PYSEC-2026-4261 PraisonAI: Project custom command templates can read outside-workspace files into model prompts

Project custom command templates can read outside-workspace files into model prompts Summary PraisonAI's new file-based custom command feature auto-discovers project commands from .praisonai/commands/.md. When a user runs praisonai run --command inside a repository, the command body is interpolat...

GHSA-XPX6-X8C2-MW5W PraisonAI: Project custom command templates can read outside-workspace files into model prompts

Project custom command templates can read outside-workspace files into model prompts Summary PraisonAI's new file-based custom command feature auto-discovers project commands from .praisonai/commands/.md. When a user runs praisonai run --command inside a repository, the command body is interpolat...

EUVD-2026-71001

SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows readers to retrieve files from notebooks explicitly configured as Visible:false. Attackers with reader role can access private workspace files including notebook metadata and internal...

CVE-2026-85578: Missing Authorization

SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows readers to retrieve files from notebooks explicitly configured as Visible:false. Attackers with reader role can access private workspace files including notebook metadata and internal...

CVE-2026-82862

Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution...

CVE-2026-82862 Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files

Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution...

CVE-2026-82862

Hulumi versions prior to v1.3.2 are affected by a helper script shadowing vulnerability in which the threat-model helper script is resolved from an unsafe root . An attacker can place a malicious file in the workspace directory, causing it to be loaded in place of the intended helper script, resu...

CVE-2026-82862 Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files

Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution...

CVE-2026-82862 Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files

Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution...

EUVD-2026-68450

Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution...

Path Traversal

SiYuan is vulnerable to Path Traversal. The vulnerability is due to improper validation of double URL-encoded path traversal sequences in the /assets/path route, where attackers can bypass path restrictions to read arbitrary files within the workspace directory, exposing sensitive configuration...

GHSA-WGVQ-3JXH-4QG7 Duplicate Advisory: PraisonAI: Project custom command templates can read outside-workspace files into model prompts

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xpx6-x8c2-mw5w. This link is maintained to preserve external references. Original Description PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing attackers to rea...

MCP Auto-Execution: From Git Clone to Cloud Compromise in Amazon Q VS Code Extension

By automatically loading MCP servers from workspace files, Amazon Q enabled attackers to execute code and access sensitive cloud environments...

CVE-2026-54158

SiYuan CVE-2026-54158: A stored XSS in the attribute-view cell renderer (genAVValueHTML) can break out of its tag with crafted values in text/url/phone/mAsset, potentially leading to RCE in Electron if nodeIntegration is enabled. The issue persists in AV files under the workspace and propagates a...

CVE-2026-54066 SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read)

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 "Path Traversal via Double URL Encoding" sanitized the /export/ route but the identical root cause remains in the /assets/path route. In publish mode anonymous read-only HTTP endpoint,...

CVE-2025-66389

GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder without user approval via a file-handler URI parameter to fetchwebpage. Therefore, exfiltration could occur if there is indirect prompt injection...

CVE-2026-46580

Theia before v1.71.0 loads files matching .prompts/*.prompttemplate from a workspace, allowing attacker-controlled content to override the AI agent’s system prompts (indirect prompt injection). This enables attack chains with untrusted workspaces, potentially causing data exfiltration via Markdow...

CVE-2026-53864

OpenClaw before 2026.5.26 contains an insufficient sanitization vulnerability in the host environment sanitizer that allows Node.js control variables to bypass validation. Attackers with access to workspace .env files, tool environment overrides, or skill environment blocks can pass malicious...

CVE-2026-53864 OpenClaw < 2026.5.26 - Insufficient Environment Variable Sanitization in Node.js Control Variables

OpenClaw before 2026.5.26 contains an insufficient sanitization vulnerability in the host environment sanitizer that allows Node.js control variables to bypass validation. Attackers with access to workspace .env files, tool environment overrides, or skill environment blocks can pass malicious...

PT-2026-48749

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.27 Description An arbitrary code execution issue exists in skill install flows. This occurs because workspace .env files can override the Homebrew executable selection, allowing attackers with access to truste...