praisonaiagents vulnerable to SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap)

The webcrawl tool performs its SSRF check only on the initial URL: it resolves the hostname oncewith socket.gethostbyname and rejects private/loopback/link-local results. It then passes the URL toa fetcher that uses httpx.Clientfollowredirects=True - or urllib.request.urlopen when httpx isabsent,...

PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution

Summary PraisonAI's praisonai serve agents command exposes --api-key as the documented authentication control for production/external deployments, but the configured key is not enforced on the public agent invocation compatibility endpoints. An operator can start the server with --api-key and bin...

PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation

SummaryThe webhookurl field in the Jobs API silently passes validation when DNS resolution fails socket.gaierror, enabling DNS rebinding attacks. An attacker's domain can initially resolve to a public IP passing validation then switch to an internal IP before the server makes the HTTP request...

praisonaiagents: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool

Target: PraisonAI MervinPraison/PraisonAIAffected component: praisonaiagents/tools/astgreptool.py — astgreprewriteAffected versions: master at ce97667156a116c50b4a3d1aa21e09f048903fda; reproduced against the current praisonaiagents PyPI release praisonaiagents = 1.6.52. SummaryTools in...

PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated

Summarypraisonai serve agents exposes HTTP routes that invoke registered agents. The CLI advertises --api-key with help text "API key for authentication", parses it, and forwards it into ServeHandler. But createagentsapp never reads config"apikey" again and installs no auth dependency or middlewa...

PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks

SummaryPraisonAI's praisonai.code tool wrappers exported as CODETOOLS for agents expose a workspace setting that the module itself treats as a path-traversal security boundary — readfile, writefile, applydiff, and searchreplace explicitly call ispathwithindirectory and return "… is outside the...

PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced

Summarypraisonai serve agents and praisonai serve unified both accept --api-key for authentication. The flag is parsed but never wired into the FastAPI app — no middleware, no header check, nothing. The server runs wide open regardless of what key you set. Tested on 4.6.50 from PyPI. Affected...

praisonaiagents: AgentServer declares auth_token but never enforces it on any route

Researcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security ResearchTarget: https://github.com/MervinPraison/PraisonAI---Package: praisonaiagents on PyPIAffected version empirically tested: 1.6.48Component: praisonaiagents.server.AgentServer the bundled HTTP / SSE server---...

PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code

SummaryPraisonAI's workflow include implementation implicitly imports and executes an included recipe's tools.py file even when the documented tools.py autoload opt-in is unset.This bypasses the hardening added for the prior automatic tools.py RCE advisory family. A workflow that includes an...

praisonaiagents web_crawl vulnerable to SSRF via redirect-following

Summarywebcrawl an exported, model-callable tool validates only the INITIAL URL's resolved IP against a private/loopback blocklist, then fetches with httpx.Clientfollowredirects=True and never re-validates redirect targets. An attacker who controls the agent's crawl target a malicious task, or...

PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server

SummaryPraisonAI's MCP HTTP Stream transport uses an unsafe prefix match when validating the Origin header. The default localhost allowlist includes origins such as http://localhost, and the validation accepts any origin that starts with an allowed value.As a result, an attacker-controlled origin...

praisonaiagents has a `web_crawl` SSRF protection bypass via unchecked redirect targets

Summarypraisonaiagents.tools.webcrawltools.webcrawl validates the initial URL and blocks direct loopback/private destinations by default, but the default httpx fallback still uses httpx.Clientfollowredirects=True and does not revalidate redirect targets.An attacker-controlled public URL can pass...

mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server

Commit: f855e54d5b7bc1c91b977574a03b91eff6b86bb6Component: mcp-servers/python/pythonsandboxserver/src/pythonsandboxserver/serverfastmcp.py VulnerabilityRestrictedPython's sandbox in ContextForge's pythonsandboxserver sub-project allows arbitrary Python execution via three compounding weaknesses:1...

django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

SummaryThe CMS page cache key ignores the request headers that plugins declare via getvarycacheon. The header is added to the response Vary header, but the CMS's own cache key does not incorporate the header values, so the first visitor's variant is served to all subsequent visitors regardless of...

NLTK AllowlistUnpickler dotted-name validation bypass allows remote code execution

NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traversal to callables outside the allowlisted namespace. Attackers can craft...

Hydra: hydra.utils.instantiate with untrusted config can lead to code execution

Summaryhydra.utils.instantiate resolves and calls Python objects from config. If anapplication passes untrusted config to instantiate, an attacker who controlstarget and its arguments can cause arbitrary code execution in the consumingprocess.Hydra is not a network service. Exploitation requires ...

django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

SummaryThe moveplugin admin endpoint does not prevent a plugin from being reparented under itself or one of its own descendants. Doing so creates a cycle in the plugin tree, after which the recursive descendant/ancestor SQL queries loop without terminating, stalling the request worker...

PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code

SummaryPraisonAI's workflow include implementation implicitly imports and executes an included recipe's tools.py file even when the documented tools.py autoload opt-in is unset.This bypasses the hardening added for the prior automatic tools.py RCE advisory family. A workflow that includes an...

django CMS: Structure endpoint bypasses page-view permission

SummaryThe structure-board endpoint renderobjectstructure renders a page's plugin structure without verifying that the requesting user is allowed to view the page. The edit and preview endpoints enforce this via renderpage, but the structure endpoint does not, allowing a low-privileged staff user...

Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing

SummaryXinference used Python's unsafe eval function when parsing Llama3 tool-call output generated by a large language model. Because the model output can be influenced by attacker-controlled prompts sent to the chat completion API, a remote attacker can craft prompts that cause the model to...

LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure

Executive SummaryA NoSQL injection issue exists in the langgraph-checkpoint-mongodb andlanggraph-store-mongodb libraries. MongoDBSaver.list and MongoDBStore.search methodsaccept a filter parameter that is incorporated into MongoDB queries without sufficient validation.Because MongoDB query operat...

NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORDRE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix a-z0-9+?:.\-a-z0-9+ is unbounded. Input consisting of many alternating label separators can be partitioned i...

Wagtail: Improper restriction handling on Pages admin API

ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in apifields. A user with access to the Wagtail admin can use this API to fetch draft and live page fields’ contents that are part of apifields on the base page model title, slug,...

asteval has a Sandbox Escape via BaseException Subclasses

SummaryAn attacker who can supply expressions to asteval.Interpreter.eval can raise SystemExit,KeyboardInterrupt, GeneratorExit, or BaseException from inside the sandbox. Theseexceptions are subclasses of BaseException but not Exception, so they bypass theexcept Exception: safety net in both run...

django CMS: Stored XSS in edit-mode plugin exception rendering

SummaryWhen plugin rendering fails in edit mode, django CMS renders a cms-rendering-exception block so editors can see that a placeholder could not be rendered. Older code built that block's heading by interpolating the exception message, placeholder/source strings, and the failing plugin's short...

django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)

ImpactThe only authorization gate on the duplicate flow is PageAdmin.hasaddpermission,which checks usercanaddpageuser, site / usercanaddsubpage... — i.e. “maythis user create a page at all”. Nothing checks the user’s relationship to the page beingcopied:- cms/admin/forms.py —...

django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff

SummaryThe django-cms frontend-editing structure endpointGET //admin/cms/placeholder/object//structure//did not perform an object-level authorization check for non-PageContent objects. Any authenticated, active staff user could request the structure endpoint for a frontend-editable object a model...

django CMS: Clipboard copy IDOR discloses unauthorized plugin content

Summary The clipboard copy paths of the copyplugins admin endpoint validate only the target the user's own clipboard and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the secret content. Details In...

LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure

Executive SummaryA NoSQL injection issue exists in the langgraph-checkpoint-mongodb andlanggraph-store-mongodb libraries. MongoDBSaver.list and MongoDBStore.search methodsaccept a filter parameter that is incorporated into MongoDB queries without sufficient validation.Because MongoDB query operat...

GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()

SummaryIndexFile.remove and Head.checkout forward kwargs into git rm and git checkoutwith no guard. Passing --pathspec-from-file= together with --pathspec-file-nulmakes Git treat the whole file as a single NUL-delimited pathspec, and the unmatched-pathspecerror quotes it verbatim. GitPython...

Accelerate path traversal and denial of service via sharded checkpoint weight_map entries

Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in loadcheckpointinmodel and loadcheckpointanddispatch functions that fail to sanitize weightmap entries from sharded checkpoint indexes. Attackers can supply relative paths with ../ sequences or absolute paths to read...

Transformers save_pretrained path traversal allows arbitrary file writes through chat template names

A vulnerability in huggingface/transformers versions 5.10.0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the savepretrained methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chattemplate dictionary are used directly as...

Copier has a trust-prefix bypass via path traversal that runs tasks unprompted

Copier: trust-prefix bypass via path traversal runs tasks unprompted SummaryIn copier = 9.5.0,...

Keras model loading is vulnerable to denial of service through HDF5 shape bombs

A vulnerability in keras-team/keras versions 3.15.0 allows for a denial of service DoS attack when loading malicious .keras model files via the keras.models.loadmodel function. The H5IOStore.getitem method in keras/src/saving/savinglib.py does not validate the shape or size of datasets, leading t...

MLflow AI Gateway permits SSRF through an unvalidated api_base

MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...

GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite

SummaryIndexFile.fromtree, IndexFile.reset → fromtree and IndexFile.mergetree append caller-influenced treeish strings positionally to git read-tree with no unsafe-option guard, no allowunsafeoptions parameter, and no -- separator. git read-tree --index-output= writes the resulting index to an...

Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)

ImpactA remote code execution RCE via server-side template injection SSTI allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container. The vulnerability...

langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication

SummaryIn affected versions of langgraph-api the LangGraph Server runtime, a run or cron could be created with a relative webhook target. When the server later delivers such a webhook, it routes the request back into the same application through an in-process loopback transport that the...

langgraph-api: Incomplete assistant authorization in LangGraph Server run creation

SummaryIn affected versions of langgraph-api the LangGraph Server runtime, the run-creation path authorized the assistant attached to a run using a different authorization event than the rest of the assistant-handling code paths. Direct assistant reads and cron creation dispatch the assistants.re...

GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks

SummaryRepo.init forwards kwargs verbatim to git init with no unsafe-option guard and no allowunsafeoptions parameter. git init --template= copies /hooks/ into the new repo's .git/hooks, so an attacker-controlled template kwarg plants a hook that executes on the next git operation → arbitrary cod...

GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution

SummaryThe checkunsafeoptions guard can be bypassed on every guarded method clone/clonefrom, fetch/pull/push, lsremote, itercommits, blame, archive by combining a single-character kwarg with splitsinglecharoptions=False. The guard's candidate list omits the smuggled option, but transformkwarg emi...

GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

SummaryRepo.clonefrom passes the caller-supplied remote URL through Git.polishurl, which on every non-Cygwin platform calls os.path.expandvars on the URL before handing it to git clone. An attacker who controls the URL argument — the documented use case for clonefrom in "import repository from UR...

Snowflake SQLAlchemy affected by SQL injection and local file disclosure vulnerabilities

Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: Improper handling of user-supplied column identifiers in merge operations could allow SQL injection through attacker-controlled input keys. An attacker may be able to exploit this through request...

Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API

The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based shouldhidevalueforkey check which triggers on secret-suffixed key names like password / token / secret could not fire for JSON-decodable variable values. An authenticated UI/API user...

GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

Command injection via long-option prefix abbreviation bypassing checkunsafeoptions incomplete fix of CVE-2026-42215 / GHSA-rpm5-65cw-6hj4Component: gitpython-developers/GitPython PyPI: GitPythonAffected: all versions carrying the 3.1.47 blocklist fix, through current main verified at commit...

Cognee allows non-superusers to overwrite global LLM configuration

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all L...

OpenHarness remote project-context commands allow persistent prompt poisoning

OpenHarness /issue and /prcomments slash commands lack remoteinvocable=False protection, allowing remote channel senders to write attacker-controlled Markdown into project context files. Admitted remote attackers can inject malicious content into .openharness/issue.md and .openharness/prcomments....

OpenHarness remote resume commands expose other users' saved session snapshots

OpenHarness ohmo gateway /resume and /summary slash commands default remoteinvocable to True, allowing admitted remote senders to enumerate and load arbitrary session snapshots by ID. Attackers can exploit this to access victim snapshots containing private prompts, credentials, tool output, and...

PyOD persistence.load deserializes untrusted artifacts before validation

A vulnerability was detected in yzhao062 pyod 3.5.0/3.5.1/3.5.2. Affected is the function pyod.utils.persistence.load of the file pyod/utils/persistence.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. The pull request to fix thi...

Apache Thrift Python bindings have an Improper Handling of Highly Compressed Data (Data Amplification) vulnerability

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Python bindings.This issue affects Apache Thrift: before 0.24.0.Users are recommended to upgrade to version 0.24.0, which fixes the issue...