Snyk Security Database

msgpack5 is an A msgpack v5 implementation for node.js and the browser, with extension points

Affected versions of this package are vulnerable to Improper Handling of Syntactically Invalid Structure via the tryDecode function in lib/decoder.js, which does not reject the reserved MessagePack byte 0xc1 before attempting to process it. An attacker can send a message containing this reserved byte to trigger an unhandled error that crashes the stream, causing a denial of service.

pydantic-ai is an AI Agent Framework, the Pydantic way

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the OpenTelemetry instrumentation layer, specifically in record_exception and related span-recording helpers, when the include_content setting is disabled. Exception events recorded on model request spans and realtime spans include the full exception message and stack trace, which can contain content the setting is intended to withhold - such as tool retry payloads, model request/response echoes, validation error arguments, and user-supplied data. An authenticated attacker with access to the exported trace data can read sensitive content that should have been suppressed.

org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client (AHC) classes.

Affected versions of this package are vulnerable to Protection Mechanism Failure due to improper handling of the scheme when processing Set-Cookie headers. An attacker can overwrite, plant, or delete secure cookies by sending crafted HTTP responses over plaintext connections, which can result in session fixation, CSRF token manipulation, or removal of critical cookies. This is only exploitable if a plaintext host under the same site is able to set cookies for the target domain.