PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source

API deploy code generator embeds unescaped YAML fields into Python source SummaryPraisonAI's API deployment generator copies deploy.api.host from agents.yaml directly into generated Python source without safe literal encoding. A malicious PraisonAI project can set that host value to a Python...

PYSEC-2026-4251 PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source

API deploy code generator embeds unescaped YAML fields into Python source Summary PraisonAI's API deployment generator copies deploy.api.host from agents.yaml directly into generated Python source without safe literal encoding. A malicious PraisonAI project can set that host value to a Python...

GHSA-79FV-7HQ9-W7XG PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source

API deploy code generator embeds unescaped YAML fields into Python source Summary PraisonAI's API deployment generator copies deploy.api.host from agents.yaml directly into generated Python source without safe literal encoding. A malicious PraisonAI project can set that host value to a Python...

PT-2026-108711

Name of the Vulnerable Software and Affected Versions praisonai versions 4.5.128 through 4.6.63 Description The API deployment generator in PraisonAI improperly embeds configuration values from agents.yaml directly into generated Python source code without safe encoding. This allows a malicious...

GHSA-QPQ9-HWX9-CWGC Duplicate Advisory: PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-79fv-7hq9-w7xg. This link is maintained to preserve external references. Original Description PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for...

CVE-2026-34926

A directory traversal vulnerability in the Apex One on-premise server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. This vulnerability is only exploitable on the on-premise version of Apex...

EUVD-2022-51390

Malicious code in bioql PyPI...

Improper Authorization

gitlab is vulnerable to Improper Authorization. An attacker could exploit this vulnerability to update the status of an external status check to "success", even if the check has failed. This could cause GitLab to deploy code or release a package that is not ready, which could lead to security...