MCP and agent packages
The packages that advisories about the Model Context Protocol and AI agents name, with what the Exposure Registry knows about each one: the LLM components it declares and the authority its dependencies grant (shell, files, browser, network, code execution).
Advisories are grouped by topic. The Model Context Protocol view counts the records that match that topic, and the AI agents view counts those that match the AI agents or the agent-to-agent protocols topic. Package names are those the advisory source lists. How authority is measured
- Advisories
- 160
- Critical or high
- 106
- Packages named
- 44
- Advisories listed as exploited (CISA KEV)
- 0
51 advisories were published in the last 90 days and 37 in the 90 days before. 74 of the 160 name no package, because their source lists none.
Advisories by month of publication
| Month | Items |
|---|---|
| May 2025 | 1 |
| Jun 2025 | 4 |
| Jul 2025 | 2 |
| Aug 2025 | 5 |
| Sep 2025 | 10 |
| Oct 2025 | 4 |
| Nov 2025 | 3 |
| Dec 2025 | 4 |
| Jan 2026 | 6 |
| Feb 2026 | 14 |
| Mar 2026 | 13 |
| Apr 2026 | 9 |
| May 2026 | 24 |
| Jun 2026 | 4 |
| Jul 2026 | 17 |
| Aug 2026 | 17 |
| Sep 2026 | 17 |
| Oct 2026 | 4 |
Latest advisories
- CriticalCVE-2026-108263: Astron Agent code-node execution as root through workflow run endpoints2026-10-09
- LowCVE-2026-107288: Pydantic AI web fetch bypasses blocked_domains via hostname variants2026-10-08
- HighCVE-2026-107286: Pydantic AI streamed requests leak concurrency slots, causing denial of service2026-10-08
- HighCVE-2026-82627: Uncanny Automator WordPress plugin PHP object injection via deserialization2026-10-08
- HighCVE-2026-55157: Token Optimizer MCP OS command injection through smart_user username argument2026-09-28
- MediumCVE-2026-55156: Token Optimizer MCP dashboard path traversal via sessionId in session endpoints2026-09-28
- CriticalCVE-2026-101065: Obot Docker quickstart exposes admin access without authentication2026-09-27
- HighCVE-2026-84462: Zammad security filter bypass in AI Agent configuration fields2026-09-25
Authority in the registry
282 registry packages declare an agent framework. Their dependencies grant:
- Outbound HTTP105Makes outbound requests, the precondition for server-side request forgery and exfiltration.
- MCP tools49Exposes or calls Model Context Protocol tools, which pass authority between agents and servers.
- File system23Reads or writes files, so path traversal and data exposure are in reach.
- Browser control16Drives a browser, so it can act on websites with the user's sessions.
- Code execution14Runs code it is given, so injected instructions can become arbitrary code.
- Shell commands4Starts processes on the host, the most direct path from a prompt to the operating system.
Advisories that name praisonai
ClosePyPI. Every record that names the package, on any topic, newest first. RSS feed for this package
- HighGHSA-cv3g-hj65-pcfh: PraisonAI: Shell command allowlist bypass via find -exec built-in action2026-10-08
- CriticalGHSA-9mp3-24cc-77mg: PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls2026-10-08
- HighGHSA-hc5v-gxvj-58wh: PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface2026-10-08
- HighGHSA-4w49-gwv8-fpjg: PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF2026-10-08
- CriticalCVE-2026-57125: PraisonAI unauthenticated command execution through POST /api/v1/runs Jobs API2026-09-14
- HighGHSA-pvph-5j39-v8qc: PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server2026-08-25
- HighGHSA-2jgc-f764-c5r2: PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete2026-08-25
- HighGHSA-pvxx-r596-f5qj: PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced2026-08-25
- HighGHSA-r7v3-x45f-g7hp: PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated2026-08-25
- HighGHSA-ch89-h4r2-c8f8: PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks2026-08-25
- HighGHSA-7ww9-85pg-cv4x: PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution2026-08-25
- HighGHSA-hxmv-c4g6-5fqc: PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code2026-08-25
- HighCVE-2026-61439: PraisonAI prompt injection defense fails to block HIGH-level threats2026-07-11
- MediumCVE-2026-60086: PraisonAI prompt injection defense bypass via single or double-vector injections2026-07-10
- CriticalGHSA-29w3-p9w9-wc47: PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation2026-06-18
- HighGHSA-hvhp-v2gc-268q: PraisonAI has an Arbitrary File Write in Python API2026-05-29
- CriticalGHSA-vg22-4gmj-prxw: PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution2026-05-29
- HighGHSA-9cr9-25q5-8prj: PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate2026-05-29
- CriticalGHSA-4mr5-g6f9-cfrh: PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)2026-05-29
- MediumGHSA-5cxw-77wg-jrf3: PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context2026-05-29
- CriticalGHSA-8444-4fhq-fxpq: PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default2026-05-29
- HighGHSA-78r8-wwqv-r299: PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-443342026-05-29
- HighGHSA-xcmw-grxf-wjhj: PraisonAI has unauthenticated RCE via `tool_override.py` (CVE-2026-40287 patch bypass)2026-05-06
- CriticalGHSA-8x8f-54wf-vv92: PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions2026-04-10
- HighCVE-2026-40116: PraisonAI unauthenticated WebSocket endpoint at /media-stream drains API credits2026-04-09
- HighCVE-2026-40113: PraisonAI deploy script env var injection via commas in Cloud Run deployment2026-04-09
- MediumCVE-2026-40112: PraisonAI Flask API stored cross-site scripting through unsanitized agent output2026-04-09
- CriticalGHSA-2763-cj5r-c79m: PraisonAI Vulnerable to OS Command Injection2026-04-08
- HighGHSA-r4f2-3m54-pp7q: PraisonAI Has Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox2026-04-01
- HighGHSA-x6m9-gxvr-7jpv: PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback2026-04-01
Packages named in advisories
44 packages
| Package | Advisories | Highest severity | Latest advisory | Exploited | Authority |
|---|---|---|---|---|---|
| @anthropic-ai/claude-codenpm | 22 | Critical | Not in the registry | ||
| github.com/pinchtab/pinchtabGo | 6 | High | Not in the registry | ||
| github.com/hatchet-dev/hatchetGo | 5 | Medium | Not in the registry | ||
| pydantic-aiPyPI | 4 | High | None detected | ||
| pydantic-ai-slimPyPI | 4 | High | Outbound HTTP | ||
| omnigentPyPI | 4 | Critical | Not in the registry | ||
| n8nnpm | 4 | High | Code execution, File system, MCP tools, Shell commands | ||
| @evomap/evolvernpm | 3 | Critical | Not in the registry | ||
| github.com/pinchtab/pinchtab/cmd/pinchtabGo | 3 | High | Not in the registry | ||
| @ooples/token-optimizer-mcpnpm | 2 | High | Not in the registry | ||
| @agenticmail/corenpm | 2 | High | Not in the registry | ||
| @agenticmail/apinpm | 2 | High | Not in the registry | ||
| apm-cliPyPI | 2 | High | Not in the registry | ||
| @paperclipai/servernpm | 2 | Critical | Not in the registry | ||
| @enclave-vm/corenpm | 2 | Critical | Not in the registry | ||
| enclave-vmnpm | 2 | Critical | Not in the registry | ||
| opencode-ainpm | 2 | High | Not in the registry | ||
| neuron-core/neuron-aicomposer | 2 | Critical | Not in the registry | ||
| hatchetGo | 1 | High | Not in the registry | ||
| hatchet-dev/hatchetGo | 1 | Medium | Not in the registry | ||
| @andrea9293/mcp-documentation-servernpm | 1 | High | Not in the registry | ||
| @apify/actors-mcp-servernpm | 1 | High | Not in the registry | ||
| @trigger.dev/corenpm | 1 | High | Not in the registry | ||
| @jshookmcp/jshooknpm | 1 | Medium | Not in the registry | ||
| n8nEcosystem not stated | 1 | High | Not in the registry | ||
| @agenticmail/claudecodenpm | 1 | High | Not in the registry | ||
| @agenticmail/codexnpm | 1 | High | Not in the registry | ||
| @agenticmail/openclawnpm | 1 | High | Not in the registry | ||
| agentic-flownpm | 1 | High | Not in the registry | ||
| @agenticmail/mcpnpm | 1 | High | Not in the registry | ||
| praisonaiPyPI | 1 | Critical | Not in the registry | ||
| github.com/safedep/gryphGo | 1 | Medium | Not in the registry | ||
| @yoda.digital/gitlab-mcp-servernpm | 1 | Critical | Not in the registry | ||
| apmPyPI | 1 | High | Not in the registry | ||
| paperclipainpm | 1 | Critical | Not in the registry | ||
| agixtPyPI | 1 | High | Not in the registry | ||
| openclawnpm | 1 | High | Not in the registry | ||
| langflowPyPI | 1 | Critical | None detected | ||
| github.com/agentgateway/agentgatewayGo | 1 | Medium | Not in the registry | ||
| microsoft-semantickernel-corenuget | 1 | Critical | Not in the registry | ||
| semantic-kernelPyPI | 1 | Critical | Outbound HTTP, MCP tools | ||
| @mastra/mcp-docs-servernpm | 1 | Medium | Not in the registry | ||
| @openai/codexnpm | 1 | High | Not in the registry | ||
| khojPyPI | 1 | Medium | Code execution, Outbound HTTP |
Topics are assigned by matching a record's title and summary against published patterns, so an advisory that never uses the words is missed and one that mentions them in passing is counted. An advisory that names several packages counts once for each. A package is listed with the ecosystem its advisory source states, and by name alone when the source states none.
Authority is read from the dependencies a package's latest release declares, and it is known only for packages the Exposure Registry tracks. It shows what a package's dependencies can do on the host. It does not show that a model is given that reach. Severity comes from the source advisory when it gives one, otherwise from the classifier. Dates are in UTC.