enject

enject Hide .env secrets from prAIng eyes. Note: this project was previously called enveil and has been renamed to enject AI coding tools like Claude Code, Copilot, Cursor, and others can read files in your project directory, which means a plaintext .env file is an accidental secret dump waiting ...

agentsh

agentsh macOS note: Native macOS enforcement via ESF Endpoint Security Framework + NE Network Extension is in Alpha. It works end-to-end — file, process, and network events flow through the system extension to the Go policy engine — but expect rough edges and breaking changes between releases. Fo...

PIL-CVE-2017-8291

Python PIL Remote Command Execution Vulnerability GhostButt The PIL Pillow module for processing images in Python is affected by the GhostButt vulnerability CVE-2017-8291 because it calls GhostScript internally, resulting in a remote command execution vulnerability. Vulnerability Summary PIL...

CVE-2024-29973

CVE-2024-29973 GET /cmd,/simZysh/registermain/setCookie?c0=storageextcgi+CGIGetExtStoInfo+None+and+False+or+import"subprocess".checkoutput"id",+shell=True%23 HTTP/1.1 Host: xxxx User-Agent: Mozilla/5.0 X11; Linux x8664; rv:109.0 Gecko/20100101 Firefox/115.0 Accept: / Accept-Language: en-US,en;q=0...

CVE-2026-115726

Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without a trust prompt. Attackers can set notifications-command or editor values that are executed via subprocess with shell=Tr...

CVE-2026-57144

The praisonai package (versions 4.5.110 through 4.6.58 ) is vulnerable to a Protection Mechanism Failure in its SandlockSandbox component. When the optional sandlock module is present but the host kernel lacks Landlock support, the execute() and run_command() functions fail open by silently falli...

CVE-2026-115726

The AI coding tool Aider (versions through 0.86.2) is vulnerable to command execution via the repository-level .aider.conf.yml file. The root cause is the automatic loading of this configuration file without a trust prompt. Attackers who can commit a malicious .aider.conf.yml can set notification...

CVE-2024-12970

CVE-2024-12970 CVE-2024-12970 describes an OS Command Injection vulnerability found in the My Computer software of the Pardus operating system. This vulnerability allows a user to inject system commands through the file name parameter, thus enabling an attacker to execute malicious commands on th...

reNgine 2.2.0 - Command Injection

reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/wafdetector/?url= string. The commands are executed as root via subprocess.checkoutput. id: CVE-2023-50094 info: name: reNgine 2.2.0 - Command Injection...

StegCracker

StegCracker Steganography brute-force utility to uncover hidden data inside files. Looking for the Docker repository? You can find it here Deprecation Stop wasting time and CPU, use stegseek instead! Not convinced? Look at these benchmarks stolen with love: password| Line| Stegseek v0.4|...

CVE-2026-77934

Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with import'subprocess' to run commands, stealing environment...

CVE-2026-77934 Coze Studio before 0.5.0 RCE via Unsandboxed Local Python Code Runner

Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with import'subprocess' to run commands, stealing environment...

CVE-2026-77934 Coze Studio before 0.5.0 RCE via Unsandboxed Local Python Code Runner

Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with import'subprocess' to run commands, stealing environment...

CVE-2026-77934

Coze Studio versions before 0.5.0 are affected by an insecure default configuration allowing registered users to perform Remote Code Execution (RCE) . The vulnerability exists because workflow code nodes run in an unsandboxed python3 subprocess , where attackers can bypass regex import filters us...

EUVD-2026-104690

Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with import'subprocess' to run commands, stealing environment...

PYSEC-2026-4250 PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend

Summary SecurityPolicy in praisonaiagents/sandbox/config.py is a documented configuration data class with fields for allowsubprocess, allowedpaths, blockedpaths, allowedcommands, blockedcommands, allowedimports, and blockedimports. Its strict classmethod is explicitly described as creating "a...

EUVD-2026-44636

PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend...

GHSA-2XV2-W8CQ-5GXW PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets

Summary CodeAgent.executepython executes LLM-generated Python code in a subprocess with the complete parent-process environment os.environ.copy, zero AST validation, zero import restrictions, and no sandbox enforcement — even when CodeConfigsandbox=True is explicitly set. This allows an attacker...

PT-2026-108714

Name of the Vulnerable Software and Affected Versions PraisonAI Agents affected versions not specified Description The Subprocess Sandbox backend fails to enforce security policies defined in the SecurityPolicy data class. Although the strict method is intended to create a restrictive environment...

PT-2026-105784

AnyIO 4.14.0 accepts the POSIX extra groups argument on anyio.run process and anyio.open process, but open process forwards the wrong variable to the backend: when extra groups is not None, it assigns kwargs"extra groups" = group instead of extra groups. As a result, callers cannot reliably clear...