Anushkavirgaonkar

An issue exists in the embedded web server and network library where an attacker controlling an SSI-enabled file can use directory traversal sequences within an #include file or #include virtual directive. This occurs because the `mg ssi()` function in src/ssi.c concatenates the directive argument into a filesystem path without utilizing the `mg path is sane()` function. Consequently, deployments using MG ENABLE SSI with a configured ssi pattern may disclose files readable by the Mongoose process.

A reflected cross-site scripting issue exists when the `MG ENABLE DIRLIST` feature is enabled. A remote attacker can send a crafted percent-encoded request path to a user, which is then processed by the `mg http serve dir()` and `listdir()` functions in `src/http.c`. These functions place the decoded request URI into the title and h1 HTML elements without proper HTML entity encoding. This allows the execution of malicious scripts in the Mongoose origin, potentially exposing session data or allowing actions to be performed on behalf of the victim.

A remote code execution issue exists in the plugin manager. The system loads and executes arbitrary Python (.py) files from project-level and user-home `.praisonai/plugins/` directories using the `spec from file location()` and `exec module()` functions. This process occurs without code signing, integrity verification, or sandboxing. An attacker capable of writing a malicious `.py` file to a plugin directory—potentially through path traversal, a supply chain attack, or a compromised dependency—can achieve arbitrary code execution during the plugin system initialization.

The AICoder component contains flaws allowing arbitrary file write and command execution. These issues result from missing path validation and inadequate command sanitization during Large Language Model (LLM) tool calls. An attacker can use the chat interface to inject malicious prompts, enabling them to write files to any location on the filesystem and execute shell commands with root privileges.

A remote code execution issue exists in the `CodeAgent. execute python()` function. The software executes Python code generated by a Large Language Model (LLM) without Abstract Syntax Tree (AST) validation, import restrictions, or sandbox enforcement. An attacker can use prompt injection to influence the LLM output, allowing them to execute arbitrary code on the host system and exfiltrate environment secrets. This can occur if the agent processes untrusted input, such as customer support tickets, which may contain hidden instructions to execute malicious commands.

A code injection issue exists in the `deploy/api.py` file. The `agents file` parameter is directly interpolated into an f-string without proper sanitization. This interpolated string is used to generate server code that is subsequently executed via the `subprocess.Popen()` function. An authorized user with access to the deploy API can exploit this to inject and execute arbitrary Python code within the context of the deployment process.