Browse All

Dradis Community Edition has a broken authorization check in its ProvidersController and AgentsController because they check for a constant that never exists, allowing any logged-in non-admin user to create fake AI providers pointing to arbitrary websites. When triggered, the server makes requests to these attacker-controlled URLs (SSRF, or server-side request forgery, where a server is tricked into making requests to unintended targets) and leaks the responses back to the attacker through error messages.

A security flaw (CVE-2026-78379) in Strands Agents Tools, a Python SDK for building AI agents, allows attackers to bypass the approval prompt in the python_repl tool (which normally requires human consent before running Python code on a system). An attacker can craft a malicious prompt that uses the batch tool to sneak in a keyword argument, letting them execute arbitrary Python code without permission.

browse-mcp versions before 0.8.2 had a critical security flaw where file download and state management functions didn't properly check file paths, allowing attackers to write files to any location on the system (like startup scripts or configuration files) and potentially execute code. The vulnerability could be exploited by malicious MCP clients (software components that interact with the browser tool) or through prompt injection (tricking an AI by hiding instructions in web page content).

The qwed package (version 5.1.1) has a critical vulnerability where user-supplied mathematical expressions are passed directly to SymPy's `parse_expr()` function without restrictions. Since `parse_expr()` internally uses Python's `eval()` (a function that runs arbitrary code), any authenticated user can execute malicious Python code on the server, leading to complete compromise. An attacker only needs to create a free account through the signup endpoint to exploit this.

Vocos, an AI model loading library, has a security flaw where it loads and runs any code specified in a configuration file without checking if that code is safe (instantiate_class, a function that creates objects based on config file instructions, doesn't use an allowlist to restrict which classes can be loaded). This means if you load a model from an untrusted source, the attacker who controls that source can run arbitrary code on your computer during the loading process.

Nokogiri versions before 1.19.3 have a ReDoS vulnerability (regular expression denial of service, where carefully crafted input causes a regex pattern to take exponentially longer to process) in how it parses CSS selectors. Attackers can exploit this by injecting malicious CSS selectors into methods like Node#css and Node#at_css to make the application hang or crash.

A vulnerability in the utcp-http library allows attackers to bypass URL validation through HTTP redirects. When a tool is invoked, the library validates the initial URL but then follows redirects without re-checking where they lead, allowing an attacker to redirect the request to internal services like cloud metadata endpoints (systems that store sensitive configuration data) and steal the response. This is a form of SSRF (server-side request forgery, where an attacker tricks a server into making requests to unintended targets).

mcp-shell has two security flaws that disable protections in both deployment methods. By default, security is turned off (opt-in instead of opt-out), so users following the standard installation instructions run an unrestricted shell server where any connected LLM can execute arbitrary commands through prompt injection. Additionally, even Docker users who enable "secure mode" can bypass it by calling allowed programs like bash or python with flags that create interactive shells, giving the LLM direct command execution.

mcp-shell has a security flaw where its default configuration allows `/bin/bash` as an allowed command, but the validator only checks the first word of a command and ignores flags like `-c`. This means an attacker can send `/bin/bash -c <any-command>` to bypass the allowlist (a restrictions list) and run any command on the system, such as `id` or `curl`, with no authentication needed.

mcp-shell's secure mode is supposed to restrict which programs can run, but it has a bypass vulnerability. An attacker can use a Git feature (shell aliases, triggered by the `!` character) to run any command they want, even though the security checker blocks other dangerous characters. The default Docker setup runs this vulnerable version without protection, so anyone who can send commands can take over the system.

PraisonAI's HTTP server has a flaw in how it checks which websites are allowed to make requests to it, using a prefix match that allows attackers to bypass it by registering domains like 'localhost.attacker.com'. Combined with no default authentication and no requirement for session validation, an attacker can trick a victim into visiting a malicious webpage that silently makes requests to the victim's local PraisonAI server to create rules that inject the attacker's instructions into all future agent runs on that machine.

PraisonAI's Jobs API (a FastAPI service that runs AI agent jobs) has no authentication checks on any of its endpoints. This means anyone who can reach the server can submit jobs to run against the system's AI credentials, view all jobs and their results, cancel running jobs, and delete completed jobs without providing any token, password, or proof of identity. The vulnerability is separate from a similar bug that was already fixed in an older Flask-based API component, but this FastAPI jobs module was left unpatched.

PraisonAI's `praisonai serve` command accepts an `--api-key` flag for authentication, but the flag is parsed and never actually used to protect the server. The FastAPI application (a web framework for building APIs) is created without any authentication middleware (code that checks credentials before allowing access), leaving endpoints like `POST /agents` completely open to anyone, even though the help text promises the key would protect them. This affects version 4.6.50 and likely all versions since 4.6.34 when the serve system was introduced.

PraisonAI's `praisonai serve agents` command accepts an `--api-key` flag that claims to enable authentication, but the code that creates the HTTP server never actually uses this key. This means anyone on the network can invoke agents through the `POST /agents` and `POST /agents/{agent_name}` routes without providing any credentials, even though the operator thought they were securing the service. The problem is made worse because a working authentication function already exists in the same codebase (called `verify_token`, which guards other API routes), but it is simply not applied to these agent-invocation routes.

PraisonAI's workspace containment system, which is supposed to prevent agent tools from accessing files outside a designated directory, has three critical flaws. First, the `read_file`, `write_file`, `apply_diff`, and `search_replace` tools use `os.path.abspath()` instead of `realpath()` (a function that fully resolves symbolic links, or pointers to other files), allowing attackers to use symlinks inside the workspace to read or modify files outside it. Second, `list_files()` doesn't check containment at all, letting attackers escape using `../` path traversal (a technique where `../` moves up one directory level). Third, `execute_command()` doesn't validate the working directory, letting attackers run commands from outside the workspace.