检索 GitHub Advisory Database 中的已审查与未审查安全公告。
| 公告编号 | 摘要 | 级别 | 生态 / 软件包 | 审查状态 | 发布时间 | 修改时间 |
|---|---|---|---|---|---|---|
| GHSA-CH89-H4R2-C8F8 CVE-2026-55540 | PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks | 高危 | PyPIPraisonAI | 已审查 | 2026-08-25 22:54 | 2026-08-25 22:54 |
| GHSA-CFXV-8FW8-RWPV CVE-2026-55530 | praisonaiagents: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool |
当前筛选结果 366,391 条 · 时间按北京时间显示
| 中危 |
PyPIpraisonaiagents |
| 已审查 |
| 2026-08-25 22:46 |
| 2026-08-25 22:46 |
| GHSA-VG6P-V9VM-6FGJ CVE-2026-55524 | praisonaiagents vulnerable to SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap) | 高危 | PyPIpraisonaiagents | 已审查 | 2026-08-25 22:43 | 2026-08-25 22:43 |
| GHSA-7WW9-85PG-CV4X CVE-2026-55534 | PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution | 高危 | PyPIPraisonAI | 已审查 | 2026-08-25 22:42 | 2026-08-25 22:42 |
| GHSA-X44H-65QV-CW74 CVE-2026-55526 | praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`) | 高危 | PyPIpraisonaiagents | 已审查 | 2026-08-25 22:37 | 2026-08-25 22:38 |
| GHSA-WV94-5QCP-6M36 CVE-2026-55531 | PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced) | 中危 | PyPIPraisonAI | 已审查 | 2026-08-25 22:34 | 2026-08-25 22:34 |
| GHSA-7G3P-92QQ-8WVH CVE-2026-55528 | praisonaiagents: AgentServer declares auth_token but never enforces it on any route | 高危 | PyPIpraisonaiagents | 已审查 | 2026-08-25 22:31 | 2026-08-25 22:31 |
| GHSA-WJ6G-V78P-6FX3 CVE-2026-55529 | PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server | 中危 | PyPIPraisonAI | 已审查 | 2026-08-25 22:26 | 2026-08-25 22:26 |
| GHSA-8HJW-25CG-G52H CVE-2026-55523 | praisonaiagents has a `web_crawl` SSRF protection bypass via unchecked redirect targets | 高危 | PyPIpraisonaiagents | 已审查 | 2026-08-25 22:18 | 2026-08-25 22:18 |
| GHSA-HXMV-C4G6-5FQC CVE-2026-55522 | PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code | 高危 | PyPIPraisonAI+1 | 已审查 | 2026-08-25 22:15 | 2026-08-25 22:15 |
| GHSA-5R34-2G38-6569 CVE-2026-55525 | praisonaiagents web_crawl vulnerable to SSRF via redirect-following | 高危 | PyPIpraisonaiagents | 已审查 | 2026-08-25 22:05 | 2026-08-25 22:05 |
| GHSA-6H3P-88P7-M8GP CVE-2026-79673 | 无摘要 | 高危 | —— | 未审查 | 2026-08-25 20:31 | 2026-08-25 20:31 |
| GHSA-X98J-GH4V-7P7G CVE-2026-79672 | 无摘要 | 高危 | —— | 未审查 | 2026-08-25 20:31 | 2026-08-25 20:31 |
| GHSA-VW9J-C9FF-MWF8 CVE-2026-79669 | 无摘要 | 中危 | —— | 未审查 | 2026-08-25 20:31 | 2026-08-25 20:31 |
| GHSA-VGPJ-V99M-7H5J CVE-2026-79667 | 无摘要 | 高危 | —— | 未审查 | 2026-08-25 20:31 | 2026-08-25 20:31 |
| GHSA-MJ42-9VH2-F8V3 CVE-2026-79670 | 无摘要 | 中危 | —— | 未审查 | 2026-08-25 20:31 | 2026-08-25 20:31 |
| GHSA-7V7F-8GW6-2Q2X CVE-2026-79668 | 无摘要 | 中危 | —— | 未审查 | 2026-08-25 20:31 | 2026-08-25 20:31 |
| GHSA-7RWV-FQQ2-88C4 CVE-2026-79671 | 无摘要 | 中危 | —— | 未审查 | 2026-08-25 20:31 | 2026-08-25 20:31 |
| GHSA-7J6F-2MQ2-G5VQ CVE-2026-79666 | 无摘要 | 高危 | —— | 未审查 | 2026-08-25 20:31 | 2026-08-25 20:31 |
| GHSA-Q8HH-M6V5-4F3X CVE-2026-79665 | 无摘要 | 高危 | —— | 未审查 | 2026-08-25 20:31 | 2026-08-25 20:31 |
| GHSA-M5W8-4879-F4PC CVE-2026-79662 | 无摘要 | 高危 | —— | 未审查 | 2026-08-25 20:31 | 2026-08-25 20:31 |
| GHSA-J8JC-X8V7-X64G CVE-2026-79658 | 无摘要 | 高危 | —— | 未审查 | 2026-08-25 20:31 | 2026-08-25 20:31 |
| GHSA-9G26-825H-8V6P CVE-2026-79659 | 无摘要 | 高危 | —— | 未审查 | 2026-08-25 20:31 | 2026-08-25 20:31 |
| GHSA-9277-65XQ-8GWW CVE-2026-79663 | 无摘要 | 中危 | —— | 未审查 | 2026-08-25 20:31 | 2026-08-25 20:31 |
| GHSA-845P-52XJ-2432 CVE-2026-79660 | 无摘要 | 中危 | —— | 未审查 | 2026-08-25 20:31 | 2026-08-25 20:31 |