Snyk Security Database

smol-toml is an A small, fast, and correct TOML parser/serializer

Affected versions of this package are vulnerable to Unchecked Input for Loop Condition due to the skipUntil comment-skipping logic in src/util.ts. An attacker can hang parse() by supplying a TOML document with a value in an array or inline table followed by a # comment that runs to end of input without a trailing newline. The parser gets stuck in an internal loop while searching for the end of the structure, pinning CPU and preventing the application from completing TOML parsing.

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in nltk/downloader.py through the Downloader._download_package() download-and-extract flow. An attacker can install malicious package contents by tampering with the archive response, such as through a compromised mirror, HTTP interception, or a substituted download source. The downloader writes the fetched package to disk and then proceeds to extract it without verifying the final file against the expected checksum, so a modified archive can be unpacked as if it were trusted. This can lead to attacker-controlled corpus or model files being installed on systems that use nltk.download().

Affected versions of this package are vulnerable to Missing Authorization via cancellation of downstream builds in Pipeline: Build Step Plugin. An attacker can cancel downstream Jenkins builds without the required Item/Cancel permission because the plugin fails to verify that the build's authentication is authorized to cancel the downstream job.