CVE-2026-40113 PraisonAI has an Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars

PraisonAI is a multi-agent teams system. Prior to 4.5.128, deploy.py constructs a single comma-delimited string for the gcloud run deploy --set-env-vars argument by directly interpolating openaimodel, openaikey, and openaibase without validating that these values do not contain commas. gcloud use...

CVE-2026-40113: Improper Neutralization of Argument Delimiters in a Command

PraisonAI is a multi-agent teams system. Prior to 4.5.128, deploy.py constructs a single comma-delimited string for the gcloud run deploy --set-env-vars argument by directly interpolating openaimodel, openaikey, and openaibase without validating that these values do not contain commas. gcloud use...

gcloud-connectors (>=0.1.58b10, <=0.1.62), spsdk (>=1.3.0, <=1.5.0) +1 more potentially affected by CVE-2026-34073 via cryptography (3.4.3)

cryptography PYPI version 3.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - gcloud-connectors =0.1.58b10, =1.3.0, =0.1.29, =0.1.32 Source cves: CVE-2026-34073 Source advisory: OSV:PYSEC-2026-35...

gcloud-connectors (>=0.1.58b10, <=0.1.62), spsdk (>=1.3.0, <=1.5.0) +1 more potentially affected by CVE-2026-34073 via cryptography (3.4.3)

cryptography PYPI version 3.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - gcloud-connectors =0.1.58b10, =1.3.0, =0.1.29, =0.1.32 Source cves: CVE-2026-34073 Source advisory: OSV:GHSA-M959-CC7F-WV43...

gcloud-connectors (>=0.1.58b10, <=0.1.62), spsdk (>=1.3.0, <=1.5.0) +1 more potentially affected by CVE-2026-26007 via cryptography (3.4.3)

cryptography PYPI version 3.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - gcloud-connectors =0.1.58b10, =1.3.0, =0.1.29, =0.1.32 Source cves: CVE-2026-26007 Source advisory: OSV:PYSEC-2026-2141...

gcloud-connectors (>=0.1.58b10, <=0.1.62), spsdk (>=1.3.0, <=1.5.0) +1 more potentially affected by CVE-2026-26007 via cryptography (3.4.3)

cryptography PYPI version 3.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - gcloud-connectors =0.1.58b10, =1.3.0, =0.1.29, =0.1.32 Source cves: CVE-2026-26007 Source advisory: OSV:GHSA-R6PH-V2QM-Q3C2...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: fq, k8sgpt, cadvisor, nri-cassandra, paranoia, memcached-exporter, yam, ferretdb, vexctl, nri-nagios, kubeflow-pipelines, secrets-store-csi-driver-provider-gcp, amass, docker-credential-ecr-login, aws-efs-csi-driver, rqlite, nri-mysql, newrelic-infrastructure-agent,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: fq, k8sgpt, cadvisor, nri-cassandra, paranoia, memcached-exporter, yam, ferretdb, vexctl, nri-nagios, kubeflow-pipelines, secrets-store-csi-driver-provider-gcp, amass, docker-credential-ecr-login, aws-efs-csi-driver, rqlite, nri-mysql, newrelic-infrastructure-agent,...

com.aspectsecurity.automationservices.plugins.jenkins:ibm-security-appscansource-scanner (>=1.0.3, <=1.0.5), com.blazemeter.plugins:blazemeterjenkinsplugin (>=2.7, <=4.18) +195 more potentially affected by CVE-2024-47803 via org.jenkins-ci.main:jenkins-core (1.580.1)

org.jenkins-ci.main:jenkins-core MAVEN version 1.580.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.aspectsecurity.automationservices.plugins.jenkins:ibm-security-appscansource-scanner...

Malicious PyPI Package Targets macOS to Steal Google Cloud Credentials

Cybersecurity researchers have discovered a malicious package on the Python Package Index PyPI repository that targets Apple macOS systems with the goal of stealing users' Google Cloud credentials from a narrow pool of victims. The package, named "lr-utils-lib," attracted a total of 59 downloads...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: fq, k8sgpt, cadvisor, nri-cassandra, paranoia, memcached-exporter, yam, ferretdb, vexctl, nri-nagios, kubeflow-pipelines, secrets-store-csi-driver-provider-gcp, amass, docker-credential-ecr-login, aws-efs-csi-driver, rqlite, nri-mysql, newrelic-infrastructure-agent,...

gcloud-connectors (>=0.1.58b10, <=0.1.62), spsdk (>=1.3.0, <=1.5.0) +1 more potentially affected by CVE-2023-50782 via cryptography (3.4.3)

cryptography PYPI version 3.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - gcloud-connectors =0.1.58b10, =1.3.0, =0.1.29, =0.1.32 Source cves: CVE-2023-50782 Source advisory: OSV:GHSA-3WW4-GG4F-JR7F...

gcloud-connectors (>=0.1.58b10, <=0.1.62), spsdk (>=1.3.0, <=1.5.0) +1 more potentially affected by CVE-2024-0727 via cryptography (3.4.3)

cryptography PYPI version 3.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - gcloud-connectors =0.1.58b10, =1.3.0, =0.1.29, =0.1.32 Source cves: CVE-2024-0727 Source advisory: OSV:GHSA-9V9H-CGJ8-H64P...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: memcached-exporter, secrets-store-csi-driver-provider-gcp, amass, aws-efs-csi-driver, rqlite, aactl, newrelic-infrastructure-agent, ko, skaffold, pulumi-language-java, scorecard, dgraph, kubewatch, envoy-ratelimit, hugo, nginx-stable, ip-masq-agent,...

com.google.cloud:gcloud-java-examples (>=0.2.5, <=0.2.8), com.google.cloud:gcloud-java-nio-examples (>=0.2.5, <=0.2.8) +4 more potentially affected by CVE-2023-37460 via org.codehaus.plexus:plexus-archiver (2.10)

org.codehaus.plexus:plexus-archiver MAVEN version 2.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-archiver and may be impacted: - com.google.cloud:gcloud-java-examples =0.2.5, =0.2.5, =0.3.0, =0.3.0, =0.13.0-alpha -...

CVE-2022-41723 vulnerabilities

Vulnerabilities for packages: hey, terraform-provider-sendgrid-fips, kubeflow, k3d, kubeflow-fips, wireguard-go, kubeflow-katib, terraform-provider-sendgrid, grpcurl, go, gke-gcloud-auth-plugin, dynamic-localpv-provisioner-fips, kube-state-metrics, dynamic-localpv-provisioner, restic...

GHSA-VVPX-J8F3-3W6H vulnerabilities

Vulnerabilities for packages: hey, terraform-provider-sendgrid-fips, kubeflow, k3d, kubeflow-fips, wireguard-go, kubeflow-katib, terraform-provider-sendgrid, grpcurl, go, gke-gcloud-auth-plugin, dynamic-localpv-provisioner-fips, kube-state-metrics, dynamic-localpv-provisioner, restic...

google-cloudstorage-commands command injection vulnerability

google-cloudstorage-commands is a set of commands for node and gcloud interactions from the individual developers at sam. A security vulnerability exists in google-cloudstorage-commands, which stems from the vulnerability of this package to command injection attacks...

Malicious code in nodejs-gcloud-pubsub-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40eb63d0a4ed52650bf16d9a4d3a4cc2a9e305ba71dadfa7f7276be2f36ab743 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

com.aspectsecurity.automationservices.plugins.jenkins:ibm-security-appscansource-scanner (>=1.0.3, <=1.0.5), com.blazemeter.plugins:blazemeterjenkinsplugin (>=2.7, <=4.18) +195 more potentially affected by CVE-2021-21691 via org.jenkins-ci.main:jenkins-core (1.580.1)

org.jenkins-ci.main:jenkins-core MAVEN version 1.580.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.aspectsecurity.automationservices.plugins.jenkins:ibm-security-appscansource-scanner...