I think there may be a problem in sandboxes/llm_remote/uv.lock around line 1.
The cryptography package before version 46.0.5 does not verify that EC public keys belong to the prime‑order subgroup of SECT curves. An attacker can supply a point from a small‑order subgroup, which leaks least‑significant bits of the private key in ECDH and enables signature forgery in ECDSA. The installed version 43.0.3 is vulnerable, so the finding is real and high‑risk. Upgrading to 46.0.5 (or any later version) restores the required subgroup checks and eliminates the issue.
Something like this might fix it:
--- a/sandboxes/llm_remote/uv.lock
+++ b/sandboxes/llm_remote/uv.lock
@@ -2,5 +2,5 @@
[[package]]
name = "cryptography"
-version = "43.0.3"
+version = "46.0.5"
For reference: rule CVE-2026-26007. Rated high.
If I have misread how this is used, sorry for the noise — feel free to close.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
I think there may be a problem in
sandboxes/llm_remote/uv.lockaround line 1.The cryptography package before version 46.0.5 does not verify that EC public keys belong to the prime‑order subgroup of SECT curves. An attacker can supply a point from a small‑order subgroup, which leaks least‑significant bits of the private key in ECDH and enables signature forgery in ECDSA. The installed version 43.0.3 is vulnerable, so the finding is real and high‑risk. Upgrading to 46.0.5 (or any later version) restores the required subgroup checks and eliminates the issue.
Something like this might fix it:
For reference: rule
CVE-2026-26007. Rated high.If I have misread how this is used, sorry for the noise — feel free to close.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.