Rexpository

ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation (check-time) and the file write operation (use-time) to write to policy-denied locations.

**Name of the Vulnerable Software and Affected Versions** JupyterLab versions 4.1.0 through 4.5.9 JupyterLab versions 4.6.0 through 4.6.1 **Description** A plugin manager lock-rule enforcement bypass exists where server-side gaps allow an authenticated user to circumvent administrator lock rules. By making direct requests to the '/lab/api/plugins' endpoint, a user can enable or disable locked plugins, including child plugins of multi-plugin extensions and those locked via the 'lock all' mechanism. This may lead to compromised data integrity and the bypass of hardening restrictions, such as download or upload limits, established through locked plugins. **Recommendations** Update versions 4.1.0 through 4.5.9 to version 4.5.10. Update versions 4.6.0 through 4.6.1 to version 4.6.2.

**Name of the Vulnerable Software and Affected Versions** PraisonAI Platform versions prior to 0.1.9 **Description** The platform fails to properly authorize mutations related to labels and issue-labels. This allows users with workspace member privileges to rename and recolor shared labels, as well as add or remove labels on issues created by the owner. This is achieved by exploiting PATCH and POST/DELETE endpoints to alter the shared label taxonomy and manipulate issue-label associations without the required owner or admin authorization. **Recommendations** Update PraisonAI Platform to version 0.1.9 or later.

**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 4.6.78 **Description** In AgentMail webhook mode, the software fails to verify Svix webhook signatures. This allows unauthenticated attackers to forge `message.received` events by sending crafted JSON payloads to the webhook endpoint. Consequently, attackers can invoke configured agents using arbitrary sender addresses and message content. **Recommendations** Update PraisonAI to version 4.6.78 or later.

**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 4.6.78 **Description** An authentication bypass exists in the agent invocation endpoints when the `PRAISONAI CALL AUTH` variable is set to `disabled`. The system attempts to restrict this disabled authentication mode to localhost bindings by deriving the host from `request.url.hostname`, which relies on the client-controlled HTTP Host header. A remote, unauthenticated attacker can spoof the 'Host: 127.0.0.1' header to bypass this restriction. This allows the attacker to list agents via the 'GET /api/v1/agents' endpoint and invoke them via the 'POST /api/v1/agents/{agent id}/invoke' endpoint without authentication. **Recommendations** Update to version 4.6.78 or later. Avoid configuring `PRAISONAI CALL AUTH=disabled` if the service is accessible over a network.

**Name of the Vulnerable Software and Affected Versions** ImageMagick versions prior to 7.1.2-26 ImageMagick versions 6.9.13-x prior to 6.9.13-51 **Description** A policy bypass exists in the `-script` operation due to missing security policy checks. This flaw allows the reading of files from paths that are otherwise restricted by the configured security policy. **Recommendations** Update to version 7.1.2-26 or later. Update to version 6.9.13-51 or later.

**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 4.6.78 **Description** The software fails to safely encode deployment configuration values during the generation of Python source code for API servers. This allows attackers to inject arbitrary Python expressions via the `deploy.api.host` and `agents file` configuration parameters, which are then executed when the generated server starts or processes requests. **Recommendations** Update PraisonAI to version 4.6.78 or later. Avoid using the `deploy.api.host` and `agents file` parameters with untrusted input until the update is applied.

**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 4.6.78 **Description** The PGVector and Cassandra knowledge-store `create collection()` backends fail to validate the caller-controlled `dimension` argument. While schema, keyspace, and collection-name identifiers are validated, the `dimension` value is interpolated directly into the vector column of the generated CREATE TABLE DDL (Data Definition Language). This allows a caller to inject SQL or CQL tokens into the statement executed by the database driver by passing a malicious string through the `dimension` variable. **Recommendations** Update PraisonAI to version 4.6.78 or later. As a temporary workaround, restrict access to the `create collection()` function to prevent unauthorized users from influencing the `dimension` argument.

**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 4.6.78 **Description** The software fails to validate file path references within custom command templates. This allows attackers to read files outside the designated workspace by using absolute paths or path traversal sequences, such as `@../outside secret.txt`, in project command files. This flaw enables the exfiltration of files readable by the process into model prompts. **Recommendations** Update PraisonAI to version 4.6.78 or later.

**Name of the Vulnerable Software and Affected Versions** PraisonAI Platform versions prior to 0.1.9 **Description** The platform fails to enforce owner or administrator authorization on the PATCH routes for projects, issues, and agents, requiring only the workspace-member role. This allows a user with low privileges to modify records created by the workspace owner. Specifically, for projects, a member can reassign the `lead id` variable to their own user ID and subsequently delete the project, which bypasses the owner or administrator permission check typically required by the delete route. **Recommendations** Update to version 0.1.9 or later.

**Name of the Vulnerable Software and Affected Versions** ImageMagick versions prior to 7.1.2-26 ImageMagick versions prior to 6.9.13-51 **Description** ImageMagick fails to verify the allowed memory allocation limit during matrix-backed operations, such as the `-canny` operation. A remote attacker can provide a specially crafted image that forces the application to allocate memory exceeding the limits defined in the configured policy, leading to a denial of service. **Recommendations** Update to version 7.1.2-26 or later. Update to version 6.9.13-51 or later.

**Name of the Vulnerable Software and Affected Versions** ImageMagick versions prior to 7.1.2-26 **Description** A heap use-after-free issue exists due to a missing null check during the parsing of XMP profiles. An attacker can use specially crafted image files containing malicious XMP data to trigger this condition, leading to application crashes. Heap use-after-free occurs when a program continues to use a pointer after the memory it points to has been freed. **Recommendations** Update to version 7.1.2-26 or later.

**Name of the Vulnerable Software and Affected Versions** ImageMagick versions prior to 7.1.2-26 **Description** A policy bypass exists in the APNG encoder and external delegates caused by missing validation checks. This allows attackers to bypass configured policy restrictions during the APNG encoding process to write files to disallowed paths. **Recommendations** Update to version 7.1.2-26 or later.

**Name of the Vulnerable Software and Affected Versions** PraisonAI (praisonaiagents) versions prior to 1.6.78 **Description** A path traversal issue exists in the FastContext feature (praisonaiagents.context.fast). The `execute tool()` function in FastContextAgent only prepends the configured `workspace path` for relative paths and fails to reject absolute paths or canonicalize joined paths before enforcing workspace containment. This allows tool arguments or model-generated function calls to `grep search()`, `glob search()`, `read file()`, or `list directory()` to use absolute paths or `../` sequences. Consequently, an attacker can read, search, and enumerate files outside the intended workspace directory, leading to file contents being returned to the caller or injected into the model's tool-result context. **Recommendations** Update PraisonAI (praisonaiagents) to version 1.6.78 or later.

**Name of the Vulnerable Software and Affected Versions** PraisonAI Platform versions prior to 0.1.9 **Description** Improper authorization occurs during the deletion of issue dependencies. The DELETE dependency route allows a user to specify either endpoint of a dependency edge, but the system only validates delete permissions against the issue URL selected by the caller. Consequently, a workspace member can bypass owner or administrator authorization to remove dependencies created by an owner by targeting a related issue endpoint that the member owns, as the permission check is performed against the member-owned issue. **Recommendations** Update PraisonAI Platform to version 0.1.9 or later.

**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 4.6.78 **Description** A path traversal issue exists in the ContextGatherer component. The system fails to validate include paths within `.praisoncontext` and `.praisoninclude` files, allowing attackers to use absolute paths or parent directory traversal sequences to read arbitrary files outside the workspace and include their contents in the generated context bundle. **Recommendations** Update PraisonAI to version 4.6.78 or later.

**Name of the Vulnerable Software and Affected Versions** PraisonAI (pip package praisonaiagents) versions prior to 1.6.78 **Description** The software automatically loads default settings from a project-local `.praisonai/config.toml` file when constructing an Agent but fails to validate the `defaults.output.output file` path. An attacker can provide a repository-controlled configuration file that sets `output file` to an absolute path or a path using directory traversal (e.g., `..`). When the `agent.start()` function is called without an explicit output parameter, the agent response is written to the specified path, potentially overwriting files outside the project root with the privileges of the user running the application. **Recommendations** Update PraisonAI (pip package praisonaiagents) to version 1.6.78 or later.

**Name of the Vulnerable Software and Affected Versions** vLLM versions 0.22.0 through 0.23.0 **Description** The software fails to validate the size of uploaded audio files before loading them into memory. Specifically, the endpoints '/v1/audio/transcriptions' and '/v1/audio/translations' execute the `request.file.read()` function to fully materialize the file in memory before verifying the `VLLM MAX AUDIO CLIP FILESIZE MB` limit. This allows an attacker to submit an oversized multipart upload, leading to excessive memory allocation that can cause memory pressure or terminate the process. **Recommendations** Update to version 0.24.0.

**Name of the Vulnerable Software and Affected Versions** ImageMagick versions prior to 7.1.2-26 **Description** The `-concatenate` operation lacks necessary policy checks. This flaw allows the software to read from and write to file paths that are explicitly disallowed by the security policy, enabling a policy bypass. **Recommendations** Update to version 7.1.2-26.

**Name of the Vulnerable Software and Affected Versions** ImageMagick versions prior to 6.9.13-51 ImageMagick versions prior to 7.1.2-26 **Description** An infinite loop occurs when invalid arguments are provided to the `connected-components` option. **Recommendations** Update to version 6.9.13-51. Update to version 7.1.2-26.