Eric-D

**Name of the Vulnerable Software and Affected Versions** AstrBot versions prior to 4.25.6 **Description** An authorization bypass exists in the session-listing endpoint. The issue resides in the `OpenApiRoute.get chat sessions()` function within the `astrbot/dashboard/routes/open api.py` file. A remote attacker can exploit this by manipulating the `Username` argument to bypass authorization mechanisms. **Recommendations** Update to a version newer than 4.25.5. As a temporary mitigation, restrict access to the `OpenApiRoute.get chat sessions()` function.

**Name of the Vulnerable Software and Affected Versions** AstrBotDevs AstrBot versions prior to 4.25.6 **Description** An authentication bypass exists in the API component due to username spoofing. A remote attacker can manipulate the `Username` argument within the `OpenApiRoute.chat send()` function located in the `astrbot/dashboard/routes/open api.py` file to bypass authentication mechanisms. **Recommendations** Update AstrBotDevs AstrBot to version 4.25.6 or later. As a temporary mitigation, restrict access to the `OpenApiRoute.chat send()` function.

**Name of the Vulnerable Software and Affected Versions** AstrBot versions prior to 4.25.6 **Description** An issue exists in the Filesystem Computer-Use Tool within the ` normalize rw path()` function of the `astrbot/core/tools/computer tools/fs.py` file. A local attacker can perform a manipulation that results in link following, which occurs when the software follows a symbolic link to access a file or directory outside the intended scope. **Recommendations** Update to a version newer than 4.25.5. As a temporary mitigation, restrict local access to the system to prevent exploitation of the ` normalize rw path()` function.

**Name of the Vulnerable Software and Affected Versions** AstrBotDevs AstrBot versions prior to 4.25.3 **Description** A remote cross-site scripting issue exists within the T2I Feature component. The flaw is located in the `Star.text to image/NetworkRenderStrategy.render()` function within the `astrbot/core/star/base.py` file, allowing an attacker to execute malicious scripts remotely. **Recommendations** Update AstrBotDevs AstrBot to version 4.25.3 or later. As a temporary workaround, restrict access to the `Star.text to image/NetworkRenderStrategy.render()` function.

**Name of the Vulnerable Software and Affected Versions** AstrBotDevs AstrBot versions prior to 4.25.3 **Description** A server-side request forgery exists in the Plugin Update Handler component within the file astrbot/dashboard/routes/plugin.py. A remote attacker can manipulate the `download url`, `download urls`, or `proxy` arguments in the `update plugin()` or `update all plugins()` functions to induce the server to make unauthorized requests. **Recommendations** Update AstrBotDevs AstrBot to version 4.25.3 or later. As a temporary workaround, restrict access to the `update plugin()` and `update all plugins()` functions until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Sipeed PicoClaw versions prior to 0.3.0 **Description** A security flaw in the Guarded Web Fetch Flow component allows for remote server-side request forgery (SSRF), a condition where an attacker can induce the server to make requests to an unintended location. The issue resides in the `WebFetchTool.Execute()` function within the `pkg/tools/integration/web.go` file. **Recommendations** Update to a version newer than 0.2.9. As a temporary workaround, restrict access to the `WebFetchTool.Execute()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Sipeed PicoClaw versions prior to 0.3.0 **Description** Improper access controls exist within the Launcher component, specifically affecting the `IPAllowlist()` function located in the `web/backend/middleware/access control.go` file. This flaw allows a remote attacker to manipulate access controls. **Recommendations** Apply patch 3126 to resolve the issue. As a temporary mitigation, restrict access to the `IPAllowlist()` function until the patch is applied.

**Name of the Vulnerable Software and Affected Versions** Sipeed PicoClaw versions prior to 0.3.0 **Description** An issue exists in the MQTT Channel Handler component within the file pkg/channels/mqtt/mqtt.go. Remote manipulation of the `client id` argument leads to incorrect authorization. **Recommendations** Update Sipeed PicoClaw to a version newer than 0.2.9. Restrict access to the `client id` argument in the MQTT Channel Handler to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** NousResearch hermes-agent versions prior to 2026.5.29.3 **Description** A remote cross site scripting issue exists within the Matrix Adapter component. The flaw is located in the `MatrixAdapter. markdown to html()` function within the `gateway/platforms/matrix.py` file, where improper manipulation of input allows for the execution of malicious scripts. **Recommendations** As a temporary workaround, restrict the use of the `MatrixAdapter. markdown to html()` function until a patch is officially released.

**Name of the Vulnerable Software and Affected Versions** BerriAI litellm versions prior to 1.82.3 **Description** Improper authorization occurs in the `ui view users()` function located in the `litellm/proxy/management endpoints/internal user endpoints.py` file. This flaw allows a remote attacker to bypass authorization controls. **Recommendations** Update to a version later than 1.82.2. As a temporary workaround, restrict access to the `ui view users()` function until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Kilo-Org kilocode versions prior to 7.0.48 **Description** A flaw in the Environment Variable Handler component allows remote information disclosure. The issue exists within the `Load()` function located in the `packages/opencode/src/config/config.ts` file. An attacker can trigger this by manipulating the `KILO CONFIG CONTENT` argument. **Recommendations** Update to a version newer than 7.0.47. As a temporary workaround, restrict or monitor the use of the `KILO CONFIG CONTENT` argument to minimize the risk of information disclosure.

**Name of the Vulnerable Software and Affected Versions** vercel ai versions prior to 3.0.98 **Description** An OS command injection issue exists in the PR Branch Name Interpolation component. The flaw is located within the `run()` function of the `.github/workflows/prettier-on-automerge.yml` file. This allows a remote attacker to execute arbitrary operating system commands, although the attack complexity is high and exploitability is considered difficult. **Recommendations** Update to a version later than 3.0.97. As a temporary workaround, restrict access to or disable the `run()` function in the `.github/workflows/prettier-on-automerge.yml` file.

**Name of the Vulnerable Software and Affected Versions** Kilo-Org kilocode versions prior to 7.0.48 **Description** A path traversal issue exists in the File Diff API Endpoint within the `Bun.file` function of the `packages/opencode/src/kilocode/review/worktree-diff.ts` file. A remote attacker can trigger this by manipulating the `File` argument. **Recommendations** Update to a version later than 7.0.47. As a temporary workaround, restrict access to the `Bun.file` function in the File Diff API Endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** inkeep agents version 0.58.14 **Description** An authentication bypass via an alternate channel is possible in the runAuth Middleware component. This issue occurs within the `createDevContext()` function located in the agents-api/src/middleware/runAuth.ts file and can be exploited remotely. **Recommendations** As a temporary workaround, consider restricting the use of the `createDevContext()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** langflow-ai langflow versions prior to 1.8.4 **Description** A weakness in the Flow Using API component allows for the unprotected storage of credentials. This issue occurs within the `remove api keys/has api terms` function located in the 'src/backend/base/langflow/api/utils/core.py' file. The flaw can be triggered remotely. **Recommendations** Update to a version newer than 1.8.3. As a temporary workaround, restrict access to the `remove api keys/has api terms` function to minimize the risk of credential exposure.

**Name of the Vulnerable Software and Affected Versions** langflow-ai langflow versions prior to 1.1.1 **Description** An unrestricted file upload flaw exists in the API Endpoint component. The issue is located in the `create upload file()` function within the file 'src/backend/base/Langflow/api/v1/endpoints.py'. This allows a remote attacker to upload files without proper restrictions. Over 2,900 internet-facing instances have been identified as potentially exposed. **Recommendations** Update to a version later than 1.1.0. As a temporary workaround, restrict access to the `create upload file()` function until a patch is applied.

Name of the Vulnerable Software and Affected Versions FoundationAgents MetaGPT versions up to 0.8.1 Description A cross-site request forgery issue exists in FoundationAgents MetaGPT up to version 0.8.1. The issue is located in the `evaluateCode` function of the `metagpt/environment/minecraft/mineflayer/index.js` file within the Mineflayer HTTP API component. The attack can be performed remotely and has been publicly disclosed. Recommendations Update FoundationAgents MetaGPT to a version later than 0.8.1.

**Name of the Vulnerable Software and Affected Versions** FoundationAgents MetaGPT versions up to 0.8.1 **Description** A security flaw exists in FoundationAgents MetaGPT versions up to 0.8.1. The `decode image` function within the `metagpt/utils/common.py` file is susceptible to server-side request forgery (SSRF) through manipulation of the `img url or b64` argument. This allows for remote attacks. The exploit is publicly available. The project was notified of the issue but has not yet responded. **Recommendations** Update FoundationAgents MetaGPT to a version newer than 0.8.1.

Name of the Vulnerable Software and Affected Versions FoundationAgents MetaGPT versions up to 0.8.1 Description A code injection issue exists in FoundationAgents MetaGPT up to version 0.8.1. The issue is located in the `generate thoughts` function within the `metagpt/strategy/tot.py` file of the Tree-of-Thought Solver component. Remote attackers can exploit this issue. The exploit is publicly available. Recommendations Update to a version beyond 0.8.1.

Name of the Vulnerable Software and Affected Versions FoundationAgents MetaGPT versions up to 0.8.1 Description A flaw exists in FoundationAgents MetaGPT up to version 0.8.1 due to an os command injection issue within the `Bash.run` function located in the `metagpt/tools/libs/terminal.py` library. This issue is remotely exploitable. Recommendations Update FoundationAgents MetaGPT to a version later than 0.8.1.