106 matches found
duo-agentflow-auditor
Duo AgentFlow Auditor AI 代码安全 — 捕获 SAST 在 AI 生成代码中遗漏的问题 基于 GitLab Duo Agent 平台 40-62% 的 AI 生成代码存在安全漏洞。 传统 SAST 能捕获 CVE。而我们能捕获 SAST 遗漏的问题 — 提示注入、LLM 输出执行、不安全的 ML 反序列化。 快速开始 · 架构 · 检测规则 · 设置指南 · 实现 问题 AI 加速了代码生成，但也带来了新的安全瓶颈： 来源：GitLab 2025 全球 DevSecOps 报告 解决方案 AgentFlow Auditor — 四个 AI 代理，能够捕获传统 SA...
CVE-2026-69262
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, DELETE /api/v1/chatflows/:id authorized requests with checkAnyPermission'chatflows:delete,agentflows:delete', so possession of either permission was sufficient to reach the delete path. The...
Protection Mechanism Failure
Overview praisonaiagents is a Praison AI agents for completing complex tasks with Self Reflection Agents Affected versions of this package are vulnerable to Protection Mechanism Failure in the AgentFlow.resolvepydanticclass process. An attacker can execute arbitrary Python code with the privilege...
CVE-2026-7439
AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing attackers to bypass trust-boundary enforcement on sensitive operations. Attackers can exploit this content-type validation...
CVE-2026-7466
AgentFlow contains an arbitrary code execution vulnerability that allows attackers to execute local Python pipeline files by supplying a user-controlled pipelinepath parameter to the POST /api/runs and POST /api/runs/validate endpoints. Attackers can induce requests to the local AgentFlow API to...
NPM: FlowiseAI has Mass Assignment in Chatflow Update Endpoint that Allows Cross-Workspace AgentFlow Reassignment
NPM: FlowiseAI has Mass Assignment in Chatflow Update Endpoint that Allows Cross-Workspace AgentFlow Reassignment vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.1...
CVE-2026-7466
AgentFlow contains an arbitrary code execution vulnerability that allows attackers to execute local Python pipeline files by supplying a user-controlled pipelinepath parameter to the POST /api/runs and POST /api/runs/validate endpoints. Attackers can induce requests to the local AgentFlow API to...
CVE-2026-7439
AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing attackers to bypass trust-boundary enforcement on sensitive operations. Attackers can exploit this content-type validation...
CVE-2026-7466 AgentFlow Arbitrary Python Pipeline Execution via pipeline_path
AgentFlow contains an arbitrary code execution vulnerability that allows attackers to execute local Python pipeline files by supplying a user-controlled pipelinepath parameter to the POST /api/runs and POST /api/runs/validate endpoints. Attackers can induce requests to the local AgentFlow API to...
EUVD-2026-26279
AgentFlow contains an arbitrary code execution vulnerability that allows attackers to execute local Python pipeline files by supplying a user-controlled pipelinepath parameter to the POST /api/runs and POST /api/runs/validate endpoints. Attackers can induce requests to the local AgentFlow API to...
CVE-2026-7466 AgentFlow Arbitrary Python Pipeline Execution via pipeline_path
AgentFlow contains an arbitrary code execution vulnerability that allows attackers to execute local Python pipeline files by supplying a user-controlled pipelinepath parameter to the POST /api/runs and POST /api/runs/validate endpoints. Attackers can induce requests to the local AgentFlow API to...
CVE-2026-7466
AgentFlow contains an arbitrary code execution vulnerability: an attacker can supply a user-controlled pipeline_path to POST /api/runs or POST /api/runs/validate, causing the API to load and execute existing Python pipeline files on disk in the context of the user running AgentFlow. The underlyin...
EUVD-2026-26278
AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing attackers to bypass trust-boundary enforcement on sensitive operations. Attackers can exploit this content-type validation...
CVE-2026-7439
CVE-2026-7439: AgentFlow local web API content-type validation bypass. The vulnerability affects AgentFlow’s local web API, where non-JSON content types are accepted on POST /api/runs and POST /api/runs/validate without enforcing application/json, enabling bypass of trust-boundary enforcement for...
CVE-2026-7439 AgentFlow Local Web API Content-Type Validation Bypass
AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing attackers to bypass trust-boundary enforcement on sensitive operations. Attackers can exploit this content-type validation...
CVE-2026-7439 AgentFlow Local Web API Content-Type Validation Bypass
AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing attackers to bypass trust-boundary enforcement on sensitive operations. Attackers can exploit this content-type validation...
CVE-2026-7439 AgentFlow Local Web API Content-Type Validation Bypass
AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing attackers to bypass trust-boundary enforcement on sensitive operations. Attackers can exploit this content-type validation...
AgentFlow 代码注入漏洞
AgentFlow is an open-source multi-agent orchestration and dependency graph execution tool developed by Bera Buddies. AgentFlow has a code injection vulnerability, which stems from allowing attackers to execute local Python scripts by providing user-controlled pipelinepath parameters through POST...
AgentFlow 访问控制错误漏洞
AgentFlow is an open-source multi-agent orchestration and dependency graph execution tool developed by Bera Buddies. There is a security vulnerability in AgentFlow related to access control. This vulnerability stems from the local Web API accepting non-JSON content types at the POST /api/runs and...
PT-2026-35970
Name of the Vulnerable Software and Affected Versions AgentFlow affected versions not specified Description The local web API fails to enforce application/json validation for non-JSON content types on the 'POST /api/runs' and 'POST /api/runs/validate' endpoints. This allows attackers to bypass...