PYSEC-2026-2481 flyto-core has SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf

Summary flyto-core's SSRF protection validateurlssrf / isprivateip in src/core/utils.py blocks private and metadata destinations by resolving the host and testing the resulting IP for membership in a hardcoded PRIVATEIPRANGES list. That list contains only the native RFC 1918 / loopback / link-loc...

PYSEC-2026-3412 WeasyPrint has CSS Injection via Presentational Hints

Summary A CSS injection issue exists in WeasyPrint when HTML presentational hints are enabled. Unescaped attribute values are embedded into CSS, allowing injection of arbitrary CSS declarations. This affects applications processing untrusted HTML input. Details File: weasyprint/css/init.py The...

LangGraph SDK has unsafe URL path construction

Summarylanggraph-sdk constructs HTTP request paths for resource operations by interpolating caller-supplied identifier values into URL templates. Without sanitization of those values, identifiers that contain characters with special meaning in URL paths could cause the resulting request to addres...

Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects

SummaryThe SafePlaywrightURLLoader implements a validateurl function to prevent SSRF attacks by checking the IP address of the user-provided URL. However, this validation is performed only on the initial URL.Since Playwright automatically follows HTTP redirects 301/302 by default, an attacker can...

PYSEC-2026-2766 Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field

summary POST /api/chat/completions accepts an imageurl.url value that, when it does NOT start with http://, https://, or data:image/, is interpreted as a file id and resolved against the global file table with no ownership check. An authenticated user can therefore set imageurl.url to another...

PYSEC-2026-2690 Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401)

Summary backend/openwebui/utils/oauth.py::processpictureurl v0.9.5, lines 1435-1470 calls validateurlpictureurl on the initial URL only, then invokes aiohttp.ClientSession.getpictureurl, ... without allowredirects=False. aiohttp's default is allowredirects=True, maxredirects=10; the function does...

PYSEC-2026-2718 Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter

Summary Several direct, index-addressed Ollama proxy routes accept a caller-supplied urlidx path parameter and use it as a raw index into the admin-configured OLLAMABASEURLS list. Access control on these routes validates only whether the user may use the requested model, never which backend the...

Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field

summaryPOST /api/chat/completions accepts an imageurl.url value that, when it does NOT start with http://, https://, or data:image/, is interpreted as a file id and resolved against the global file table with no ownership check. An authenticated user can therefore set imageurl.url to another user...

Open WebUI: Stored XSS to Account Takeover via Model Profile Images

Stored XSS to Account Takeover via Model Profile Images in Open WebUIAffected: Open WebUI = 0.9.5Bypass of: GHSA-3wgj-c2hg-vm6q, GHSA-3856-3vxq-m6fc--- TL;DROpen WebUI patched SVG XSS in user profile images and webhook profile images but forgot to apply the same fix to model profile images. The...

vk-url-scraper (>=0.2.1, <=0.3.5) potentially affected by CVE-2026-50023 via yt-dlp (2022.5.18)

yt-dlp PYPI version 2022.5.18 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - vk-url-scraper =0.2.1, =0.3.5 Source cves: CVE-2026-50023 Source advisory: OSV:PYSEC-2026-3430...

vk-url-scraper (0.3.30) potentially affected by CVE-2026-50023 via yt-dlp (2024.7.15.232803.dev0)

yt-dlp PYPI version 2024.7.15.232803.dev0 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - vk-url-scraper 0.3.30 Source cves: CVE-2026-50023 Source advisory: OSV:PYSEC-2026-3430...

vk-url-scraper (>=0.2.1, <=0.3.5) potentially affected by CVE-2026-50574 via yt-dlp (2022.5.18)

yt-dlp PYPI version 2022.5.18 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - vk-url-scraper =0.2.1, =0.3.5 Source cves: CVE-2026-50574 Source advisory: OSV:PYSEC-2026-3433...

basketcase (3.0.2), gridplayer (0.4.3) +1 more potentially affected by CVE-2026-50023 via yt-dlp (2022.7.18)

yt-dlp PYPI version 2022.7.18 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - basketcase 3.0.2 - gridplayer 0.4.3 - vk-url-scraper =0.3.8, =0.3.10 Source cves: CVE-2026-50023 Source advisory: OSV:PYSEC-2026-3430...

vk-url-scraper (0.3.30) potentially affected by CVE-2026-50574 via yt-dlp (2024.7.15.232803.dev0)

yt-dlp PYPI version 2024.7.15.232803.dev0 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - vk-url-scraper 0.3.30 Source cves: CVE-2026-50574 Source advisory: OSV:PYSEC-2026-3433...

basketcase (3.0.2), gridplayer (0.4.3) +1 more potentially affected by CVE-2026-50574 via yt-dlp (2022.7.18)

yt-dlp PYPI version 2022.7.18 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - basketcase 3.0.2 - gridplayer 0.4.3 - vk-url-scraper =0.3.8, =0.3.10 Source cves: CVE-2026-50574 Source advisory: OSV:PYSEC-2026-3433...

scdlbot (0.15.0), vk-url-scraper (0.3.15) +1 more potentially affected by CVE-2026-50574 via yt-dlp (2023.2.17)

yt-dlp PYPI version 2023.2.17 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - scdlbot 0.15.0 - vk-url-scraper 0.3.15 - ytb-downloader 0.3.1 Source cves: CVE-2026-50574 Source advisory: OSV:PYSEC-2026-3433...

scdlbot (0.15.0), vk-url-scraper (0.3.15) +1 more potentially affected by CVE-2026-50023 via yt-dlp (2023.2.17)

yt-dlp PYPI version 2023.2.17 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - scdlbot 0.15.0 - vk-url-scraper 0.3.15 - ytb-downloader 0.3.1 Source cves: CVE-2026-50023 Source advisory: OSV:PYSEC-2026-3430...

PYSEC-2026-2345 Apache Airflow: Authenticated users can bypass the `is_safe_url` check

A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the issafeurl check, enabling redirection from a trusted Airflow domain to an attacker-controlled origin. Users are advised to upgrade to apache-airflow 3.2.2 or later. As a defense-in-dept...

PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context

SummaryPraisonAI's direct-prompt CLI automatically expands @url: mentions in raw prompt text before agent execution begins.If a prompt contains @url:, the CLI calls MentionsParser.process.... The @url: handler then performs a direct urllib.request.urlopen request to the attacker-controlled URL an...

PYSEC-2026-2902 PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings

Summary PraisonAI's spidertools URL validation can be bypassed using alternate loopback host encodings. The affected component is: text praisonaiagents/tools/spidertools.py The tool contains a URL validation function intended to block local or unsafe targets before fetching attacker-controlled...