bug-free-memory

nate158 https://t.me/Nate158digimon gcloud compute addresses create google-managed-services-VPCNETWORKNAME --global --purpose=VPCPEERING --addresses=192.168.0.0 --prefix-length=16 --network=projects/PROJECTID/global/networks/VPCNETWORKNAME nate15872.wordpress.com...

GO-2023-1571 vulnerabilities

Vulnerabilities for packages: dynamic-localpv-provisioner, dynamic-localpv-provisioner-fips, terraform-provider-sendgrid, terraform-provider-sendgrid-fips, kubeflow-katib, gke-gcloud-auth-plugin, grpcurl, k3d, kubeflow-fips, restic, kube-state-metrics, wireguard-go, go, kubeflow, hey...

GO-2023-1571 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, terraform-provider-sendgrid, wireguard-go, dynamic-localpv-provisioner, restic, hey, k3d, kubeflow, grpcurl, gke-gcloud-auth-plugin, go...

PraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars

Summarydeploy.py constructs a single comma-delimited string for the gcloud rundeploy --set-env-vars argument by directly interpolating openaimodel,openaikey, and openaibase without validating that these values do notcontain commas. gcloud uses a comma as the key-value pair separator...

PT-2026-59547

Summary deploy.py constructs a single comma-delimited string for the gcloud run deploy --set-env-vars argument by directly interpolating openai model, openai key, and openai base without validating that these values do not contain commas. gcloud uses a comma as the key-value pair separator for...

EUVD-2026-37144

OpenClaw: Workspace .env CLOUDSDKPYTHON could influence Gmail setup gcloud execution...

OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution

Summary Workspace .env CLOUDSDKPYTHON could influence Gmail setup gcloud execution. In affected versions, a workspace .env in a repository opened by a trusted operator could influence which Python runtime gcloud used through CLOUDSDKPYTHON. This advisory is scoped to the named feature and...

NPM: OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution

NPM: OpenClaw: Workspace .env CLOUDSDKPYTHON could influence Gmail setup gcloud execution vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.2...

GHSA-9FR2-P65V-GQXQ Duplicate Advisory: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fq9j-vw4w-fr6v. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace .env files to...

CVE-2026-53842 OpenClaw < 2026.5.2 - Arbitrary Python Runtime Execution via CLOUDSDK_PYTHON Environment Variable

OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace .env files to influence Python runtime selection through CLOUDSDKPYTHON during Gmail setup gcloud execution. Attackers with repository access can manipulate the CLOUDSDKPYTHON variable to execute...

CVE-2026-40113

PraisonAI is a multi-agent teams system. Prior to 4.5.128, deploy.py constructs a single comma-delimited string for the gcloud run deploy --set-env-vars argument by directly interpolating openaimodel, openaikey, and openaibase without validating that these values do not contain commas. gcloud use...

MAL-2026-4789 Malicious code in ggk-happy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d747cc7acd8bbc1defbf475aa3202fd332fd43135a6fedddfcc37356ce02eb54 Package presents itself as the legitimate slopus/happy CLI README instructs npm install -g happy; homepage, repository, bugs, and author fields all...

CVE-2026-40113 PraisonAI has an Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars

PraisonAI is a multi-agent teams system. Prior to 4.5.128, deploy.py constructs a single comma-delimited string for the gcloud run deploy --set-env-vars argument by directly interpolating openaimodel, openaikey, and openaibase without validating that these values do not contain commas. gcloud use...

CVE-2026-40113

PraxionAI’s CVE-2026-40113 affects PraisonAI before version 4.5.128. The flaw arises in deploy.py, which builds a single comma-delimited string for gcloud run deploy --set-env-vars by directly interpolating openai_model, openai_key, and openai_base without validating for commas. Since gcloud uses...

CVE-2026-40113: Improper Neutralization of Argument Delimiters in a Command

PraisonAI is a multi-agent teams system. Prior to 4.5.128, deploy.py constructs a single comma-delimited string for the gcloud run deploy --set-env-vars argument by directly interpolating openaimodel, openaikey, and openaibase without validating that these values do not contain commas. gcloud use...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: configmap-reload, speedtest-go, aws-flb-cloudwatch, dive, dask-gateway, influx, aws-load-balancer-controller, cri-tools, kubebuilder, litefs, metrics-server, newrelic-infra-operator, temporal-ui-server, wait-for-port, kubeflow-katib, task, wireguard-go, yam,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: configmap-reload, speedtest-go, aws-flb-cloudwatch, dive, dask-gateway, influx, aws-load-balancer-controller, cri-tools, kubebuilder, litefs, metrics-server, newrelic-infra-operator, temporal-ui-server, wait-for-port, kubeflow-katib, task, wireguard-go, yam,...

Malicious PyPI Package Targets macOS to Steal Google Cloud Credentials

Cybersecurity researchers have discovered a malicious package on the Python Package Index PyPI repository that targets Apple macOS systems with the goal of stealing users' Google Cloud credentials from a narrow pool of victims. The package, named "lr-utils-lib," attracted a total of 59 downloads...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: configmap-reload, speedtest-go, aws-flb-cloudwatch, dive, dask-gateway, influx, aws-load-balancer-controller, cri-tools, kubebuilder, litefs, metrics-server, newrelic-infra-operator, temporal-ui-server, wait-for-port, kubeflow-katib, task, wireguard-go, yam,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: aactl, kubeflow, metrics-server, kubeflow-katib, wireguard-go, secrets-store-csi-driver, src, cortex, terraform-provider-sendgrid, kubescape, terraform-provider-aws, dgraph, flux-kustomize-controller, frp, pulumi-language-java, skaffold, rqlite, oauth2-proxy,...