GHSA-79FV-7HQ9-W7XG PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source

API deploy code generator embeds unescaped YAML fields into Python source Summary PraisonAI's API deployment generator copies deploy.api.host from agents.yaml directly into generated Python source without safe literal encoding. A malicious PraisonAI project can set that host value to a Python...

GHSA-2GPF-2492-Q9JH PraisonAI: Call API localhost-only authentication bypass via spoofed Host header

Call API localhost-only authentication bypass via spoofed Host header Summary PraisonAI's patched PRAISONAICALLAUTH=disabled safeguard for the n8n/call agent invocation API can be bypassed with a spoofed Host: 127.0.0.1 header, allowing an unauthenticated network caller to list and invoke...

GHSA-Q7M5-3JMV-VM48 PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace

ContextGatherer include resolution permits absolute and traversal reads outside the workspace Summary PraisonAI's praisonai.ui.context.ContextGatherer treats the configured directory as the project workspace, but project-controlled .praisoncontext and .praisoninclude files can name absolute paths...

GHSA-77XJ-X4RM-935C datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

Summary When processing an attacker-controlled Protobuf schema, vulnerable versions of datamodel-code-generator could write a generated weak-import stub outside the intended weakimports temporary directory. Absolute import paths and relative paths containing .. could escape this directory. An...

GHSA-XPX6-X8C2-MW5W PraisonAI: Project custom command templates can read outside-workspace files into model prompts

Project custom command templates can read outside-workspace files into model prompts Summary PraisonAI's new file-based custom command feature auto-discovers project commands from .praisonai/commands/.md. When a user runs praisonai run --command inside a repository, the command body is interpolat...

GHSA-XW65-4HP5-5HC7 Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

Summary Handlebars.precompile generates JavaScript source that is commonly embedded in browser elements. Before the fix, static template text containing was emitted unchanged. HTML parsers recognize even inside a JavaScript string literal, closing the surrounding script element and allowing...

GHSA-8R5X-FM3F-WHWJ Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)

Summary Handlebars.compile and Handlebars.precompile accept a pre-parsed AST as well as a template string. Handlebars 4.7.9 added validation for such ASTs. It only checks values on PathExpression, NumberLiteral and BooleanLiteral nodes, and the compiler still writes several other AST values into...

GHSA-P8WG-VRV2-V86F Handlebars: JavaScript Injection via Own Property Check Bypass

Summary Handlebars can expose the Function constructor despite its prototype-access deny list. When a template reaches Function.prototype, its own constructor property is returned before the deny list is checked. An attacker who can render a controlled template with allowProtoMethodsByDefault: tr...

GHSA-M6RX-H84Q-8R95 LangChain: MongoDBChatMessageHistory query injection can allow cross-session access

Impact MongoDBChatMessageHistory did not enforce the documented string type for session identifiers at runtime. In affected applications, a structured session identifier could be interpreted as a MongoDB query condition rather than as a literal identifier. Applications are affected when they pass...

GHSA-MX22-3794-2VPV Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic

Summary extractPivotTableFields builds order := pc.getPivotCacheFieldsName from xl/pivotCache/pivotCacheDefinitionN.xml's list, then indexes it with values taken from a separately parsed xl/pivotTables/pivotTableN.xml part with zero cross-validation: orderfield.Fld where field.Fld is a raw...

GHSA-RP9V-7XV3-R6G3 Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor

Summary defer temp.Close sits inside a for loop in the multipart processor. Go defers run at function return, not loop end, so every file part in the request holds an open fd until ProcessRequest exits. Send enough parts and you hit EMFILE. With CRS loaded, that flips MULTIPARTSTRICTERROR to 1 an...

GHSA-W253-M66G-RX24 Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection

Summary Coraza fails to inspect URL-encoded form bodies when their valid Content-Type contains a media-type parameter, for example: http Content-Type: application/x-www-form-urlencoded; charset=UTF-8 An unauthenticated attacker can use this header to hide the complete form body from custom Coraza...

GHSA-3C6W-J9XM-8H2H Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion

Summary The JSON response body processor parses response bodies with no recursion limit. ProcessResponse calls readJSONss, ignoreJSONRecursionLimit, and that constant is -1. The guard in readItems only fires on == 0, so counting down from -1 -2, -3, ... never reaches it. The guard is effectively...

GHSA-3WR7-993Q-JRFF Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules

Summary Coraza extracts a multipart file upload's filename using Go's standard-library mime.ParseMediaType, which only decodes the RFC 5987/6266 extended filename Content-Disposition parameter when its declared charset is exactly us-ascii or utf-8. Any other charset — including iso-8859-1, which...

GHSA-G4QM-M288-5CP9 Coraza has Cookie Parser Confusion

Summary Coraza's cookie parser internal/cookies.ParseCookies does not strip ASCII control characters CTLs from the edges of a cookie name/value before they're matched against REQUESTCOOKIES / REQUESTCOOKIESNAMES. When a CTL sits directly next to the = separator, Coraza absorbs it into the adjacen...

GHSA-X26Q-WVHG-FH4M Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

Root Cause File: internal/corazawaf/transaction.go, lines 834–866. go parsedURL, err := url.ParseRequestURIuri query := "" if err != nil tx.variables.urlencodedError.Seterr.Error path = uri tx.variables.requestURI.Seturi / tx.Variables.VARIABLEURIPARSEERROR.Set"1" posRawQuery := strings.Indexuri,...

GHSA-PC5Q-QFXP-GGQV Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass

Summary The t:jsDecode transformation in Coraza WAF contains an off-by-one error when parsing octal escape sequences. A backslash character was incorrectly included in the octal number buffer, causing strconv.ParseInt to fail for every octal escape sequence and return a null byte instead of the...

GHSA-6GCQ-WC29-5XF2 Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

Summary The JSON body processor internal/bodyprocessors/json.go can be made to crash the whole process with an unrecoverable fatal error: stack overflow, using a request body that is well under the recommended SecRequestBodyLimit and the default SecArgumentsLimit. Root cause readJSON...

GHSA-5GJ4-9GM7-2FX2 Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection

Summary Coraza's JSON body processor converts nested JSON properties into dot-separated ARGSPOST names without escaping dots contained in literal property names. Two distinct JSON properties can therefore collapse into the same Coraza variable An unauthenticated attacker can place a malicious val...

GHSA-V36G-JCW9-X7CW Pydantic AI: Excessive resource use when local web fetching converts nested HTML

Summary Applications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. Details Nested block elements cause HTML-to-Markdown conversion...

GHSA-R223-96JV-Q533 JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

SQL Injection in the sort Parameter of JHipster-Generated Reactive WebFlux + R2DBC Applications - Product: jhipster/generator-jhipster npm package generator-jhipster - Affected versions: v7.0.0 through v9.2.0 - Component: generated reactive-application code, template EntityManagerreactive.java.ej...

GHSA-9FFP-22J7-56R2 JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob

Summary Applications generated by generator-jhipster v9.2.0 can persist user-controlled Blob ContentType values and later use those values as the MIME type for client-side Blob objects. The shared generated openFile helper creates an object URL from the Blob and opens it in a new window. For...

GHSA-8F34-F56X-9XPH msgpack5: Truncated map32 headers throw an unexpected error

Impact A truncated map32 header causes an out-of-bounds buffer read and throws RangeError instead of IncompleteBufferError. Applications that rely on IncompleteBufferError to wait for additional bytes may terminate a request, stream, or worker unexpectedly. No adjacent memory is disclosed because...

GHSA-5X5G-H9X8-2FH9 msgpack5: Many buffered values can exhaust the streaming decoder stack

Impact The streaming decoder recursively invokes itself for every complete value remaining in a chunk. A single chunk containing many small valid MessagePack values can exhaust the JavaScript call stack and interrupt the process or stream. Patches The streaming decoder now drains concatenated...

GHSA-26WQ-P25C-J6FV msgpack5: Reserved byte can cause unbounded stream buffering

Impact The reserved MessagePack byte 0xc1 is incorrectly treated as incomplete input. When it appears at the start of a decoder stream, all subsequent data is retained while the decoder waits for bytes that can never make the value valid, allowing memory exhaustion. Patches The decoder now reject...

GHSA-8HQ7-GGX2-CC6M msgpack5: Partial options disable prototype protection

Impact Passing an empty or partial options object disables the default protoAction: 'error' protection. A map containing a proto key can then replace the prototype of the decoded object, potentially changing inherited properties or causing unexpected behavior in downstream code. Only the decoded...

GHSA-24CH-F2G6-9HHH msgpack5: Deeply nested input can exhaust the decoder stack

Impact The decoder has no nesting-depth limit for arrays and maps. An attacker who can provide MessagePack input can use deeply nested containers to exhaust the JavaScript call stack and interrupt the process or request handler. Patches The decoder now limits nesting depth to 100 by default and...

GHSA-GCX5-HXJ7-GPQQ msgpack5: Quadratic parsing in the streaming decoder

Impact The streaming decoder reparses an incomplete container from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack value across many small chunks, causing quadratic CPU usage and blocking the event loop. Patches The decoder now preserves incremental...

GHSA-QW35-55VC-RHGJ msgpack5: Decoding negative int64 values mutates the input buffer

Impact Decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer. Applications that retain or reuse encoded input for integrity checks, logging, or subsequent processing may observe silently corrupted data. Positive integers and other MessagePa...

GHSA-WF65-4JJX-Q444 PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL

PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL Summary The PGVector and Cassandra knowledge-store backends validate SQL/CQL identifiers such as schema, keyspace, and collection names, but still insert the caller-controlled dimension argument directly into CREATE...

GHSA-Q2XC-RRXJ-58X9 Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

Summary The Pydantic AI development web chat UI Agent.toweb, clai web does not validate the Host header of incoming requests. A website a developer visits can use DNS rebinding to make requests to a chat UI running on that developer's machine appear same-origin to the browser, causing the served...

GHSA-H4XC-3QFQ-JF93 Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint

Summary The Pydantic AI development web chat UI Agent.toweb, clai web did not check the content type of requests to its chat endpoint. This allowed a website visited by a developer to submit a request to a chat UI running on that developer's machine, causing the served agent to run and to execute...

GHSA-3GH4-CGHQ-F8V4 Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`

Summary Pydantic AI's OpenTelemetry instrumentation supports InstrumentationSettingsincludecontent=False to exclude message content — user prompts, model completions, tool call arguments and responses — from exported telemetry, so that agents can be monitored without sending sensitive content to...

GHSA-V2XH-2VP8-57H8 Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl

Summary Several remote-content download paths in Pydantic AI buffered the entire HTTP response body into memory before enforcing any size limit. An application that exposes the local web-fetch tool webfetchtool, or the WebFetch capability's local fallback to untrusted prompts can be driven to fet...

GHSA-JW42-F3RR-4CC3 Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days

Summary A worksheet whose number is far past Excel's 1,048,576-row limit makes File.GetRows and the Rows iterator loop once for every missing row. The row limit is checked in Rows.Next, but not in Rows.Columns, which also reads elements. A 1.5 KB file with after an ordinary first row keeps GetRow...

GHSA-R7X5-4969-99P7 Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element

Summary GetSlicers guards only if ws.ExtLst == nil return slicer.go:816-818 and then immediately dereferences ws.Drawing.RID with no nil check on ws.Drawing itself. Drawing and ExtLst are two independently optional child elements of in xl/worksheets/sheetN.xml, populated separately by encoding/xm...

GHSA-2JWH-9RMR-J4XF AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)

Impact With the cookie store enabled, which is the default, a Cookie header that the caller sets on a request with setHeader or addHeader is thrown away whenever the store holds any cookie for the request's origin: the request's cookie list is written into that header afterwards and replaces it...

GHSA-P2JM-6HJ6-9RJG AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS

Impact The cookie store ignores the scheme a Set-Cookie arrived on. draft-ietf-httpbis-rfc6265bis-22 approved to obsolete RFC 6265, in the RFC Editor queue Section 5.7 requires a user agent to ignore a cookie with the Secure attribute unless it arrived over a secure connection step 13, and to...

GHSA-X8V2-478Q-2HVG AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled

Impact With WebSocket compression enabled, the client inflates permessage-deflate messages with no limit on the decompressed size. It installed Netty's shared WebSocketClientCompressionHandler.INSTANCE, whose inflater is unbounded, and webSocketMaxFrameSize and webSocketMaxBufferSize only bound t...

GHSA-V2J5-22FR-J62R AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins

Impact The fix for GHSA-vvp4-63h8-v5pm in 3.0.13 folded the authenticated principal into the HTTP/1.1 connection pool key, so that a connection one principal authenticated with NTLM, Kerberos or SPNEGO is not handed to another. It left three cases out. In each, a socket that one identity...

GHSA-C44F-37QR-GW3F PraisonAI: SkillTools Executes Scripts Without Path Containment Validation

Summary SkillTools.runskillscript accepts a scriptpath parameter and executes it via subprocess.run without any path containment validation. While FileTools has validatepath with traversal detection, SkillTools performs none. An LLM-directed call can execute arbitrary scripts from any filesystem...

GHSA-4GFV-WG42-7JW5 PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow

Summary An unsafe dynamic module loading vulnerability allows an attacker who can control a workflow file and a sibling tools.py to execute arbitrary Python code when the workflow is executed. Details The vulnerability is located in the workflow structured output resolution logic. File:...

GHSA-4XXV-6WMF-XF45 PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace

FastContext path resolution permits absolute and traversal reads outside the workspace Summary PraisonAI's praisonaiagents.context.fast FastContext feature treats workspacepath as the root directory for code search, but its model-facing search tools and high-level readcontext helper accept absolu...

GHSA-FPF4-VWCP-V4HP Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`

Summary The local web-fetch tool webfetchtool, also used as the WebFetch capability's local fallback processed responses with several steps whose running time grows quadratically with the size of certain server-controlled inputs, and ran them on the event loop: decoding the body with whichever...

GHSA-4X9P-G9WM-8Q7F Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`

Summary Pydantic AI's OpenTelemetry instrumentation supports InstrumentationSettingsincludecontent=False to exclude message content — user prompts, model completions, tool call arguments and responses, and any other message content — from exported telemetry, so that agents can be monitored withou...

GHSA-VMXC-H2X2-JMF3 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers

Summary When an application using Pydantic AI opts a URL into local network access — either a FileUrl with forcedownload='allow-local', or webfetchtoolallowlocalurls=True — the cloud-metadata blocklist could be bypassed by appending an IPv6 zone identifier to a metadata address for example...

GHSA-M6WP-H223-4C8G PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification

Summary The plugin manager loads and executes arbitrary .py files from .praisonai/plugins/ directories both project-level and user home via importlib.util.specfromfilelocation + execmodule with zero code signing, integrity verification, or sandboxing. Any attacker who can write a file to the...

GHSA-2XV2-W8CQ-5GXW PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets

Summary CodeAgent.executepython executes LLM-generated Python code in a subprocess with the complete parent-process environment os.environ.copy, zero AST validation, zero import restrictions, and no sandbox enforcement — even when CodeConfigsandbox=True is explicitly set. This allows an attacker...

GHSA-29R9-67VG-QJ56 PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments

Summary PraisonAI gates dangerous tools file writes, deletes, shell/code execution behind an interactive approval prompt. The first approval of a tool is cached for the remainder of the run and silently reused for all later invocations of that tool with arbitrary, unreviewed arguments. Root cause...

GHSA-QG25-6GC4-48MG PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure

Summary PraisonAI's webcrawl agent tool performs a server-side HTTP fetch of an agent/attacker-influenced URL. SSRF is meant to be prevented by issafecrawlurl, which resolves the hostname and rejects private/loopback/link-local IPs at validation time. The validated value is the URL string not a...