{"dataType":"CVE_RECORD","dataVersion":"1.0","cveMetadata":{"cveId":"GCVE-110-VULN-PYPI-2026-000636","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-10-27T22:42:51Z","dateUpdated":"2026-10-27T22:42:51Z","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"en","value":"If you run aimarket-platon on a network that hosts or containers you do not control can also reach (a LAN, a shared Docker network, a Kubernetes namespace), any of them can reset the per-client rate limit on the paid ask completion (POST /api/ask and the platon.ask@v1 capability) with every request and spend your model budget past the 30-a-minute ceiling. The server binds 0.0.0.0 by default and keys the limit on X-Real-IP, or the right-most X-Forwarded-For entry. 0.1.5 reads those headers only when the TCP peer is a loopback, private or link-local address (main._from_local_proxy, main._key_from), on the assumption that such a peer is your reverse proxy. A neighbour on a private network is such a peer, so it still names its own key. In 0.1.0 through 0.1.3 a caller on any network could (GCVE-110-VULN-PYPI-2026-000615). No release limits header trust to your proxy. Affects 0.1.0 through 0.1.5.","supportingMedia":null}],"references":[{"url":"https://pypi.org/project/aimarket-platon/","name":"","tags":["advisory"]}],"metrics":[{"format":"","scenarios":null,"cvssV2_0":null,"cvssV3_0":null,"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":4.3,"baseSeverity":"MEDIUM"},"cvssV4_0":null,"other":null}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Use of Less Trusted Source","cweId":"CWE-348","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Improper Control of Interaction Frequency","cweId":"CWE-799","type":"CWE"}]}],"affected":[{"vendor":"pypi","product":"aimarket-platon","collectionURL":"https://pypi.org","packageName":"aimarket-platon","repo":"","defaultStatus":"unknown","versions":[{"version":"0.1.0","status":"affected","versionType":"python","lessThan":"","lessThanOrEqual":"0.1.5","changes":null}],"cpes":null,"modules":["platon.main"],"programFiles":["platon/main.py"],"programRoutines":[{"name":"platon.main._from_local_proxy"},{"name":"platon.main._key_from"},{"name":"platon.main._client_key"},{"name":"platon.main._ws_client_key"}],"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null},"adp":null}}