Snyk Security Database

rank4222wun is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Command Injection via the install_frontmatter_requirements function. An attacker can execute arbitrary code in the context of the service account by supplying crafted input that is not properly validated before being used in a system call.

*Note: This is only exploitable if the attacker is authenticated.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the log-socket collector process. An attacker can execute arbitrary code or cause a denial of service by sending specially crafted serialized objects to the exposed port 4560 when the allowed classes property is configured in a way that can be bypassed.

Note: This is only exploitable if the Decanter log socket collector is installed and configured to expose the allowed classes property.