Skip to content
Threat Feed
Subscribe

Tag

Llm-Agent

3 briefs RSS
high advisory

Langroid File Tools Path Traversal Vulnerability (CVE-2026-50181)

A path traversal vulnerability (CVE-2026-50181) exists in Langroid's `ReadFileTool` and `WriteFileTool` components (versions <= 0.63.0), allowing an attacker to read or write arbitrary files outside the configured `curr_dir` via crafted `file_path` arguments, potentially leading to sensitive information disclosure or unauthorized file modification in applications exposing these tools to user or LLM input.

langroid path-traversal python-library vulnerability llm-agent
3t
high advisory

PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters

A command injection vulnerability (CVE-NONE) exists in PraisonAI's `praisonaiagents` package (versions <= 1.6.48) where unsanitized LLM-controlled parameters are directly interpolated into IMAP SEARCH commands, allowing attackers to craft malicious prompts to inject arbitrary IMAP commands, leading to unauthorized email exfiltration, deletion, or denial-of-service when email tools are configured.

praisonaiagents command-injection llm-agent imap email data-exfiltration
3r 4t
high threat

PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web Tools via Attacker-Controlled searxng_url Parameter

A Server-Side Request Forgery (SSRF) vulnerability in PraisonAI's `praisonaiagents` package (versions prior to 1.6.61), specifically within the `searxng_search` and `search_web` tools, allows an attacker to exploit prompt injection by controlling the `searxng_url` parameter, enabling the server to make requests to arbitrary internal endpoints, read responses, perform network enumeration, and potentially expose cloud instance credentials.

exploited praisonaiagents ssrf llm-agent prompt-injection praisonai python ghsa
2r 6t 1i