Średnia

A Regular Expression Denial of Service (ReDoS) vulnerability exists in gaizhenbiao/chuanhuchatgpt, as of commit 20b2e02. The server uses the regex pattern `r'<[^>]+>'` to parse user input. In Python's

Ujawniono: 20.03.2025
Aktualizacja: 11.10.2026 12:19

A Regular Expression Denial of Service (ReDoS) vulnerability exists in gaizhenbiao/chuanhuchatgpt, as of commit 20b2e02. The server uses the regex pattern r'<[^>]+>' to parse user input. In Python's default regex engine, this pattern can take polynomial time to match certain crafted inputs. An attacker can exploit this by uploading a malicious JSON payload, causing the server to consume 100% CPU for an extended period. This can lead to a Denial of Service (DoS) condition, potentially affecting the entire server.

Czego dotyczy

Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.

Platforma	Paczka	Podatne wersje	Poprawka w wersji
Python (PyPI)	chuanhuchatgpt	<= 2024-09-19	brak poprawki

Odnośniki

https://huntr.com/bounties/8291f8d0-5060-47e7-9986-1f411310fb7b

Ocena CVSS 6.5/10

Wektor CVSS: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Słabość (CWE): -
Platforma: Python (PyPI)
Paczka: chuanhuchatgpt
Ujawniono: 20.03.2025
Aktualizacja: 11.10.2026 12:19

Źródła i licencje

OSV / GitHub Advisory Database - PYSEC-2025-94 - PyPA Advisory Database; CC BY 4.0

Historia podatności: chuanhuchatgpt

Wszystkie opisane podatności tej paczki (Python (PyPI)), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.

Wszystkie (21) w archiwum

Wszystkich wpisów: 21
Pierwsza → ostatnia: 04.2024 03.2025
Bez poprawki: 21
Wykorzystywana w atakach: 0

Rozkład istotności

Krytyczna 4
Wysoka 9
Średnia 8

Ujawnienia w latach

2024: 12
2025: 9
2026: 0

20.03.2025

An authentication bypass vulnerability exists in gaizhenbiao/ChuanhuChatGPT, as of commit 3856d4f, allowing any user to read and delete other users' chat history. The vulnerability arises because the

Wysoka · 8.1 CVE-2024-9216 <= 2024-12-04 brak poprawki
20.03.2025

A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240802 allows attackers to access, copy, and delete other users' chat histories. This issue arises due to improper handling of session data and

Wysoka · 8.8 CVE-2024-8613 <= 20240802 brak poprawki
20.03.2025

A Regular Expression Denial of Service (ReDoS) vulnerability exists in gaizhenbiao/chuanhuchatgpt, as of commit 20b2e02. The server uses the regex pattern `r'<[^>]+>'` to parse user input. In Python's ten wpis

Średnia · 6.5 CVE-2024-10955 <= 2024-09-19 brak poprawki
20.03.2025

An unauthenticated Denial of Service (DoS) vulnerability was identified in ChuanhuChatGPT version 20240918, which could be exploited by sending large data payloads using a multipart boundary. Although

Wysoka · 7.5 CVE-2024-10650 <= 20240918 brak poprawki
29.10.2024

A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240628 allows for a Denial of Service (DOS) attack. When uploading a file, if an attacker appends a large number of characters to the end of a m

Wysoka · 7.5 CVE-2024-7807 wszystkie wersje brak poprawki
29.10.2024

An arbitrary file read vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240628 due to insufficient validation when loading prompt template files. An attacker can read any file that matches

Wysoka · 7.5 CVE-2024-7962 wszystkie wersje brak poprawki
31.07.2024

A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as `config.j

Krytyczna · 9.1 CVE-2024-6255 wszystkie wersje brak poprawki
10.07.2024

A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows an attacker to create arbitrary folders at any location on the server, including the root directory (C: dir). This can lead to unc

Krytyczna · 9.1 CVE-2024-6037 <= 20240410 brak poprawki
10.07.2024

A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to restart the server at will by sending a specific request to the `/queue/join?` endpoint with `"fn_index":66`. This unr

Krytyczna · 9.1 CVE-2024-6036 <= 20240410 brak poprawki
27.06.2024

A path traversal vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410, allowing any user to delete other users' chat histories. This vulnerability can also be exploited to delete any fi

Wysoka · 7.5 CVE-2024-6090 <= 20240410 brak poprawki
27.06.2024

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability is located in the filter_history function within the utils.py

Wysoka · 7.5 CVE-2024-6038 <= 20240410 brak poprawki
27.06.2024

A Server-Side Request Forgery (SSRF) vulnerability exists in the upload processing interface of gaizhenbiao/ChuanhuChatGPT versions <= ChuanhuChatGPT-20240410-git.zip. This vulnerability allows attack

Krytyczna · 9.8 CVE-2024-5822 <= 20240410 brak poprawki
16.05.2024

A Local File Inclusion (LFI) vulnerability exists in the gaizhenbiao/chuanhuchatgpt application, specifically within the functionality for uploading chat history. The vulnerability arises due to impro

Wysoka · 7.5 CVE-2024-4321 <= 20240310 brak poprawki
10.04.2024

gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the `config.json` file. This vulnerability is present in both authenticated and unauthenticated ver

Wysoka · 7.5 CVE-2024-2217 <= 20240121 brak poprawki

Dowiedz się, które podatności dotyczą Twojej aplikacji

Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.

Podłącz swoją aplikację