PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation

Summary The deploy/api.py module generates Python server code by directly interpolating the agentsfile parameter into an f-string that is then written to a file and executed via subprocess.Popen. An attacker who controls the agentsfile value via CLI argument, configuration, or upstream API can...

CVE-2026-62176: Improper Control of Generation of Code

PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the deploy/api.py module generates Python server code by directly interpolating the agentsfile parameter into an f-string that is then written to a file and executed via subprocess.Popen. An attacker who controls the agentsfile val...

PT-2026-107589

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.78 Description The deploy/api.py module generates Python server code by directly interpolating the agents file parameter into an f-string, which is subsequently written to a file and executed using...

EUVD-2026-93435

openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious OpenAPI document content before rendering string, docstring, and f-string contexts in generated Python. The generated Python client can contain...

CVE-2026-105801: Improper Control of Generation of Code

openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious OpenAPI document content before rendering string, docstring, and f-string contexts in generated Python. The generated Python client can contain...

kartykgithub-ph-f-dep (1.0.0) potentially affected by unknown CVE via kartykgithub-ph-f (1.0.0)

kartykgithub-ph-f NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on kartykgithub-ph-f and may be impacted: - kartykgithub-ph-f-dep 1.0.0 Source cves: unknown CVE Source advisory: SNYK:JS-KARTYKGITHUBPHF-20385969...

Malicious Package

Overview kartykgithub-ph-f is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in kartykgithub-ph-f (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e9463feb27a295ad0b7136837e12908bc8d668e0b7bbd70309c760165f071f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

kartykgithub-ph-f-dep (1.0.0) potentially affected by unknown CVE via kartykgithub-ph-f (1.0.0)

kartykgithub-ph-f NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on kartykgithub-ph-f and may be impacted: - kartykgithub-ph-f-dep 1.0.0 Source cves: unknown CVE Source advisory: GHSA-X2M2-W3GV-M5WG...

kartykgithub-ph-f-dep (1.0.0) potentially affected by unknown CVE via kartykgithub-ph-f (1.0.0)

kartykgithub-ph-f NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on kartykgithub-ph-f and may be impacted: - kartykgithub-ph-f-dep 1.0.0 Source cves: unknown CVE Source advisory: OSV:MAL-2026-17426...

MAL-2026-17426 Malicious code in kartykgithub-ph-f (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e9463feb27a295ad0b7136837e12908bc8d668e0b7bbd70309c760165f071f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-102913: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in SourceCodester Car Driving School Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=saveenrollment. The manipulation results in sql injection. The attack can be executed remotely. The exploit has been released to the...

PT-2026-98812

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel where bpf map check op flags incorrectly validates the target CPU ID stored in the upper 32 bits of map operation flags when BPF F CPU is used. The...

CVE-2026-61741

http4s-scala-xml provides EntityDecoderF, scala.xml.Elem instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default...

CVE-2026-61741 http4s-scala-xml has an XML External Entity (XXE) processing issue

http4s-scala-xml provides EntityDecoderF, scala.xml.Elem instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default...

EUVD-2026-86332

http4s-scala-xml provides EntityDecoderF, scala.xml.Elem instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default...

CVE-2026-61741

The http4s-scala-xml library is vulnerable to XML External Entity (XXE) attacks in versions prior to 0.24.1 and 1.0.0-M39 . The root cause is the use of SAXParserFactory.newInstance to obtain a javax.xml.parsers.SAXParserFactory without any security configuration, allowing the parser to resolve D...

PT-2026-97881

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock exists in the usb gadget f tcm module within the usbg make tpg function. The issue occurs because usbg make tpg holds dep lock while calling configfs depend item unlocked, whi...

PT-2026-97937

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the vxlan mdb flush function. The function iterates over Multicast Database MDB entries using hlist for each entry safe, which is designed to handle the...

CVE-2026-61741: Improper Restriction of XML External Entity Reference

http4s-scala-xml provides EntityDecoderF, scala.xml.Elem instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default...