shescape is a simple shell escape library

Affected versions of this package are vulnerable to Information Exposure due to the configuration of shell parameter. An attacker can gain read-only access to environment variables by manipulating input parameters such as quote, quoteAll, escape, or escapeAll.

Note: This is only exploitable if the attacker is a user of Shescape on Windows that explicitly configures shell: cmd.exe or shell: true using any of quote/quoteAll/escape/escapeAll.

vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs

Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the MessageQueue.dequeue() API function. An attacker can execute arbitrary code by sending a malicious payload to the message queue.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the ProcessorYaml class, whose processor() method deserializes YAML without checking/sanitizing its content.