Vulnerability GHSA-wxpc-2674-rxvw
High Risk
HIGH RISK
CVSS Score: 7.4
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
1 year ago
March 20, 2025 at 12:32 PM UTC
Feast Cross-Origin Resource Sharing vulnerability
0.1.0 - 0.40.0
0.1.0 - 0.40.0
Summary
Feast Cross-Origin Resource Sharing vulnerability
Details
A Cross-Origin Resource Sharing (CORS) vulnerability exists in feast-dev/feast version 0.40.0. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can bypass intended security controls and potentially expose sensitive information.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Critical
2 months ago
Feast vulnerable to arbitrary code execution via unsafe deserialization of dill-serialized UDFs
0.1.0 - 0.67.0.dev126 GHSA-gg2p-37pv-v7fq
0.1.0 - 0.67.0.dev126 GHSA-gg2p-37pv-v7fq
High Risk
3 months ago
Feast vulnerable to Deserialization of Untrusted Data
0.1.0 - 0.53.0 PYSEC-2026-1366
0.1.0 - 0.53.0 PYSEC-2026-1366
High Risk
3 months ago
Feast Cross-Origin Resource Sharing vulnerability
0.1.0 - 0.40.0 PYSEC-2026-1367
0.1.0 - 0.40.0 PYSEC-2026-1367
Critical
4 months ago
Feast vulnerable to unsafe deserialization RCE in registry server via UDF proto
0.1.0 - 0.62.0 GHSA-q63x-9pfm-mjx4
0.1.0 - 0.62.0 GHSA-q63x-9pfm-mjx4
High Risk
10 months ago
Feast vulnerable to Deserialization of Untrusted Data
0.1.0 - 0.53.0 GHSA-34wm-4hw7-qfjv
0.1.0 - 0.53.0 GHSA-34wm-4hw7-qfjv
Impacted packages
Timeline
Published
1 year ago
March 20, 2025 at 12:32 PM UTC
Last Modified
3 months ago
July 07, 2026 at 05:57 PM UTC