PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace

FastContext path resolution permits absolute and traversal reads outside the workspace SummaryPraisonAI's praisonaiagents.context.fast FastContext feature treats workspacepath as the root directory for code search, but its model-facing search tools and high-level readcontext helper accept absolut...

PYSEC-2026-4267 PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow

Summary An unsafe dynamic module loading vulnerability allows an attacker who can control a workflow file and a sibling tools.py to execute arbitrary Python code when the workflow is executed. Details The vulnerability is located in the workflow structured output resolution logic. File:...

PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow

SummaryAn unsafe dynamic module loading vulnerability allows an attacker who can control a workflow file and a sibling tools.py to execute arbitrary Python code when the workflow is executed. DetailsThe vulnerability is located in the workflow structured output resolution logic.File:...

PYSEC-2026-4268 PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace

FastContext path resolution permits absolute and traversal reads outside the workspace Summary PraisonAI's praisonaiagents.context.fast FastContext feature treats workspacepath as the root directory for code search, but its model-facing search tools and high-level readcontext helper accept absolu...

PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure

SummaryPraisonAI's webcrawl agent tool performs a server-side HTTP fetch of an agent/attacker-influenced URL. SSRF is meant to be prevented by issafecrawlurl, which resolves the hostname and rejects private/loopback/link-local IPs at validation time. The validated value is the URL string not a...

Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine

SummaryWhen the LaTeX backend is configured to render TikZ pictures with the Tectonic engine LatexBackendOptionstikzengine="tectonic", the TikZ body and the document preamble from the input file are compiled by Tectonic without any restriction on TeX's file primitives. A crafted .tex file can rea...

PYSEC-2026-4272 PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure

Summary PraisonAI's webcrawl agent tool performs a server-side HTTP fetch of an agent/attacker-influenced URL. SSRF is meant to be prevented by issafecrawlurl, which resolves the hostname and rejects private/loopback/link-local IPs at validation time. The validated value is the URL string not a...

PYSEC-2026-4216 Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine

Summary When the LaTeX backend is configured to render TikZ pictures with the Tectonic engine LatexBackendOptionstikzengine="tectonic", the TikZ body and the document preamble from the input file are compiled by Tectonic without any restriction on TeX's file primitives. A crafted .tex file can re...

PYSEC-2026-4234 Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

Summary Before Langflow 1.10.1, two deprecated but still-routed endpoints in the chat API did not check that the authenticated caller owns the flow referenced in the URL path: - POST /api/v1/build/flowid/vertices retrieveverticesorder - POST /api/v1/build/flowid/vertices/vertexid buildvertex Any...

PYSEC-2026-4238 Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

Summary Before Langflow 1.10.1, two deprecated but still-routed endpoints in the chat API did not check that the authenticated caller owns the flow referenced in the URL path: - POST /api/v1/build/flowid/vertices retrieveverticesorder - POST /api/v1/build/flowid/vertices/vertexid buildvertex Any...

PYSEC-2026-4230 Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers

Summary Langflow's project-scoped MCP transport authenticates the caller for the projectid in the connection URL, but the subsequent resources/read operation does not authorize the resource URI being requested. An authenticated user can connect to their own project-scoped MCP endpoint and supply ...

Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers

SummaryLangflow's project-scoped MCP transport authenticates the caller for the projectid in the connection URL, but the subsequent resources/read operation does not authorize the resource URI being requested. An authenticated user can connect to their own project-scoped MCP endpoint and supply a...

PYSEC-2026-4315 wger: API credentials remain valid after logout/password change

Summary A vulnerability exists in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken Authorization: Token ... or JWT refresh token can continue ...

Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write

Description: SummaryAn IP spoofing vulnerability in the Model Context Protocol MCP configuration installation endpoint POST /api/v1/mcp/project/projectid/install allowed authenticated remote attackers to bypass the "local-only" access restriction. By sending a spoofed X-Forwarded-For: 127.0.0.1...

PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents

AgentMail webhook mode accepts forged unsigned message.received events and invokes agents Summarypraisonai AgentMail webhook mode exposes a public aiohttp webhook endpoint that accepts caller-controlled message.received JSON without verifying AgentMail's Svix webhook signatures, then dispatches t...

PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues

Platform members can delete owner issue dependencies through member-owned related issues Summarypraisonai-platform issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but c...

wger: API credentials remain valid after logout/password change

SummaryA vulnerability exists in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken Authorization: Token ... or JWT refresh token can continue t...

PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing

SummaryPraisonAI's AgentMail bot, when run in webhook or hybrid mode, starts an aiohttp webhook server bound to 0.0.0.0 and processes inbound message.received events without verifying any signature/HMAC and without authentication. The sender address and message body are taken directly from the...

PYSEC-2026-4263 PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues

Platform members can delete owner issue dependencies through member-owned related issues Summary praisonai-platform issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but...

PYSEC-2026-4314 wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

Summary An authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slotentry ID in a POST /api/v2/workoutlog/ request. The slotentry foreign key is not included in the ownership verification performed by...