{"dataType":"CVE_RECORD","dataVersion":"1.0","cveMetadata":{"cveId":"GCVE-110-VULN-PYPI-2026-000615","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-10-27T04:10:54Z","dateUpdated":"2026-10-27T04:12:09Z","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"en","value":"aimarket-platon limits the paid completion behind POST /api/ask and the platon.ask@v1 capability to 30 requests a minute per client (main._ask_limiter). The client key is read from X-Real-IP, or the right-most X-Forwarded-For entry, from any peer (main._client_key). The server binds 0.0.0.0 by default, so a caller that reaches it directly can write either header itself and receive a fresh allowance with each request, which lifts the ceiling on the operator's model spend. The steer and project writes had the same key and, with PLATON_STEER_TOKEN unset, accepted every caller as a public demo. Fixed in 0.1.5: the forwarding headers count only when the TCP peer is a loopback, private or link-local address, and without a steer token the write routes answer only the machine's own user unless PLATON_PUBLIC_WRITES=1 opts a public demo in. Affects 0.1.0 through 0.1.3.","supportingMedia":null}],"references":[{"url":"https://pypi.org/project/aimarket-platon/","name":"","tags":["advisory"]},{"url":"https://pypi.org/project/aimarket-platon/0.1.5/","name":"aimarket-platon 0.1.5","tags":["release"]}],"metrics":[{"format":"","scenarios":null,"cvssV2_0":null,"cvssV3_0":null,"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM"},"cvssV4_0":null,"other":null}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Use of Less Trusted Source","cweId":"CWE-348","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Improper Control of Interaction Frequency","cweId":"CWE-799","type":"CWE"}]}],"affected":[{"vendor":"pypi","product":"aimarket-platon","collectionURL":"https://pypi.org","packageName":"aimarket-platon","repo":"","defaultStatus":"unaffected","versions":[{"version":"0.1.0","status":"affected","versionType":"python","lessThan":"0.1.5","lessThanOrEqual":"","changes":null},{"version":"0.1.5","status":"unaffected","versionType":"python","lessThan":"","lessThanOrEqual":"","changes":null}],"cpes":null,"modules":["platon.main"],"programFiles":["platon/main.py"],"programRoutines":[{"name":"platon.main._client_key"},{"name":"platon.main._ws_client_key"},{"name":"platon.main._write_authorized"},{"name":"platon.main.ask"}],"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null},"adp":null}}