PYSEC-2026-3827 Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

Summary While investigating Django REST Framework's request parsing behavior, I identified that DRF's high-level request.data parsing appears to bypass Django's configured DATAUPLOADMAXMEMORYSIZE protection for application/json and application/x-www-form-urlencoded request bodies. In the tested...

PYSEC-2026-3868 NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary

Two NLTK sites executed the Graphviz dot program by bare name, so process creation resolved it via the search path — and on Windows via the current working directory — rather than a validated absolute location. An attacker who can place a file named dot where resolution looks the CWD on Windows, ...

PYSEC-2026-3871 NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`

Summary XMLCorpusView.readxmlfragment reads a corpus file in 1 KiB blocks, appending each block to a growing fragment string, then calls VALIDXMLRE.matchfragment on the full accumulated buffer every iteration. Because each iteration rescans the entire accumulated fragment, the total amount of wor...

PYSEC-2026-3928 Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

Summary Tornado parses application/x-www-form-urlencoded bodies with urllib.parse.parseqs and does not pass maxnumfields. A body made almost entirely of separators produces tens of millions of fields, and the parse happens on the event loop before the handler runs, so a single request stalls the...

PYSEC-2026-3869 NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars

nltk.parse.RecursiveDescentParser and SteppingRecursiveDescentParser enumerate parses top-down with no bound on the number of recursive steps. A small, crafted context-free grammar makes a short input consume unbounded CPU and/or exhaust the Python recursion stack, pinning a process indefinitely ...

PYSEC-2026-3884 plone.app.portlets vulnerable to denial of service via RSS feed portlet

Impact By adding an RSS portlet, and giving this a link to a very large file, a member can cause a denial of service attack, because Plone will use lots of memory. The member could also use different urls to try to get information about the internal network and open port numbers SSRF. A malicious...

PYSEC-2026-3828 Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

Summary AdminRenderer may disclose data that would normally be protected by GET permissions when rendering a 400 Bad Request response for an invalid write request. If a view allows POST or another write method but denies GET, an invalid request rendered through AdminRenderer can invoke the view's...

PYSEC-2026-3942 Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project

Impact The API did not properly handle project- and workspace-scoped teams and allowed setting invalid configurations, including granting access to projects the user has no access to. Patches https://github.com/WeblateOrg/weblate/pull/19970 References Parts of this issue were independently report...

PYSEC-2026-3882 piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET /api/tables/sessions/.

Summary piccoloadmin uses a helper called superuservalidators to gate access to the user and session tables for non-superusers. The helper rejects PUT, PATCH, DELETE, and POST, but does not reject GET. The sessions table stores live session tokens in plaintext, and the token column is not marked...

PYSEC-2026-3906 Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching

Problem description Protego constructs regular expressions to match URLs against robots.txt Allow: and Disallow: directives, see protego.urlpattern.URLPattern.preparepatternforregex. Every in the directive value is translated into a lazy .? regex piece, thus a specially crafted directive value wi...

PYSEC-2026-3941 Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookups

Impact The several endpoints could leak object existence information to users who had no access to it by HTTP status code 403 instead of 404. Patches https://github.com/WeblateOrg/weblate/pull/19971 References Thanks to Yaohui Wang for reporting this via GitHub...

PYSEC-2026-3883 plone.app.event vulnerable to denial of service via iCalendar import

Impact By abusing the iCalendar import functionality, a logged-in editor could take the whole site offline, make the server reach into the internal network and read calendar files off disk SSRF, and store XSS. Patches The problem has been patched in plone.app.event. For Plone 6.2: upgrade to...

PYSEC-2026-3945 WsgiDAV MySQL provider has a blind SQL injection

Summary The sample MySQLBrowserProvider builds its SQL queries by concatenating strings, and the record key from the request URL goes straight into the WHERE clause with no escaping. Any user who can reach a share backed by this provider can inject SQL through the URL. Since these read shares are...

PYSEC-2026-3917 RestrictedPython guard hooks can be shadowed via positional-only arguments

Impact RestrictedPython rewrites sensitive operations to go through guard hooks. Attribute access becomes getattrobj, name, item access becomes getitemobj, key, writes go through write, and print goes through print. The embedding application supplies these hooks to enforce its policy. Argument-na...

PYSEC-2026-3919 senaite.core Vulnerable to Eval Injection and Missing Authorization

Summary An unauthenticated remote code execution vulnerability in the SENAITE JSON API allows any network-reachable attacker to execute arbitrary Python on the Zope worker process via a two-request anonymous chain. The /@@API/update route is reachable to anonymous callers and runs eval on...

PYSEC-2026-3924 Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

Summary Affected versions of Starlette-Admin prior to 0.16.1 do not properly validate user-supplied sort and search parameters against the configured field allowlists. While the administrative UI restricts available fields based on field configuration, the backend accepts arbitrary field names...

PYSEC-2026-3855 kas Persistently Disables SSH Host Key Checking

Summary kas persistently disables SSH host key checking for the invoking user when internal SSH key setup is triggered via SSHPRIVATEKEY or SSHPRIVATEKEYFILE and no user-specific SSH configuration file exists so far. When this path is used, kas creates /.ssh/config with a global Host rule...

PYSEC-2026-3817 Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data

Impact A Server-Side Template Injection SSTI vulnerability exists in multiple locations of trestle's Jinja2 rendering pipeline due to a systemic pattern: untrusted data is re-parsed as Jinja2 template source code without sandboxing. This advisory tracks the root cause across all affected code...

PYSEC-2026-3805 aiosmtplib: STARTTLS response injection

Impact When a connection is upgraded with STARTTLS, aiosmtplib reads the server's 220 go-ahead reply and immediately performs the TLS handshake without discarding any data still sitting in the receive buffer. Bytes the protocol read off the plaintext socket before the handshake survive across the...

PYSEC-2026-3851 icalendar has Algorithmic Complexity in Equality

Summary Component.eq compares subcomponents in O2^n time relative to nesting depth. Because the parser accepts arbitrarily nested components, a sub-kilobyte .ics file is enough to make a single equality check run for minutes or hang indefinitely. Any application that compares parsed components ==...

PYSEC-2026-3861 LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint

BerriAI litellm =1.82.4 is vulnerable to Server-Side Template Injection SSTI, which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotpromptcontent parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment...

PYSEC-2026-3808 asyncssh has SCP Path Traversal to Arbitrary File Write

| | | |---|---| | Product | asyncssh all versions through 2.23.0 | | Related | CVE-2019-6111 same class in OpenSSH | | Fix | AsyncSSH 2.23.1 | A malicious SSH server can write arbitrary files on the asyncssh SCP client's filesystem by sending filenames containing ../ traversal sequences. The SCP...

PYSEC-2026-3809 asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution

Incomplete fix for CVE-2026-45309 GHSA-g794-3fmp-753h. The 2.23.0 guard that sanitises the SSH username before %u substitution in AuthorizedKeysFile blocks /, \ and .., but does not block a leading or $ENV, both of which are re-introduced by later expansion and reach the file open — defeating the...

PYSEC-2026-3943 WebOb: Open redirect in Location header normalization via leading C0 control / space characters

Summary This is a third follow-up to CVE-2024-42353 / GHSA-mg3v-6m49-jhp3 and CVE-2026-44889 / GHSA-fh3h-vg37-cc95. WebOb makes the Location header absolute when it serves a redirect. To stop a relative or protocol-relative target from redirecting users off-host, it checks the value for a URI...

PYSEC-2026-3853 JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login

Impact Invalid input to login resulted in unbounded logging output. Only form-based Authenticators the default PAM Authenticator, but not the more widely used OAuthenticator are affected. Patches Upgrade to 5.5.0. Workarounds Use an Authenticator that doesn't use a login form, such as...

PYSEC-2026-3831 eml_parser has a URL extraction bypass via HTML entities in URLs

Summary emlparser performs certain validations on potential URL strings to discard bogus values. In versions prior to 3.0.2, this validation was performed before unescaping any HTML entities that might occur in the string. This caused the library to wrongfully reject valid URLs that use HTML...

PYSEC-2026-3916 reachy_mini Allows Unrestricted Upload of File with Dangerous Type

Summary The Reachy Mini daemon exposes the “/api/media/sounds/upload” endpoint without authentication and file validation mechanisms. An attacker can use this endpoint to upload malicious files into the file system that will propagate in future attacks. Compromise Chain: Unauthenticated to Full...

PYSEC-2026-3812 Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution

Am I affected? Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. Summary When MCP ...

PYSEC-2026-3829 djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls

Impact djust's LiveViewConsumer mounts a LiveView over a WebSocket. When a view is gated loginrequired / permissionrequired, or an onmount hook that returns a redirect and the connecting user is not authorized, the consumer sent the client a "type":"navigate","to":... redirect frame and then...

PYSEC-2026-3811 Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access

Am I affected? Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. Summary When MCP ...

PYSEC-2026-3866 nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )

Summary The POST /webhooks/nextcloud endpoint has no authentication by default: WEBHOOKSECRET defaults to None and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The userid is taken directly from the attacker-supplied payload and passed to...

PYSEC-2026-3832 eml_parser vulnerable to DoS via deeply nested parens in Received headers

Summary emlparser strips parenthesised CFWS comments from Received: headers using a regex-based fix-point loop. The loop has quadratic time complexity in the number of nested parens. A single Received: header containing 5,000 nested parens causes 1.3 seconds of CPU saturation per parsed message;...

PYSEC-2026-3833 eml_parser has parser DoS via deeply nested parentheses in e-mail headers

Summary emlparser uses the email.utils.getaddresses function from the CPython standard library to parse e-mail headers that contain e-mail addresses such as To, Cc, Bcc, From, Reply-To, Sender, .... When the input header contains a deeply nested CFWS comment / folding white space construct, the...

PYSEC-2026-3914 qwed Vulnerable to Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`

Summary The qwed package version 5.1.1 passes attacker-controlled input directly to SymPy's parseexpr function without a restricted namespace. Because parseexpr internally calls Python's eval, any authenticated tenant can execute arbitrary Python code inside the API server process. The attack...

PYSEC-2026-3932 utcp-gql SSRF: CVE-2026-44661 fix not applied to the GraphQL and WebSocket plugins

Summary The fix for CVE-2026-44661 commit 5b16e43 added the ensuresecureurl / issecureurl helpers and wired them into the three HTTP-family plugins, but it did not reach the GraphQL or WebSocket plugins. The GraphQL plugin utcp-gql still uses the startswith prefix check that the fix explicitly...

PYSEC-2026-3892 PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server

Summary The PraisonAI MCP server exposes an HTTP-stream transport praisonai mcp serve --transport http-stream that binds to localhost and, by default, has no API key. Its only access control for browser-originated requests is an Origin allowlist, which the code implements as required by the MCP...

PYSEC-2026-3902 praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location

Summary praisonaiagents/memory/filememory.py::FileMemory.init constructs all memory file paths by directly joining the userid parameter to a base path: python self.userpath = self.basepath / userid LINE 145 — no sanitization No validation or normalization is applied to userid before the path join...

PYSEC-2026-3885 PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete

Summary PraisonAI's async Jobs API the FastAPI service in praisonai/jobs/ installs its router with no authentication middleware, no router-level dependency, and no per-route auth check. Any caller who can reach the jobs server can submit agent jobs executed against the operator's configured LLM...

PYSEC-2026-3889 PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret

Summary The PraisonAI Recipe HTTP server silently allows unauthenticated requests when auth is configured as api-key or jwt but the corresponding secret is missing. This creates an authentication fail-open condition. An operator can start the Recipe server with authentication enabled, including o...

PYSEC-2026-3886 PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

Summary praisonai/browser/server.py validates incoming WebSocket connections using a Chrome extension Origin check. The regex chrome-extension://a-z0-932 is applied with re.match, which only anchors at the start of the string, not the end. Any Origin header with more than 32 alphanumeric characte...

PYSEC-2026-3915 qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input

Summary verifymathexpression in qwed-mcp v0.2.0 passes attacker-controlled strings directly to SymPy's parseexpr without restricting globaldict or validating the expression's AST. Because parseexpr internally calls eval and Python automatically injects the current module's builtins when no explic...

PYSEC-2026-3931 utcp-gql SSRF: CVE-2026-44661 fix not applied to the GraphQL and WebSocket plugins

Summary The fix for CVE-2026-44661 commit 5b16e43 added the ensuresecureurl / issecureurl helpers and wired them into the three HTTP-family plugins, but it did not reach the GraphQL or WebSocket plugins. The GraphQL plugin utcp-gql still uses the startswith prefix check that the fix explicitly...

PYSEC-2026-3897 PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)

Summary The PraisonAI MCP HTTP-stream server creates a new in-memory session on every initialize request and never removes it. The cleanup routine that would expire sessions cleanupsessions is defined but never called anywhere in the codebase, and the configured session TTL is never enforced. The...

PYSEC-2026-3904 praisonaiagents vulnerable to SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap)

The webcrawl tool performs its SSRF check only on the initial URL: it resolves the hostname once with socket.gethostbyname and rejects private/loopback/link-local results. It then passes the URL to a fetcher that uses httpx.Clientfollowredirects=True - or urllib.request.urlopen when httpx is...

PYSEC-2026-3888 PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks

Summary PraisonAI's praisonai.code tool wrappers exported as CODETOOLS for agents expose a workspace setting that the module itself treats as a path-traversal security boundary — readfile, writefile, applydiff, and searchreplace explicitly call ispathwithindirectory and return "… is outside the...

PYSEC-2026-3905 praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)

Summary praisonaiagents/tools/spidertools.py contains an SSRF protection bypass. The function hostisblocked validates URLs against a list of blocked IP literals and hostname aliases, but never performs DNS resolution. Any hostname that resolves to a private or loopback IP address — including publ...

PYSEC-2026-3895 PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114

Summary praisonai/jobs/models.py::JobSubmitRequest.validatewebhookurl validates webhook URLs by resolving the hostname and checking whether the IP is private. When DNS resolution fails socket.gaierror, the validator silently passes the URL via except socket.gaierror: pass. Additionally, even when...

PYSEC-2026-3887 PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution

Summary PraisonAI's praisonai serve agents command exposes --api-key as the documented authentication control for production/external deployments, but the configured key is not enforced on the public agent invocation compatibility endpoints. An operator can start the server with --api-key and bin...

PYSEC-2026-3890 PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation

Summary The webhookurl field in the Jobs API silently passes validation when DNS resolution fails socket.gaierror, enabling DNS rebinding attacks. An attacker's domain can initially resolve to a public IP passing validation then switch to an internal IP before the server makes the HTTP request...

PYSEC-2026-3894 PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated

Summary praisonai serve agents exposes HTTP routes that invoke registered agents. The CLI advertises --api-key with help text "API key for authentication", parses it, and forwards it into ServeHandler. But createagentsapp never reads config"apikey" again and installs no auth dependency or...