Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)

SummaryWhen an application using Pydantic AI opts a URL into forcedownload='allow-local' which disables the default block on private/internal IPs, the cloud-metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form IPv4-mapped IPv6, 6to4, or NAT64. Dual-stack and...

Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)

SummaryWhen an application using Pydantic AI opts a URL into forcedownload='allow-local' which disables the default block on private/internal IPs, the cloud-metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form IPv4-mapped IPv6, 6to4, or NAT64. Dual-stack and...

FlaskBB: SSRF in get_image_info() via unrestricted avatar URL

SummaryA Server-Side Request Forgery SSRF vulnerability in getimageinfo allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata services e.g., AWS 169.254.169.254. This is a blind SSRF with confirmed internal port scanning...

PYSEC-2026-2479 FlaskBB: SSRF in get_image_info() via unrestricted avatar URL

Summary A Server-Side Request Forgery SSRF vulnerability in getimageinfo allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata services e.g., AWS 169.254.169.254. This is a blind SSRF with confirmed internal port scanning...

PYSEC-2026-3396 utcp-http vulnerable to SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol

Summary The utcp-http plugin is vulnerable to a blind Server-Side Request Forgery SSRF caused by a trust-boundary inconsistency between manual discovery and tool invocation. registermanual validates the discovery URL against an HTTPS / loopback allowlist, but calltool and calltoolstreaming reuse...

apache-airflow-providers-microsoft-azure (>=11.0.0rc1, <=12.2.2), apimarket (>=3.2.0, <=3.3.1) +6 more potentially affected by CVE-2026-44503 via microsoft-kiota-http (>=1.3.1, <=1.9.2)

microsoft-kiota-http PYPI version =1.3.1, =11.0.0rc1, =3.2.0, =1.0.0, =1.5.0, =3.16.1, =3.16.1, =1.2.0, =1.5.0 Source cves: CVE-2026-44503 Source advisory: OSV:PYSEC-2026-2647...

PYSEC-2026-2607 LMDeploy has Server-Side Request Forgery (SSRF) via Vision-Language Image Loading

Summary A Server-Side Request Forgery SSRF vulnerability exists in LMDeploy's vision-language module. The loadimage function in lmdeploy/vl/utils.py fetches arbitrary URLs without validating internal/private IP addresses, allowing attackers to access cloud metadata services, internal networks, an...

LMDeploy has Server-Side Request Forgery (SSRF) via Vision-Language Image Loading

SummaryA Server-Side Request Forgery SSRF vulnerability exists in LMDeploy's vision-language module. The loadimage function in lmdeploy/vl/utils.py fetches arbitrary URLs without validating internal/private IP addresses, allowing attackers to access cloud metadata services, internal networks, and...

PYSEC-2026-2329 AgentScope vulnerable to Server-Side Request Forgery

A vulnerability was identified in modelscope agentscope up to 1.0.18. Affected by this issue is the function parseurl/prepareimage/openaiaudiototext of the file src/agentscope/tool/multimodality/openaitools.py of the component Cloud Metadata Endpoint. Such manipulation of the argument...

AgentScope vulnerable to Server-Side Request Forgery

A vulnerability was identified in modelscope agentscope up to 1.0.18. Affected by this issue is the function parseurl/prepareimage/openaiaudiototext of the file src/agentscope/tool/multimodality/openaitools.py of the component Cloud Metadata Endpoint. Such manipulation of the argument...

dagit (0.12.5), dagster-airflow (0.12.5) +28 more potentially affected by CVE-2026-41490 via dagster (0.12.5)

dagster PYPI version 0.12.5 is affected by a known vulnerability. The following packages have a transitive dependency on dagster and may be impacted: - dagit 0.12.5 - dagster-airflow 0.12.5 - dagster-aws 0.12.5 - dagster-azure 0.12.5 - dagster-cloud 0.12.5 - dagster-dask 0.12.5 - dagster-databric...

dagit (0.11.15rc0), dagster-airflow (0.11.15rc0) +29 more potentially affected by CVE-2026-41490 via dagster (0.11.15rc0)

dagster PYPI version 0.11.15rc0 is affected by a known vulnerability. The following packages have a transitive dependency on dagster and may be impacted: - dagit 0.11.15rc0 - dagster-airflow 0.11.15rc0 - dagster-aws 0.11.15rc0 - dagster-azure 0.11.15rc0 - dagster-cloud 0.11.15rc0 - dagster-cron...

dagit (0.12.7rc0), dagster-airflow (0.12.7rc0) +28 more potentially affected by CVE-2026-41490 via dagster (0.12.7rc0)

dagster PYPI version 0.12.7rc0 is affected by a known vulnerability. The following packages have a transitive dependency on dagster and may be impacted: - dagit 0.12.7rc0 - dagster-airflow 0.12.7rc0 - dagster-aws 0.12.7rc0 - dagster-azure 0.12.7rc0 - dagster-cloud 0.12.7rc0 - dagster-dask 0.12.7r...

PYSEC-2026-2913 PraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars

Summary deploy.py constructs a single comma-delimited string for the gcloud run deploy --set-env-vars argument by directly interpolating openaimodel, openaikey, and openaibase without validating that these values do not contain commas. gcloud uses a comma as the key-value pair separator for...

PraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars

Summarydeploy.py constructs a single comma-delimited string for the gcloud rundeploy --set-env-vars argument by directly interpolating openaimodel,openaikey, and openaibase without validating that these values do notcontain commas. gcloud uses a comma as the key-value pair separator...

alibaba-cloud-application-management-mcp-server (>=0.1.0, <=1.0.4), alibaba-cloud-ops-mcp-server (>=0.9.2, <=0.9.27) +19 more potentially affected by CVE-2026-27124 via fastmcp (2.8.0)

fastmcp PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - alibaba-cloud-application-management-mcp-server =0.1.0, =0.9.2, =0.0.1, =0.2.2, =0.2.0, =2.0.5, =2.0.7, =2.0.7, =0.9.8, =2.0.0, =0.2.0, =0.3.0 and...

PYSEC-2026-2661 MLflow has a command injection in mlflow/sagemaker/__init__.py

A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the mlflow/sagemaker/init.py file at lines 161-167. The vulnerability arises from the direct interpolation of user-supplied container image names into shell commands without proper sanitization, whic...

airflow-provider-huawei-cloud-demo (>=0.0.9, <=0.0.23) potentially affected by CVE-2025-69219 via apache-airflow-providers-http (5.2.1)

apache-airflow-providers-http PYPI version 5.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-http and may be impacted: - airflow-provider-huawei-cloud-demo =0.0.9, =0.0.23 Source cves: CVE-2025-69219 Source advisory:...

adkgc (0.0.1), agent-starter-pack (>=0.1.0, <=0.5.1) +78 more potentially affected by CVE-2026-2473 via google-cloud-aiplatform (>=1.35.0, <=1.130.0)

google-cloud-aiplatform PYPI version =1.35.0, =0.1.0, =0.1.0, =0.1.3, =2.3.1, =0.2.9b1, =0.8.70, =0.0.1, =1.0.11, =0.1.0, =6.4.0rc2, =0.1.23, =0.1.17, =1.0.0, =2025.7.6 and more Source cves: CVE-2026-2473 Source advisory: OSV:PYSEC-2026-2500...

Google Cloud Vertex AI SDK affected by Stored Cross-Site Scripting (XSS)

Stored Cross-Site Scripting XSS in the genai/evalsvisualization component of Google Cloud Vertex AI SDK google-cloud-aiplatform versions from 1.98.0 up to but not including 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment...