Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

potato-annotation

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.1PyPIAmendedPublished

    potato-annotation has a Project-Boundary Bypass

    GHSA-q9m2-fhv9-3jcf

    Affected
    • PyPI potato-annotation >= 2.0.0, < 2.4.5
    Fixed in
    2.4.5· Vendor fix available
    Issue
    validatepathsecurity uses string-prefix containment (startswith) for boundary checks. This allows paths that are outside the intended project directory but share its prefix string (e.g., /tmp/potatoprojdemoevil/... vs /tmp/potatoprojdemo) to be accepted. Details Affected source location (root cause) File: potato/serverutils/configmodule.py Snippet (lines 370–373): Snippet (lines 384–389): startswith() is string-based, so /tmp/potatoprojdemoevil/... passes when checked against /tmp/potatoprojdemo. Confirmed affected call sites File: potato/serverutils/configmodule.py 1) validatefilepaths taskdir branch (line 2113) 2) validatefilepaths datafiles branch (line 2151) 3) validatetrainingconfig training.datafile branch (line 2286) PoC Impact - Can allow unauthorized sibling-prefix file access outside intended project boundary. - Can affect read paths (datafiles, training.datafile, basecss, headerlogo) and output/path placement depending on configuration.

    Recommended action: Upgrade to 2.4.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →