Advisories

The mobile_open_url tool in @mobilenext/mobile-mcp passes user-supplied URLs straight to Android's intent system through adb shell am start without scheme validation. Because MCP servers are driven by AI agents that can be manipulated through prompt injection, a malicious document or website could make the agent open tel:, sms:, mailto:, content:// or market:// URLs, enabling USSD codes, calls, SMS drafts, content provider access and app installation prompts.

BentoML's generate_containerfile() in src/bentoml/_internal/container/generate.py renders user-supplied dockerfile_template files with an unsandboxed jinja2.Environment that loads the jinja2.ext.do and jinja2.ext.debug extensions. A malicious bento archive containing a crafted template runs arbitrary Python on the host when a victim imports it and runs bentoml containerize, before any Docker container is created, bypassing container isolation.

BentoML's commit ce53491 added shlex.quote to fix command injection via system_packages in Dockerfile templates and images.py, but the cloud deployment path in src/bentoml/_internal/cloud/deployment.py was left out. Line 1648 of that file joins system_packages values from bentofile.yaml into an apt-get install shell command with an f-string and no quoting. The generated setup.sh is uploaded to BentoCloud and run on the cloud build infrastructure, so a malicious bentofile.yaml can execute arbitrary commands there during deployment, including during Deployment.watch() dev-mode deployments.

LiteLLM's /config/update endpoint does not enforce admin role authorization, so any authenticated user can reach it. From there, an attacker can change proxy configuration and environment variables, register pass-through endpoint handlers that run attacker-controlled Python code (remote code execution), read arbitrary server files via UI_LOGO_PATH and /get_image, and take over privileged accounts by overwriting UI_USERNAME and UI_PASSWORD.

The Mesop framework's WebSocket handler, `handle_websocket` in `mesop/server/server.py`, starts a new `threading.Thread` for every parsed `ui_request` with no thread pool, message queue or rate limit. An unauthenticated attacker can send a rapid stream of messages over one connection to exhaust threads and memory, causing a denial of service for applications built on the framework.

OpenClaw's openclaw npm package, versions <=2026.3.24, lets an LLM agent silently disable exec approval through the config.patch function, bypassing user consent for command execution. Maintainers fixed it in commit 76411b2afc4ae721e36c12e0ea24fd23e2fed61e, shipped in v2026.3.28, and rate the issue high severity.

CVE-2026-34524 affects SillyTavern versions prior to 1.17.0. A path traversal flaw in the chat endpoints lets an authenticated attacker read and delete arbitrary files under their user data root, such as secrets.json and settings.json, by supplying avatar_url="..". The weakness is classified as CWE-22.

CVE-2026-34522 affects SillyTavern, a locally installed user interface for text generation large language models, image generation engines, and text-to-speech voice models, prior to version 1.17.0. An authenticated attacker can inject traversal sequences into character_name in /api/chats/import to write attacker-controlled files outside the intended chats directory. The weakness is classified as CWE-22 and CWE-73.

The ONNX save_external_data method in onnx/external_data_helper.py is reported to contain a local TOCTOU flaw, enabling arbitrary file read and write. Between os.path.isfile and open, the code creates no atomic file and does not use O_NOFOLLOW, so an attacker can swap in a symlink and overwrite victim files under the same privilege scope. A possible path validation bypass on Windows, using absolute paths such as C:\ with a single path part, is described but not verified by the reporter.

GHSA-44c2-3rw4-5gvh reports an SSRF flaw in FileTools.download_file() in praisonaiagents. The function checks the destination path but passes the caller-supplied url directly to httpx.stream() with follow_redirects=True, so an attacker who controls the URL can reach any host the server can access, including cloud metadata services and internal services. On EC2 instances with IMDSv1 enabled, IAM credentials can be retrieved and written to disk, and the flaw is reachable through indirect prompt injection without authentication.

In PraisonAI, `SubprocessSandbox` runs commands through `subprocess.run()` with `shell=True` and blocks dangerous commands only by string-pattern matching. The blocklist omits `sh` and `bash`, so in STRICT mode a call such as `sh -c 'id'` escapes the sandbox, and blocked commands like curl, wget, nc and ssh become reachable. Combined with agent prompt injection, an attacker could reach the network, filesystem and cloud metadata services. The source reports testing on praisonai==4.5.87.

The praisonai package's passthrough() and apassthrough() functions take a caller-controlled api_base parameter and concatenate it with endpoint, sending the request via httpx.Client.request() when the litellm primary path raises AttributeError. No scheme validation, private IP filtering or domain allowlist is applied, enabling server-side request forgery to any host reachable from the server. On EC2 with IMDSv1, the source says an attacker can retrieve IAM credentials, and internal services such as Redis, Elasticsearch and the Kubernetes API can be reached without authentication from within the VPC.

PraisonAI's `run_python()` in `praisonai` builds a shell command by placing user-controlled code inside `python3 -c "<code>"` and runs it with `subprocess.run(..., shell=True)`. Its escaping only handles `\` and `"`, so `$()` and backtick substitutions execute as OS commands before Python starts, enabling arbitrary command execution as the process user. The advisory notes the function is reachable through indirect prompt injection, and the auto-generated Flask server ships with `AUTH_ENABLED = False` when no token is configured.

The Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. A malicious website could use DNS rebinding to bypass same-origin restrictions and send requests to an HTTP-based MCP server running on localhost without authentication, using `StreamableHTTPHandler` or `SSEHandler`. This could let an attacker invoke tools or access resources on the user's behalf, and servers using stdio transport are not affected.