Skip to content

Conversation

@AlessandroPomponio
Copy link
Member

Checked with ruff check --select TC

@DRL-NextGen
Copy link
Member

Checks Summary

Last run: 2026-01-23T17:17:22.526Z

Code Risk Analyzer vulnerability scan found 1 vulnerabilities:

Severity Identifier Package Details Fix
◻ Unknown CVE-2025-53000 nbconvert
nbconvert has an uncontrolled search path that leads to unauthorized code execution on WindowsGHSA-xm59-rqc7-hhvf

nbconvert:7.16.6->ado-core:1.3.3
>7.16.6

Mend Unified Agent vulnerability scan found 2 vulnerabilities:

Severity Identifier Package Details Fix
❗ Critical CVE-2025-56005 ply-3.11-py2.py3-none-any.whl
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Exec...An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the "picklefile" parameter in the "yacc()" function. This parameter accepts a ".pkl" file that is deserialized with "pickle.load()" without validation. Because "pickle" allows execution of embedded code via "reduce()", an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk.
Not Available
🔺 High CVE-2025-53000 nbconvert-7.16.6-py3-none-any.whl
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja...The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions of nbconvert up to and including 7.16.6 on Windows have a vulnerability in which converting a notebook containing SVG output to a PDF results in unauthorized code execution. Specifically, a third party can create a "inkscape.bat" file that defines a Windows batch script, capable of arbitrary code execution. When a user runs "jupyter nbconvert --to pdf" on a notebook containing SVG output to a PDF on a Windows platform from this directory, the "inkscape.bat" file is run unexpectedly. As of time of publication, no known patches exist.
Not Available

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants