CVE-2026-81030: Improper Limitation of a Pathname to a Restricted Directory

Mage AI does not confine the paths accepted by its browser-items API to the project directory. BrowserItemResource in mageai/api/resources/BrowserItemResource.py passes a caller-supplied path to the filesystem read and write helpers without calling the containment helper that the sibling...

Remote Code Execution (RCE)

mageai is vulnerable to Remote Code Execution RCE. The vulnerability is due to inadequate account management that fails to properly revoke privileges and sessions of guest users after their accounts are deleted and allows them to execute arbitrary code through the Mage AI terminal server...