asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution

Incomplete fix for CVE-2026-45309 GHSA-g794-3fmp-753h. The 2.23.0 guard that sanitises the SSH username before %u substitution in AuthorizedKeysFile blocks /, \ and .., but does not block a leading or $ENV, both of which are re-introduced by later expansion and reach the file open — defeating the...

PYSEC-2026-3817 Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data

Impact A Server-Side Template Injection SSTI vulnerability exists in multiple locations of trestle's Jinja2 rendering pipeline due to a systemic pattern: untrusted data is re-parsed as Jinja2 template source code without sandboxing. This advisory tracks the root cause across all affected code...

PYSEC-2026-3919 senaite.core Vulnerable to Eval Injection and Missing Authorization

Summary An unauthenticated remote code execution vulnerability in the SENAITE JSON API allows any network-reachable attacker to execute arbitrary Python on the Zope worker process via a two-request anonymous chain. The /@@API/update route is reachable to anonymous callers and runs eval on...

djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls

Impactdjust's LiveViewConsumer mounts a LiveView over a WebSocket. When a view is gated loginrequired / permissionrequired, or an onmount hook that returns a redirect and the connecting user is not authorized, the consumer sent the client a "type":"navigate","to":... redirect frame and then...

PYSEC-2026-3832 eml_parser vulnerable to DoS via deeply nested parens in Received headers

Summary emlparser strips parenthesised CFWS comments from Received: headers using a regex-based fix-point loop. The loop has quadratic time complexity in the number of nested parens. A single Received: header containing 5,000 nested parens causes 1.3 seconds of CPU saturation per parsed message;...

Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access

Am I affected?Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. SummaryWhen MCP is...

eml_parser vulnerable to DoS via deeply nested parens in Received headers

Summaryemlparser strips parenthesised CFWS comments from Received: headers using a regex-based fix-point loop. The loop has quadratic time complexity in the number of nested parens. A single Received: header containing 5,000 nested parens causes 1.3 seconds of CPU saturation per parsed message;...

PYSEC-2026-3811 Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access

Am I affected? Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. Summary When MCP ...

nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )

SummaryThe POST /webhooks/nextcloud endpoint has no authentication by default: WEBHOOKSECRET defaults to None and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The userid is taken directly from the attacker-supplied payload and passed to Qdran...

PYSEC-2026-3866 nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )

Summary The POST /webhooks/nextcloud endpoint has no authentication by default: WEBHOOKSECRET defaults to None and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The userid is taken directly from the attacker-supplied payload and passed to...

PYSEC-2026-3829 djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls

Impact djust's LiveViewConsumer mounts a LiveView over a WebSocket. When a view is gated loginrequired / permissionrequired, or an onmount hook that returns a redirect and the connecting user is not authorized, the consumer sent the client a "type":"navigate","to":... redirect frame and then...

praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location

Summarypraisonaiagents/memory/filememory.py::FileMemory.init constructs allmemory file paths by directly joining the userid parameter to a base path:pythonself.userpath = self.basepath / userid LINE 145 — no sanitizationNo validation or normalization is applied to userid before the path join.An...

PYSEC-2026-3886 PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

Summary praisonai/browser/server.py validates incoming WebSocket connections using a Chrome extension Origin check. The regex chrome-extension://a-z0-932 is applied with re.match, which only anchors at the start of the string, not the end. Any Origin header with more than 32 alphanumeric characte...

PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

Summarypraisonai/browser/server.py validates incoming WebSocket connections using a Chromeextension Origin check. The regex chrome-extension://a-z0-932 is applied withre.match, which only anchors at the start of the string, not the end. Any Originheader with more than 32 alphanumeric characters...

PYSEC-2026-3902 praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location

Summary praisonaiagents/memory/filememory.py::FileMemory.init constructs all memory file paths by directly joining the userid parameter to a base path: python self.userpath = self.basepath / userid LINE 145 — no sanitization No validation or normalization is applied to userid before the path join...

praisonaiagents vulnerable to SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap)

The webcrawl tool performs its SSRF check only on the initial URL: it resolves the hostname oncewith socket.gethostbyname and rejects private/loopback/link-local results. It then passes the URL toa fetcher that uses httpx.Clientfollowredirects=True - or urllib.request.urlopen when httpx isabsent,...

PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114

Summarypraisonai/jobs/models.py::JobSubmitRequest.validatewebhookurl validates webhookURLs by resolving the hostname and checking whether the IP is private. When DNSresolution fails socket.gaierror, the validator silently passes the URL viaexcept socket.gaierror: pass. Additionally, even when DNS...

PYSEC-2026-3904 praisonaiagents vulnerable to SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap)

The webcrawl tool performs its SSRF check only on the initial URL: it resolves the hostname once with socket.gethostbyname and rejects private/loopback/link-local results. It then passes the URL to a fetcher that uses httpx.Clientfollowredirects=True - or urllib.request.urlopen when httpx is...

PYSEC-2026-3890 PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation

Summary The webhookurl field in the Jobs API silently passes validation when DNS resolution fails socket.gaierror, enabling DNS rebinding attacks. An attacker's domain can initially resolve to a public IP passing validation then switch to an internal IP before the server makes the HTTP request...

PYSEC-2026-3895 PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114

Summary praisonai/jobs/models.py::JobSubmitRequest.validatewebhookurl validates webhook URLs by resolving the hostname and checking whether the IP is private. When DNS resolution fails socket.gaierror, the validator silently passes the URL via except socket.gaierror: pass. Additionally, even when...