GitHub Advisoryadvisory · PyPI

GHSA-wxpc-2674-rxvw Feast Cross-Origin Resource Sharing vulnerability

HIGH Published 2025-03-20 Modified 2025-03-21 Official page ↗
Aliases
CVE-2024-11602
Ecosystem
PyPI
Packages
feast
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Weaknesses
CWE-346
Reviewed
2025-03-21

Affected packages

• PyPI feast: <= 0.40.0 (no fix yet)

Description

A Cross-Origin Resource Sharing (CORS) vulnerability exists in feast-dev/feast version 0.40.0. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can bypass intended security controls and potentially expose sensitive information.

Related

Alias · CVE (1)

  • CVE-2024-11602 A Cross-Origin Resource Sharing (CORS) vulnerability exists in feast-dev/feast version 0.40.0. vulnerability

Weakness · CWE (1)

  • CWE-346 Origin Validation Error weakness

References