Advisory Catalog

NLTK: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions

Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)

Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)

Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data

icalendar has Algorithmic Complexity in Equality

Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access

consciousness-explorer / sublinear-time-solver MCP export_state has an arbitrary file write

eml_parser vulnerable to DoS via deeply nested parens in Received headers

mcp-contextforge-gateway has Server-Side Template Injection (SSTI) leading to Remote Code Execution in `PromptService._render_template` via unsandboxed Jinja2 Environment

browse-mcp has an arbitrary file write via unconfined download and state paths

qwed Vulnerable to Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`

urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage

NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement

NLTK: Corpus Reader Sandbox Bypass

djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls

pickem vulnerable to terminal escape-sequence injection via unsanitized item text

utcp-http has an OAuth2 `tokenUrl` Trust Boundary Bypass in OpenAPI Conversion

utcp-http SSRF: HTTP tool invocation follows redirects without re-validating the target

PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server

PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret

PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete

praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location

PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced

PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114

PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated

PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks

PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution

praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)

praisonaiagents: AgentServer declares auth_token but never enforces it on any route

praisonaiagents web_crawl vulnerable to SSRF via redirect-following

NLTK: pathsec SSRF protection can be bypassed when a proxy is configured

NLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses

NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary

GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)

GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()

GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination

GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)

Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled

Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()

Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths

Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content

Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion

CakePHP: SmtpTransport vulnerable to CRLF header injection

Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled

Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown

webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath

fast-uri vulnerable to host confusion via percent-encoded scheme normalization

fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references

fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding