CVE-2026-57145

PraisonAI is a multi-agent teams system. Prior to 4.6.62, src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to open for reading and writing without traversal rejection, symlink resolution, a workspace boundary, or protected-path checks...

CVE-2026-57130

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/emailtools.py interpolates LLM-controlled fromaddr, subject, and query values directly into quoted IMAP SEARCH criteria. Embedded quote, backslash, newline, or null characters can...

CVE-2026-57145

CVE-2026-57145 affects PraisonAI , an AI multi-agent framework. The multiedit tool in src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to open() for reading and writing without path traversal rejection, symlink resolution, workspace boundary validat...

CVE-2026-57130

PraisonAI (praisonaiagents) is a multi-agent framework. Prior to 1.6.59 , the file email_tools.py interpolates LLM-controlled parameters (from_addr, subject, query, search_id) directly into IMAP SEARCH criteria using f-string formatting with double-quote delimiters, with no escaping or sanitizati...

GHSA-CFXV-8FW8-RWPV praisonaiagents: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool

Target: PraisonAI MervinPraison/PraisonAI Affected component: praisonaiagents/tools/astgreptool.py — astgreprewrite Affected versions: master at ce97667156a116c50b4a3d1aa21e09f048903fda; reproduced against the current praisonaiagents PyPI release praisonaiagents --rewrite --lang --update-all line...

Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint

Summary exportspace and importspace tools in @contentful/mcp-tools accept LLM-controlled host and proxy parameters that are spread directly into the options object passed to contentful-export / contentful-import. These libraries pass the merged options — including the attacker-controlled host — t...