Datalab-to vulnerabilities
We track 2 vulnerabilities in Datalab-to products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 4, 2026.
2vulnerabilities
1critical
1high
0exploited
8.3average CVSS score
Latest Datalab-to vulnerabilities
- 7.5 High severity
surya: External Control of File Name or Path
surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw file_path parameters. Attackers can read any image or PDF file on the host by supplying arbitrary file paths t
- 9.1 Critical severity
marker: External Control of File Name or Path
marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary fi