# PyPI Advisories.

Every PyPI Advisory we hold (Python), newest first.

## Records, newest first (an older page)

- [Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)](https://agentprime.io/advisories/GHSA-526j-582w-7fm9.md)
  `GHSA-526j-582w-7fm9`, `CVE-2026-62322` · PyPI `social-auth-core`: affected `<5.0.2`, fixed in `5.0.2` · CVSS 6.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Apprise forwards configured auth headers across cross-origin HTTP redirects](https://agentprime.io/advisories/GHSA-856c-92hv-3vxx.md)
  `GHSA-856c-92hv-3vxx`, `CVE-2026-59180`, `PYSEC-2026-4200` · PyPI `apprise`: affected `<1.11.0`, fixed in `1.11.0` · CVSS 3.1 Low · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure, Open redirect
- [Shiny for Python has path traversal in bookmark restore](https://agentprime.io/advisories/GHSA-47c3-hpmg-7j6p.md)
  `GHSA-47c3-hpmg-7j6p`, `CVE-2026-108258`, `PYSEC-2026-4300` · PyPI `shiny`: affected `>=1.4.0, <1.6.4`, fixed in `1.6.4` · CVSS 6.9 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Path traversal
- [pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents](https://agentprime.io/advisories/GHSA-3hj7-6vmj-h8v4.md)
  `GHSA-3hj7-6vmj-h8v4`, `CVE-2026-107841`, `PYSEC-2026-4246` · PyPI `pacioli-guard`: affected `>=0.9.6, <0.10.0`, fixed in `0.10.0` · CVSS 5.7 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password](https://agentprime.io/advisories/GHSA-68w4-83fh-f2w8.md)
  `GHSA-68w4-83fh-f2w8` · PyPI `pyload-ng`: affected `>=0.5.0b3.dev1, <=0.5.0b3.dev101`, no fixed version yet · CVSS 8.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled \`X-Forwarded-For\` Header](https://agentprime.io/advisories/GHSA-9q47-3cm2-2rp8.md)
  `GHSA-9q47-3cm2-2rp8` · PyPI `pyload-ng`: affected `=0.5.0b3.dev101`, no fixed version yet · CVSS 4.0, no score published · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session](https://agentprime.io/advisories/GHSA-jq7h-wrvp-3rgx.md)
  `GHSA-jq7h-wrvp-3rgx` · PyPI `pyload-ng`: affected `<=0.5.0b3.dev101`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [pyLoad: Api.set_user_permission never invalidates the target's session](https://agentprime.io/advisories/GHSA-889w-m37p-88m5.md)
  `GHSA-889w-m37p-88m5` · PyPI `pyload-ng`: affected `>=0.5.0b3.dev98, <=0.5.0b3.dev101`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host](https://agentprime.io/advisories/GHSA-p3pr-8f3m-4qp8.md)
  `GHSA-p3pr-8f3m-4qp8` · PyPI `pyload-ng`: affected `<=0.5.0b3.dev101`, no fixed version yet · CVSS 6.4 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)](https://agentprime.io/advisories/GHSA-fr26-jjhm-638c.md)
  `GHSA-fr26-jjhm-638c` · PyPI `pyload-ng`: affected `<=0.5.0b3.dev101`, no fixed version yet · CVSS 4.0, no score published · Not analysed yet · Published 9 Oct 2026 · Tags: Path traversal
- [pyLoad has an authentication bypass in API key validation (check_apikey cache)](https://agentprime.io/advisories/GHSA-r44w-v6gf-x3p6.md)
  `GHSA-r44w-v6gf-x3p6` · PyPI `pyload-ng`: affected `<0.5.0b3.dev101`, fixed in `0.5.0b3.dev101` · CVSS 8.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [pyLoad: Unauthenticated access to /web/\<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo](https://agentprime.io/advisories/GHSA-j92p-c242-7hfx.md)
  `GHSA-j92p-c242-7hfx`, `CVE-2026-75597`, `PYSEC-2026-4292` · PyPI `pyload-ng`: affected `<0.5.0b3.dev101`, fixed in `0.5.0b3.dev101` · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure, Authentication bypass
- [pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination](https://agentprime.io/advisories/GHSA-vq8p-m3wm-gv5f.md)
  `GHSA-vq8p-m3wm-gv5f`, `CVE-2026-48484`, `PYSEC-2026-4293` · PyPI `pyload-ng`: affected `<0.5.0b3.dev101`, fixed in `0.5.0b3.dev101` · CVSS 6.5 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Denial of service, CWE-20
- [Strawberry legacy graphql-ws retains naturally completed subscription slots](https://agentprime.io/advisories/GHSA-m952-2w3f-6r8h.md)
  `GHSA-m952-2w3f-6r8h`, `CVE-2026-107727`, `PYSEC-2026-4302` · PyPI `strawberry-graphql`: affected `>=0.312.3, <0.327.2`, fixed in `0.327.2` · CVSS 3.7 Low · Not analysed yet · Published 9 Oct 2026 · Tags: Denial of service
- [Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy](https://agentprime.io/advisories/GHSA-pfvf-fwfp-25mp.md)
  `GHSA-pfvf-fwfp-25mp`, `CVE-2026-107728`, `PYSEC-2026-4303` · PyPI `strawberry-graphql`: affected `>=0.217.0, <0.326.1`, fixed in `0.326.1` · CVSS 7.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry](https://agentprime.io/advisories/GHSA-556j-vv39-8rqv.md)
  `GHSA-556j-vv39-8rqv`, `CVE-2026-107716`, `PYSEC-2026-4201` · PyPI `banks`: affected `<2.5.1`, fixed in `2.5.1` · CVSS 7.3 High · Not analysed yet · Published 8 Oct 2026 · Tags: Path traversal
- [Banks: User-controlled prompt input can be parsed as privileged chat messages](https://agentprime.io/advisories/GHSA-hmq2-7hp6-7crh.md)
  `GHSA-hmq2-7hp6-7crh`, `CVE-2026-107717`, `PYSEC-2026-4202` · PyPI `banks`: affected `<2.5.0`, fixed in `2.5.0` · CVSS 6.5 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-20
- [Indico: Incomplete Server-Side Request Forgery (SSRF) check](https://agentprime.io/advisories/GHSA-2v95-h47v-g4x9.md)
  `GHSA-2v95-h47v-g4x9`, `CVE-2026-107394`, `PYSEC-2026-4225` · PyPI `indico`: affected `<3.3.13`, fixed in `3.3.13` · CVSS 6.8 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Indico: Missing access check in legacy session export API](https://agentprime.io/advisories/GHSA-6p4f-j8j6-463q.md)
  `GHSA-6p4f-j8j6-463q`, `CVE-2026-107395`, `PYSEC-2026-4226` · PyPI `indico`: affected `<3.3.13`, fixed in `3.3.13` · CVSS 4.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Indico: Cross-Site-Scripting in minutes editor](https://agentprime.io/advisories/GHSA-cw24-x4mj-fw3q.md)
  `GHSA-cw24-x4mj-fw3q`, `CVE-2026-107397`, `PYSEC-2026-4228` · PyPI `indico`: affected `<3.3.13`, fixed in `3.3.13` · CVSS 4.4 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Indico: Cross-Site-Scripting in link fields](https://agentprime.io/advisories/GHSA-c4wc-ggrj-jg9v.md)
  `GHSA-c4wc-ggrj-jg9v`, `CVE-2026-107396`, `PYSEC-2026-4227` · PyPI `indico`: affected `<3.3.13`, fixed in `3.3.13` · CVSS 5.4 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-692
- [PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass](https://agentprime.io/advisories/GHSA-c78w-2q4r-68r7.md)
  `GHSA-c78w-2q4r-68r7`, `CVE-2026-61442`, `PYSEC-2026-4262` · PyPI `praisonai-platform`: affected `<0.1.9`, fixed in `0.1.9` · CVSS 7.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [PraisonAI: Shell command allowlist bypass via find -exec built-in action](https://agentprime.io/advisories/GHSA-cv3g-hj65-pcfh.md)
  `GHSA-cv3g-hj65-pcfh`, `CVE-2026-61434`, `PYSEC-2026-4254` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 8.7 High · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection, CWE-693
- [PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls](https://agentprime.io/advisories/GHSA-9mp3-24cc-77mg.md)
  `GHSA-9mp3-24cc-77mg`, `CVE-2026-61445`, `PYSEC-2026-4253` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Path traversal, Command injection
- [PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface](https://agentprime.io/advisories/GHSA-hc5v-gxvj-58wh.md)
  `GHSA-hc5v-gxvj-58wh`, `CVE-2026-61427`, `PYSEC-2026-4257` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 6.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass, Broken access control, CWE-20
- [PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization](https://agentprime.io/advisories/GHSA-xxgv-vgvj-qvxh.md)
  `GHSA-xxgv-vgvj-qvxh`, `CVE-2026-61440`, `PYSEC-2026-4264` · PyPI `praisonai-platform`: affected `<0.1.9`, fixed in `0.1.9` · CVSS 7.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend](https://agentprime.io/advisories/GHSA-5r6c-gj4g-r697.md)
  `GHSA-5r6c-gj4g-r697`, `CVE-2026-60085`, `PYSEC-2026-4250` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 8.7 High · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-273
- [PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF](https://agentprime.io/advisories/GHSA-4w49-gwv8-fpjg.md)
  `GHSA-4w49-gwv8-fpjg`, `CVE-2026-60091`, `PYSEC-2026-4249` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 6.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure, Authentication bypass, Race condition, Server-side request forgery (SSRF)
- [Duplicate Advisory: PYTHON-6110 Out-of-bounds read in BSON decoding via a malformed Regex element](https://agentprime.io/advisories/GHSA-86gh-39m5-hhg6.md)
  `GHSA-86gh-39m5-hhg6` · PyPI `pymongo`: affected `>=3.9.0, <=4.18.2`, no fixed version yet · CVSS 5.1 Medium · Withdrawn · Not analysed yet · Published 8 Oct 2026 · Tags: Memory corruption
- [Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early](https://agentprime.io/advisories/GHSA-6fqq-452j-qhrp.md)
  `GHSA-6fqq-452j-qhrp`, `CVE-2026-107286`, `PYSEC-2026-4276`, `PYSEC-2026-4285` · PyPI `pydantic-ai` and 1 more: affected `>=2.10.0, <2.53.0`, fixed in `2.53.0` · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service
- [CairoSVG: Quadratic-time DoS parsing a crafted SVG \<path>](https://agentprime.io/advisories/GHSA-c3jg-qh8m-j3h2.md)
  `GHSA-c3jg-qh8m-j3h2`, `CVE-2026-107378`, `PYSEC-2026-4204` · PyPI `cairosvg`: affected `<2.9.1`, fixed in `2.9.1` · CVSS 8.7 High · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service
- [PraisonAI: Prompt-injection defense blocks only when 3+ detector families fire simultaneously; realistic single-vector injections pass through unblocked](https://agentprime.io/advisories/GHSA-4r3p-w3mc-5v34.md)
  `GHSA-4r3p-w3mc-5v34`, `CVE-2026-60086`, `PYSEC-2026-4248` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 6.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-693
- [PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source](https://agentprime.io/advisories/GHSA-79fv-7hq9-w7xg.md)
  `GHSA-79fv-7hq9-w7xg`, `CVE-2026-61433`, `PYSEC-2026-4251` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 8.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Code injection, CWE-116
- [PraisonAI: Call API localhost-only authentication bypass via spoofed Host header](https://agentprime.io/advisories/GHSA-2gpf-2492-q9jh.md)
  `GHSA-2gpf-2492-q9jh`, `CVE-2026-61435`, `PYSEC-2026-4247` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 8.8 High · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass, CWE-346
- [PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace](https://agentprime.io/advisories/GHSA-q7m5-3jmv-vm48.md)
  `GHSA-q7m5-3jmv-vm48`, `CVE-2026-61431`, `PYSEC-2026-4258` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 6.8 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Path traversal, Information disclosure
- [datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory](https://agentprime.io/advisories/GHSA-77xj-x4rm-935c.md)
  `GHSA-77xj-x4rm-935c`, `CVE-2026-107377`, `PYSEC-2026-4205` · PyPI `datamodel-code-generator`: affected `>=0.59.0, <0.81.0`, fixed in `0.81.0` · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Path traversal
- [PraisonAI: Project custom command templates can read outside-workspace files into model prompts](https://agentprime.io/advisories/GHSA-xpx6-x8c2-mw5w.md)
  `GHSA-xpx6-x8c2-mw5w`, `CVE-2026-60088`, `PYSEC-2026-4261` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 6.8 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Path traversal, Information disclosure
- [Pydantic AI: Excessive resource use when local web fetching converts nested HTML](https://agentprime.io/advisories/GHSA-v36g-jcw9-x7cw.md)
  `GHSA-v36g-jcw9-x7cw`, `CVE-2026-107287`, `PYSEC-2026-4281`, `PYSEC-2026-4290` · PyPI `pydantic-ai` and 1 more: affected `>=1.77.0, <1.107.7 || >=2.0.0b1, <2.52.0`, fixed in `1.107.7`, `2.52.0` · CVSS 6.5 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service
- [PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL](https://agentprime.io/advisories/GHSA-wf65-4jjx-q444.md)
  `GHSA-wf65-4jjx-q444`, `CVE-2026-60090`, `PYSEC-2026-4260` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: SQL injection, Other injection
- [Pydantic AI Web chat UI (\`Agent.to_web()\`, \`clai web\`): the local chat endpoint does not validate the \`Host\` header](https://agentprime.io/advisories/GHSA-q2xc-rrxj-58x9.md)
  `GHSA-q2xc-rrxj-58x9`, `CVE-2026-107292`, `PYSEC-2026-4279`, `PYSEC-2026-4288` · PyPI `pydantic-ai` and 1 more: affected `>=1.34.0, <1.107.5 || >=2.0.0b1, <2.30.0`, fixed in `1.107.5`, `2.30.0` · CVSS 6.4 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-346, CWE-350
- [Pydantic AI Web chat UI (\`Agent.to_web()\`, \`clai web\`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint](https://agentprime.io/advisories/GHSA-h4xc-3qfq-jf93.md)
  `GHSA-h4xc-3qfq-jf93`, `CVE-2026-107295`, `PYSEC-2026-4278`, `PYSEC-2026-4287` · PyPI `pydantic-ai` and 1 more: affected `>=1.34.0, <1.107.4 || >=2.0.0b1, <2.28.0`, fixed in `1.107.4`, `2.28.0` · CVSS 7.6 High · Not analysed yet · Published 8 Oct 2026 · Tags: Cross-site request forgery (CSRF), CWE-346
- [Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when \`include_content=False\`](https://agentprime.io/advisories/GHSA-3gh4-cghq-f8v4.md)
  `GHSA-3gh4-cghq-f8v4`, `CVE-2026-107293`, `PYSEC-2026-4274`, `PYSEC-2026-4283` · PyPI `pydantic-ai` and 1 more: affected `>=0.3.4, <1.107.4 || >=2.0.0b1, <2.27.1`, fixed in `1.107.4`, `2.27.1` · CVSS 2.3 Low · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure, CWE-212
- [Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl](https://agentprime.io/advisories/GHSA-v2xh-2vp8-57h8.md)
  `GHSA-v2xh-2vp8-57h8`, `CVE-2026-107294`, `PYSEC-2026-4280`, `PYSEC-2026-4289` · PyPI `pydantic-ai` and 1 more: affected `>=1.77.0, <1.107.2 || >=2.0.0b1, <2.24.0`, fixed in `1.107.2`, `2.24.0` · CVSS 6.5 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service
- [PraisonAI: SkillTools Executes Scripts Without Path Containment Validation](https://agentprime.io/advisories/GHSA-c44f-37qr-gw3f.md)
  `GHSA-c44f-37qr-gw3f`, `CVE-2026-61443`, `PYSEC-2026-4270` · PyPI `praisonaiagents`: affected `<1.6.78`, fixed in `1.6.78` · CVSS 8.6 High · Not analysed yet · Published 8 Oct 2026 · Tags: Path traversal, Command injection
- [PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow](https://agentprime.io/advisories/GHSA-4gfv-wg42-7jw5.md)
  `GHSA-4gfv-wg42-7jw5`, `CVE-2026-61437`, `PYSEC-2026-4267` · PyPI `praisonaiagents`: affected `<1.6.78`, fixed in `1.6.78` · CVSS 8.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-693, CWE-829
- [PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace](https://agentprime.io/advisories/GHSA-4xxv-6wmf-xf45.md)
  `GHSA-4xxv-6wmf-xf45`, `CVE-2026-61432`, `PYSEC-2026-4268` · PyPI `praisonaiagents`: affected `<1.6.78`, fixed in `1.6.78` · CVSS 6.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Path traversal, Information disclosure
- [Pydantic AI: Event loop blocked by quadratic title extraction in \`web_fetch\`](https://agentprime.io/advisories/GHSA-fpf4-vwcp-v4hp.md)
  `GHSA-fpf4-vwcp-v4hp`, `CVE-2026-107290`, `PYSEC-2026-4277`, `PYSEC-2026-4286` · PyPI `pydantic-ai` and 1 more: affected `>=1.77.0, <1.107.6 || >=2.0.0b1, <2.44.0`, fixed in `1.107.6`, `2.44.0` · CVSS 6.5 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service
- [Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when \`include_content=False\`](https://agentprime.io/advisories/GHSA-4x9p-g9wm-8q7f.md)
  `GHSA-4x9p-g9wm-8q7f`, `CVE-2026-107291`, `PYSEC-2026-4275`, `PYSEC-2026-4284` · PyPI `pydantic-ai` and 1 more: affected `>=0.3.4, <1.107.6 || >=2.0.0b1, <2.44.0`, fixed in `1.107.6`, `2.44.0` · CVSS 2.3 Low · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure, CWE-212
- [Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers](https://agentprime.io/advisories/GHSA-vmxc-h2x2-jmf3.md)
  `GHSA-vmxc-h2x2-jmf3`, `CVE-2026-107289`, `PYSEC-2026-4282`, `PYSEC-2026-4291` · PyPI `pydantic-ai` and 1 more: affected `>=1.56.0, <1.107.6 || >=2.0.0b1, <2.44.0`, fixed in `1.107.6`, `2.44.0` · CVSS 6.8 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Server-side request forgery (SSRF), CWE-1289
- [PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification](https://agentprime.io/advisories/GHSA-m6wp-h223-4c8g.md)
  `GHSA-m6wp-h223-4c8g`, `CVE-2026-61446`, `PYSEC-2026-4271` · PyPI `praisonaiagents`: affected `<1.6.78`, fixed in `1.6.78` · CVSS 8.6 High · Not analysed yet · Published 8 Oct 2026 · Tags: Code injection, CWE-427
- [PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets](https://agentprime.io/advisories/GHSA-2xv2-w8cq-5gxw.md)
  `GHSA-2xv2-w8cq-5gxw`, `CVE-2026-61447`, `PYSEC-2026-4266` · PyPI `praisonaiagents`: affected `<1.6.78`, fixed in `1.6.78` · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.15 · Not analysed yet · Published 8 Oct 2026 · Tags: Code injection, Information disclosure
- [PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments](https://agentprime.io/advisories/GHSA-29r9-67vg-qj56.md)
  `GHSA-29r9-67vg-qj56`, `CVE-2026-60087`, `PYSEC-2026-4265` · PyPI `praisonaiagents`: affected `<1.6.78`, fixed in `1.6.78` · CVSS 6.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [PraisonAI: DNS rebinding bypass in \`web_crawl\` SSRF protection allows internal response disclosure](https://agentprime.io/advisories/GHSA-qg25-6gc4-48mg.md)
  `GHSA-qg25-6gc4-48mg`, `CVE-2026-61430`, `PYSEC-2026-4272` · PyPI `praisonaiagents`: affected `<1.6.78`, fixed in `1.6.78` · CVSS 8.4 High · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure, Race condition, Server-side request forgery (SSRF)
- [PraisonAI: Project config can auto-save agent output outside the project root](https://agentprime.io/advisories/GHSA-qjw5-xwrp-xwpq.md)
  `GHSA-qjw5-xwrp-xwpq`, `CVE-2026-60089`, `PYSEC-2026-4273` · PyPI `praisonaiagents`: affected `<1.6.78`, fixed in `1.6.78` · CVSS 6.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Path traversal
- [PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats](https://agentprime.io/advisories/GHSA-fj8f-m44g-c479.md)
  `GHSA-fj8f-m44g-c479`, `CVE-2026-61439`, `PYSEC-2026-4255` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 8.7 High · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-116, CWE-693, CWE-1188, CWE-1287
- [Docling: Configured HTTP headers sent to every remote image host named by a document](https://agentprime.io/advisories/GHSA-p3fw-7699-7926.md)
  `GHSA-p3fw-7699-7926`, `CVE-2026-105742`, `PYSEC-2026-4189`, `PYSEC-2026-4212` · PyPI `docling` and 1 more: affected `>=2.95.0, <2.132.0`, fixed in `2.132.0` · CVSS 3.7 Low · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure, Hard-coded credentials
- [Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)](https://agentprime.io/advisories/GHSA-pc36-qwjq-x68c.md)
  `GHSA-pc36-qwjq-x68c`, `CVE-2026-105743`, `PYSEC-2026-4190`, `PYSEC-2026-4214` · PyPI `docling` and 1 more: affected `>=2.91.0, <2.132.0`, fixed in `2.132.0` · CVSS 4.0 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Race condition, Server-side request forgery (SSRF)
- [Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine](https://agentprime.io/advisories/GHSA-x3q2-h9hx-4r4j.md)
  `GHSA-x3q2-h9hx-4r4j`, `CVE-2026-105744`, `PYSEC-2026-4191`, `PYSEC-2026-4216` · PyPI `docling` and 1 more: affected `>=2.94.0, <2.132.0`, fixed in `2.132.0` · CVSS 7.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal, CWE-1188
- [Docling: Crafted DoclingDocument JSON embeds local image files into converted output](https://agentprime.io/advisories/GHSA-p944-4xh2-x776.md)
  `GHSA-p944-4xh2-x776`, `CVE-2026-105748`, `PYSEC-2026-4208`, `PYSEC-2026-4213` · PyPI `docling` and 1 more: affected `>=2.16.0, <2.131.0`, fixed in `2.131.0` · CVSS 4.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal, Information disclosure
- [Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion](https://agentprime.io/advisories/GHSA-cgc7-9qp3-86m3.md)
  `GHSA-cgc7-9qp3-86m3`, `CVE-2026-105749`, `PYSEC-2026-4195`, `PYSEC-2026-4211` · PyPI `docling` and 1 more: affected `>=2.0.0, <2.131.0`, fixed in `2.131.0` · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service

Newest: <https://agentprime.io/advisories/ecosystem/pypi.md>
Older: <https://agentprime.io/advisories/ecosystem/pypi.md?cursor=WyIyMDI2LTEwLTA3VDIwOjQxOjAyLjAwMDAwMFoiLCJHSFNBLWNnYzctOXFwMy04Nm0zIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=PyPI&cursor=WyIyMDI2LTEwLTE1VDIwOjA5OjIzLjAwMDAwMFoiLCJHSFNBLWdmcDgtdzgzNS12NDRqIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/pypi/?cursor=WyIyMDI2LTEwLTE1VDIwOjA5OjIzLjAwMDAwMFoiLCJHSFNBLWdmcDgtdzgzNS12NDRqIl0>. Everything for agents: <https://agentprime.io/llms.txt>.