PYSEC-2026-3500 PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation

Summary The multiedit tool in src/praisonai/praisonai/tools/multiedit.py allows LLM-controlled arbitrary file read and write without any path validation, workspace boundary check, or protected path guard. This enables an attacker who can influence agent tool arguments via crafted prompts, user...

PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation

Summary The multiedit tool in src/praisonai/praisonai/tools/multiedit.py allows LLM-controlled arbitrary file read and write without any path validation, workspace boundary check, or protected path guard. This enables an attacker who can influence agent tool arguments via crafted prompts, user...

Gforge <= 4.6 rc1 (skill_edit) SQL Injection Vulnerability

Exploit for unknown platform in category web applications ========================================================== Gforge = 4.6 rc1 skilledit SQL Injection Vulnerability ========================================================== Gforge = 4.6 rc1 skilledit SQL injection Vendor Notified: 2008-10-...