Sivaadityacoder

**Name of the Vulnerable Software and Affected Versions** Flowise versions prior to 3.1.3 **Description** A sandbox escape exists in `pythonCodeValidator.ts` because it fails to block native Pandas DataFrame methods, including `to csv`, `to json`, `pipe`, and `query`. Authenticated attackers can leverage this to exfiltrate uploaded CSV data or write arbitrary files to the server filesystem. **Recommendations** Update to version 3.1.3 or later.

**Name of the Vulnerable Software and Affected Versions** AutoGPT versions prior to 0.6.46 **Description** AutoGPT is a platform for creating and managing AI agents to automate workflows. The Stagehand integration improperly logs API keys and authentication secrets in plaintext using `logger.info()` statements. This occurs within the `StagehandObserveBlock`, `StagehandActBlock`, and `StagehandExtractBlock` implementations, where the code calls `api key.get secret value()` and logs the returned value. The vulnerable code exposes sensitive information through logging mechanisms. **Recommendations** Update to version 0.6.46 or later.