PYSEC-2026-4311 WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE

Summary This was found during a pentest, funded by the NLNnet foundation, conducted by Stefan Vink from Radically Open Security and the only High issue found. WeasyPrint passes fetched image bytes directly to Pillow's generic format dispatcher without restricting the input format. When Ghostscrip...

PYSEC-2026-4238 Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

Summary Before Langflow 1.10.1, two deprecated but still-routed endpoints in the chat API did not check that the authenticated caller owns the flow referenced in the URL path: - POST /api/v1/build/flowid/vertices retrieveverticesorder - POST /api/v1/build/flowid/vertices/vertexid buildvertex Any...

PYSEC-2026-4239 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Summary Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to reach the MCP server settings "Settings → MCP Servers → Add MCP Server",...

Hydra: Mutable instantiate policy sets allow target blocklist bypass

SummaryHydra's legacy instantiate target blocklists and related execution-policycollections are stored in mutable module-level state. Because locate canresolve attributes on imported objects, a configuration can resolve a mutationmethod such as .discard, modify the active policy, and then...

Hydra logging configuration permits unsafe callable resolution

SummaryHydra passed its Python logging configuration to logging.config.dictConfig. Python's logging configurator can resolve and invoke importable classes and factories named by configuration, including handler class values and formatter, filter, handler, queue, and listener factories.This loggin...

Hydra instantiate target blacklist bypasses permit code execution

SummaryHydra's instantiate API resolves and invokes Python callables named by the target field in configuration. The target blacklist introduced for CVE-2026-68508 was incomplete.Representative bypasses included execution wrappers such as timeit.timeit, executable deserialization through...

PYSEC-2026-4223 Hydra instantiate target blacklist bypasses permit code execution

Summary Hydra's instantiate API resolves and invokes Python callables named by the target field in configuration. The target blacklist introduced for CVE-2026-68508 was incomplete. Representative bypasses included execution wrappers such as timeit.timeit, executable deserialization through...

PYSEC-2026-4229 Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write

Description: Summary An IP spoofing vulnerability in the Model Context Protocol MCP configuration installation endpoint POST /api/v1/mcp/project/projectid/install allowed authenticated remote attackers to bypass the "local-only" access restriction. By sending a spoofed X-Forwarded-For: 127.0.0.1...

PYSEC-2026-4304 Twisted: IMAP wildcardToRegexp() ReDoS

Summary wildcardToRegexp in twisted/mail/imap4.py converts IMAP LIST/LSUB wildcard patterns to Python regular expressions. It substitutes the two IMAP wildcards → ?:.? and % → ?:?:^\/? but passes every other character through unchanged to re.compile. This means that an authenticated IMAP client...

PYSEC-2026-4252 PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents

AgentMail webhook mode accepts forged unsigned message.received events and invokes agents Summary praisonai AgentMail webhook mode exposes a public aiohttp webhook endpoint that accepts caller-controlled message.received JSON without verifying AgentMail's Svix webhook signatures, then dispatches...

PYSEC-2026-4263 PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues

Platform members can delete owner issue dependencies through member-owned related issues Summary praisonai-platform issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but...

PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues

Platform members can delete owner issue dependencies through member-owned related issues Summarypraisonai-platform issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but c...

Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write

Description: SummaryAn IP spoofing vulnerability in the Model Context Protocol MCP configuration installation endpoint POST /api/v1/mcp/project/projectid/install allowed authenticated remote attackers to bypass the "local-only" access restriction. By sending a spoofed X-Forwarded-For: 127.0.0.1...

PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents

AgentMail webhook mode accepts forged unsigned message.received events and invokes agents Summarypraisonai AgentMail webhook mode exposes a public aiohttp webhook endpoint that accepts caller-controlled message.received JSON without verifying AgentMail's Svix webhook signatures, then dispatches t...

Twisted: IMAP wildcardToRegexp() ReDoS

SummarywildcardToRegexp in twisted/mail/imap4.py converts IMAP LIST/LSUB wildcard patterns to Python regular expressions. It substitutes the two IMAP wildcards → ?:.? and % → ?:?:^\/? but passes every other character through unchanged to re.compile. This means that an authenticated IMAP client...

PyMongo: PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encoding

An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch...

Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation

SummaryLangflow's built-in Python interpreter components — PythonREPLComponent Python Interpreter and the legacy PythonREPLToolComponent Python REPL Tool — executed arbitrary user- or model-supplied Python code inside flows without effective sandboxing. Because the code ran in-process with the...

PYSEC-2026-4312 Werkzeug safe_join() allows Windows special device names

Werkzeug's safejoin function allows Windows device names as filenames when they have an empty ADS marker on NTFS. This was previously reported as https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact Windows allows...

PYSEC-2026-4296 PyMongo: PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encoding

An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch...

Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)

SummaryWhen docling detects the input format of a gzip-compressed tar archive METS-GBS, and later when the METS-GBS backend opens it, it calls tarfile.TarFile.getmembers. That builds the full member list in memory before the maxmembercount limit is checked. A small archive with a very large numbe...