Skip to content

Fix high-severity model and image loading vulnerabilities #626

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
peter-matkovski wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

Fix high-severity model and image loading vulnerabilities #626

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion agents-core/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ dependencies = [
"aiortc>=1.14.0,<1.15.0",
"av>=14.2.0, <17",
"python-dotenv>=1.1.1",
"pillow>=10.4.0",
"pillow>=12.3.0,<13",

@coderabbitai coderabbitai Bot Aug 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== tracked files close to pyproject =="
git ls-files | rg '(^|/)pyproject\.toml$|moondream|agents-core'

echo
echo "== agents-core/pyproject.toml =="
cat -n agents-core/pyproject.toml

echo
echo "== dependencies mentioning moondream/pillow =="
rg -n "moondream|Pillow|pillow" -S --glob '!*.lock' --glob '!**/.venv/**' --glob '!**/dist/**' --glob '!**/build/**' .

echo
echo "== diff/stat if available =="
git diff --stat || true
git diff -- agents-core/pyproject.toml || true

Repository: GetStream/Vision-Agents

Length of output: 31060

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== root pyproject relevant sections =="
rg -n "vision-agents-plugins-moondream|pillow|python-dotenv|tool\\.uv|\\[tool\\.uv" pyproject.toml
sed -n '1,120p' pyproject.toml

echo
echo "== moondream pyproject and README dependency refs =="
cat -n plugins/moondream/pyproject.toml
sed -n '300,326p' plugins/moondream/README.md

echo
echo "== direct moondream API usage of Pillow/PIL in source =="
rg -n "Image\\.|PIL|Pillow|pillow|open\\(|annotate_detections|save\\(" plugins/moondream/vision_agents plugins/moondream/tests -S
sed -n '230,330p' plugins/moondream/vision_agents/plugins/moondream/detection/moondream_cloud_processor.py
sed -n '140,230p' plugins/moondream/vision_agents/plugins/moondream/detection/moondream_local_processor.py
sed -n '1,80p' plugins/moondream/vision_agents/plugins/moondream/moondream_utils.py

echo
echo "== tests expecting errors / compatibility notes =="
rg -n "pillow|Pillow|version|12\\.|1[01]|<11|>=10" plugins/moondream tests examples -S

Repository: GetStream/Vision-Agents

Length of output: 50381

🌐 Web query:

Pillow 12.3.0 Release Notes breaking changes

💡 Result:

Pillow 12.3.0, released on July 1, 2026, includes several security and functional updates that involve changes to existing behaviors, which may impact applications relying on previous versions [1][2]. While the release notes do not use the explicit label "breaking changes," the following modifications constitute significant shifts in behavior: 1. Decompression Bomb Protection: - PdfStream.decode: A default maximum of ImageFile.SAFEBLOCK has been added to limit data decompression when parsing PDFs, which could potentially cause issues for processes handling extremely large PDF streams [1][3]. - GdImageFile: A decompression bomb check has been added to PIL.GdImageFile, which must now be explicitly handled [3][4]. - FontFile: Decompression bomb checks have been added to FontFile and its subclasses, validating the width and height of characters [1][3]. 2. Validation Changes: - EPS Parsing: The BeginBinary byte count in EPS images is now validated to prevent potential infinite loops caused by negative byte counts [3][4]. 3. Removed Support: - Python 3.13 Free-Threaded Wheels: Support for Python 3.13 free-threaded wheels has been removed, following the official release of Python 3.14 [3][4]. 4. New API Parameters: - ImageGrab.grab: Now accepts an optional scale_down keyword argument, which defaults to False (capturing Retina screenshots at 2x) [3][4]. - PdfStream.decode: Now accepts an optional max_length argument to specify the maximum amount of data to decode [1][3]. Users are encouraged to review these changes, particularly if their workflows involve complex PDF/EPS parsing or specific Python build environments [1][3].

Citations:

🌐 Web query:

Pillow 12 major version changelog changes removing deprecated APIs

💡 Result:

Pillow 12.0.0 was released on October 15, 2025, and included a significant number of removals of previously deprecated APIs [1][2][3]. Key removals in this major version include: - Python Support: Dropped support for Python 3.9 [4][1]. - ImageFile APIs: ImageFile.raise_oserror() was removed as it was an undocumented helper function whose functionality is now handled automatically [4][5]. - IptcImageFile Helpers: The functions IptcImageFile.dump and IptcImageFile.i, along with the constant IptcImageFile.PAD, were removed [4][5]. - ImageMath: ImageMath.eval() was removed; users should use lambda_eval() or unsafe_eval() instead [5]. - ImageCms: Removed various constants and a function related to LittleCMS version 1, as well as the use of non-Pillow image modes in ImageCms [5]. - Library Support: Dropped support for FreeType versions 2.9.0 and earlier, and LibTIFF versions earlier than 4 [6][5]. - Drawing and Coordinate APIs: The hints parameter in ImageDraw.getdraw() was removed [6][5]. Additionally, various coordinate processing APIs (such as those in ImagePath.Path, polygon(), and line()) were hardened against heap buffer overflows caused by nested lists [7]. - Other Removals: Numerous internal helper functions and constants were removed, including Image.isImageType(), ImageMath.lambda_eval and ImageMath.unsafe_eval options parameters, ImageFile.h, and various internal pointer and legacy API helpers [6]. For a complete list of deprecated and removed features, you can refer to the official Pillow documentation [6][2].

Citations:

Verify Moondream compatibility before allowing Pillow 12.x.

agents-core requires pillow>=12.3.0,<13, and the Moondream plugin now mirrors that workspace constraint even though its docs still list pillow>=10.0.0. Add/enable Moondream annotation integration tests against Pillow 12.3.0, or restore the previous working cap until those tests pass.

Source: Learnings

"numpy>=1.24.0", # capped at <2.0 via workspace override in root pyproject.toml
"mcp>=1.23.3,<2",
"colorlog>=6.10.1",
Expand Down
4 changes: 2 additions & 2 deletions plugins/huggingface/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,12 +12,12 @@ requires-python = ">=3.10"
license = "MIT"
dependencies = [
"vision-agents",
"huggingface_hub<1.0",
"huggingface_hub>=1.5.0,<2",
]

[project.optional-dependencies]
transformers = [
"transformers>=4.45.0,<5",
"transformers>=5.5.0,<6",
"torch>=2.0.0,<3",
"accelerate>=0.25.0,<2",
"supervision>=0.21.0,<0.28",
Expand Down
6 changes: 3 additions & 3 deletions plugins/moondream/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,10 +12,10 @@ license = "MIT"
dependencies = [
"vision-agents",
"numpy>=2.0.0,<3",
"pillow>=10.4.0,<11",
"pillow>=12.3.0,<13",
"opencv-python>=4.8.0,<5",
"moondream>=0.2.0,<1", # Now compatible with vision-agents pillow>=10.4.0
"transformers>=4.57.6,<5", # For local model loading
"moondream>=0.2.0,<1", # Compatible with the workspace Pillow constraint.
"transformers>=5.5.0,<6", # For local model loading
"torch>=2.10.0,<3", # PyTorch for model inference
"accelerate>=1.13.0,<2", # Required for device_map and device management
]
Expand Down
2 changes: 1 addition & 1 deletion plugins/smart_turn/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ dependencies = [
"numpy>=2.2.6,<2.3",
"httpx>=0.28.1,<1",
"onnxruntime>=1.24.3,<2",
"transformers>=4.57.6,<5",
"transformers>=5.5.0,<6",
]

[project.urls]
Expand Down
7 changes: 6 additions & 1 deletion pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,12 @@ vision-agents-plugins-speechify = { workspace = true }
[tool.uv]
# Workspace-level override to resolve numpy version conflicts
# vogent-turn requires numpy<2.0, so we override to use 1.26.x
override-dependencies = ["numpy>=1.26.0,<2.0"]
override-dependencies = [
"numpy>=1.26.0,<2.0",
"onnx>=1.21.0",
"pillow>=12.3.0,<13",
"transformers>=5.5.0,<6",
]

# Store uv cache in project directory for better sandboxing
cache-dir = ".uv-cache"
Expand Down
Loading
Loading