{"dataType":"CVE_RECORD","dataVersion":"1.0","cveMetadata":{"cveId":"GCVE-110-VULN-PYPI-2026-000633","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-10-27T21:56:29Z","dateUpdated":"2026-10-27T22:45:37Z","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"en","value":"If you run aimarket-logos 0.1.0 or 0.2.0, anyone who can reach its port directly can reset its rate limit with every request and spend your model budget through the language-model backed POST /api/v1/ask and /api/v1/chat routes past LOGOS_RATE_MAX. The limit is keyed on X-Real-IP, or an X-Forwarded-For entry, from any peer (app._client_key), and the logos entry point binds 0.0.0.0 (logos.main), although the code assumes it is reachable only through an edge proxy. Fixed in 0.2.1 for callers on public networks: the headers count only when the TCP peer is a loopback, private or link-local address. A caller on a private network the app shares with others is still trusted (GCVE-110-VULN-PYPI-2026-000638). Affects 0.1.0 and 0.2.0.","supportingMedia":null}],"references":[{"url":"https://pypi.org/project/aimarket-logos/","name":"","tags":["advisory"]},{"url":"https://github.com/alexar76/logos/commit/892c82f775ef5ef7f53b74225697636d0f367533","name":"Fix: logos 0.2.1","tags":["fix"]},{"url":"https://pypi.org/project/aimarket-logos/0.2.1/","name":"aimarket-logos 0.2.1","tags":["release"]}],"metrics":[{"format":"","scenarios":null,"cvssV2_0":null,"cvssV3_0":null,"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM"},"cvssV4_0":null,"other":null}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Use of Less Trusted Source","cweId":"CWE-348","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Improper Control of Interaction Frequency","cweId":"CWE-799","type":"CWE"}]}],"affected":[{"vendor":"pypi","product":"aimarket-logos","collectionURL":"https://pypi.org","packageName":"aimarket-logos","repo":"","defaultStatus":"unaffected","versions":[{"version":"0.1.0","status":"affected","versionType":"python","lessThan":"0.2.1","lessThanOrEqual":"","changes":null},{"version":"0.2.1","status":"unaffected","versionType":"python","lessThan":"","lessThanOrEqual":"","changes":null}],"cpes":null,"modules":["logos.app"],"programFiles":["logos/app.py"],"programRoutines":[{"name":"logos.app._client_key"},{"name":"logos.app.create_app"}],"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null},"adp":null}}