Incorrect Authorization

Overview praisonai is a PraisonAI TypeScript AI Agents Framework - Node.js, npm, and Javascript AI Agents Framework Affected versions of this package are vulnerable to Incorrect Authorization via the SandboxExecutor process. An attacker can execute arbitrary shell commands with the privileges of...

GHSA-GQMF-56H7-RRPF npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients

Summary The published npm package praisonai exports a TypeScript SandboxExecutor with a network-isolated mode. The CLI lists that mode as: text network-isolated No network access proxy blocked The implementation does not create a network namespace, firewall rule, socket filter, or proxy-enforced...

npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients

Summary The published npm package praisonai exports a TypeScript SandboxExecutor with a network-isolated mode. The CLI lists that mode as: text network-isolated No network access proxy blocked The implementation does not create a network namespace, firewall rule, socket filter, or proxy-enforced...

PT-2026-53150

Summary The published npm package praisonai exports SandboxExecutor, CommandValidator, and sandboxExec as "safe command execution with restrictions." When allowedCommands is configured, CommandValidator checks only the first whitespace-delimited token of the command string. SandboxExecutor then...

PT-2026-53138

Summary The published npm package praisonai exports a TypeScript SandboxExecutor with a network-isolated mode. The CLI lists that mode as: text network-isolated No network access proxy blocked The implementation does not create a network namespace, firewall rule, socket filter, or proxy-enforced...

PT-2026-53034

Impact An authenticated user with permission to create or modify workflows containing a Python Code node could bypass the AST security validator and access the task executor module namespace. On self-hosted instances where N8N BLOCK RUNNER ENV ACCESS=false is set, this extended to disclosure of...

Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management via the podspec parameter in the Container Executor path. An attacker can gain elevated privileges and potentially escape the node by supplying a crafted podspec that is merged into the deployment process...

Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management via the podspec parameter in the Container Executor path. An attacker can gain elevated privileges and potentially escape the node by supplying a crafted podspec that is merged into the deployment process...

Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management via the podspec parameter in the Container Executor path. An attacker can gain elevated privileges and potentially escape the node by supplying a crafted podspec that is merged into the deployment process...

Execution with Unnecessary Privileges

Overview Affected versions of this package are vulnerable to Execution with Unnecessary Privileges via the Environment Runtime.Container and Builder.Container processes. An attacker can gain elevated privileges and execute arbitrary code with high-level access by creating or updating environments...

CVE-2026-50563 Fission Container Executor Function PodSpec Injection Leading to Node Escape

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's Container Executor path lets a tenant supply Function.spec.podspec directly; the executor merges it into the...

CVE-2026-50563 Fission Container Executor Function PodSpec Injection Leading to Node Escape

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's Container Executor path lets a tenant supply Function.spec.podspec directly; the executor merges it into the...

CVE-2026-50563

Fission before v1.24.0 allows a tenant to supply Function.spec.podspec, which is merged into the executor-built podspec and used to create a Deployment for the user’s container image. This directly explains the root cause of the listed vulnerability and aligns with the patched state in v1.24.0. T...

br.com.ingenieux.jenkins.plugins:awseb-deployment-plugin (>=0.1.0, <=0.3.5), org.jenkins-ci.main:jenkins-test-harness (1.625.2) +6 more potentially affected by CVE-2026-53435 via org.jenkins-ci.main:jenkins-core (1.625.2)

org.jenkins-ci.main:jenkins-core MAVEN version 1.625.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - br.com.ingenieux.jenkins.plugins:awseb-deployment-plugin =0.1.0, =1.0.1, =1.0.2 Source cves:...

br.com.ingenieux.jenkins.plugins:awseb-deployment-plugin (>=0.1.0, <=0.3.5), org.jenkins-ci.main:jenkins-test-harness (1.625.2) +6 more potentially affected by CVE-2026-53442 via org.jenkins-ci.main:jenkins-core (1.625.2)

org.jenkins-ci.main:jenkins-core MAVEN version 1.625.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - br.com.ingenieux.jenkins.plugins:awseb-deployment-plugin =0.1.0, =1.0.1, =1.0.2 Source cves:...

br.com.ingenieux.jenkins.plugins:awseb-deployment-plugin (>=0.1.0, <=0.3.5), org.jenkins-ci.main:jenkins-test-harness (1.625.2) +6 more potentially affected by CVE-2026-53439 via org.jenkins-ci.main:jenkins-core (1.625.2)

org.jenkins-ci.main:jenkins-core MAVEN version 1.625.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - br.com.ingenieux.jenkins.plugins:awseb-deployment-plugin =0.1.0, =1.0.1, =1.0.2 Source cves:...

Fission security vulnerabilities

Fission is an open-source function deployment framework based on Kubernetes. Versions of Fission prior to 1.24.0 contain security vulnerabilities. These vulnerabilities stem from the Container Executor’s path, which allows tenants to directly provide Function.spec.podspec. The executor merges thi...

CVE-2026-50563: Improper Privilege Management

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's Container Executor path lets a tenant supply Function.spec.podspec directly; the executor merges it into the...

com.cognifide.aet:cleaner (>=2.0.0-rc2, <=2.1.6), com.cognifide.aet:communication (>=2.0.0-rc2, <=2.1.6) +189 more potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (4.1.9.release)

org.springframework:spring-webmvc MAVEN version 4.1.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.cognifide.aet:cleaner =2.0.0-rc2, =2.0.0-rc2, =2.0.0-rc2, =2.0.0-rc2, =2.0.3-rc1,...

Malicious code in executor-http (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cde4da7201fbc0dd3ae09240232f5767c2893e33977d6c8ee9071d15e79f0363 The package ships executorhttp-setup.pth, which Python auto-loads at interpreter start for any environment where the package is installed. The.pth fi...