Michael Sromin

Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSandbox subprocesses inherit the full server environment. Attackers can run code via POST /v1/tools/run or custom tools to read LETTA PG URI, POSTGRES PASSWORD, and provider API keys, then access cross-tenant database data.

Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant's workflowID in save, update meta, batch delete, canvas, test run and nodeDebug routes to read, run, overwrite or delete workflows.

Letta through 0.16.8 ships a compose.yaml that does not enable LETTA SERVER SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST /v1/tools/run, manage /v1/admin users, or run OS commands via COPY PROGRAM.

Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user id HTTP header. Attackers can set user id to another tenant's ID, even with LETTA SERVER SECURE enabled, to read and modify that user's agents, memory and configuration.

LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attackers can run code in the workspace sandbox and exfiltrate vault secrets from internal/.vault secrets.json.

LangAlpha through 2026.09.07 contains an improper isolation vulnerability that places all tenants' sandbox containers on Docker's shared default bridge network with inter-container communication enabled. Authenticated users with code execution in their own sandbox can connect directly to other tenants' containers, bypassing require workspace owner checks to read files such as vault secrets from exposed servers.

piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat and POST /chat/stream endpoints lack authentication. Attackers can instruct the agent to call the exec shell tool, which runs arbitrary commands via subprocess.run without human approval or an allow-list, exposing environment secrets such as LLM API keys and database credentials.

JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copilot standard mode. Attackers can self-register, select standard mode in the WebSocket chat.start extension, and have the agent invoke subprocess.run with shell=True on the host to access other tenants' data and server secrets.

OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute shell run commands without confirmation because the headless presenter's execution allowed() always returns True. Attackers can inject instructions into alerts or Slack messages triaged by the agent to run commands on the host and exfiltrate LLM, Slack and cloud credentials.

Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable. Remote attackers can send a single request naming the shell tool to execute arbitrary OS commands as the server user (root in the shipped Docker image).

Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Attackers can send crafted chat input to POST /dify/get answer or upload documents with malicious text to run host commands, exposing datasource credentials and model API keys.

EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating them to async sub-agents lacking an interrupt on gate. Attackers can plant instructions in ingested content such as fetched web pages, so the agent calls start async task and runs commands with user privileges and environment secrets.

DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock get user from headers function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandboxed code interpreter and shell interpreter tools run arbitrary Python or bash as root in the webserver container, including reaching the bundled database with default credentials.

DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL ROOT PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database access including FILE and SUPER privileges.

Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with import ('subprocess') to run commands, stealing environment variables, model API keys, and accessing MySQL, MinIO, Redis and etcd.

Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST /sessions/{id}/messages without credentials, causing the Deep Agents ReAct loop to run attacker-directed shell commands through the local shell backend, resulting in remote code execution as the server process.

**اسم البرنامج المصاب والإصدارات المتأثرة** IntentKit الإصدارات السابقة لـ 2.6.4 **الوصف** يوجد خلل في تجاوز التفويض حيث يقوم المنفذ بالتحقق من استدعاءات الأدوات مقابل سجل الأدوات الكامل بدلاً من إعلان الأدوات المحدود لكل طلب والذي يفرضه `ToolBindingMiddleware`. يسمح هذا بتنفيذ أدوات تغيير الحالة المخصصة للمالك فقط، مثل تحويل المحفظة، والنشر، وكتابة الذاكرة، و `call-agent()`، دون الحاجة إلى تدخل بشري أو بوابة موافقة. يمكن للمتصلين غير المصرح لهم أو العامين في سياقات WEB أو API أو TWITTER أو TELEGRAM استغلال ذلك عن طريق تقديم اسم الأداة الملغاة بالضبط والحجج عبر حقن المطالبة غير المباشر أو عن طريق إعادة تشغيل بيانات نقطة الفحص والسجل على خيط (thread) معاد استخدامه. **التوصيات** تحديث IntentKit إلى إصدار أحدث من 2.6.3.

**اسم البرنامج المصاب والإصدارات المتأثرة** MoviePilot الإصدارات السابقة لـ 3.1.6 **الوصف** يحدث حقن للأوامر عندما يتم معالجة تعليمات خبيثة مدمجة في محتوى غير موثوق من خلال أدوات مثل browse webpage و search web ومحللات بيانات التورنت الوصفية. يتم تمرير هذه التعليمات إلى ExecuteCommandTool غير المقيد عبر دالة `asyncio.create subprocess shell`. يمكن للمهاجم صياغة محتوى يؤدي إلى استدعاء دالة `execute command()` مع تعيين المتغير `confirm dangerous` على true، مما يتجاوز قائمة الحظر `validate command safety`. ومن خلال استغلال سياق `is admin` لجلسة المسؤول، يمكن تحقيق تنفيذ عن بعد للكود على النظام المضيف. **التوصيات** تحديث MoviePilot إلى الإصدار 3.1.6 أو أحدث. كإجراء تخفيف مؤقت، قم بتقييد استخدام أدوات browse webpage و search web وتجنب معالجة بيانات التورنت الوصفية غير الموثوقة.