9 matches found
PYSEC-2026-4251 PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source
API deploy code generator embeds unescaped YAML fields into Python source Summary PraisonAI's API deployment generator copies deploy.api.host from agents.yaml directly into generated Python source without safe literal encoding. A malicious PraisonAI project can set that host value to a Python...
GHSA-79FV-7HQ9-W7XG PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source
API deploy code generator embeds unescaped YAML fields into Python source Summary PraisonAI's API deployment generator copies deploy.api.host from agents.yaml directly into generated Python source without safe literal encoding. A malicious PraisonAI project can set that host value to a Python...
PT-2026-108711
Name of the Vulnerable Software and Affected Versions praisonai versions 4.5.128 through 4.6.63 Description The API deployment generator in PraisonAI improperly embeds configuration values from agents.yaml directly into generated Python source code without safe encoding. This allows a malicious...
GHSA-QPQ9-HWX9-CWGC Duplicate Advisory: PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-79fv-7hq9-w7xg. This link is maintained to preserve external references. Original Description PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for...
CVE-2025-2855
A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7. Affected by this issue is the function checkFile of the file /api/deploy/upload. The manipulation of the argument servers leads to deserialization. The attack may be launched remotely...
PT-2025-13277
Name of the Vulnerable Software and Affected Versions elunez eladmin versions up to 2.7 Description A problematic issue has been found, affecting the function checkFile of the file "/api/deploy/upload". The manipulation of the argument servers leads to deserialization. This issue can be exploited...
CVE-2024-7458: Path Traversal: 'dir/../../filename'
A vulnerability was found in elunez eladmin up to 2.7 and classified as critical. This issue affects some unknown processing of the file /api/deploy/upload /api/database/upload of the component Database Management/Deployment Management. The manipulation of the argument file leads to path traversa...
