PyPI Advisories.

Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)

• Cross-site request forgery (CSRF)

<5.0.2 · fixed in 5.0.2

Apprise forwards configured auth headers across cross-origin HTTP redirects

• Information disclosure
• Open redirect

<1.11.0 · fixed in 1.11.0

Shiny for Python has path traversal in bookmark restore

• Path traversal

>=1.4.0, <1.6.4 · fixed in 1.6.4

pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents

• Broken access control

>=0.9.6, <0.10.0 · fixed in 0.10.0

pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password

• Authentication bypass

>=0.5.0b3.dev1, <=0.5.0b3.dev101 · no fixed version yet

pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header

• Authentication bypass

=0.5.0b3.dev101 · no fixed version yet

pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session

• Authentication bypass

<=0.5.0b3.dev101 · no fixed version yet

pyLoad: Api.set_user_permission never invalidates the target's session

• Authentication bypass

>=0.5.0b3.dev98, <=0.5.0b3.dev101 · no fixed version yet

pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host

• Server-side request forgery (SSRF)

<=0.5.0b3.dev101 · no fixed version yet

pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)

• Path traversal

<=0.5.0b3.dev101 · no fixed version yet

pyLoad has an authentication bypass in API key validation (check_apikey cache)

• Authentication bypass

<0.5.0b3.dev101 · fixed in 0.5.0b3.dev101

pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo

• Information disclosure
• Authentication bypass

<0.5.0b3.dev101 · fixed in 0.5.0b3.dev101

pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination

• Denial of service
• CWE-20

<0.5.0b3.dev101 · fixed in 0.5.0b3.dev101

Strawberry legacy graphql-ws retains naturally completed subscription slots

• Denial of service

>=0.312.3, <0.327.2 · fixed in 0.327.2

Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy

• Broken access control

>=0.217.0, <0.326.1 · fixed in 0.326.1

Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry

• Path traversal

<2.5.1 · fixed in 2.5.1

Banks: User-controlled prompt input can be parsed as privileged chat messages

• CWE-20

<2.5.0 · fixed in 2.5.0

Indico: Incomplete Server-Side Request Forgery (SSRF) check

• Server-side request forgery (SSRF)

<3.3.13 · fixed in 3.3.13

Indico: Missing access check in legacy session export API

• Broken access control

<3.3.13 · fixed in 3.3.13

Indico: Cross-Site-Scripting in minutes editor

• Cross-site scripting (XSS)

<3.3.13 · fixed in 3.3.13

Indico: Cross-Site-Scripting in link fields

• CWE-692

<3.3.13 · fixed in 3.3.13

PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass

• Broken access control

<0.1.9 · fixed in 0.1.9

PraisonAI: Shell command allowlist bypass via find -exec built-in action

• Command injection
• CWE-693

<4.6.78 · fixed in 4.6.78

PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls

• Path traversal
• Command injection

<4.6.78 · fixed in 4.6.78

PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface

• Authentication bypass
• Broken access control

<4.6.78 · fixed in 4.6.78

PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization

• Broken access control

<0.1.9 · fixed in 0.1.9

PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend

• CWE-273

<4.6.78 · fixed in 4.6.78

PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF

• Information disclosure
• Authentication bypass

<4.6.78 · fixed in 4.6.78

Duplicate Advisory: PYTHON-6110 Out-of-bounds read in BSON decoding via a malformed Regex element

• Memory corruption

>=3.9.0, <=4.18.2 · no fixed version yet

Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early

• Denial of service

>=2.10.0, <2.53.0 · fixed in 2.53.0

CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>

• Denial of service

<2.9.1 · fixed in 2.9.1

PraisonAI: Prompt-injection defense blocks only when 3+ detector families fire simultaneously; realistic single-vector injections pass through unblocked

• CWE-693

<4.6.78 · fixed in 4.6.78

PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source

• Code injection
• CWE-116

<4.6.78 · fixed in 4.6.78

PraisonAI: Call API localhost-only authentication bypass via spoofed Host header

• Authentication bypass
• CWE-346

<4.6.78 · fixed in 4.6.78

PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace

• Path traversal
• Information disclosure

<4.6.78 · fixed in 4.6.78

datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

• Path traversal

>=0.59.0, <0.81.0 · fixed in 0.81.0

PraisonAI: Project custom command templates can read outside-workspace files into model prompts

• Path traversal
• Information disclosure

<4.6.78 · fixed in 4.6.78

Pydantic AI: Excessive resource use when local web fetching converts nested HTML

• Denial of service

>=1.77.0, <1.107.7 || >=2.0.0b1, <2.52.0 · fixed in 1.107.7, 2.52.0

PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL

• SQL injection
• Other injection

<4.6.78 · fixed in 4.6.78

Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

• CWE-346
• CWE-350

>=1.34.0, <1.107.5 || >=2.0.0b1, <2.30.0 · fixed in 1.107.5, 2.30.0

Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint

• Cross-site request forgery (CSRF)
• CWE-346

>=1.34.0, <1.107.4 || >=2.0.0b1, <2.28.0 · fixed in 1.107.4, 2.28.0

Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`

• Information disclosure
• CWE-212

>=0.3.4, <1.107.4 || >=2.0.0b1, <2.27.1 · fixed in 1.107.4, 2.27.1

Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl

• Denial of service

>=1.77.0, <1.107.2 || >=2.0.0b1, <2.24.0 · fixed in 1.107.2, 2.24.0

PraisonAI: SkillTools Executes Scripts Without Path Containment Validation

• Path traversal
• Command injection

<1.6.78 · fixed in 1.6.78

PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow

• CWE-693
• CWE-829

<1.6.78 · fixed in 1.6.78

PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace

• Path traversal
• Information disclosure

<1.6.78 · fixed in 1.6.78

Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`

• Denial of service

>=1.77.0, <1.107.6 || >=2.0.0b1, <2.44.0 · fixed in 1.107.6, 2.44.0

Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`

• Information disclosure
• CWE-212

>=0.3.4, <1.107.6 || >=2.0.0b1, <2.44.0 · fixed in 1.107.6, 2.44.0

Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers

• Server-side request forgery (SSRF)
• CWE-1289

>=1.56.0, <1.107.6 || >=2.0.0b1, <2.44.0 · fixed in 1.107.6, 2.44.0

PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification

• Code injection
• CWE-427

<1.6.78 · fixed in 1.6.78

PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets

• Code injection
• Information disclosure

<1.6.78 · fixed in 1.6.78

PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments

• Broken access control

<1.6.78 · fixed in 1.6.78

PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure

• Information disclosure
• Race condition

<1.6.78 · fixed in 1.6.78

PraisonAI: Project config can auto-save agent output outside the project root

• Path traversal

<1.6.78 · fixed in 1.6.78

PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats

• CWE-116
• CWE-693

<4.6.78 · fixed in 4.6.78

Docling: Configured HTTP headers sent to every remote image host named by a document

• Information disclosure
• Hard-coded credentials

>=2.95.0, <2.132.0 · fixed in 2.132.0

Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)

• Race condition
• Server-side request forgery (SSRF)

>=2.91.0, <2.132.0 · fixed in 2.132.0

Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine

• Path traversal
• CWE-1188

>=2.94.0, <2.132.0 · fixed in 2.132.0

Docling: Crafted DoclingDocument JSON embeds local image files into converted output

• Path traversal
• Information disclosure

>=2.16.0, <2.131.0 · fixed in 2.131.0

Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion

• Denial of service

>=2.0.0, <2.131.0 · fixed in 2.131.0