Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
105 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
SubprocessSandbox in all modes (BASIC, STRICT, NETWORKISOLATED) calls subprocess.run() with shell=True and relies solely on string-pattern matching to block dangerous commands. The blocklist does not include sh or bash as standalone executables, allowing trivial sandbox escape in STRICT mode via sh -c '<command'. Details sandboxexecutor.py:179 (source) - sandboxexecutor.py:326 (sink) PoC Impact Users who deploy with --sandbox strict have no meaningful OS-level isolation. Any command blocked by the policy (curl, wget, nc, ssh) is trivially reachable via sh -c '<blockedcommand'. Combined with agent prompt injection, an attacker can escape the sandbox and reach the network, filesystem, and cloud metadata services. Suggested Fix
Recommended action: Upgrade to 4.5.97 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
passthrough() and apassthrough() in praisonai accept a caller-controlled apibase parameter that is concatenated with endpoint and passed directly to httpx.Client.request() when the litellm primary path raises AttributeError. No URL scheme validation, private IP filtering, or domain allowlist is applied, allowing requests to any host reachable from the server. Details passthrough.py:92 (source) - passthrough.py:109 (fallback trigger) - passthrough.py:110 (sink) PoC Impact On cloud infrastructure with IMDSv1 enabled, an attacker can retrieve IAM credentials via the EC2 metadata service. Internal services (Redis, Elasticsearch, Kubernetes API) are reachable without authentication from within the VPC. The Flask API server deploys with AUTHENABLED = False by default, making this reachable over the network without credentials.
Recommended action: Upgrade to 4.5.90 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
MCPToolIndex.searchtools() compiles a caller-supplied string directly as a Python regular expression with no validation, sanitization, or timeout. A crafted regex causes catastrophic backtracking in the re engine, blocking the Python thread for hundreds of seconds and causing a complete service outage. Details toolindex.py:365 (source) - toolindex.py:368 (sink) PoC Impact A single crafted query blocks the Python thread for hundreds of seconds, causing a complete service outage for the duration. The MCP server HTTP transport runs without an API key by default, making this reachable by any attacker on the network. Repeated requests sustain the DoS indefinitely.
Recommended action: Upgrade to 4.5.90 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The getalluserthreads function constructs raw SQL queries using f-strings with unescaped thread IDs fetched from the database. An attacker stores a malicious thread ID via updatethread. When the application loads the thread list, the injected payload executes and grants full database access. --- Details File Path: src/praisonai/praisonai/ui/sqlalchemy.py Flow: - Source (Line 539): - Hop (Line 547): - Sink (Line 576): --- Proof of Concept (PoC) --- Impact An attacker can achieve full database compromise, including: - Exfiltration of sensitive data (user emails, session tokens, API keys) - Access to all conversation histories - Ability to modify or delete database contents
Recommended action: Upgrade to 4.5.90 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The --mcp CLI argument is passed directly to shlex.split() and forwarded through the call chain to anyio.openprocess() with no validation, allowlist check, or sanitization at any hop, allowing arbitrary OS command execution as the process user. Details cli/features/mcp.py:61 (source) - praisonaiagents/mcp/mcp.py:345 (hop) - mcp/client/stdio/init.py:253 (sink) Fixed in commit 47bff65413beaa3c21bf633c1fae4e684348368c (v4.5.69) by introducing a command allowlist: PoC Impact Any deployment where the --mcp argument is influenced by untrusted input is exposed to full OS command execution as the process user. No authentication is required.
Recommended action: Upgrade to 4.5.69 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.