Advisory Catalog

Crawl4AI: Arbitrary file write (path traversal) in crawler downloads can lead to RCE

netlicensing-mcp: REST Path Traversal Bypasses Token Redaction

PGHoard: Password written to debug log

Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID

Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP

praisonai-platform: Authorization Bypass Through User-Controlled Key

pypdf: Missing stream length values ignore defined limits

praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery

PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable

PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication

PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter

praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)

PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation

PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default

PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml

PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters

PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion

PraisonAI Code agent tools fail open without a workspace boundary

PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai

PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)

PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API

PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation

PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints

PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding

PraisonAI: Jobs API exposes agent-execution endpoints with no authentication

PraisonAI: Arbitrary File Read via `@file:` Mention Path Traversal

praisonai: recipe serve auth middleware silently disables itself when no secret is set

praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS

PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass

PraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs API

PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in

PraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder

PraisonAI: SpiderTools redirect-target SSRF protection bypass

PraisonAI: Compute-bridged file tools allow shell command injection

PraisonAI recipe.run_stream skips dangerous-tool policy enforcement

PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools

PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing

PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage

PraisonAI Slack app_mention bypasses configured user/channel authorization

PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard

PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools

PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal

PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals

PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint

BBOT: Arbitrary File Write in postman_download Module

BBOT: Symlink-Following Arbitrary Write via github_workflows Module

BBOT: Server-Side Request Forgery (SSRF) in docker_pull module via WWW-Authenticate realm parsing

BBOT: Path traversal (Zip-Slip) in unarchive module - incomplete fix for CVE-2025-10284

marimo contains a reflected cross-site scripting vulnerability in the notebook page