287149 matches found
PYSEC-2026-3501 PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass
Unauthenticated Remote Code Execution via Jobs API and Approval Bypass in PraisonAI Summary An unauthenticated attacker can execute arbitrary OS commands on any server running the PraisonAI Jobs API by submitting a crafted workflow YAML. The attack chains two weaknesses: the /api/v1/runs endpoint...
PYSEC-2026-3513 praisonai: recipe serve auth middleware silently disables itself when no secret is set
praisonai: recipe serve authentication middleware silently disables itself when no secret is set Researcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security Research Target: https://github.com/MervinPraison/PraisonAI --- Package: praisonai on PyPI Version tested: 4.6.48...
PraisonAI recipe.run_stream skips dangerous-tool policy enforcement
PraisonAI recipe.runstream skips dangerous-tool policy enforcement SummaryPraisonAI recipe execution blocks default-denied dangerous tools unless thecaller explicitly passes allowdangeroustools=True. The normal recipe.runpath enforces this with checktoolpolicy. The streaming path,recipe.runstream...
PraisonAI: Compute-bridged file tools allow shell command injection
Compute-bridged file tools allow shell command injection SummaryLocalManagedAgent / SandboxedAgent compute bridging wrapsreadfile, listfiles, and writefile when a compute provider isattached. The bridge converts those file operations into shell command stringsusing raw path arguments, then sends...
PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal
PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal SummaryPraisonAI's Dynamic Context module provides filesystem-backed history andterminal-log storage. The SDK reference describes the module as providing:- artifact storage for tool...
PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard
PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard SummaryPraisonAI's installed console entrypoint is Typer-first. In current releases,the recipe command is registered in the Typer app andpraisonai recipe serve dispatches to the deprecated Typer command...
PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage
PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage SummaryPraisonAI's Dynamic Context Discovery feature exposes artifact helper toolsthrough ctx.gettools:pythonctx = setupdynamiccontextagent = Agent instructions="You are a data analyst.", tools=ctx.gettool...
PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools
HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools Summarypraisonai.bots.HTTPApproval renders pending tool approval arguments directlyinto the approval dashboard HTML. An attacker-controlled tool argument caninject JavaScript into that...
PYSEC-2026-3503 PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools
HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools Summary praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can inject JavaScript into...
PYSEC-2026-3514 PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage
PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage Summary PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ctx.gettools: python ctx = setupdynamiccontext agent = Agent instructions="You are a data analyst.",...
PYSEC-2026-3499 PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal
PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal Summary PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The SDK reference describes the module as providing: - artifact storage for tool...
PYSEC-2026-3520 PraisonAI recipe.run_stream skips dangerous-tool policy enforcement
PraisonAI recipe.runstream skips dangerous-tool policy enforcement Summary PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes allowdangeroustools=True. The normal recipe.run path enforces this with checktoolpolicy. The streaming path,...
PYSEC-2026-3522 PraisonAI: Compute-bridged file tools allow shell command injection
Compute-bridged file tools allow shell command injection Summary LocalManagedAgent / SandboxedAgent compute bridging wraps readfile, listfiles, and writefile when a compute provider is attached. The bridge converts those file operations into shell command strings using raw path arguments, then...
PYSEC-2026-3502 PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard
PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard Summary PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe serve dispatches to the deprecated Typer command in...
PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals
DiscordApproval accepts unrelated channel messages as dangerous-tool approvals Summarypraisonai.bots.DiscordApproval approves a pending dangerous tool call when itsees any later non-bot message in the configured Discord channel whose text isclassified as approval, such as yes.The decision is not...
ansible-core: Argument injection in ansible-galaxy role install leads to arbitrary code execution
A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field...
PYSEC-2026-3506 PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals
DiscordApproval accepts unrelated channel messages as dangerous-tool approvals Summary praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any later non-bot message in the configured Discord channel whose text is classified as approval, such as yes. The decision is...
PYSEC-2026-3458 ansible-core: Argument injection in ansible-galaxy role install leads to arbitrary code execution
A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field...
Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers
Cybersecurity researchers have shed light on a large-scale campaign that has turned compromised GitHub repositories into distributed attack infrastructure designed to target cPanel and WebHost Manager WHM instances. The activity involves malicious Packagist development versions spanning 10 packag...
