Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

SummaryBefore Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to reach the MCP server settings "Settings → MCP Servers → Add MCP Server",...

Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method

Summaryhydra-optuna-sweeper accepted a configuration-controlled dotted path inhydra.sweeper.customsearchspace, resolved it with the lower-levelhydra.utils.getmethod API, and later invoked the returned callable.Hydra's object-lookup helpers intentionally trust their input and do not applythe...

PYSEC-2026-4239 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Summary Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to reach the MCP server settings "Settings → MCP Servers → Add MCP Server",...

PYSEC-2026-4237 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Summary Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to reach the MCP server settings "Settings → MCP Servers → Add MCP Server",...

PYSEC-2026-4241 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Summary Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to reach the MCP server settings "Settings → MCP Servers → Add MCP Server",...

Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

SummaryBefore Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to reach the MCP server settings "Settings → MCP Servers → Add MCP Server",...

PYSEC-2026-4224 Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method

Summary hydra-optuna-sweeper accepted a configuration-controlled dotted path in hydra.sweeper.customsearchspace, resolved it with the lower-level hydra.utils.getmethod API, and later invoked the returned callable. Hydra's object-lookup helpers intentionally trust their input and do not apply the...

PYSEC-2026-4222 Hydra: Mutable instantiate policy sets allow target blocklist bypass

Summary Hydra's legacy instantiate target blocklists and related execution-policy collections are stored in mutable module-level state. Because locate can resolve attributes on imported objects, a configuration can resolve a mutation method such as .discard, modify the active policy, and then...

Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

SummaryBefore Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to reach the MCP server settings "Settings → MCP Servers → Add MCP Server",...

PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation

SummaryThe deploy/api.py module generates Python server code by directly interpolating the agentsfile parameter into an f-string that is then written to a file and executed via subprocess.Popen. An attacker who controls the agentsfile value via CLI argument, configuration, or upstream API can...

Twisted: IMAP wildcardToRegexp() ReDoS

SummarywildcardToRegexp in twisted/mail/imap4.py converts IMAP LIST/LSUB wildcard patterns to Python regular expressions. It substitutes the two IMAP wildcards → ?:.? and % → ?:?:^\/? but passes every other character through unchanged to re.compile. This means that an authenticated IMAP client...

PYSEC-2026-4256 PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation

Summary The deploy/api.py module generates Python server code by directly interpolating the agentsfile parameter into an f-string that is then written to a file and executed via subprocess.Popen. An attacker who controls the agentsfile value via CLI argument, configuration, or upstream API can...

PYSEC-2026-4304 Twisted: IMAP wildcardToRegexp() ReDoS

Summary wildcardToRegexp in twisted/mail/imap4.py converts IMAP LIST/LSUB wildcard patterns to Python regular expressions. It substitutes the two IMAP wildcards → ?:.? and % → ?:?:^\/? but passes every other character through unchanged to re.compile. This means that an authenticated IMAP client...

PYSEC-2026-4232 Langflow: Prompt injection in Langflow Smart Transform can lead to code execution

Summary Langflow versions 1.3.0 through 1.10.2 contain a code-injection vulnerability in the Smart Transform LambdaFilterComponent component. Smart Transform places flow-author instructions and a preview of its input data into a prompt asking an LLM to generate a Python lambda. It then extracts a...

PYSEC-2026-4220 Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

Summary The Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious...

PYSEC-2026-4219 GPT Researcher MCP STDIO configuration allows remote command execution

An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a crafted HTML page...

Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

SummaryThe Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious...

GPT Researcher MCP STDIO configuration allows remote command execution

An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a crafted HTML page...

Struts2Shell

Struts2Shell An exploit and library for CVE-2017-5638 - Apache Struts2 S2-045 bug. Installation $ npm install -g struts2shell Installation as Library $ npm install struts2shell Command Line Options -h, --help output usage information -V, --version output the version number -u, --url target URL to...

teamcity-exploit-cve-2023-42793

TeamCity Exploit Cve 2023 42793 A quick script to exploit the cve-2023-42793 bug. Some additional reading on the exploit can be found here: https://www.fortinet.com/blog/threat-research/teamcity-intrusion-saga-apt29-suspected-exploiting-cve-2023-42793​...