Snailsploit

PraisonAI before 1.6.78 caches tool approval decisions by tool name only, allowing attackers to reuse initial approvals for subsequent calls with arbitrary arguments. Attackers can exploit this by obtaining approval for a benign operation and then executing dangerous file write operations with unreviewed parameters in the same session.

**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 4.6.78 **Description** A prompt injection defense bypass exists because the system only blocks threats classified as CRITICAL, which requires three or more detector families to match simultaneously. This allows attackers to use single or double-vector prompt injections that are classified as HIGH threat level to bypass the defense and reach the model. **Recommendations** Update PraisonAI to version 4.6.78 or later.

**Name of the Vulnerable Software and Affected Versions** Rapid7 InsightConnect Markdown Plugin versions prior to 3.1.5 **Description** Server-Side Cross-Site Scripting (XSS) and Server-Side Request Forgery (SSRF) exist in the `markdown to pdf` action. These issues occur because the PDF rendering engine fails to restrict script execution and outbound network access, allowing remote attackers to execute JavaScript on the server and initiate arbitrary outbound HTTP requests through specially crafted content embedded in Markdown input. **Recommendations** Update Rapid7 InsightConnect Markdown Plugin to version 3.1.5 or later. As a temporary mitigation, restrict the use of the `markdown to pdf` action.

**Name of the Vulnerable Software and Affected Versions** Jenkins Contrast Continuous Application Security Plugin versions prior to 3.12 **Description** Missing permission checks allow users with Overall/Read permission to enumerate the names of configured Contrast metadata. **Recommendations** Update Jenkins Contrast Continuous Application Security Plugin to version 3.12 or later.

**Name of the Vulnerable Software and Affected Versions** Jenkins Assembla Plugin versions prior to 1.5 **Description** A missing permission check allows users with Overall/Read permission to force the system to connect to an arbitrary URL using a specified username and password. **Recommendations** Update Jenkins Assembla Plugin to version 1.5 or later.

**Name of the Vulnerable Software and Affected Versions** Jenkins Assembla Plugin versions prior to 1.5 **Description** The XML parser is not configured to prevent XML external entity (XXE) attacks. This allows attackers who can control the responses from the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery (SSRF), which is a technique used to induce the server to make requests to an unintended location. **Recommendations** Update Jenkins Assembla Plugin to version 1.5 or later.

**Name of the Vulnerable Software and Affected Versions** vLLM versions prior to 0.23.1rc0 **Description** An incomplete fix for a previous memory leak issue allows unauthenticated attackers to leak heap memory addresses. The system fails to properly sanitize error messages in several response paths, echoing the string representation of exceptions directly to clients. This occurs because certain routes catch exceptions internally and construct responses themselves, bypassing the global sanitizing exception handler, while WebSocket frames bypass the handler chain entirely. Technical details include: - **API Endpoints**: 'POST /v1/messages' and 'POST /v1/messages/count tokens' within the Anthropic API router. - **Vulnerable Components**: The Server-Sent Events streaming converter in `vllm/entrypoints/anthropic/serving.py` and the realtime speech-to-text WebSocket in `vllm/entrypoints/speech to text/realtime/connection.py`. An attacker can exploit this by sending malformed image bytes through the Anthropic Messages API image content parts. This causes the `PIL.Image.open()` function to raise an `UnidentifiedImageError`, which includes a `BytesIO` object representation containing a verbatim heap memory address in the `error.message` field of the response body. **Recommendations** Update to version 0.23.1rc0 or later. As a temporary workaround, restrict access to the 'POST /v1/messages' and 'POST /v1/messages/count tokens' endpoints and the realtime speech-to-text WebSocket to minimize the risk of exploitation.

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.56.0 through 1.101.0, 2.0.0b1, and 2.0.0b2, the cloud-metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form that the previous fix, CVE-2026-46678, did not decode, exposing cloud IAM short-term credentials. The previous remediation decoded only IPv4-mapped IPv6, 6to4, and the NAT64 well-known prefix, so the metadata guarantee did not hold for the remaining transition forms: IPv4-compatible IPv6 (::a.b.c.d), the NAT64 RFC 8215 local-use prefix (64:ff9b:1::/48), operator-chosen NAT64 prefixes, and ISATAP. The IPv6 wrapper is then delivered to the underlying IPv4 metadata endpoint. This occurs when an application using Pydantic AI opts a URL into force download='allow-local' (which disables the default block on private/internal IPs) and runs on a network that actually routes the affected IPv6 transition forms: NAT64-configured networks (IPv6-only or dual-stack-with-NAT64 deployments, including some Kubernetes setups) for the NAT64 variants, or networks with an ISATAP tunnel for ISATAP. A standard dual-stack cloud VM or container does not route these forms and is not affected in practice. The IPv4-compatible and Teredo variants are deprecated and addressed as defense-in-depth. This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 (itself a follow-up to CVE-2026-25580). This issue has been fixed in version 2.0.0b3.

**Name of the Vulnerable Software and Affected Versions** phpMyFAQ versions prior to 4.1.4 **Description** Missing authorization flaws in the `editUser()` and `updateUserRights()` endpoints allow authenticated administrators to escalate privileges. An authenticated non-SuperAdmin user possessing the `edit user` permission can modify the `is superadmin` flag or grant arbitrary rights to an account, enabling them to gain full SuperAdmin access and complete control over the knowledge base. **Recommendations** Upgrade to version 4.1.4.

**Name of the Vulnerable Software and Affected Versions** Network-AI versions prior to 5.7.2 **Description** The MCP SSE server allows unauthenticated cross-origin MCP tool invocation because the server defaults to an empty secret and the `isAuthorized()` function returns true when the secret is empty. While a previous update restricted CORS to localhost origins, the server remains unauthenticated by default for non-browser callers, such as curl or SSRF. This allows unauthorized access to 22 MCP tools, including `config set`, `agent spawn`, `blackboard write`, and `token *` functions, especially when a non-loopback bind is used. **Recommendations** Update to version 5.7.2.

**Name of the Vulnerable Software and Affected Versions** AVideo versions 29.0 and earlier **Description** An issue exists in the open source video platform where the endpoint "objects/mention.json.php" lacks a `User::loginCheck()` or admin gate. The endpoint only implements an entry guard using `preg match('/^@/', $ REQUEST['term'])` and a hard-coded `rowCount=10`. This allows unauthenticated users to perform user enumeration by manipulating the `term` variable. **Recommendations** Update AVideo to a version later than 29.0. As a temporary workaround, restrict access to the "objects/mention.json.php" endpoint to minimize the risk of user enumeration.

**Name of the Vulnerable Software and Affected Versions** WWBN AVideo versions 29.0 and earlier **Description** Certain components, including `EpgParser.php` and `plugin/AI/receiveAsync.json.php`, fail to utilize the `$resolvedIP` out-parameter of the `isSSRFSafeURL()` function for DNS pinning via `CURLOPT RESOLVE`. This oversight creates a Time-of-Check to Time-of-Use (TOCTOU) condition, which allows for DNS rebinding attacks. DNS rebinding is a technique used to bypass security restrictions by changing the IP address associated with a domain name between the time the application validates the address and the time it actually accesses the resource. **Recommendations** Update to a version where `EpgParser.php` and `plugin/AI/receiveAsync.json.php` are patched to use redirect-safe methods or correctly implement DNS pinning using the `$resolvedIP` parameter with `CURLOPT RESOLVE`.

**Name of the Vulnerable Software and Affected Versions** AVideo versions prior to 29.0 **Description** Two endpoints, 'plugin/AI/receiveAsync.json.php' and 'objects/EpgParser.php', use the `isSSRFSafeURL()` function to validate user-supplied URLs but then fetch them using `file get contents()` without disabling automatic redirect following. This allows an attacker to provide a URL that redirects to an internal or cloud-metadata address (such as 'http://169.254.169.254/latest/meta-data/'), bypassing SSRF protections because only the initial URL is validated. This can lead to the exfiltration of IAM credentials, instance identity, or access to internal services and port scanning. Additionally, several callers of `isSSRFSafeURL()` discard the `$resolvedIP` parameter intended for DNS pinning, making them susceptible to DNS rebinding TOCTOU (Time-of-Check to Time-of-Use) attacks. This occurs when a domain's DNS record changes between the time of validation and the time of the actual request. Affected callers include: - 'objects/aVideoEncoderReceiveImage.json.php' - 'objects/aVideoEncoder.json.php' - 'plugin/BulkEmbed/save.json.php' - 'plugin/AI/receiveAsync.json.php' - 'objects/EpgParser.php' - 'plugin/Scheduler/Scheduler.php' **Recommendations** Update AVideo to a version later than 29.0. As a temporary workaround, restrict access to the 'plugin/AI/receiveAsync.json.php' and 'objects/EpgParser.php' endpoints to minimize the risk of redirect-based SSRF.

**Name of the Vulnerable Software and Affected Versions** DDEV versions prior to 1.25.2 **Description** DDEV is an open-source tool for running local web development environments for PHP and Node.js. The software performs unsanitized extraction of archives from remote sources without path validation within the `Untar()` and `Unzip()` functions located in `pkg/archive/archive.go`. **Recommendations** Update to version 1.25.2.

**Name of the Vulnerable Software and Affected Versions** CairoSVG versions prior to 2.9.0 **Description** CairoSVG is an SVG converter based on Cairo, a 2D graphics library. A denial of service can occur due to recursive `<use>` element amplification within the `cairosvg/defs.py` file, specifically in the `use()` function. This amplification leads to CPU exhaustion even from a small input file. A 1,411-byte SVG payload can pin the CPU at 100% indefinitely. The issue arises from the recursive processing of `<use>` elements without depth or count limits. The amplification factor is O(10^N) rendering calls from O(N) input. **Recommendations** Update CairoSVG to version 2.9.0 or later. As a temporary workaround, consider limiting the recursion depth within the `use()` function to prevent excessive CPU usage.