wandb 0.5.2

Direct Vulnerabilities

Known vulnerabilities in the wandb package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Directory Traversal wandb is an A CLI and library for interacting with the Weights and Biases API. Affected versions of this package are vulnerable to Directory Traversal in the `File.download()` method of `wandb/apis/public/files.py`, which builds the destination with `os.path.join(root, self.name)` and never checks that the result stays under `root`, even though `util.make_file_path_upload_safe()` normalizes the equivalent path on the upload side. An attacker who controls the backend server, or is in a MitM position, can write files to arbitrary locations such as shell startup files, cron jobs, or SSH configuration, reaching code execution, by returning a file name containing `../` sequences or an absolute path such as `/tmp/x.txt`, since `util.download_file_from_url()` creates any missing parent directories. This requires the user to invoke `File.download()`, directly or by iterating `run.files()`, against that attacker-controlled backend. How to fix Directory Traversal? Upgrade `wandb` to version 0.29.0 or higher.	[,0.29.0)
L Use of Weak Hash wandb is an A CLI and library for interacting with the Weights and Biases API. Affected versions of this package are vulnerable to Use of Weak Hash through `ArtifactManifestEntry.download` in `wandb/sdk/artifacts/artifact_manifest_entry.py` and related artifact verification paths. An attacker can bypass or poison artifact integrity checks by supplying content that collides under the MD5-based digest comparison used for cached downloads and local file verification. This allows a substituted artifact file to be accepted as legitimate during download or verification, so users may load, cache, or verify tampered artifact contents instead of the expected file. How to fix Use of Weak Hash? A fix was pushed into the `master` branch but not yet published.	[0,)
M Race Condition wandb is an A CLI and library for interacting with the Weights and Biases API. Affected versions of this package are vulnerable to Race Condition in the thread cleanup behavior in the `finish_thread_id()` function in `agent.py`. An attacker can access job status from an unauthorized thread if they are accessed or modified at the same time, which could cause data corruption. How to fix Race Condition? Upgrade `wandb` to version 0.15.12 or higher.	[,0.15.12)
M Race Condition wandb is an A CLI and library for interacting with the Weights and Biases API. Affected versions of this package are vulnerable to Race Condition in `handler.go` and `writer.go` that allows attackers to access or modify data, especially in concurrent environments. How to fix Race Condition? Upgrade `wandb` to version 0.15.10 or higher.	[,0.15.10)
M Race Condition wandb is an A CLI and library for interacting with the Weights and Biases API. Affected versions of this package are vulnerable to Race Condition as a result of using the `tempfile.mktemp()` fuctions that returns a file name, which can potentially allow a malicious actor the replace the file before it is used with something else. How to fix Race Condition? Upgrade `wandb` to version 0.12.12 or higher.	[,0.12.12)

Vulnerability

Vulnerable Version

Directory Traversal