Perspective
Monthly
Remote unauthenticated file disclosure in perspective-dev/perspective 5.0.0 allows any network attacker to read arbitrary server-side files by injecting literal `../` path traversal segments into HTTP request URLs targeting the CWD static file handler. The sanitization routine strips only query-string parameters, leaving path-based traversal sequences intact and enabling escape from the configured asset root to retrieve sensitive files such as system credentials and application secrets. A publicly available proof-of-concept exploit exists per VulnCheck and researcher disclosure; combined with a wildcard Access-Control-Allow-Origin header on all responses, the vulnerability also enables cross-origin exfiltration through attacker-controlled web pages without any victim interaction.
Denial of service in Perspective 5.0.0 allows low-privileged remote attackers to render the server permanently unresponsive by submitting a crafted TableMakeViewReq message containing expression columns with unbounded for or while loop constructs. Because the Tornado IOLoop evaluates the expression once per table row with no iteration cap, deadline enforcement, or cancellation mechanism, a single malicious request stalls the entire event loop and blocks all connected clients. A publicly available proof-of-concept exploit exists, and the vulnerability is part of a batch of five CVEs disclosed against this version.
Unauthenticated remote denial-of-service in Perspective 5.0.0 crashes the server process by exploiting missing field validation in the VirtualServer protocol dispatcher. Attackers send syntactically valid but semantically incomplete protobuf messages - such as ViewToArrowReq without a viewport or MakeTableReq without a data field - triggering Rust unwrap() calls on None values at nine distinct code sites, each causing an immediate SIGABRT process abort. No public exploit is confirmed actively exploited (no CISA KEV listing), but a publicly available proof-of-concept exists via a researcher blog post, and the attack requires no authentication against a network-accessible endpoint.
Cross-site scripting in Perspective 5.0.0's built-in Debug plugin enables an authenticated attacker with low privileges to inject arbitrary HTML and JavaScript into the embedding page's origin by writing crafted table cell values that bypass RFC 4180 quoting. The Debug plugin's CSV serialization renderer assigns table cell content directly to innerHTML without sanitization, meaning event handler attributes and unquoted injection payloads execute as script in any page embedding the component. A publicly available proof-of-concept exists; the vulnerability is not listed in CISA KEV, but the low attack complexity and available exploit code elevate practical risk above the moderate CVSS 4.0 score of 5.1.
Remote code execution in Perspective 5.0.0 exposes any network-reachable PolarsVirtualServer backend to arbitrary OS command execution via Python eval() injection. The server passes client-supplied expression strings to eval() with only __builtins__={} cleared - a well-known insufficient sandbox - enabling attackers to traverse Python's loaded class hierarchy to reach subprocess.Popen through crafted TableValidateExprReq or TableMakeViewReq protobuf messages. A public exploit is confirmed by VulnCheck, and five vulnerabilities were disclosed simultaneously in the researcher's blog post, suggesting a broader attack surface in this release. No KEV listing is identified, but the published PoC substantially lowers the exploitation barrier.
Perspective ICM Investigation & Case 5.1.1.16 allows remote authenticated users to modify access level permissions and consequently gain privileges by leveraging insufficient validation methods and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Remote unauthenticated file disclosure in perspective-dev/perspective 5.0.0 allows any network attacker to read arbitrary server-side files by injecting literal `../` path traversal segments into HTTP request URLs targeting the CWD static file handler. The sanitization routine strips only query-string parameters, leaving path-based traversal sequences intact and enabling escape from the configured asset root to retrieve sensitive files such as system credentials and application secrets. A publicly available proof-of-concept exploit exists per VulnCheck and researcher disclosure; combined with a wildcard Access-Control-Allow-Origin header on all responses, the vulnerability also enables cross-origin exfiltration through attacker-controlled web pages without any victim interaction.
Denial of service in Perspective 5.0.0 allows low-privileged remote attackers to render the server permanently unresponsive by submitting a crafted TableMakeViewReq message containing expression columns with unbounded for or while loop constructs. Because the Tornado IOLoop evaluates the expression once per table row with no iteration cap, deadline enforcement, or cancellation mechanism, a single malicious request stalls the entire event loop and blocks all connected clients. A publicly available proof-of-concept exploit exists, and the vulnerability is part of a batch of five CVEs disclosed against this version.
Unauthenticated remote denial-of-service in Perspective 5.0.0 crashes the server process by exploiting missing field validation in the VirtualServer protocol dispatcher. Attackers send syntactically valid but semantically incomplete protobuf messages - such as ViewToArrowReq without a viewport or MakeTableReq without a data field - triggering Rust unwrap() calls on None values at nine distinct code sites, each causing an immediate SIGABRT process abort. No public exploit is confirmed actively exploited (no CISA KEV listing), but a publicly available proof-of-concept exists via a researcher blog post, and the attack requires no authentication against a network-accessible endpoint.
Cross-site scripting in Perspective 5.0.0's built-in Debug plugin enables an authenticated attacker with low privileges to inject arbitrary HTML and JavaScript into the embedding page's origin by writing crafted table cell values that bypass RFC 4180 quoting. The Debug plugin's CSV serialization renderer assigns table cell content directly to innerHTML without sanitization, meaning event handler attributes and unquoted injection payloads execute as script in any page embedding the component. A publicly available proof-of-concept exists; the vulnerability is not listed in CISA KEV, but the low attack complexity and available exploit code elevate practical risk above the moderate CVSS 4.0 score of 5.1.
Remote code execution in Perspective 5.0.0 exposes any network-reachable PolarsVirtualServer backend to arbitrary OS command execution via Python eval() injection. The server passes client-supplied expression strings to eval() with only __builtins__={} cleared - a well-known insufficient sandbox - enabling attackers to traverse Python's loaded class hierarchy to reach subprocess.Popen through crafted TableValidateExprReq or TableMakeViewReq protobuf messages. A public exploit is confirmed by VulnCheck, and five vulnerabilities were disclosed simultaneously in the researcher's blog post, suggesting a broader attack surface in this release. No KEV listing is identified, but the published PoC substantially lowers the exploitation barrier.
Perspective ICM Investigation & Case 5.1.1.16 allows remote authenticated users to modify access level permissions and consequently gain privileges by leveraging insufficient validation methods and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.