Hoanggxyuuki

knowns (npm package) versions <= 0.29.1 contain a path traversal vulnerability in the Document API. The HTTP handler in internal/server/routes/docs.go normalizes the user-supplied document path with cleanDocPath(), which strips leading/trailing slashes and the .md suffix but does not neutralize ../ traversal sequences, and internal/storage/doc store.go then builds the target path with filepath.Join(ds.docsDir(), filepath.FromSlash(doc.Path)+".md") without verifying that the resolved path remains inside the documents directory. In the default deployment, where the Management API is unauthenticated and bound to all interfaces, a remote unauthenticated attacker can supply a traversal payload (for example {"path": "../../../../tmp/knowns pwn marker"} to POST /api/docs, or an encoded path to GET /api/docs/...) to read, create, overwrite, or delete arbitrary files with a .md extension anywhere on the host filesystem and to create arbitrary directories via os.MkdirAll. This can expose sensitive data stored in other projects' documentation, corrupt or destroy files, and provide an arbitrary-write primitive that may be chained toward code execution. The issue is fixed in version 0.30.0.

**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 4.6.58 **Description** The MCP HTTP Stream transport in PraisonAI uses an unsafe prefix match when validating the `Origin` header via the ` validate origin()` method. The validation logic accepts any origin that starts with an allowed value, meaning an attacker-controlled origin such as `http://localhost.evil.example` can bypass the localhost allowlist because it starts with `http://localhost`. When the MCP HTTP Stream server is started without an API key (the CLI default), a malicious webpage can trigger unauthenticated `tools/call` requests against a locally running server. This allows the execution of exposed tools, such as `praisonai.files.create()`, which can read local files, or `praisonai.todo.add()`, which can modify local state files. **Recommendations** Update PraisonAI to version 4.6.58 or later. Configure a strong API key for the MCP server to enforce authentication. Explicitly define a strict list of `allowed-origins` instead of relying on the default localhost allowlist.

**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 4.6.58 **Description** The Recipe HTTP server in PraisonAI contains an authentication fail-open condition. When authentication is configured as `api-key` or `jwt`, the server silently allows unauthenticated requests if the corresponding `PRAISONAI API KEY` or `PRAISONAI JWT SECRET` environment variables (or configuration secrets) are missing. This occurs within the `create auth middleware()` function, which permits requests to proceed if no secret is found, even when authentication is explicitly enabled. This is particularly critical for servers bound to non-localhost interfaces, as the CLI safety check only verifies that authentication is not set to `none`, without confirming that a secret actually exists. Affected API endpoints include: - `POST /v1/recipes/run` - `POST /v1/recipes/stream` - `POST /v1/recipes/validate` - `POST /admin/reload` (when `enable admin` is true) **Recommendations** Update PraisonAI to version 4.6.58. As a temporary mitigation, ensure that `PRAISONAI API KEY` or `PRAISONAI JWT SECRET` are explicitly configured when using `api-key` or `jwt` authentication, or restrict the server binding to `127.0.0.1` to prevent external access.

**Name of the Vulnerable Software and Affected Versions** Crawl4AI versions prior to 0.9.0 **Description** The Docker API server allows the `browser config.extra args` parameter to be passed directly into Chromium launch arguments. Because the Docker API is unauthenticated by default, an attacker can inject Chromium switches combined with `--no-zygote` to force Chromium to fork or execute arbitrary commands as the container runtime user. **Recommendations** Update to version 0.9.0.