CWE-862

{
  "affected": [],
  "aliases": [
    "CVE-2026-0023"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-02T19:16:30Z",
    "severity": "HIGH"
  },
  "details": "In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
  "id": "GHSA-9cfj-6m9j-h4ww",
  "modified": "2026-03-06T06:30:31Z",
  "published": "2026-03-02T21:31:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0023"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/docs/security/bulletin/2026/2026-03-01"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/2026-03-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-12937"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-18T09:15:49Z",
    "severity": "MODERATE"
  },
  "details": "The ACF Flexible Layouts Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the \u0027acf_flm_update_template_with_pasted_layout\u0027 function in all versions up to, and including, 1.1.6. This makes it possible for unauthenticated attackers to update custom field values on individual posts and pages.",
  "id": "GHSA-9cg3-r62g-92w5",
  "modified": "2025-11-18T09:30:52Z",
  "published": "2025-11-18T09:30:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12937"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/acf-flexible-layouts-manager/trunk/includes/ajax/ajax-paste.php#L4"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/915cce97-8305-4249-b2d3-c4da2f59a95a?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-57808"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-23T12:18:30Z",
    "severity": "MODERATE"
  },
  "details": "Subscriber Arbitrary Content Deletion in WP EasyPay \u003c= 4.5.0 versions.",
  "id": "GHSA-9cmg-7p6p-5xq3",
  "modified": "2026-07-23T12:32:25Z",
  "published": "2026-07-23T12:32:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57808"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/wp-easy-pay/vulnerability/wordpress-wp-easypay-plugin-4-5-0-arbitrary-content-deletion-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-4347"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-06-07T02:15:13Z",
    "severity": "MODERATE"
  },
  "details": "The function update_shipment_status_email_status_fun in the plugin Advanced Shipment Tracking for WooCommerce in versions up to 3.2.6 is vulnerable to authenticated arbitrary options update. The function allows attackers (including those at customer level) to update any WordPress option in the database. Version 3.2.5 was initially released as a fix, but doesn\u0027t fully address the issue.",
  "id": "GHSA-9cp6-9c8r-555x",
  "modified": "2024-04-04T04:38:02Z",
  "published": "2023-06-07T03:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4347"
    },
    {
      "type": "WEB",
      "url": "https://blog.nintechnet.com/wordpress-advanced-shipment-tracking-for-woocommerce-fixed-critical-vulnerability"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4174b47a-75d0-4ada-bd4d-efbaf0b1a049?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-24611"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-17T13:20:10Z",
    "severity": "CRITICAL"
  },
  "details": "Unauthenticated Broken Access Control in MetForm Pro \u003c= 3.9.1 versions.",
  "id": "GHSA-9cpf-p5q4-qjrx",
  "modified": "2026-06-17T18:35:47Z",
  "published": "2026-06-17T18:35:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24611"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/metform-pro/vulnerability/wordpress-metform-pro-plugin-3-9-1-broken-access-control-vulnerability-2?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-92763"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-16T21:17:25Z",
    "severity": "HIGH"
  },
  "details": "Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint. Attackers with only the import action can replace project configuration files including security-relevant settings like node executors and SSH key paths that affect job execution.",
  "id": "GHSA-9cq6-jmp6-5vf7",
  "modified": "2026-09-16T21:32:53Z",
  "published": "2026-09-16T21:32:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92763"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rundeck/rundeck/issues/10459"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rundeck/rundeck"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rundeck/rundeck/blob/v5.20.1/rundeckapp/grails-app/controllers/rundeck/controllers/ProjectController.groovy#L3395-L3506"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/rundeck-through-6.2.1-authorization-bypass-via-project-import"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/siyuan-note/siyuan/kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-20260726161145-9b8e8956f997"
            },
            {
              "fixed": "0.0.0-20260812083335-251596fc0de2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-01T16:24:38Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Scope note\n\nThis endpoint does not exist in v3.7.3 or on master. It was introduced on the development branch by commit `9b8e8956f` on 2026-07-27 and is present on the current development head. No released stable version is affected.\n\n### Summary\n\n`/api/av/getAttributeViewSearchTarget` is registered with `CheckAuth` only and performs no authorization of any kind. Given a database identifier and a keyword, it searches that database\u0027s rows and returns matching content, regardless of whether the caller may see the database, the rows, or the notebook holding them.\n\nCommit `64c26e74b` on 2026-07-26 closed a reader-reachable gap on `getAttributeViewFieldViews` by adding `CheckReadonly` at router line 536. `9b8e8956f`, the following day, registered this endpoint at line 535 without it. The new route returns more than the one that was just closed: row content rather than field-visibility metadata.\n\n### Details\n\n**Route.** `kernel/api/router.go:535` on the development branch:\n\n```go\nginServer.Handle(\"POST\", \"/api/av/getAttributeViewSearchTarget\", model.CheckAuth, getAttributeViewSearchTarget)\n```\n\nNo `CheckReadonly`, no `CheckAdminRole`.\n\n**Handler.** `kernel/api/av.go` parses its arguments and calls `model.GetAttributeViewSearchTarget(id, keywords)`. `IsReadOnlyRoleContext`, `publishAccess` and any encrypted-notebook check are all absent. The sink is `kernel/model/attribute_view_render.go:69`.\n\n**The adjacent routes make the omission stark.** Lines 533 to 541 all handle the same data class:\n\n| Line | Route | Guard |\n|---|---|---|\n| 534 | `getAttributeViewKeys` | `CheckAuth`, filters in-body for readers |\n| 535 | `getAttributeViewSearchTarget` | `CheckAuth`, nothing |\n| 536 | `getAttributeViewFieldViews` | `CheckAuth`, `CheckReadonly` |\n| 540 | `searchAttributeView` | `CheckAuth`, `CheckReadonly` |\n| 541 | `getAttributeView` | `CheckAuth`, `CheckReadonly` |\n\nThe guard at 536 is the one added by `64c26e74b`. The new route sits directly above it without one.\n\n**Why this is not bounded by identifier guessing.** The closest functional sibling, `renderAttributeView`, applies two distinct reader protections:\n\n1. A containing-document gate, `CheckAttributeViewBlockAccessableByPublishAccess`, which is the full gate including `CheckPublishAuthCookie`.\n2. Per-item filtering, `FilterAttributeViewByPublishAccess`, using the `itemAccess` and `attributeAccess` maps. This strips rows bound to restricted blocks out of views the reader is otherwise entitled to see.\n\nThe second layer is what makes this exploitable without guesswork. A reader takes a database block identifier from the published DOM of a page they are allowed to view, then queries this endpoint against that same database and receives precisely the rows `renderAttributeView` removed from the view they were served. `GetAttributeViewSearchTarget` reaches the same internal render function; it simply bypasses the API-layer gate.\n\n**Two aggravating properties.**\n\n`getAttributeViewSearchMatches` runs `strings.Contains` across every value of every key, and the response carries `MatchedKeyID` alongside the title. That is a substring oracle over every column, so a caller can test for content without needing to retrieve it wholesale.\n\nThe path also branches on `IsEncryptedBox(tree.Box)` into `ParseAttributeViewInBox`, so it reads encrypted notebooks while they are unlocked. `isEncryptedNotebookDeniedForPublish` appears seventeen times across the block, ref, outline, search and filetree paths, and does not appear in `av.go` at all.\n\n**Extraction is iterative.** Each request returns a single row. Systematic recovery of a database therefore requires many requests rather than one bulk response. There is no rate limiting on the path, and the substring oracle narrows the search considerably, but I mention it so the effort is not overstated.\n\n### Proof of Concept\n\nPrecondition: a development-branch build, publish mode enabled (default port 6808), anonymous when `Publish.Auth.Enable` is `false`. A published page embedding a database whose view contains rows bound to blocks the reader cannot access.\n\nStep 1, take the database block identifier from the published page\u0027s DOM. It is present in the served markup.\n\nStep 2, confirm what the reader is supposed to see:\n\n```\nPOST http://127.0.0.1:6808/api/av/renderAttributeView\n{\"id\":\"\u003cdatabase block id\u003e\"}\n\n\u2192 200, rows bound to restricted blocks are absent\n```\n\nStep 3, retrieve them anyway:\n\n```\nPOST http://127.0.0.1:6808/api/av/getAttributeViewSearchTarget\n{\"id\":\"\u003csame database block id\u003e\",\"keywords\":\"\u003cterm\u003e\"}\n\n\u2192 200, matching rows including those step 2 withheld,\n       with MatchedKeyID identifying the column that matched\n```\n\nThe differential between steps 2 and 3, on one session against one database, is the finding.\n\n### Impact\n\nAn anonymous reader in publish mode, or any publish `RoleReader`, reads the content of database rows that the publish filters deliberately withhold, including rows in documents that are hidden, password-protected or forbidden, and rows in encrypted notebooks while those notebooks are unlocked. The database identifier required is published in the DOM of pages the reader is entitled to view, so no enumeration or guessing is involved. The substring matching across all columns lets a caller confirm specific content without retrieving whole rows.\n\nConfidentiality only, with no integrity or availability impact.\n\n### Suggested fix\n\nAdd `CheckReadonly` at router line 535, matching lines 536, 540 and 541. If read-only roles are meant to use this endpoint, apply `CheckAttributeViewBlockAccessableByPublishAccess` and `FilterAttributeViewByPublishAccess` inside the handler as `renderAttributeView` does, and add the `isEncryptedNotebookDeniedForPublish` check that the block, ref, outline, search and filetree paths already carry.\n\nMore generally, the attribute-view routes now split between middleware-gated and in-body-gated, and a new route defaults to neither. A registration-time convention, where any new `/api/av/` route is `CheckReadonly` unless it deliberately implements in-body filtering, would prevent this recurring.",
  "id": "GHSA-9cqf-hhrq-7v45",
  "modified": "2026-10-01T16:24:38Z",
  "published": "2026-10-01T16:24:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9cqf-hhrq-7v45"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/commit/9b8e8956f997d6452d40aff4159d58f3283a98a4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/siyuan-note/siyuan"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-108626"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-10T22:16:37Z",
    "severity": "MODERATE"
  },
  "details": "JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController queryById handler that allows low-privileged authenticated users to read any message push record. Attackers can supply arbitrary record ids to GET /sys/message/sysMessage/queryById to disclose message content and receiver addresses of other users.",
  "id": "GHSA-9cr4-cm48-69pq",
  "modified": "2026-10-11T00:30:53Z",
  "published": "2026-10-11T00:30:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108626"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_record_query_by_id.py"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/message/controller/SysMessageController.java#L117-L121"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sysmessage-querybyid-endpoint"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-91047"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-19T06:17:25Z",
    "severity": "MODERATE"
  },
  "details": "The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooCommerce product downloads, allowing unauthenticated users to bypass the payment requirement and retrieve any product\u0027s paid downloadable file.",
  "id": "GHSA-9cr7-6wq5-54c2",
  "modified": "2026-10-19T12:32:46Z",
  "published": "2026-10-19T06:32:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91047"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/08afea88-4268-40b3-b5fb-0ac2546c3100"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.6.39"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "PraisonAI"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.6.40"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47394"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-22",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-29T22:30:58Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe fix for GHSA-9mqq-jqxf-grvw / CVE-2026-44336 is incomplete. The original advisory description named four vulnerable handlers in `mcp_server/adapters/cli_tools.py`:\n\n\u003e \"registers four file-handling tools by default, `praisonai.rules.create`, `praisonai.rules.show`, `praisonai.rules.delete`, **and `praisonai.workflow.show`**. Each accepts a path or filename string from MCP `tools/call` arguments\u2026 **with no containment check**.\"\n\nCommit `68cc9427` (\"fix(security): harden MCP rules path handling\u2026\") added a `_resolve_rule_path()` helper and applied it to `rules.create`, `rules.show`, and `rules.delete`. `workflow.show` was left unchanged. Two adjacent handlers in the same file have the same pattern, `workflow.validate` and `deploy.validate`. Neither was mentioned in the original advisory. Both remain unchanged.\n\nThe original advisory also identified the dispatcher (`server.py:281-298`) as a root cause. It accepts unvalidated `**kwargs` from `params[\"arguments\"]` with no enforcement against the tool\u0027s declared `input_schema`. That code is unchanged in HEAD as of commit `42221210`.\n\n**Result**: A single unauthenticated MCP `tools/call` to `praisonai.workflow.show` returns the contents of any file the host user can read: `/etc/passwd`, `~/.ssh/id_rsa`, `~/.aws/credentials`, or any project `.env`.\n\n## Affected functionality\n\n`src/praisonai/praisonai/mcp_server/adapters/cli_tools.py`:\n\n| Lines | Tool | Bug |\n|-------|------|-----|\n| 63-73 | `praisonai.workflow.show` | Returns the full contents of any file the host user can read |\n| 42-61 | `praisonai.workflow.validate` | Reads any path; YAML parser error messages leak file existence + content fragments |\n| 415-432 | `praisonai.deploy.validate` | Same pattern as `workflow.validate`. The `config_path=\"deploy.yaml\"` default does not constrain the input. |\n\n`src/praisonai/praisonai/mcp_server/server.py:281-298`, `_handle_tools_call`:\n\n```python\nasync def _handle_tools_call(self, params: Dict[str, Any]) -\u003e Dict[str, Any]:\n    tool_name = params.get(\"name\")\n    arguments = params.get(\"arguments\", {})\n    ...\n    tool = self._tool_registry.get(tool_name)\n    ...\n    if asyncio.iscoroutinefunction(tool.handler):\n        result = await tool.handler(**arguments)        # \u2190 no schema enforcement\n    else:\n        result = tool.handler(**arguments)\n```\n\nAny JSON arguments the MCP client sends become a `**kwargs` call to the handler. The original advisory pointed at this code path as the root cause. The May 3 patch did not change it.\n\n## Default deployment is exposed\n\n`src/praisonai/praisonai/mcp_server/transports/http_stream.py:38-91`:\n\n- `host` defaults to `127.0.0.1`, which is still reachable from any local process or container neighbour on loopback.\n- `api_key` defaults to `None`. The auth check at `http_stream.py:192-198` is gated on `if self.api_key:`, so it is skipped when no key is configured. There is no env var or config switch that turns auth on by default.\n- The same handlers are also reachable on the stdio transport, which is the exploitation model the original advisory was written around (Claude Desktop, Cursor, Continue.dev, Claude Code).\n\n## Other file-read sinks reachable via the same dispatcher\n\nThese were not named in the original advisory. They confirm the bug is dispatcher-wide and not limited to `cli_tools.py`:\n\n- `mcp_server/adapters/capabilities.py:19-28`, `praisonai.audio.transcribe(file_path)`. Opens any host file and ships it to OpenAI Whisper.\n- `mcp_server/adapters/extended_capabilities.py:47-62`, `praisonai.files.create(file_path)`. Uploads any host file to OpenAI Files. A follow-up call to `praisonai.files.content(file_id)` (`extended_capabilities.py:103-113`) returns the bytes.\n- `mcp_server/adapters/extended_capabilities.py:243-258`, `praisonai.ocr_extract(image_path)`. Opens any image, returns OCR text.\n\nThe three handlers in `cli_tools.py` are the most direct primitives, since they echo the file content back without an OpenAI round-trip.\n\n## Proof of Concept\n\n### Layout\n```\nPraisonAI/\n\u2514\u2500\u2500 poc/\n    \u251c\u2500\u2500 start_mcp_server.sh         \u2190 starts the real MCP server\n    \u251c\u2500\u2500 run_mcp_poc_video.sh        \u2190 runs the attack with curl\n    \u251c\u2500\u2500 venv/                       \n    \u2514\u2500\u2500 output/\n        \u251c\u2500\u2500 mcp_server_run.log\n        \u251c\u2500\u2500 mcp_attacker_run.log\n        \u2514\u2500\u2500 synthetic_credentials.txt   (PoC-only fake creds)\n```\n\n[start_mcp_server.sh](https://github.com/user-attachments/files/27569524/start_mcp_server.sh)\n[run_mcp_poc_video.sh](https://github.com/user-attachments/files/27569525/run_mcp_poc_video.sh)\n\nThe server starter runs the real `MCPServer` class with `register_cli_tools()`, same code path `praisonai mcp serve --transport http-stream` uses. No mocks.\n\n### How to reproduce\n\n**Terminal 1, start the server**:\n```bash\ncd PraisonAI\nbash poc/start_mcp_server.sh\n```\nBoots `MCPServer` on `127.0.0.1:8766/mcp` with no auth, matching the documented default `api_key=None`.\n\n**Terminal 2, run the attack**:\n```bash\ncd PraisonAI\nbash poc/run_mcp_poc_video.sh\n```\nSix numbered steps. Each one prints the action, runs one `curl`, prints the JSON-RPC response.\n\n**`workflow.validate` leaks `/etc/hosts`:**\n```json\n{ \"result\": { \"content\": [{ \"type\": \"text\",\n  \"text\": \"YAML error: while scanning for the next token\\nfound character \u0027\\\\t\u0027 that cannot start any token\\n  in \\\"/etc/hosts\\\", line 7, column 10\" }] } }\n```\nThe parser error message confirms the file exists and includes a fragment of its content.\n\n**`deploy.validate` leaks `~/.ssh/known_hosts`:**\n```json\n{ \"result\": { \"content\": [{ \"type\": \"text\",\n  \"text\": \"Error: expected \u0027\u003cdocument start\u003e\u0027, but found \u0027\u003cscalar\u003e\u0027\\n  in \\\"/Users/\u003cvictim\u003e/.ssh/known_hosts\\\", line 1, column 13\" }] } }\n```\n\n**`workflow.show` exfiltrates a credential file:**\n```json\n{ \"result\": { \"content\": [{ \"type\": \"text\",\n  \"text\": \"# AWS-style credentials (SYNTHETIC, for PoC only)\\n[default]\\naws_access_key_id = AKIA-FAKE-EXFIL-KEY-FOR-POC\\naws_secret_access_key = synthetic-secret-do-not-actually-exist-12345\\n\\n# .env-style secrets\\nDATABASE_URL=postgres://app:hunter2@db.internal/prod\\nSLACK_BOT_TOKEN=xoxb-FAKE-TOKEN-for-poc-only\\nOPENAI_API_KEY=sk-FAKE-FOR-POC\\n\" }] } }\n```\n\nThe PoC writes its own synthetic credential file so the demonstration does not depend on the reviewer\u0027s real secrets. The same call reads `~/.ssh/id_rsa`, `~/.aws/credentials`, or any project `.env` if you point it there.\n\nhttps://github.com/user-attachments/assets/09511e66-6a52-4fe3-a303-91d1f99cd27a\n\n\n## Impact\n\n- Confidentiality, High. Any file the praisonai user can read becomes available to the MCP caller. Typical targets are host SSH keys, cloud credentials, API tokens, project `.env` files, `~/.netrc`, `~/.docker/config.json`, browser cookie databases, and the system password file.\n- No authentication required. The default is `api_key=None` (`http_stream.py:91`). The auth check at `http_stream.py:192-198` is wrapped in `if self.api_key:`, so it does not run when no key is configured.\n- No operator misconfiguration required. This is the documented default.\n- The original advisory\u0027s exploitation model still applies. An MCP-connected LLM whose context contains attacker-controlled web pages, documents, or emails can be steered into issuing the same `tools/call` and returning the response. No operator click is needed beyond \"summarise this page\".\n\nThe original advisory was Critical because the write primitive (rules.create) chained to RCE through `.pth` injection. This finding is the read half of the same shape. Read alone is enough to take SSH keys, cloud credentials, and tokens, which is usually how the rest of the host gets compromised through credential reuse.\n\n## Suggested fix\n\nThere are two ways to fix this. Doing both is fine. The dispatcher fix is preferred because it closes the same class of bug for every handler that takes a path-shaped argument, including the OpenAI-backed ones called out earlier.\n\n### 1. Enforce `tool.input_schema` in the dispatcher\n\n`mcp_server/server.py:281-298`. The schemas are already built reflectively from each handler\u0027s signature in `registry.py:320-376`. Validate `arguments` against the registered schema before calling `tool.handler(**arguments)` and reject anything that does not match. This covers `workflow.show`, `workflow.validate`, `deploy.validate`, `audio.transcribe`, `files.create`, `ocr_extract`, and any handler added later.\n\n### 2. Per-handler containment\n\nThis is the same shape as the existing `_resolve_rule_path()` helper added in commit `68cc9427`:\n\n```python\n# cli_tools.py\ndef _resolve_workflow_path(file_path: str) -\u003e Path:\n    \"\"\"Restrict workflow file_path to an allowed root.\"\"\"\n    if not isinstance(file_path, str) or not file_path:\n        raise ValueError(\"file_path must be a non-empty string\")\n    if \"\\x00\" in file_path or file_path.startswith(\"~\"):\n        raise ValueError(f\"invalid file_path: {file_path!r}\")\n    workflows_root = Path(os.path.expanduser(\"~/.praison/workflows\")).resolve()\n    workflows_root.mkdir(parents=True, exist_ok=True)\n    candidate = (workflows_root / file_path).resolve()\n    try:\n        candidate.relative_to(workflows_root)\n    except ValueError:\n        raise ValueError(f\"invalid file_path: {file_path!r}\")\n    return candidate\n```\n\nApply the same helper to:\n\n- `workflow_show(file_path)` and `workflow_validate(file_path)`. Restrict to a workflow root.\n- `deploy_validate(config_path)`. Restrict to a deploy-config root or an explicit allowlist.\n- The `default=\"deploy.yaml\"` fallback resolves into the user\u0027s current working directory. Containment is what fixes the bug, but removing that default also makes prompt-injection chains harder.",
  "id": "GHSA-9cr9-25q5-8prj",
  "modified": "2026-05-29T22:30:58Z",
  "published": "2026-05-29T22:30:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9cr9-25q5-8prj"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate"
}