by the Tor network. It also brings extensive screen reader and keyboard accessibility improvements. Changelog: t.co/4YVq0yJBbg
Update: Microsoft has removed seven certificates associated with the affected eMudhra hierarchies from the Microsoft Edge trust list, following their removal from the Windows trust list. We’ve updated our guidance with additional information on these protections and what customers should consider when managing trust locally. Read the latest in our blog: t.co/5WQnB0WH3D
Following the eMudhra certificate authority incident, the Besu, Teku and Web3Signer teams have shared notes for operators. → Besu: t.co/6j5rLcLBbd → Teku: t.co/djHIQNiHaA → Web3Signer: t.co/EzUaF4SOyi t.co/GFRZ1PUFM4
CERT-In has published Advisory on its website. Multiple Vulnerabilities in Oracle Products t.co/UVCjvG7j9L Compromise of eMudhra Intermediate CA Certificates t.co/gixbWR83Vf
Sandboxes SDK 0.12.14 is live to patch the eMudhra certificate compromise. Update your `Dockerfile` to use the new image and redeploy. t.co/QBvp8tFeFy
🚨 LiteLLM reveals the root cause of its supply chain attack. A master key leaked on GitHub in May was never revoked, allowing attackers to access its Agent Platform, steal a GitHub owner token, and publish a malicious PyPI release in October. Read: t.co/KfE5QuX1Zs
+32 more on the incident pages above.