Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
estimatebatchcost (atomicagents/agent.py) looks up the per-model output price with PRICING.get(model, {}), returning 0.0 for any model not in the hardcoded pricing table. checkbatchreservation then early-returns when the reservation is <= 0, skipping the batch reservation entirely. That reservation is the only defense against the documented fan-out race where every parallel helper/delegate reads the identical pre-batch on-disk cost total and each passes its individual check even though the collective spend overruns the configured cap. Impact: an operator running any model not in the pricing table (self-hosted/Ollama/vLLM, a new provider SKU) with costguardrails + dailycapusd set believes the cap protects them, but a single parallel batch can blow past the cap. The parallel-helper model argument can also be steered to an unknown id. The sibling dream.estimatedreamcost does this correctly (PRICING.get(model, fallbackpricing())), which makes this a clear defect. Affected: agent.py…
Recommended action: Upgrade to 1.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The HTTP MCP server-registry backend factory (atomicagents/mcpregistry/http.py, makehttpmcpserverregistrybackendfromurl) accepts both http and https schemes. Catalog entries carry command/args that are type-validated but content-unrestricted, and are later spawned as local stdio subprocesses by MCPClientPool. Over a cleartext http:// catalog URL, a network man-in-the-middle can rewrite the catalog response to inject an arbitrary command/args and obtain code execution on the agent host, with no LLM involvement. The Policy MCP allowlist is not a default mitigation (mcpallowfn defaults to None), so absent an operator-authored allowlist every resolved spec connects. Affected: mcpregistry/http.py, all versions through 1.0.0. (The https path is sound: httpx defaults to verify=True, followredirects=False.) Fix: require https by default and gate http:// behind a loud explicit opt-in. Defense-in-depth: allowlist the resolved command basename (or require confirmation) before any…
Recommended action: Upgrade to 1.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The optional dashboard HTTP server (atomicagents/dashboard/serve.py) builds filesystem paths directly from the request path and serves them without a containment check. It is the only per-request untrusted-path site in the codebase that does not route through io.saferesolveunder. Literal ../ segments survive urlparse and Path joining, so a request can read files outside the intended agentsroot (including via the static branch). Impact: arbitrary file read. The default bind is loopback, but --host is an operator-settable documented flag; binding 0.0.0.0 exposes this to the LAN. Even on loopback it is reachable via DNS-rebinding from a browser or SSRF from a co-located service. Affected: dashboard/serve.py (DashboardHandler.doGET / servefile), all versions through 1.0.0. Fix: route every served path through io.saferesolveunder against the intended root and return 404 on PathTraversalError; reject ../separators early; optionally refuse a non-loopback --host unless an explicit auth/allow…
Recommended action: Upgrade to 1.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.