Snailsploit

**Name of the Vulnerable Software and Affected Versions** praisonaiagents versions prior to 1.6.58 **Description** The `ast grep rewrite()` function in the `praisonaiagents/tools/ast grep tool.py` component lacks the `@require approval` decorator used by other mutation tools. When the `dry run` variable is set to `False`, an agent can execute the function to rewrite matching files across a specified `path` without requiring authorization. This allows for the modification of any file the host process has permission to write, including source trees and build configurations. Furthermore, the function incorrectly returns the string "No changes made" even when files are successfully modified, hiding the action from the operator. This issue can be triggered if an agent is steered via prompt injection to call the function with attacker-controlled `pattern`, `replacement`, and `path` variables. **Recommendations** Update praisonaiagents to version 1.6.58. As a temporary workaround, restrict the use of the `ast grep rewrite()` function or avoid using the `code intelligence` profile until the update is applied.

**Name of the Vulnerable Software and Affected Versions** praisonaiagents versions prior to 1.6.58 **Description** In the `AgentServer` component, the `ServerConfig.auth token` variable is exposed but not validated by the `AgentServer. create app()` function across any routes. This allows a remote caller to perform actions without a valid bearer token or `X-Auth-Token`, even when authentication is configured. An unauthenticated attacker can eavesdrop on the event bus, inject control events into agent processes, and leak server configurations. **API Endpoints:** - `/info` (GET): Leaks server configuration and confirms if an `auth token` is set. - `/publish` (POST): Allows broadcasting arbitrary event payloads to all subscribed agents. - `/events` (GET): Allows subscription to the Server-Sent Events (SSE) stream to observe all published events. - `/health` (GET): Leaks the current count of live SSE clients. **Vulnerable Parameters or Variables:** - `auth token` **Recommendations** Update praisonaiagents to version 1.6.58. As a temporary workaround, restrict network access to the `AgentServer` to trusted sources only to minimize the risk of unauthorized access to the affected endpoints.

**Name of the Vulnerable Software and Affected Versions** rclone versions prior to 1.75.0 **Description** The RC API includes full Go stack traces in error responses when panics occur. This allows attackers to trigger panics to leak sensitive information, including internal file paths, module versions, goroutine states, and memory addresses. **Recommendations** Update rclone to version 1.75.0 or later.

PraisonAI before 1.6.78 caches tool approval decisions by tool name only, allowing attackers to reuse initial approvals for subsequent calls with arbitrary arguments. Attackers can exploit this by obtaining approval for a benign operation and then executing dangerous file write operations with unreviewed parameters in the same session.

**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 4.6.78 **Description** A prompt injection defense bypass exists because the system only blocks threats classified as CRITICAL, which requires three or more detector families to match simultaneously. This allows attackers to use single or double-vector prompt injections that are classified as HIGH threat level to bypass the defense and reach the model. **Recommendations** Update PraisonAI to version 4.6.78 or later.

**Name of the Vulnerable Software and Affected Versions** Rapid7 InsightConnect Markdown Plugin versions prior to 3.1.5 **Description** Server-Side Cross-Site Scripting (XSS) and Server-Side Request Forgery (SSRF) exist in the `markdown to pdf` action. These issues occur because the PDF rendering engine fails to restrict script execution and outbound network access, allowing remote attackers to execute JavaScript on the server and initiate arbitrary outbound HTTP requests through specially crafted content embedded in Markdown input. **Recommendations** Update Rapid7 InsightConnect Markdown Plugin to version 3.1.5 or later. As a temporary mitigation, restrict the use of the `markdown to pdf` action.

**Name of the Vulnerable Software and Affected Versions** Jenkins Contrast Continuous Application Security Plugin versions prior to 3.12 **Description** Missing permission checks allow users with Overall/Read permission to enumerate the names of configured Contrast metadata. **Recommendations** Update Jenkins Contrast Continuous Application Security Plugin to version 3.12 or later.

**Name of the Vulnerable Software and Affected Versions** Jenkins Assembla Plugin versions prior to 1.5 **Description** The XML parser is not configured to prevent XML external entity (XXE) attacks. This allows attackers who can control the responses from the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery (SSRF), which is a technique used to induce the server to make requests to an unintended location. **Recommendations** Update Jenkins Assembla Plugin to version 1.5 or later.

**Name of the Vulnerable Software and Affected Versions** Jenkins Assembla Plugin versions prior to 1.5 **Description** A missing permission check allows users with Overall/Read permission to force the system to connect to an arbitrary URL using a specified username and password. **Recommendations** Update Jenkins Assembla Plugin to version 1.5 or later.

**Name of the Vulnerable Software and Affected Versions** vLLM versions prior to 0.23.1rc0 **Description** An incomplete fix for a previous memory leak issue allows unauthenticated attackers to leak heap memory addresses. The system fails to properly sanitize error messages in several response paths, echoing the string representation of exceptions directly to clients. This occurs because certain routes catch exceptions internally and construct responses themselves, bypassing the global sanitizing exception handler, while WebSocket frames bypass the handler chain entirely. Technical details include: - **API Endpoints**: 'POST /v1/messages' and 'POST /v1/messages/count tokens' within the Anthropic API router. - **Vulnerable Components**: The Server-Sent Events streaming converter in `vllm/entrypoints/anthropic/serving.py` and the realtime speech-to-text WebSocket in `vllm/entrypoints/speech to text/realtime/connection.py`. An attacker can exploit this by sending malformed image bytes through the Anthropic Messages API image content parts. This causes the `PIL.Image.open()` function to raise an `UnidentifiedImageError`, which includes a `BytesIO` object representation containing a verbatim heap memory address in the `error.message` field of the response body. **Recommendations** Update to version 0.23.1rc0 or later. As a temporary workaround, restrict access to the 'POST /v1/messages' and 'POST /v1/messages/count tokens' endpoints and the realtime speech-to-text WebSocket to minimize the risk of exploitation.

## Summary When an application using Pydantic AI opts a URL into `force download='allow-local'` (which disables the default block on private/internal IPs) **and runs on a network that routes the affected IPv6 transition forms (NAT64- or ISATAP-configured networks)**, the cloud-metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form that the previous fix did not decode — IPv4-compatible IPv6 (`::a.b.c.d`), the NAT64 RFC 8215 local-use prefix (`64:ff9b:1::/48`), operator-chosen NAT64 prefixes, or ISATAP. The IPv6 wrapper is then delivered to the underlying IPv4 metadata endpoint, exposing cloud IAM short-term credentials. **The bypass is exploitable only in environments whose network actually routes these forms** — NAT64-configured networks (IPv6-only or dual-stack-with-NAT64 deployments, including some Kubernetes setups) for the NAT64 variants, or networks with an ISATAP tunnel for ISATAP. A standard dual-stack cloud VM or container does not route them and is not affected in practice. The IPv4-compatible and Teredo variants are deprecated and addressed as defense-in-depth. This is an incomplete fix of [GHSA-cqp8-fcvh-x7r3](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-cqp8-fcvh-x7r3) / [CVE-2026-46678](https://nvd.nist.gov/vuln/detail/CVE-2026-46678) (itself a follow-up to [CVE-2026-25580](https://nvd.nist.gov/vuln/detail/CVE-2026-25580)). The prior remediation decoded only IPv4-mapped IPv6, 6to4, and the NAT64 well-known prefix; the metadata guarantee did not hold for the remaining transition forms. ## Severity **MEDIUM** — `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N` = **6.8** Same impact metrics and narrow attack surface as the parent advisory (AC:H): exploitation requires the application to have opted into `allow-local` on a URL influenced by untrusted input, and the NAT64/ISATAP variants additionally require the deployment network to route those forms. **CWE-918**: Server-Side Request Forgery (SSRF) ## Affected Versions | Package | Vulnerable | Patched | |---|---|---| | `pydantic-ai` | `>= 1.56.0, < 1.102.0`; `>= 2.0.0b1, < 2.0.0b3` | `1.102.0`; `2.0.0b3` | | `pydantic-ai-slim` | `>= 1.56.0, < 1.102.0`; `>= 2.0.0b1, < 2.0.0b3` | `1.102.0`; `2.0.0b3` | These transition forms have not been decoded since SSRF protection was introduced in `1.56.0`. ## Who Is Affected Users are affected **only if** their application explicitly opts a `FileUrl` (`ImageUrl`, `AudioUrl`, `VideoUrl`, `DocumentUrl`) into `force download='allow-local'` on a URL that is, or could be, influenced by untrusted input. Beyond that precondition, the affected encodings only reach a metadata endpoint in environments whose network actually routes them. The broadly-routable IPv4-mapped form was addressed in `1.99.0` (CVE-2026-46678); the additional forms addressed here require a **NAT64-configured network** (IPv6-only or dual-stack-with-NAT64 deployments, including some Kubernetes setups) for the NAT64 variants, or an **ISATAP tunnel** for the ISATAP variant. The IPv4-compatible and Teredo forms are deprecated and not routed by modern stacks; they are addressed as defense-in-depth. Most deployments on a standard dual-stack cloud VM or container are therefore not exploitable in practice, but the fix restores the "always blocked" guarantee for the environments that are. Users are **not** affected if they use any of the bundled integrations to ingest user input, because they do not propagate `force download` from external data: - `Agent.to web` / `clai web` - `VercelAIAdapter` - `AGUIAdapter` / `Agent.to ag ui` Applications that only download from developer-controlled URLs are not affected. ## Remediation Upgrade to `1.102.0` or later (or `2.0.0b3` or later on the 2.0 pre-release line). The cloud-metadata and private-IP blocklists now decode the embedded IPv4 of every standardized IPv6 transition form before evaluating it — IPv4-mapped, IPv4-compatible, 6to4, NAT64 across all prefix lengths (including the RFC 8215 local-use prefix and operator-chosen prefixes), ISATAP, and Teredo. The set of always-blocked cloud metadata/credential endpoints has also been expanded across providers. ## Workaround for Unpatched Versions Avoid passing `force download='allow-local'` on any URL that could be influenced by untrusted input. If developers must, resolve the hostname themselves and validate the result against their own metadata blocklist — including IPv6 transition forms — before constructing the `FileUrl`. ## Credits Reported by [@SnailSploit](https://snailsploit.com).

**Name of the Vulnerable Software and Affected Versions** phpMyFAQ versions prior to 4.1.4 **Description** Missing authorization flaws in the `editUser()` and `updateUserRights()` endpoints allow authenticated administrators to escalate privileges. An authenticated non-SuperAdmin user possessing the `edit user` permission can modify the `is superadmin` flag or grant arbitrary rights to an account, enabling them to gain full SuperAdmin access and complete control over the knowledge base. **Recommendations** Upgrade to version 4.1.4.

**Name of the Vulnerable Software and Affected Versions** Network-AI versions prior to 5.7.2 **Description** The MCP SSE server allows unauthenticated cross-origin MCP tool invocation because the server defaults to an empty secret and the `isAuthorized()` function returns true when the secret is empty. While a previous update restricted CORS to localhost origins, the server remains unauthenticated by default for non-browser callers, such as curl or SSRF. This allows unauthorized access to 22 MCP tools, including `config set`, `agent spawn`, `blackboard write`, and `token *` functions, especially when a non-loopback bind is used. **Recommendations** Update to version 5.7.2.

**Name of the Vulnerable Software and Affected Versions** AVideo versions 29.0 and earlier **Description** An issue exists in the open source video platform where the endpoint "objects/mention.json.php" lacks a `User::loginCheck()` or admin gate. The endpoint only implements an entry guard using `preg match('/^@/', $ REQUEST['term'])` and a hard-coded `rowCount=10`. This allows unauthenticated users to perform user enumeration by manipulating the `term` variable. **Recommendations** Update AVideo to a version later than 29.0. As a temporary workaround, restrict access to the "objects/mention.json.php" endpoint to minimize the risk of user enumeration.

**Name of the Vulnerable Software and Affected Versions** WWBN AVideo versions 29.0 and earlier **Description** Certain components, including `EpgParser.php` and `plugin/AI/receiveAsync.json.php`, fail to utilize the `$resolvedIP` out-parameter of the `isSSRFSafeURL()` function for DNS pinning via `CURLOPT RESOLVE`. This oversight creates a Time-of-Check to Time-of-Use (TOCTOU) condition, which allows for DNS rebinding attacks. DNS rebinding is a technique used to bypass security restrictions by changing the IP address associated with a domain name between the time the application validates the address and the time it actually accesses the resource. **Recommendations** Update to a version where `EpgParser.php` and `plugin/AI/receiveAsync.json.php` are patched to use redirect-safe methods or correctly implement DNS pinning using the `$resolvedIP` parameter with `CURLOPT RESOLVE`.

**Name of the Vulnerable Software and Affected Versions** AVideo versions prior to 29.0 **Description** Two endpoints, 'plugin/AI/receiveAsync.json.php' and 'objects/EpgParser.php', use the `isSSRFSafeURL()` function to validate user-supplied URLs but then fetch them using `file get contents()` without disabling automatic redirect following. This allows an attacker to provide a URL that redirects to an internal or cloud-metadata address (such as 'http://169.254.169.254/latest/meta-data/'), bypassing SSRF protections because only the initial URL is validated. This can lead to the exfiltration of IAM credentials, instance identity, or access to internal services and port scanning. Additionally, several callers of `isSSRFSafeURL()` discard the `$resolvedIP` parameter intended for DNS pinning, making them susceptible to DNS rebinding TOCTOU (Time-of-Check to Time-of-Use) attacks. This occurs when a domain's DNS record changes between the time of validation and the time of the actual request. Affected callers include: - 'objects/aVideoEncoderReceiveImage.json.php' - 'objects/aVideoEncoder.json.php' - 'plugin/BulkEmbed/save.json.php' - 'plugin/AI/receiveAsync.json.php' - 'objects/EpgParser.php' - 'plugin/Scheduler/Scheduler.php' **Recommendations** Update AVideo to a version later than 29.0. As a temporary workaround, restrict access to the 'plugin/AI/receiveAsync.json.php' and 'objects/EpgParser.php' endpoints to minimize the risk of redirect-based SSRF.

**Name of the Vulnerable Software and Affected Versions** DDEV versions prior to 1.25.2 **Description** DDEV is an open-source tool for running local web development environments for PHP and Node.js. The software performs unsanitized extraction of archives from remote sources without path validation within the `Untar()` and `Unzip()` functions located in `pkg/archive/archive.go`. **Recommendations** Update to version 1.25.2.

**Name of the Vulnerable Software and Affected Versions** CairoSVG versions prior to 2.9.0 **Description** CairoSVG is an SVG converter based on Cairo, a 2D graphics library. A denial of service can occur due to recursive `<use>` element amplification within the `cairosvg/defs.py` file, specifically in the `use()` function. This amplification leads to CPU exhaustion even from a small input file. A 1,411-byte SVG payload can pin the CPU at 100% indefinitely. The issue arises from the recursive processing of `<use>` elements without depth or count limits. The amplification factor is O(10^N) rendering calls from O(N) input. **Recommendations** Update CairoSVG to version 2.9.0 or later. As a temporary workaround, consider limiting the recursion depth within the `use()` function to prevent excessive CPU usage.