enject

enject Hide .env secrets from prAIng eyes. Note: this project was previously called enveil and has been renamed to enject AI coding tools like Claude Code, Copilot, Cursor, and others can read files in your project directory, which means a plaintext .env file is an accidental secret dump waiting ...

PIL-CVE-2017-8291

Python PIL Remote Command Execution Vulnerability GhostButt The PIL Pillow module for processing images in Python is affected by the GhostButt vulnerability CVE-2017-8291 because it calls GhostScript internally, resulting in a remote command execution vulnerability. Vulnerability Summary PIL...

agentsh

agentsh macOS note: Native macOS enforcement via ESF Endpoint Security Framework + NE Network Extension is in Alpha. It works end-to-end — file, process, and network events flow through the system extension to the Go policy engine — but expect rough edges and breaking changes between releases. Fo...

reNgine 2.2.0 - Command Injection

reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/wafdetector/?url= string. The commands are executed as root via subprocess.checkoutput. id: CVE-2023-50094 info: name: reNgine 2.2.0 - Command Injection...

CVE-2024-29973

CVE-2024-29973 GET /cmd,/simZysh/registermain/setCookie?c0=storageextcgi+CGIGetExtStoInfo+None+and+False+or+import"subprocess".checkoutput"id",+shell=True%23 HTTP/1.1 Host: xxxx User-Agent: Mozilla/5.0 X11; Linux x8664; rv:109.0 Gecko/20100101 Firefox/115.0 Accept: / Accept-Language: en-US,en;q=0...

CVE-2026-67543 Heym Unsandboxed skill code execution: skills run via a local backend subprocess without the Docker isolation that Python tools mandate

Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, heym hardens one untrusted-code path but not its sibling. The Python tool executor pythontoolexecutor.py treats user code as untrusted and mandates a Docker sandbox no...

CVE-2026-67543

Prior to version 0.0.70 , the heym platform suffered from insufficient isolation for untrusted code. While the python_tool_executor.py component correctly mandates a Docker sandbox, the sibling component, skill_python_executor.py, executes skill Python via a local backend subprocess without Docke...

CVE-2026-67543 Heym Unsandboxed skill code execution: skills run via a local backend subprocess without the Docker isolation that Python tools mandate

Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, heym hardens one untrusted-code path but not its sibling. The Python tool executor pythontoolexecutor.py treats user code as untrusted and mandates a Docker sandbox no...

EUVD-2026-124044

Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, heym hardens one untrusted-code path but not its sibling. The Python tool executor pythontoolexecutor.py treats user code as untrusted and mandates a Docker sandbox no...

StegCracker

StegCracker Steganography brute-force utility to uncover hidden data inside files. Looking for the Docker repository? You can find it here Deprecation Stop wasting time and CPU, use stegseek instead! Not convinced? Look at these benchmarks stolen with love: password| Line| Stegseek v0.4|...

PT-2026-145530

Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, heym hardens one untrusted-code path but not its sibling. The Python tool executor python tool executor.py treats user code as untrusted and mandates a Docker sandbox no...

CVE-2024-12970

CVE-2024-12970 CVE-2024-12970 describes an OS Command Injection vulnerability found in the My Computer software of the Pardus operating system. This vulnerability allows a user to inject system commands through the file name parameter, thus enabling an attacker to execute malicious commands on th...

CVE-2026-123783

Skyvern through 1.0.56 contains a sandbox bypass vulnerability that allows authenticated users to execute code by reconstructing functions from raw bytecode with types.CodeType. Attackers can deploy scripts that evade the issafescriptcode AST denylist and import blocked modules such as subprocess...

EUVD-2026-118301

Skyvern through 1.0.56 contains a sandbox bypass vulnerability that allows authenticated users to execute code by reconstructing functions from raw bytecode with types.CodeType. Attackers can deploy scripts that evade the issafescriptcode AST denylist and import blocked modules such as subprocess...

Command Injection

Overview autogen is an A programming framework for agentic AI Affected versions of this package are vulnerable to Command Injection via ShellAdapter.filter in ag2/tools/sandbox/adapter/shell.py and containsshelloperator in ag2/tools/sandbox/filter.py, which omit newline \n and carriage-return \r...

Command Injection

Overview ag2 is an A programming framework for agentic AI Affected versions of this package are vulnerable to Command Injection via ShellAdapter.filter in ag2/tools/sandbox/adapter/shell.py and containsshelloperator in ag2/tools/sandbox/filter.py, which omit newline \n and carriage-return \r...

CVE-2026-123783: Skyvern-AI skyvern: Skyvern through 1.0.56 contains a sandbox bypass vulnerability that allows authenticated users to execute code by…

Skyvern through 1.0.56 contains a sandbox bypass vulnerability that allows authenticated users to execute code by reconstructing functions from raw bytecode with types.CodeType. Attackers can deploy scripts that evade the issafescriptcode AST denylist and import blocked modules such as subprocess...

CVE-2026-113663

AG2 is an open-source AgentOS. From 0.13.2 until ag2 1.1.1, and from autogen 0.13.2 to 0.14.1, SandboxShellTool configurations using allowed=... or readonly=True rely on ShellAdapter.filter and containsshelloperator in ag2/tools/sandbox/filter.py and ag2/tools/sandbox/adapter/shell.py to validate...

CVE-2026-113663: ag2ai: AG2 is an open-source AgentOS

AG2 is an open-source AgentOS. From 0.13.2 until ag2 1.1.1, and from autogen 0.13.2 to 0.14.1, SandboxShellTool configurations using allowed=... or readonly=True rely on ShellAdapter.filter and containsshelloperator in ag2/tools/sandbox/filter.py and ag2/tools/sandbox/adapter/shell.py to validate...

Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge

Summary Multiple vulnerabilities were addressed in IBM watsonx Orchestrate with watsonx Assistant Cartridge version for the component wxo-server-server Vulnerability Details CVEID:CVE-2026-59822 DESCRIPTION: LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior t...