PT-2026-71875

Name of the Vulnerable Software and Affected Versions AgenticSeek version fc242c7 Description An unauthenticated remote code execution issue exists that allows network-adjacent attackers to execute arbitrary commands. By submitting crafted queries to the unprotected 'POST /query' API endpoint, an...

PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution

Summaryrunpython in praisonai constructs a shell command string by interpolating user-controlled code into python3 -c "" and passing it to subprocess.run..., shell=True. The escaping logic only handles \ and ", leaving $ and backtick substitutions unescaped, allowing arbitrary OS command executio...