Doredry

**Name of the Vulnerable Software and Affected Versions** Semantic Kernel Python SDK versions prior to 1.39.4 **Description** A remote code execution issue exists within the `InMemoryVectorStore` filter functionality. **Recommendations** Update to version 1.39.4 or higher. As a temporary workaround, avoid using `InMemoryVectorStore` for production scenarios.

**Name of the Vulnerable Software and Affected Versions** Pydantic AI versions 1.34.0 through 1.50.9 **Description** Pydantic AI contains a path traversal issue in its web UI. A crafted URL can be used by an attacker to serve arbitrary JavaScript within the application's context. This allows execution of attacker-controlled code in the victim's browser, potentially leading to theft of chat history and session cookies. The issue arises because the CDN URL is constructed using a non-validated `version` query parameter from the request URL, enabling path traversal sequences. This vulnerability affects applications utilizing `Agent.to web` or `clai web` to serve a chat interface, which may be running locally or on a remote server. **Recommendations** Upgrade to version 1.51.0 or later to remove the user-controllable `version` parameter and prevent the vulnerability.

**Name of the Vulnerable Software and Affected Versions** Semantic Kernel .NET SDK versions prior to 1.71.0 Agent Framework version 1.0 **Description** An arbitrary file write issue exists in the .NET SDK, specifically within the `SessionsPythonPlugin`. This flaw allows for path traversal, which can be chained with an architectural trust gap in how AI agents handle autonomous tool calls to achieve remote code execution. When `AutoInvokeKernelFunctions` is enabled, the framework may treat stochastic LLM output as high-privilege system commands without effective validation. Attackers can bypass security filters using JSON type confusion, Base64/URL encoding, or Unicode homoglyphs to overwrite application source code, such as `Program.cs`, leading to full host takeover. The issue involves the `DownloadFileAsync()` and `UploadFileAsync()` functions and the `localFilePath` variable. **Recommendations** For Semantic Kernel .NET SDK versions prior to 1.71.0, update to version 1.71.0 or higher. For Agent Framework version 1.0, disable `ToolCallBehavior.AutoInvokeKernelFunctions` and switch to manual function invocation. As a temporary mitigation, create a Function Invocation Filter to verify that the `localFilePath` variable passed to `DownloadFileAsync()` or `UploadFileAsync()` is allow listed. Implement a manual `IFunctionInvocationFilter` to enforce path anchoring to a designated safe root.

**Name of the Vulnerable Software and Affected Versions** Pydantic AI versions 0.0.26 through 1.55.9 **Description** A Server-Side Request Forgery (SSRF) issue exists in the URL download functionality, specifically within the `download item()` function. This occurs when applications accept message history from untrusted external sources, allowing attackers to provide malicious URLs. The server may then perform unauthorized HTTP requests to internal network resources, such as loopback addresses, private IP ranges, or cloud metadata endpoints (e.g., AWS IMDSv1), potentially leading to the disclosure of sensitive internal information or cloud credentials. This issue affects applications using `Agent.to web`, `clai web`, `VercelAIAdapter`, `AGUIAdapter`, `Agent.to ag ui`, or custom APIs that process `ImageUrl`, `AudioUrl`, `VideoUrl`, or `DocumentUrl` objects from user input. **Recommendations** Upgrade to version 1.56.0 or later. As a temporary workaround, implement a history processor to filter out URLs targeting local or private IP addresses before they are processed by the agent.