Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
5 findings — unauthenticated full-API exposure (F1, lead Critical), read-side authorization gap that persists even with APIAUTHKEY set (F2), unauthenticated file write of .py/.sh/.yaml to a server-returned path (F3), default-permissive CORS that combines with a loopback-only check to grant any browser page on whitelisted localhost ports credentialed cross-origin access (F-A4), and partial API-key disclosure via masksecret() (F-A5). --- Shared baseline (applies to all 5 findings) The shipped agent/.env.example line 112 ships APIAUTHKEY= commented out. requireauth() at agent/apiserver.py line 303 executes if not apikey: return and returns None immediately when APIAUTHKEY is unset, so every endpoint decorated with dependencies=[Depends(requireauth)] operates as unauthenticated. The shipped Dockerfile does not contain a USER directive, so the FastAPI process runs as uid=0(root) inside the container (verified: docker exec id returns uid=0(root) gid=0(root)). The…
Recommended action: Upgrade to 0.1.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
2 findings — safeuserpath() accepts any path under Path.home() or Path.cwd(), which inside the shipped root container resolves to /root and /app (so all of root's home, including /root/.ssh/idrsa, /root/.aws/credentials, /root/.kube/config, and /app/agent/.env, passes the check) (F9). readdocument() has no sandbox call at all and returns the full content of any path the FastAPI process can read, including /etc/shadow, /etc/passwd, /proc/self/environ, and any secret file mounted into the container (F10). F10 is strictly broader than F9 but they have different fix scopes (F10 = a missing safepath() call in one function; F9 = the envelope definition in pathutils.py), so both must be patched. --- Shared baseline (applies to both findings) The container has no USER directive (Dockerfile:15 — FROM python:3.11-slim AS runtime, no subsequent USER), so the FastAPI process runs as uid=0(root). The two file-read tools described here are members of the auto-discovered LLM tool registry.…
Recommended action: Upgrade to 0.1.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
5 findings — BashTool shell-injection sink (F6, the canonical RCE primitive), BackgroundRunTool async shell-injection sink (F7), backtest execmodule() runs top-level statements before the SignalEngine class check (F8 — independent RCE path that does not match BashTool signatures), readurl outbound HTTP forwarding without schema/host validation (F-B4 SSRF), and Jinja2 codegen with autoescape disabled for .py.j2 templates (F-B5, defense-in-depth code-injection sink). --- Shared baseline (applies to all 5 findings) All five tools are members of the auto-discovered tool registry the LLM agent gets at startup; the LLM is free to call any of them based on the user prompt. The tool registration is unconditional in default config — no operator opt-in flag gates them. Combined with GHSA-1 / F1 (unauthenticated POST /sessions/{id}/messages), every primitive in this advisory is reachable from any anonymous TCP client to port 8899. The container has no USER directive, so successful…
Recommended action: Upgrade to 0.1.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.