nanmicoder/mediacrawler

vite 5.4.6

3 advisories, actively exploited. Fixed in 6.2.4.

How it can be abusedIf a developer runs the Vite dev server for the webui while it is reachable from other machines, an attacker could read files outside the project folder through crafted requests (including Windows path tricks) or trigger code execution through the editor launcher on Windows. This affects developers running the dev tools, not end users of the crawler.

• mediumGHSA-4r4m-qw57-chr8exploitedVite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
• highGHSA-c27g-q93r-2cwflaunch-editor vulnerable to command injection via the crafted request on Windows
• highGHSA-fx2h-pf6j-xcffvite: `server.fs.deny` bypass on Windows alternate paths

asyncmy 0.2.10

1 advisory.

How it can be abusedMediaCrawler can save crawled notes and comments to MySQL through asyncmy, and this flaw lets SQL be smuggled in through dictionary keys used when building queries. Anyone running the crawler against hostile or manipulated platform content and writing results to MySQL could have extra commands run inside their database, though in this project the record keys come from fixed internal models rather than attacker input, so exploiting it would require unusual setup.

• criticalGHSA-qhqw-rrw9-25rmasyncmy is vulnerable to SQL injection via crafted dict keys

aiomysql 0.2.0

1 advisory. Fixed in 0.3.0.

How it can be abusedIf you configure MediaCrawler to save crawl results to a MySQL database that someone else controls or has compromised, that fake or malicious database server can trick your machine into sending back any file it asks for, such as your .env file with database passwords and platform cookies. Anyone running this tool with the optional MySQL storage pointed at a shared, hosted, or hijacked database is exposed.

• highGHSA-r397-ff8c-wv2gaiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL server

cryptography 45.0.7

4 advisories. Fixed in 48.0.1.

How it can be abusedThis library handles encryption and certificate checking for the crawler's HTTPS connections and login-state handling. An attacker positioned on the network, such as someone running a hostile Wi-Fi network between you and a platform like Xiaohongshu or Douyin, could potentially exploit flaws in its bundled crypto to weaken that connection protection or slow the process down with malicious certificates, affecting anyone running the scraper.

• highGHSA-537c-gmf6-5ccfVulnerable OpenSSL included in cryptography wheels
• highGHSA-g6cj-pr64-35w5cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing
• highGHSA-jwv3-5hgf-82wwpython-cryptography: Duplicate self-signed intermediates can cause exponential path-building
• highGHSA-r6ph-v2qm-q3c2cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

lodash-es 4.17.21

1 advisory. Fixed in 4.18.0.

How it can be abusedThe flaw lives in lodash's template function, which can run arbitrary JavaScript if an attacker controls the text passed into it. In this repo lodash-es is only a helper library for the React web dashboard, which builds its own pages and never feeds user or scraped data into templates, so an attacker has no realistic path to exploit it; users running the crawler are effectively unaffected.

• highGHSA-r5fr-rjxr-66jclodash vulnerable to Code Injection via `_.template` imports key names

lxml 6.0.0

1 advisory. Fixed in 6.1.0.

How it can be abusedIf the crawler ever parses an XML feed or response using lxml's iterparse or ETCompatXMLParser defaults, a malicious server it scrapes could craft a document that makes the crawler read local files on the machine running it, such as config files with database passwords or saved login cookies. Anyone running MediaCrawler against untrusted or attacker-influenced sources could be exposed.

• highGHSA-vfmq-68hx-4jfwlxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files

mako 1.3.10

2 advisories. Fixed in 1.3.12.

How it can be abusedThese bugs let someone read files outside the intended folder by passing crafted paths like backslashes or double slashes to Mako's template lookup, but only if the app renders templates from user-supplied names. MediaCrawler does not use Mako for templating anywhere in its crawling or web UI stack, so there is no realistic way for an attacker to reach this code.

• highGHSA-2h4p-vjrc-8xpqMako vulnerable to path traversal via backslash URI on Windows in TemplateLookup
• highGHSA-v92g-xgxw-vvmmMako: Path traversal via double-slash URI prefix in TemplateLookup

nanoid 3.3.7

2 advisories. Fixed in 3.3.16.

How it can be abusedThis flaw only triggers if the app's own code calls nanoid with a zero or negative size, causing an infinite loop and freezing whatever runs it, such as the Node.js signing scripts or the web UI build tooling. An attacker cannot cause this remotely by themselves; only a developer mistake in how nanoid is invoked would hang the process, so users running crawls could see things stall but there is no direct attack path here.

• highGHSA-28wg-ghj8-5hjvnanoid: non-secure generators can loop indefinitely with negative size
• highGHSA-2v37-7h3g-55p8nanoid: custom generators can loop indefinitely when size is zero

postcss 8.4.47

2 advisories. Fixed in 8.5.12.

How it can be abusedAn attacker would need to trick a developer or build process into compiling a malicious CSS file that contains a crafted sourceMappingURL comment; PostCSS would then read and expose arbitrary .map files from the machine running the build. In this repo PostCSS is only used to process the project's own trusted stylesheet sources during the optional WebUI build, so end users of the crawler are not exposed.

• highGHSA-6g55-p6wh-862qPostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
• highGHSA-r28c-9q8g-f849PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

rollup 4.22.0

2 advisories. Fixed in 3.29.5.

How it can be abusedAn attacker who can influence the WebUI build, such as through a malicious dependency or crafted file path, could get code written outside the build folder or inject script content into the bundled JavaScript served to anyone using the MediaCrawler web dashboard.

• highGHSA-gcx4-mw62-g8wmDOM Clobbering Gadget found in rollup bundled scripts that leads to XSS
• highGHSA-mw96-cpmx-2vgcRollup 4 has Arbitrary File Write via Path Traversal

starlette 0.37.2

3 advisories. Fixed in 1.3.1.

How it can be abusedAnyone who can reach the FastAPI web dashboard's HTTP endpoints could flood it with huge form or multipart upload bodies that Starlette fails to cap, hanging or crashing the crawl-monitoring server while crawls run. The Windows-only file-serving flaw applies only if you expose Starlette's static file handler on Windows, which this project generally does not.

• highGHSA-82w8-qh3p-5jfqStarlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
• highGHSA-f96h-pmfr-66vwStarlette Denial of service (DoS) via multipart/form-data
• highGHSA-wqp7-x3pw-xc5rStarlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows

urllib3 2.5.0

4 advisories. Fixed in 2.6.0.

How it can be abusedThe crawler sends requests carrying your platform login cookies, so if any target server or proxy responds with a malicious redirect chain, this bug can leak those cookies to an unrelated site, letting an attacker hijack your Xiaohongshu or Douyin account; it can also send endless compressed data that hangs or crashes the crawl process.

• highGHSA-2xpw-w6gg-jr37urllib3 streaming API improperly handles highly compressed data
• highGHSA-38jv-5279-wg99Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)
• highGHSA-gm62-xv2j-4w53urllib3 allows an unbounded number of links in the decompression chain
• highGHSA-qccp-gfcp-xxvcurllib3: Sensitive headers forwarded across origins in proxied low-level redirects

All /api/* HTTP routes and /api/ws/* WebSocket routes served by api/main.py (crawler_router, data_router, websocket_router), bound to 0.0.0.0:8080

An attacker gains full read access to all crawled data, can drive arbitrary crawler subprocesses on the victim's machine, and can harvest the victim's platform login cookies from logs.

Fix: Bind the server to 127.0.0.1 by default and add an authentication dependency (e.g. a FastAPI dependency requiring a bearer token from an environment variable) applied to every router via app.include_router(..., dependencies=[Depends(verify_token)]) and to both WebSocket endpoints.