Malicious code in py-wormgpt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6f7fef8f962798019886211ac43e0e0660feae94e4396fc7969643400b2fa139 The package installs a persistent job that allows the attacker for exfiltrating files and executing remote code on the victim's machine. --- Category: MALICIOU...

Shiny for Python has path traversal in bookmark restore

ImpactShiny for Python's bookmark-restore path accepted a client-supplied stateidquery-string value and joined it into the server-side bookmark directory/shinybookmarks/ without validating it. A value containing ..path segments, or an absolute path, could therefore cause the server to open andpar...

Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry

SummaryIn banks.registries.DirectoryPromptRegistry, prompt file paths and the index file index.json do not refuse symbolic links. When a prompt directory contains or accepts untrusted files e.g. unpacked archives, shared repositories, or multi-tenant folders, symbolic links pointing outside the...

PYSEC-2026-4201 Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry

Summary In banks.registries.DirectoryPromptRegistry, prompt file paths and the index file index.json do not refuse symbolic links. When a prompt directory contains or accepts untrusted files e.g. unpacked archives, shared repositories, or multi-tenant folders, symbolic links pointing outside the...

PYSEC-2026-4293 pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination

Description: The API rpc function in apiblueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read. This occurs before the data is sent to the underlying function. Since there is no size limit set at this point, a large file uploa...

PYSEC-2026-4253 PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls

Summary The AICoder UI component exposes writetofile and executecommand tools to the LLM with no path validation and no command sanitization. An attacker can achieve arbitrary file write to any location on the filesystem including /root/.ssh/authorizedkeys, /etc/crontab and arbitrary command...

PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls

SummaryThe AICoder UI component exposes writetofile and executecommand tools to the LLM with no path validation and no command sanitization. An attacker can achieve arbitrary file write to any location on the filesystem including /root/.ssh/authorizedkeys, /etc/crontab and arbitrary command...

PraisonAI: Project custom command templates can read outside-workspace files into model prompts

Project custom command templates can read outside-workspace files into model prompts SummaryPraisonAI's new file-based custom command feature auto-discovers project commands from .praisonai/commands/.md. When a user runs praisonai run --command inside a repository, the command body is interpolate...

PYSEC-2026-4205 datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

Summary When processing an attacker-controlled Protobuf schema, vulnerable versions of datamodel-code-generator could write a generated weak-import stub outside the intended weakimports temporary directory. Absolute import paths and relative paths containing .. could escape this directory. An...

PYSEC-2026-4261 PraisonAI: Project custom command templates can read outside-workspace files into model prompts

Project custom command templates can read outside-workspace files into model prompts Summary PraisonAI's new file-based custom command feature auto-discovers project commands from .praisonai/commands/.md. When a user runs praisonai run --command inside a repository, the command body is interpolat...

datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

SummaryWhen processing an attacker-controlled Protobuf schema, vulnerable versions ofdatamodel-code-generator could write a generated weak-import stub outside theintended weakimports temporary directory. Absolute import paths and relativepaths containing .. could escape this directory.An attacker...

PYSEC-2026-4268 PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace

FastContext path resolution permits absolute and traversal reads outside the workspace Summary PraisonAI's praisonaiagents.context.fast FastContext feature treats workspacepath as the root directory for code search, but its model-facing search tools and high-level readcontext helper accept absolu...

PYSEC-2026-4273 PraisonAI: Project config can auto-save agent output outside the project root

Project config can auto-save agent output outside the project root Summary praisonaiagents automatically reads project-local .praisonai/config.toml defaults when constructing an Agent. A repository-controlled config can set defaults.output.outputfile to an absolute path or a .. traversal path. Wh...

Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine

SummaryWhen the LaTeX backend is configured to render TikZ pictures with the Tectonic engine LatexBackendOptionstikzengine="tectonic", the TikZ body and the document preamble from the input file are compiled by Tectonic without any restriction on TeX's file primitives. A crafted .tex file can rea...

PraisonAI: Project config can auto-save agent output outside the project root

Project config can auto-save agent output outside the project root Summarypraisonaiagents automatically reads project-local .praisonai/config.toml defaults when constructing an Agent. A repository-controlled config can set defaults.output.outputfile to an absolute path or a .. traversal path. Whe...

PYSEC-2026-4208 Docling: Crafted DoclingDocument JSON embeds local image files into converted output

Summary docling accepts serialized DoclingDocument JSON as an input format InputFormat.JSONDOCLING, enabled by default. A crafted JSON file can set a picture's image uri to a local file path. When the converted document is exported with embedded images ImageRefMode.EMBEDDED, the CLI default for...

PYSEC-2026-4213 Docling: Crafted DoclingDocument JSON embeds local image files into converted output

Summary docling accepts serialized DoclingDocument JSON as an input format InputFormat.JSONDOCLING, enabled by default. A crafted JSON file can set a picture's image uri to a local file path. When the converted document is exported with embedded images ImageRefMode.EMBEDDED, the CLI default for...

PYSEC-2026-4216 Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine

Summary When the LaTeX backend is configured to render TikZ pictures with the Tectonic engine LatexBackendOptionstikzengine="tectonic", the TikZ body and the document preamble from the input file are compiled by Tectonic without any restriction on TeX's file primitives. A crafted .tex file can re...

PYSEC-2026-4230 Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers

Summary Langflow's project-scoped MCP transport authenticates the caller for the projectid in the connection URL, but the subsequent resources/read operation does not authorize the resource URI being requested. An authenticated user can connect to their own project-scoped MCP endpoint and supply ...

Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers

SummaryLangflow's project-scoped MCP transport authenticates the caller for the projectid in the connection URL, but the subsequent resources/read operation does not authorize the resource URI being requested. An authenticated user can connect to their own project-scoped MCP endpoint and supply a...