Yue (Knox) Liu

2 exploits Active since Nov 2025
CVE-2025-66040 WRITEUP LOW WRITEUP
Spotipy < 2.25.2 - Cross-Site Scripting via OAuth Error Parameter
Spotipy is a Python library for the Spotify Web API. Prior to version 2.25.2, there is a cross-site scripting (XSS) vulnerability in the OAuth callback server that allows for JavaScript injection through the unsanitized error parameter. Attackers can execute arbitrary JavaScript in the user's browser during OAuth authentication. This issue has been patched in version 2.25.2.
CVSS 3.6
CVE-2026-21851 WRITEUP MEDIUM WRITEUP
MONAI <= 1.5.1 - Path Traversal via _download_from_ngc_private() Zip Slip
MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. In versions up to and including 1.5.1, a Path Traversal (Zip Slip) vulnerability exists in MONAI's `_download_from_ngc_private()` function. The function uses `zipfile.ZipFile.extractall()` without path validation, while other similar download functions in the same codebase properly use the existing `safe_extract_member()` function. Commit 4014c8475626f20f158921ae0cf98ed259ae4d59 fixes this issue.
CVSS 5.3