Snyk Security Database

aws-cdk-lib is a Version 2 of the AWS Cloud Development Kit library

Affected versions of this package are vulnerable to Symlink Attack in the asset bundling output handling, which accepts a symbolic link that the Docker build placed in the output directory even though no such link was supplied as bundling input. An attacker who controls the Dockerfile, or code running inside the bundling container, can place a symbolic link into the produced asset that points outside the supplied inputs. This requires asset bundling with a Docker file.

litellm is a Library to easily interface with LLM API providers

Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity allowing privilege escalation, in the key encryption handling, which uses a single encryption key both to seal secrets at rest and to mint session tokens. A user with internal_user privileges can gain proxy_admin access and execute arbitrary commands on the host through the MCP stdio endpoint by requesting a new API key whose metadata field carries a forged admin credential as the secret value, then presenting the returned encrypted payload as a bearer token, which the proxy decrypts and accepts as an admin identity. The affected authentication path is active in the default configuration on current releases and on earlier ones only where EXPERIMENTAL_UI_LOGIN was explicitly enabled.

Affected versions of this package are vulnerable to Reusing a Nonce, Key Pair in Encryption in the native one-shot CTR packet path ctr_pc_process_packet, which does not check that the request fits the addressable block range and reports the full input length as a success even once the block counter has wrapped. An attacker holding only the ciphertext can recover the XOR of two plaintext segments without the key, by XORing the segments that were encrypted under the repeated keystream. This requires the native library enabled on Intel x86 or x86-64, an IV of 13 to 15 bytes so the counter is only 1 to 3 bytes, and an input long enough to exhaust it, so 4 byte and longer counters and full 16 byte IVs are unaffected.