Fix high-severity model and image loading vulnerabilities - #626
Fix high-severity model and image loading vulnerabilities#626peter-matkovski wants to merge 1 commit into
Conversation
📝 WalkthroughWalkthroughUpdated dependency constraints across the core package and three plugins. Pillow now requires version 12.3.x. Transformers now requires version 5.5.x in the affected plugins. Hugging Face Hub now requires version 1.5.x. The root Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 8df70f24-c649-4036-bfd0-26b18191f987
⛔ Files ignored due to path filters (1)
uv.lockis excluded by!**/*.lock
📒 Files selected for processing (5)
agents-core/pyproject.tomlplugins/huggingface/pyproject.tomlplugins/moondream/pyproject.tomlplugins/smart_turn/pyproject.tomlpyproject.toml
| "av>=14.2.0, <17", | ||
| "python-dotenv>=1.1.1", | ||
| "pillow>=10.4.0", | ||
| "pillow>=12.3.0,<13", |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== tracked files close to pyproject =="
git ls-files | rg '(^|/)pyproject\.toml$|moondream|agents-core'
echo
echo "== agents-core/pyproject.toml =="
cat -n agents-core/pyproject.toml
echo
echo "== dependencies mentioning moondream/pillow =="
rg -n "moondream|Pillow|pillow" -S --glob '!*.lock' --glob '!**/.venv/**' --glob '!**/dist/**' --glob '!**/build/**' .
echo
echo "== diff/stat if available =="
git diff --stat || true
git diff -- agents-core/pyproject.toml || trueRepository: GetStream/Vision-Agents
Length of output: 31060
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== root pyproject relevant sections =="
rg -n "vision-agents-plugins-moondream|pillow|python-dotenv|tool\\.uv|\\[tool\\.uv" pyproject.toml
sed -n '1,120p' pyproject.toml
echo
echo "== moondream pyproject and README dependency refs =="
cat -n plugins/moondream/pyproject.toml
sed -n '300,326p' plugins/moondream/README.md
echo
echo "== direct moondream API usage of Pillow/PIL in source =="
rg -n "Image\\.|PIL|Pillow|pillow|open\\(|annotate_detections|save\\(" plugins/moondream/vision_agents plugins/moondream/tests -S
sed -n '230,330p' plugins/moondream/vision_agents/plugins/moondream/detection/moondream_cloud_processor.py
sed -n '140,230p' plugins/moondream/vision_agents/plugins/moondream/detection/moondream_local_processor.py
sed -n '1,80p' plugins/moondream/vision_agents/plugins/moondream/moondream_utils.py
echo
echo "== tests expecting errors / compatibility notes =="
rg -n "pillow|Pillow|version|12\\.|1[01]|<11|>=10" plugins/moondream tests examples -SRepository: GetStream/Vision-Agents
Length of output: 50381
🌐 Web query:
Pillow 12.3.0 Release Notes breaking changes
💡 Result:
Pillow 12.3.0, released on July 1, 2026, includes several security and functional updates that involve changes to existing behaviors, which may impact applications relying on previous versions [1][2]. While the release notes do not use the explicit label "breaking changes," the following modifications constitute significant shifts in behavior: 1. Decompression Bomb Protection: - PdfStream.decode: A default maximum of ImageFile.SAFEBLOCK has been added to limit data decompression when parsing PDFs, which could potentially cause issues for processes handling extremely large PDF streams [1][3]. - GdImageFile: A decompression bomb check has been added to PIL.GdImageFile, which must now be explicitly handled [3][4]. - FontFile: Decompression bomb checks have been added to FontFile and its subclasses, validating the width and height of characters [1][3]. 2. Validation Changes: - EPS Parsing: The BeginBinary byte count in EPS images is now validated to prevent potential infinite loops caused by negative byte counts [3][4]. 3. Removed Support: - Python 3.13 Free-Threaded Wheels: Support for Python 3.13 free-threaded wheels has been removed, following the official release of Python 3.14 [3][4]. 4. New API Parameters: - ImageGrab.grab: Now accepts an optional scale_down keyword argument, which defaults to False (capturing Retina screenshots at 2x) [3][4]. - PdfStream.decode: Now accepts an optional max_length argument to specify the maximum amount of data to decode [1][3]. Users are encouraged to review these changes, particularly if their workflows involve complex PDF/EPS parsing or specific Python build environments [1][3].
Citations:
- 1: https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html
- 2: https://pillow.readthedocs.io/en/stable/releasenotes/versioning.html
- 3: https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst
- 4: https://pillow.readthedocs.io/en/latest/%5Fsources/releasenotes/12.3.0.rst.txt
🌐 Web query:
Pillow 12 major version changelog changes removing deprecated APIs
💡 Result:
Pillow 12.0.0 was released on October 15, 2025, and included a significant number of removals of previously deprecated APIs [1][2][3]. Key removals in this major version include: - Python Support: Dropped support for Python 3.9 [4][1]. - ImageFile APIs: ImageFile.raise_oserror() was removed as it was an undocumented helper function whose functionality is now handled automatically [4][5]. - IptcImageFile Helpers: The functions IptcImageFile.dump and IptcImageFile.i, along with the constant IptcImageFile.PAD, were removed [4][5]. - ImageMath: ImageMath.eval() was removed; users should use lambda_eval() or unsafe_eval() instead [5]. - ImageCms: Removed various constants and a function related to LittleCMS version 1, as well as the use of non-Pillow image modes in ImageCms [5]. - Library Support: Dropped support for FreeType versions 2.9.0 and earlier, and LibTIFF versions earlier than 4 [6][5]. - Drawing and Coordinate APIs: The hints parameter in ImageDraw.getdraw() was removed [6][5]. Additionally, various coordinate processing APIs (such as those in ImagePath.Path, polygon(), and line()) were hardened against heap buffer overflows caused by nested lists [7]. - Other Removals: Numerous internal helper functions and constants were removed, including Image.isImageType(), ImageMath.lambda_eval and ImageMath.unsafe_eval options parameters, ImageFile.h, and various internal pointer and legacy API helpers [6]. For a complete list of deprecated and removed features, you can refer to the official Pillow documentation [6][2].
Citations:
- 1: https://github.com/python-pillow/Pillow/releases/tag/12.0.0
- 2: https://pillow.readthedocs.io/en/stable/releasenotes/index.html
- 3: https://pillow.readthedocs.io/en/latest/releasenotes/index.html
- 4: https://pillow.readthedocs.io/en/stable/releasenotes/12.0.0.html
- 5: https://pillow.readthedocs.io/en/latest/releasenotes/12.0.0.html
- 6: https://pillow.readthedocs.io/en/stable/deprecations.html
- 7: https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html
Verify Moondream compatibility before allowing Pillow 12.x.
agents-core requires pillow>=12.3.0,<13, and the Moondream plugin now mirrors that workspace constraint even though its docs still list pillow>=10.0.0. Add/enable Moondream annotation integration tests against Pillow 12.3.0, or restore the previous working cap until those tests pass.
Source: Learnings
|
@peter-matkovski - can you take a look at the CR and CI? |
2 participants
Summary
Risk
The affected plugins load configurable Hugging Face model repositories and process caller-supplied images. Those are the model-deserialization and image-processing entry points covered by the open advisories, so these alerts are reachable rather than lockfile-only findings.
Addresses the current high-severity ONNX, Transformers, and Pillow Dependabot alerts, including GHSA-fgcw and the ONNX parser advisories.
Validation
uv lock --checkgit diff --checkFull model integration tests require downloading large model artifacts and are left to CI.