PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets

### Summary `CodeAgent._execute_python()` executes LLM-generated Python code in a subprocess with the complete parent-process environment (`os.environ.copy()`), zero AST validation, zero import restri

CVSS 10.0

IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller c

IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component. An unauthenticated remote attacker could exploit this vulnerability to execute a

CVSS 9.8

A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS)

A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM o

CVSS 9.4

ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operatin

ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying unsanitized input or output path arguments. Attackers can a

CVSS 9.3

dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute

dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get(). The path is concatenated into a new Funct

CVSS 9.3

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows at

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attack

CVSS 9.3

The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimi

The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identify_format that allows attackers to execute commands by supplying a crafted image

CVSS 9.3

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote una

CVSS 9.3

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device infor

CVSS 9.3

IBM Guardium Data Protection 12.2 IBM Security Guardium Data Protection is vulnerable to stored cross-site scr

IBM Guardium Data Protection 12.2 IBM Security Guardium Data Protection is vulnerable to stored cross-site scripting (XSS) in the Quick Search results grid. An unauthenticated attacker who can influen

CVSS 9.3

Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing inv

Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid extensions.

CVSS 9.1