Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
PYSEC-2026-3902
  • PyPI/praisonaiagents
 praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location 10 Sep
  • Fix available
  • Severity - 7.1 (High)
PYSEC-2026-3901
  • PyPI/praisonaiagents
 praisonaiagents: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool 10 Sep
  • Fix available
  • Severity - 6.1 (Medium)
PYSEC-2026-3904
  • PyPI/praisonaiagents
 praisonaiagents vulnerable to SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap) 10 Sep
  • Fix available
  • Severity - 7.5 (High)
PYSEC-2026-3905
  • PyPI/praisonaiagents
 praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`) 10 Sep
  • Fix available
  • Severity - 8.5 (High)
PYSEC-2026-3899
  • PyPI/praisonaiagents
 praisonaiagents: AgentServer declares auth_token but never enforces it on any route 10 Sep
  • Fix available
  • Severity - 8.2 (High)
PYSEC-2026-3900
  • PyPI/praisonaiagents
 praisonaiagents has a `web_crawl` SSRF protection bypass via unchecked redirect targets 10 Sep
  • Fix available
  • Severity - 7.7 (High)
PYSEC-2026-3903
  • PyPI/praisonaiagents
 PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code 10 Sep
  • Fix available
  • Severity - 7.8 (High)
PYSEC-2026-3898
  • PyPI/praisonaiagents
 praisonaiagents web_crawl vulnerable to SSRF via redirect-following 10 Sep
  • Fix available
  • Severity - 7.5 (High)
GHSA-gxmw-5f7x-6g22
  • PyPI/praisonaiagents
 praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location 25 Aug
  • Fix available
  • Severity - 7.1 (High)
GHSA-cfxv-8fw8-rwpv
  • PyPI/praisonaiagents
 praisonaiagents: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool 25 Aug
  • Fix available
  • Severity - 6.1 (Medium)
GHSA-vg6p-v9vm-6fgj
  • PyPI/praisonaiagents
 praisonaiagents vulnerable to SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap) 25 Aug
  • Fix available
  • Severity - 7.5 (High)
GHSA-x44h-65qv-cw74
  • PyPI/praisonaiagents
 praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`) 25 Aug
  • Fix available
  • Severity - 8.5 (High)
GHSA-7g3p-92qq-8wvh
  • PyPI/praisonaiagents
 praisonaiagents: AgentServer declares auth_token but never enforces it on any route 25 Aug
  • Fix available
  • Severity - 8.2 (High)
GHSA-8hjw-25cg-g52h
  • PyPI/praisonaiagents
 praisonaiagents has a `web_crawl` SSRF protection bypass via unchecked redirect targets 25 Aug
  • Fix available
  • Severity - 7.7 (High)
GHSA-hxmv-c4g6-5fqc
  • PyPI/praisonai
  • PyPI/praisonaiagents
 PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code 25 Aug
  • Fix available
  • Severity - 7.8 (High)
GHSA-5r34-2g38-6569
  • PyPI/praisonaiagents
 praisonaiagents web_crawl vulnerable to SSRF via redirect-following 25 Aug
  • Fix available
  • Severity - 7.5 (High)
Load more...