@blamejs/exceptd-skills 0.13.84 → 0.13.86

package/data/atlas-ttps.json

@@ -143,6 +143,8 @@
     "maturity": "high",
     "last_verified": "2026-05-19",
     "cve_refs": [
+      "CVE-2023-43654",
+      "CVE-2024-37032",
       "CVE-2025-1550",
       "CVE-2025-8747",
       "CVE-2026-22778",
@@ -1701,7 +1703,10 @@
     "stix_id": "attack-pattern--ebeed0c7-c5de-5049-8f27-efcae5f88b00",
     "is_subtechnique": false,
     "cve_refs": [
+      "CVE-2023-43654",
       "CVE-2023-48022",
+      "CVE-2024-37032",
+      "CVE-2024-39722",
       "CVE-2024-42478",
       "CVE-2024-42479",
       "CVE-2025-64496",
@@ -2793,6 +2798,7 @@
     "stix_id": "attack-pattern--a5cc5062-f672-510a-8a4f-a8d1aa7f5024",
     "is_subtechnique": true,
     "cve_refs": [
+      "CVE-2022-1471",
       "CVE-2025-1550",
       "CVE-2025-8747"
     ]

package/data/attack-techniques.json

@@ -269,7 +269,10 @@
       "DS0017"
     ],
     "cve_refs": [
+      "CVE-2022-1471",
+      "CVE-2023-43654",
       "CVE-2023-48022",
+      "CVE-2024-37032",
       "CVE-2024-42479",
       "CVE-2024-50050",
       "CVE-2025-1094",
@@ -823,6 +826,7 @@
       "CVE-2020-25079",
       "CVE-2021-22681",
       "CVE-2021-26828",
+      "CVE-2022-1471",
       "CVE-2022-37055",
       "CVE-2022-40799",
       "CVE-2022-48503",
@@ -832,12 +836,15 @@
       "CVE-2023-33538",
       "CVE-2023-3519",
       "CVE-2023-39780",
+      "CVE-2023-43654",
       "CVE-2023-48022",
       "CVE-2023-52163",
       "CVE-2024-12987",
       "CVE-2024-1709",
       "CVE-2024-21762",
+      "CVE-2024-37032",
       "CVE-2024-37079",
+      "CVE-2024-39722",
       "CVE-2024-42478",
       "CVE-2024-42479",
       "CVE-2024-43468",
@@ -3505,6 +3512,7 @@
     "stix_id": "attack-pattern--7bc57495-ea59-4380-be31-a64af124ef18",
     "is_subtechnique": false,
     "cve_refs": [
+      "CVE-2024-39722",
       "CVE-2026-34926"
     ]
   },

package/data/cve-catalog.json

@@ -12347,6 +12347,425 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "llama.cpp's RPC backend deserialize_tensor() still skips bounds checks via GRAPH_COMPUTE (buffer=0) — the GRAPH_COMPUTE path the b3561 fix missed — giving unauthenticated RCE; fixed in b8492."
   },
+  "CVE-2023-43654": {
+    "name": "PyTorch TorchServe Management API SSRF to Remote Code Execution (ShellTorch)",
+    "type": "RCE",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cvss_note": "NVD CVSS v3.1 base 9.8 (CRITICAL). The TorchServe management interface accepts model-configuration uploads from any domain (SSRF, CWE-918), and with the default all-interfaces bind and no authentication this becomes unauthenticated remote code execution.",
+    "cisa_kev": false,
+    "poc_available": true,
+    "poc_description": "Documented by Oligo Security's ShellTorch research (and the vendor advisory): an unauthenticated request to the TorchServe management API registers a malicious model from a remote URL, leading to code execution.",
+    "ai_discovered": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Disclosed by Oligo Security (ShellTorch) against PyTorch's TorchServe model server (maintained by Amazon and Meta).",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No AI-assisted weaponization; SSRF-to-RCE on an AI model server.",
+    "active_exploitation": "none",
+    "active_exploitation_notes": "Oligo found thousands of exposed TorchServe instances (including at major organizations); research disclosure with a coordinated fix, no confirmed adversary in-the-wild exploitation reported as of curation.",
+    "affected": "PyTorch TorchServe 0.1.0 through 0.8.1 (fixed 0.8.2). The management API binds to all interfaces by default and has no built-in authentication.",
+    "affected_versions": [
+      "PyTorch TorchServe >= 0.1.0, <= 0.8.1"
+    ],
+    "vector": "TorchServe's management API allows registering a model from a remote URL the server then fetches and writes to disk (SSRF, CWE-918). Because the management console binds to all interfaces by default and TorchServe has no authentication, an unauthenticated remote attacker uploads a malicious model configuration and achieves remote code execution — the core of the ShellTorch chain (Oligo).",
+    "complexity": "low",
+    "complexity_notes": "NVD AV:N / AC:L. PR:N — the default-configured management API is unauthenticated and network-exposed.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "Remediation is an upgrade to TorchServe 0.8.2 or later; redeploy, no host reboot.",
+    "vendor_update_paths": [
+      "Upgrade TorchServe to 0.8.2 or later, bind the management API to loopback only, enable authentication / a token, and restrict allowed_urls so model configs cannot be fetched from arbitrary domains."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-IA-2": "Authentication is not enforced on the AI model server's management API; the default deployment is open and network-exposed.",
+      "NIST-800-53-SI-2": "Flaw-remediation cadence does not track AI model servers and their config/deserialization paths as managed, RCE-bearing software.",
+      "ISO-27001-2022-A.8.8": "Vulnerability management rarely enumerates the model server's management API / YAML config parsing as a code-execution surface.",
+      "NIS2-Art21-patch-management": "Article 21 measures do not reach the AI model server's management plane as a privileged, unauthenticated control plane.",
+      "DORA-Art-9": "ICT protection measures do not model an unauthenticated model-server takeover as an ICT-risk event.",
+      "UK-CAF-B2": "Identity and Access Control objective has no requirement to authenticate the AI model server's management API.",
+      "AU-ISM-1546": "Patch-application control does not single out AI model servers and their bundled deserialization libraries.",
+      "ALL-AI-PIPELINE-INTEGRITY": "No framework treats the model server's management API + config deserialization as an untrusted, RCE-bearing surface; default-open management plus unsafe YAML turns config upload into full takeover."
+    },
+    "atlas_refs": [
+      "AML.T0049",
+      "AML.T0010"
+    ],
+    "attack_refs": [
+      "T1190",
+      "T1059"
+    ],
+    "rwep_score": 31,
+    "rwep_factors": {
+      "cisa_kev": 0,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 0,
+      "blast_radius": 26,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "Standard (RWEP 31, \"patch within 30 days\" band per lib/scoring.js timeline). Not KEV, no confirmed in-the-wild exploitation, patched at/after disclosure (Hard Rule #3). poc_available=20 + blast_radius=26 minus patch 15. Note: thousands of TorchServe instances were found exposed, raising operational urgency beyond the RWEP number.",
+    "epss_score": null,
+    "epss_date": "2026-05-25",
+    "epss_note": "EPSS not pulled for this entry; retrieve via FIRST EPSS API in a future refresh.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2023-43654",
+    "cwe_refs": [
+      "CWE-918"
+    ],
+    "iocs": {
+      "behavioral": [
+        "TorchServe management API (default port 8081) reachable from untrusted networks without authentication.",
+        "Model-register requests to TorchServe referencing a remote URL (model archive / config) controlled by an external party.",
+        "TorchServe fetching and writing files from attacker-supplied URLs, or spawning processes after a model registration.",
+        "TorchServe 0.1.0–0.8.1 with the management API bound to all interfaces — the exposed precondition."
+      ],
+      "_ioc_source_note": "Behavioral signatures derived from Oligo Security's ShellTorch research (https://www.oligo.security/blog/shelltorch-explained-multiple-vulnerabilities-in-pytorch-model-server), the vendor advisory (https://github.com/pytorch/serve/security/advisories/GHSA-8fxr-qfr9-p34w), and NVD CVE-2023-43654 (CWE-918)."
+    },
+    "source_verified": "2026-05-25",
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2023-43654",
+      "https://www.oligo.security/blog/shelltorch-explained-multiple-vulnerabilities-in-pytorch-model-server",
+      "https://github.com/pytorch/serve/security/advisories/GHSA-8fxr-qfr9-p34w"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "GitHub Security Advisory (pytorch/serve)",
+        "advisory_id": "CVE-2023-43654",
+        "url": "https://github.com/pytorch/serve/security/advisories/GHSA-8fxr-qfr9-p34w",
+        "severity": "critical",
+        "published_date": "2023-09-28"
+      },
+      {
+        "vendor": "NVD",
+        "advisory_id": "CVE-2023-43654",
+        "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43654",
+        "severity": "critical",
+        "published_date": "2023-09-28"
+      }
+    ],
+    "last_updated": "2026-05-25",
+    "discovery_attribution_note": "Manually curated from NVD (CWE-918; NIST CVSS 9.8) + Oligo Security's ShellTorch research + the pytorch/serve advisory. Part of the ShellTorch TorchServe takeover chain.",
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "PyTorch TorchServe's unauthenticated, all-interfaces management API fetches and writes remote model configs (SSRF, CWE-918), giving unauthenticated RCE; the core of ShellTorch; fixed in 0.8.2."
+  },
+  "CVE-2022-1471": {
+    "name": "SnakeYAML Constructor Unsafe Deserialization RCE (ShellTorch chain)",
+    "type": "RCE",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cvss_note": "NVD CVSS v3.1 base 9.8 (CRITICAL); the CNA (Google) scored 8.3 (HIGH, PR:L). SnakeYAML's Constructor does not restrict instantiable types, so parsing attacker-controlled YAML yields arbitrary object instantiation and code execution (CWE-502 / CWE-20). In ShellTorch this is the deserialization leg reached via the TorchServe model config.",
+    "cisa_kev": false,
+    "poc_available": true,
+    "poc_description": "Documented by Oligo Security's ShellTorch research (and the vendor advisory): parsing attacker-controlled YAML with the default SnakeYAML Constructor instantiates arbitrary types and executes code.",
+    "ai_discovered": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Disclosed by Oligo Security (ShellTorch) as the deserialization leg of the TorchServe chain; SnakeYAML itself is a widely used Java YAML library.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No AI-assisted weaponization; classic unsafe deserialization.",
+    "active_exploitation": "none",
+    "active_exploitation_notes": "Oligo found thousands of exposed TorchServe instances (including at major organizations); research disclosure with a coordinated fix, no confirmed adversary in-the-wild exploitation reported as of curation.",
+    "affected": "SnakeYAML before 2.0 (fixed in 2.0, which defaults to SafeConstructor). Reached in ShellTorch through TorchServe's YAML model-config parsing.",
+    "affected_versions": [
+      "SnakeYAML < 2.0"
+    ],
+    "vector": "SnakeYAML's default Constructor instantiates arbitrary Java types named in the YAML, so deserializing attacker-controlled YAML executes code (CWE-502). Any service that parses untrusted YAML with the unsafe Constructor is exposed; in the ShellTorch chain TorchServe parses an attacker-supplied model configuration, turning the SSRF into full RCE.",
+    "complexity": "low",
+    "complexity_notes": "NVD AV:N / AC:L. NVD assesses PR:N (CNA Google assessed PR:L).",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "Remediation is an upgrade to SnakeYAML 2.0 or later (SafeConstructor default); redeploy, no host reboot.",
+    "vendor_update_paths": [
+      "Upgrade SnakeYAML to 2.0 or later, or construct YAML parsers with SafeConstructor. For TorchServe, also apply CVE-2023-43654 mitigations so untrusted model configs never reach the parser."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-IA-2": "Authentication is not enforced on the AI model server's management API; the default deployment is open and network-exposed.",
+      "NIST-800-53-SI-2": "Flaw-remediation cadence does not track AI model servers and their config/deserialization paths as managed, RCE-bearing software.",
+      "ISO-27001-2022-A.8.8": "Vulnerability management rarely enumerates the model server's management API / YAML config parsing as a code-execution surface.",
+      "NIS2-Art21-patch-management": "Article 21 measures do not reach the AI model server's management plane as a privileged, unauthenticated control plane.",
+      "DORA-Art-9": "ICT protection measures do not model an unauthenticated model-server takeover as an ICT-risk event.",
+      "UK-CAF-B2": "Identity and Access Control objective has no requirement to authenticate the AI model server's management API.",
+      "AU-ISM-1546": "Patch-application control does not single out AI model servers and their bundled deserialization libraries.",
+      "ALL-AI-PIPELINE-INTEGRITY": "No framework treats the model server's management API + config deserialization as an untrusted, RCE-bearing surface; default-open management plus unsafe YAML turns config upload into full takeover."
+    },
+    "atlas_refs": [
+      "AML.T0011.000"
+    ],
+    "attack_refs": [
+      "T1190",
+      "T1059"
+    ],
+    "rwep_score": 29,
+    "rwep_factors": {
+      "cisa_kev": 0,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 0,
+      "blast_radius": 24,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "Standard (RWEP 29, \"patch within 30 days\" band per lib/scoring.js timeline). Not KEV, no confirmed in-the-wild exploitation, patched at/after disclosure (Hard Rule #3). poc_available=20 + blast_radius=24 minus patch 15. Note: thousands of TorchServe instances were found exposed, raising operational urgency beyond the RWEP number.",
+    "epss_score": null,
+    "epss_date": "2026-05-25",
+    "epss_note": "EPSS not pulled for this entry; retrieve via FIRST EPSS API in a future refresh.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2022-1471",
+    "cwe_refs": [
+      "CWE-502",
+      "CWE-20"
+    ],
+    "iocs": {
+      "behavioral": [
+        "A service parsing untrusted YAML with SnakeYAML's default Constructor instantiating unexpected Java types (e.g. ScriptEngine, URLClassLoader) during load.",
+        "YAML payloads containing !!javax / !!java type tags or remote class-loading constructs reaching a YAML parser.",
+        "Process or class-loading activity triggered by YAML deserialization of externally supplied content.",
+        "SnakeYAML < 2.0 on the classpath of a service that parses untrusted YAML — the exposed precondition."
+      ],
+      "_ioc_source_note": "Behavioral signatures derived from Oligo Security's ShellTorch research (https://www.oligo.security/blog/shelltorch-explained-multiple-vulnerabilities-in-pytorch-model-server), the vendor advisory (https://github.com/advisories/GHSA-mjmj-j48q-9wg2), and NVD CVE-2022-1471 (CWE-502/CWE-20)."
+    },
+    "source_verified": "2026-05-25",
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2022-1471",
+      "https://www.oligo.security/blog/shelltorch-explained-multiple-vulnerabilities-in-pytorch-model-server",
+      "https://github.com/advisories/GHSA-mjmj-j48q-9wg2"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "SnakeYAML / NVD",
+        "advisory_id": "CVE-2022-1471",
+        "url": "https://github.com/advisories/GHSA-mjmj-j48q-9wg2",
+        "severity": "critical",
+        "published_date": "2022-12-01"
+      },
+      {
+        "vendor": "NVD",
+        "advisory_id": "CVE-2022-1471",
+        "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471",
+        "severity": "critical",
+        "published_date": "2022-12-01"
+      }
+    ],
+    "last_updated": "2026-05-25",
+    "discovery_attribution_note": "Manually curated from NVD (CWE-502/CWE-20; NIST CVSS 9.8) + Oligo Security's ShellTorch research + the SnakeYAML advisory. Part of the ShellTorch TorchServe takeover chain.",
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "SnakeYAML's default Constructor deserializes arbitrary types from untrusted YAML (CWE-502), enabling RCE; fixed in 2.0 (SafeConstructor default). The deserialization leg of the ShellTorch TorchServe chain."
+  },
+  "CVE-2024-37032": {
+    "name": "Ollama Model Registry Path Traversal Arbitrary File Write RCE (Probllama)",
+    "type": "RCE",
+    "cvss_score": 8.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+    "cvss_note": "NVD CVSS v3.1 base 8.8 (HIGH). Path traversal from insufficient validation of the SHA256 model-blob digest, enabling arbitrary file write and remote code execution.",
+    "cisa_kev": false,
+    "poc_available": true,
+    "poc_description": "Public exploit exists (a Metasploit module and standalone PoCs, e.g. github.com/jakabakos/CVE-2024-37032-Ollama-RCE): an attacker stands up a rogue registry whose manifest embeds a path-traversal digest, and an Ollama pull writes attacker content to an arbitrary path.",
+    "ai_discovered": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Disclosed by Wiz Research (Probllama). The abused surface is the model-pull path of the most widely used local LLM runtime.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No AI-assisted weaponization; path traversal in the model-runtime API.",
+    "active_exploitation": "none",
+    "active_exploitation_notes": "Research disclosure with a coordinated fix; no confirmed in-the-wild exploitation reported as of curation.",
+    "affected": "Ollama before 0.1.34.",
+    "affected_versions": [
+      "Ollama < 0.1.34"
+    ],
+    "vector": "Ollama does not validate that a model-blob digest is a 64-character hex SHA256, so a manifest from a rogue registry can embed path-traversal sequences in the digest. When Ollama pulls the model it writes attacker-controlled content to an arbitrary path (CWE-22), which can overwrite server files (e.g. a config or library) and achieve remote code execution. Disclosed by Wiz as Probllama; a public Metasploit module exists.",
+    "complexity": "low",
+    "complexity_notes": "NVD AV:N / AC:L. PR:L.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "Remediation is upgrading Ollama to 0.1.34 or later; redeploy, no host reboot.",
+    "vendor_update_paths": [
+      "Upgrade Ollama to 0.1.34 or later. Never expose the Ollama API (default port 11434) to untrusted networks, and only pull models from trusted registries."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "Flaw-remediation cadence does not track the local-LLM runtime as managed, network-exposed software.",
+      "NIST-800-53-SI-10": "Input-validation control is not applied to model-blob digests / API path parameters in the runtime.",
+      "ISO-27001-2022-A.8.8": "Vulnerability management rarely enumerates the model-runtime API's path handling as an injection surface.",
+      "NIS2-Art21-patch-management": "Article 21 measures do not reach the local-LLM runtime API as a privileged surface.",
+      "DORA-Art-9": "ICT protection measures do not model path traversal in an AI runtime API as an ICT-risk event.",
+      "UK-CAF-B4": "System Security objective has no objective for validating paths/digests in the model-runtime API.",
+      "AU-ISM-1546": "Patch-application control does not single out local-LLM runtimes.",
+      "ALL-AI-PIPELINE-INTEGRITY": "No framework treats the model-runtime API's path/digest handling as untrusted input; a rogue registry or crafted request reaches the filesystem."
+    },
+    "atlas_refs": [
+      "AML.T0049",
+      "AML.T0010"
+    ],
+    "attack_refs": [
+      "T1190",
+      "T1059"
+    ],
+    "rwep_score": 31,
+    "rwep_factors": {
+      "cisa_kev": 0,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 0,
+      "blast_radius": 26,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "Standard (RWEP 31, \"patch within 30 days\" band per lib/scoring.js timeline). Not KEV, no confirmed in-the-wild exploitation, patched at/after disclosure (Hard Rule #3). poc_available=20 + blast_radius=26 (Ollama is the most widely used local LLM runtime) minus patch 15.",
+    "epss_score": null,
+    "epss_date": "2026-05-25",
+    "epss_note": "EPSS not pulled for this entry; retrieve via FIRST EPSS API in a future refresh.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-37032",
+    "cwe_refs": [
+      "CWE-22"
+    ],
+    "iocs": {
+      "behavioral": [
+        "Ollama pulling a model from a non-default / untrusted registry whose manifest contains a blob digest that is not 64-hex (contains ../ or extra characters).",
+        "Ollama writing files outside its model blob store during a pull.",
+        "Ollama API (default port 11434) reachable from untrusted networks accepting model pulls.",
+        "Ollama < 0.1.34 — the exposed precondition."
+      ],
+      "_ioc_source_note": "Behavioral signatures derived from the Wiz Probllama research (https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2024-37032) and the public Metasploit module / PoC (github.com/jakabakos/CVE-2024-37032-Ollama-RCE), plus NVD CVE-2024-37032 (CWE-22)."
+    },
+    "source_verified": "2026-05-25",
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2024-37032",
+      "https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2024-37032",
+      "https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2024-37032"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "Wiz Research (Probllama)",
+        "advisory_id": "CVE-2024-37032",
+        "url": "https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2024-37032",
+        "severity": "high",
+        "published_date": "2024-05-31"
+      },
+      {
+        "vendor": "NVD",
+        "advisory_id": "CVE-2024-37032",
+        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37032",
+        "severity": "high",
+        "published_date": "2024-05-31"
+      }
+    ],
+    "last_updated": "2026-05-25",
+    "discovery_attribution_note": "Manually curated from NVD (CWE-22; NIST CVSS 8.8) + Wiz Probllama research + the ollama GitHub advisory. Member of the Ollama API path-traversal family.",
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Ollama fails to validate the model-blob digest, so a rogue registry's manifest triggers path-traversal arbitrary file write and RCE (Probllama); fixed in 0.1.34."
+  },
+  "CVE-2024-39722": {
+    "name": "Ollama api/push Path Traversal File-Existence Disclosure",
+    "type": "INFO-DISCLOSURE",
+    "cvss_score": 7.5,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
+    "cvss_note": "NVD CVSS v3.1 base 7.5 (HIGH). Path traversal on the api/push route discloses which files exist on the Ollama host.",
+    "cisa_kev": false,
+    "poc_available": true,
+    "poc_description": "Documented in Oligo's 'More Models, More ProbLLMs' research and the GitHub advisory: a crafted api/push request with traversal sequences reveals file existence on the Ollama host.",
+    "ai_discovered": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Disclosed by Oligo Security ('More Models, More ProbLLMs'). The abused surface is the Ollama HTTP API.",
+    "ai_assisted_weaponization": false,
+    "ai_assisted_notes": "No AI-assisted weaponization; path traversal in the model-runtime API.",
+    "active_exploitation": "none",
+    "active_exploitation_notes": "Research disclosure with a coordinated fix; no confirmed in-the-wild exploitation reported as of curation.",
+    "affected": "Ollama before 0.1.46 (fixed in 0.1.46).",
+    "affected_versions": [
+      "Ollama < 0.1.46"
+    ],
+    "vector": "Ollama's api/push route is vulnerable to path traversal (CWE-22): an unauthenticated request with traversal sequences reveals whether arbitrary paths exist on the server, a reconnaissance primitive that aids further exploitation. One of the Oligo 'More Models, More ProbLLMs' findings.",
+    "complexity": "low",
+    "complexity_notes": "NVD AV:N / AC:L. PR:N — unauthenticated.",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "Remediation is upgrading Ollama to 0.1.46 or later; redeploy, no host reboot.",
+    "vendor_update_paths": [
+      "Upgrade Ollama to 0.1.46 or later and do not expose the Ollama API (default port 11434) to untrusted networks."
+    ],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "Flaw-remediation cadence does not track the local-LLM runtime as managed, network-exposed software.",
+      "NIST-800-53-SI-10": "Input-validation control is not applied to model-blob digests / API path parameters in the runtime.",
+      "ISO-27001-2022-A.8.8": "Vulnerability management rarely enumerates the model-runtime API's path handling as an injection surface.",
+      "NIS2-Art21-patch-management": "Article 21 measures do not reach the local-LLM runtime API as a privileged surface.",
+      "DORA-Art-9": "ICT protection measures do not model path traversal in an AI runtime API as an ICT-risk event.",
+      "UK-CAF-B4": "System Security objective has no objective for validating paths/digests in the model-runtime API.",
+      "AU-ISM-1546": "Patch-application control does not single out local-LLM runtimes.",
+      "ALL-AI-PIPELINE-INTEGRITY": "No framework treats the model-runtime API's path/digest handling as untrusted input; a rogue registry or crafted request reaches the filesystem."
+    },
+    "atlas_refs": [
+      "AML.T0049"
+    ],
+    "attack_refs": [
+      "T1190",
+      "T1083"
+    ],
+    "rwep_score": 27,
+    "rwep_factors": {
+      "cisa_kev": 0,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 0,
+      "blast_radius": 22,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "Standard (RWEP 27, \"patch within 30 days\" band per lib/scoring.js timeline). Not KEV, no confirmed in-the-wild exploitation, patched at/after disclosure (Hard Rule #3). poc_available=20 + blast_radius=22 (Ollama is the most widely used local LLM runtime) minus patch 15.",
+    "epss_score": null,
+    "epss_date": "2026-05-25",
+    "epss_note": "EPSS not pulled for this entry; retrieve via FIRST EPSS API in a future refresh.",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-39722",
+    "cwe_refs": [
+      "CWE-22"
+    ],
+    "iocs": {
+      "behavioral": [
+        "api/push requests to the Ollama API containing path-traversal sequences (../) in path parameters.",
+        "Probe patterns enumerating host file existence via the Ollama HTTP API from untrusted sources.",
+        "Ollama API (default port 11434) exposed to untrusted networks.",
+        "Ollama < 0.1.46 — the exposed precondition."
+      ],
+      "_ioc_source_note": "Behavioral signatures derived from the Oligo 'More Models, More ProbLLMs' research (https://www.oligo.security/blog/more-models-more-probllms), plus NVD CVE-2024-39722 (CWE-22)."
+    },
+    "source_verified": "2026-05-25",
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2024-39722",
+      "https://www.oligo.security/blog/more-models-more-probllms",
+      "https://www.oligo.security/blog/more-models-more-probllms"
+    ],
+    "vendor_advisories": [
+      {
+        "vendor": "Oligo Security (More Models, More ProbLLMs)",
+        "advisory_id": "CVE-2024-39722",
+        "url": "https://www.oligo.security/blog/more-models-more-probllms",
+        "severity": "high",
+        "published_date": "2024-10-31"
+      },
+      {
+        "vendor": "NVD",
+        "advisory_id": "CVE-2024-39722",
+        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39722",
+        "severity": "high",
+        "published_date": "2024-10-31"
+      }
+    ],
+    "last_updated": "2026-05-25",
+    "discovery_attribution_note": "Manually curated from NVD (CWE-22; NIST CVSS 7.5) + Oligo 'More Models, More ProbLLMs' research + the ollama GitHub advisory. Member of the Ollama API path-traversal family.",
+    "_auto_imported": false,
+    "_intake_method": "manual-verified-curation",
+    "_kev_short_description": "Ollama's api/push route path traversal (CWE-22) lets an unauthenticated attacker disclose file existence on the host; fixed in 0.1.46."
+  },
   "CVE-2026-41091": {
     "name": "Microsoft Defender (Malware Protection Engine) Link-Following LPE to SYSTEM",
     "type": "LPE",

package/data/cwe-catalog.json

@@ -48,6 +48,7 @@
       "fuzz-testing-strategy"
     ],
     "evidence_cves": [
+      "CVE-2022-1471",
       "CVE-2024-3154",
       "CVE-2025-20393",
       "CVE-2025-54236",
@@ -95,6 +96,8 @@
       "CVE-2023-43472",
       "CVE-2024-0769",
       "CVE-2024-1708",
+      "CVE-2024-37032",
+      "CVE-2024-39722",
       "CVE-2024-57728",
       "CVE-2024-7399",
       "CVE-2025-2749",
@@ -1303,6 +1306,7 @@
       "webapp-security"
     ],
     "evidence_cves": [
+      "CVE-2022-1471",
       "CVE-2023-21529",
       "CVE-2024-50050",
       "CVE-2024-8069",
@@ -1828,6 +1832,7 @@
       "CVE-2021-22054",
       "CVE-2021-22175",
       "CVE-2021-39935",
+      "CVE-2023-43654",
       "CVE-2023-48022",
       "CVE-2025-61884"
     ],