Browse All

PraisonAI versions up to 4.6.37 contain a critical vulnerability where two functions in `agents_generator.py` use `spec.loader.exec_module` (a method that loads and runs Python code from a file) without any security checks or validation. An attacker can exploit this by providing a malicious Python file path through YAML configuration, either by modifying shared config files, submitting a crafted recipe via GitHub, or using prompt injection (tricking the AI into loading code from a malicious path), resulting in arbitrary code execution (the ability to run any commands on the system).

Ouroboros (an AI tool) has a remote code execution vulnerability where loading a `.env` file (a configuration file with environment variables) from a cloned repository could let an attacker run malicious code on your system. The flaw occurs because Ouroboros reads execution-controlling settings like CLI paths directly from the project directory's `.env` file without checking if they're trustworthy, allowing an attacker to point these paths to their own malicious scripts.

FastGPT, an AI Agent building platform, had a Server-Side Request Forgery (SSRF) vulnerability (a flaw that lets attackers trick a server into making requests to internal systems it shouldn't access) in versions before 4.15.0-beta1. An authenticated attacker could bypass security protections and make unauthorized requests to internal network services by exploiting an incomplete fix in the dataset preview endpoint when using the externalFile data import type.

Koel, a podcast player, has a vulnerability where it validates the main podcast feed URL for safety but fails to validate individual episode URLs extracted from the RSS feed (the XML file that lists episodes). When a user plays an episode, the server downloads content from these unvalidated URLs, allowing an attacker to trick it into accessing internal services like AWS metadata endpoints and stealing credentials or sensitive data.

SillyTavern, a locally installed tool for interacting with AI text and image generation models, had a vulnerability in versions before 1.18.0 where the /api/search/searxng endpoint allowed authenticated users to trick the server into making requests to internal or hidden services (SSRF, or server-side request forgery, where an attacker manipulates a server into accessing resources it shouldn't). An attacker could use this to access data from services that should only be available internally.

SillyTavern is a locally installed interface for interacting with text generation AI models. Before version 1.18.0, it had a security flaw where changing a password or recovering an account didn't log out existing sessions, because all session information was stored in a signed cookie (a small piece of data the browser keeps) rather than on the server, making it impossible to revoke access even after a password change.

Attackers are abusing ChatGPT's share feature (which lets users publish rendered content on legitimate OpenAI URLs) to display fake outage pages that trick users into downloading malware disguised as the ChatGPT desktop application. The "LLMShare" campaign uses Google ads to direct people to these malicious shared pages, which appear to come from OpenAI's domain but actually deliver malware-infected downloads through a fake installation portal.