The PyPI package 'webreader' version 2.3.8 contains embedded malicious code disguised as a pickle configuration file. A related dependency 'pafer' loads this pickle, triggering automatic execution of malicious code during unpickling. This code establishes persistence via a PTH file, downloads additional payloads, and functions as a remote access trojan (RAT) enabling remote code execution and data exfiltration.
The PyPI package media-manager5 version 0.1.0 contains malicious code that installs a persistent job on the victim's machine. This allows attackers to exfiltrate files and execute remote commands, effectively acting as a remote access trojan (RAT). The package is designed with clear malicious intent, including persistence mechanisms and limited remote command execution capabilities.
The agentaix package on PyPI contains malicious code that installs a persistent job on the victim's machine. This job enables attackers to exfiltrate files and execute remote commands, likely limited to a specific set, effectively acting as a remote access trojan (RAT). The package versions 0.1.0 and 0.2.0 are affected. There is no information about an available patch or remediation. No known exploits in the wild have been reported.
CVE-2026-108258 is a path traversal vulnerability in py-shiny, a Python framework for interactive web applications. Versions from 1.4.0 up to but not including 1.6.4 allow an unauthenticated attacker to manipulate the bookmark restore feature by supplying a crafted state_id. This can lead to unauthorized reading of files outside the intended bookmark directory, including sensitive files like input.json and values.json. Additionally, in configurations using server-side bookmark storage and ui.input_file(), attackers can copy and expose arbitrary files from the server. The issue is fixed in version 1.6.4.
CVE-2026-107841 is an incorrect authorization vulnerability in the john-broadway pacioli package version 0.9.6. It allows an attacker with a credential having API Key Scope 'require_consent' to cancel documents without proper consent markers due to a flaw in the consent gate logic. This enables cancellation of submitted documents that a human operator never approved, reversing ledger effects. The issue is fixed in version 0.10.0, which enforces act-bound consent markers for cascading cancels. Only sites that opted into consent gating are affected.
pyload-ng contains an authentication bypass vulnerability in its API endpoints getUserData and get_userdata, which are accessible to any authenticated user regardless of permission level due to a flawed permission check. This allows low-privileged users to brute-force the administrator password without lockout or effective rate limiting, potentially leading to full administrative takeover.
pyLoad-ng version 0.5.0b3 (develop branch) improperly trusts the client-supplied X-Forwarded-For HTTP header to determine client IP for rate limiting and audit logging. This allows an attacker to bypass rate limits by rotating the X-Forwarded-For value on each request, and to spoof source IP addresses in security logs, undermining IP-based blocking and attribution. The server directly faces clients without a trusted proxy configuration, making the XFF header untrusted input. This vulnerability is rated medium severity.
pyLoad-ng versions up to 0.5.0b3.dev101 contain a vulnerability where revoking user privileges or changing passwords via the REST API does not invalidate the user's existing session. This allows a user to retain access with old privileges or session state despite database updates. The issue affects the session-based authentication branch, which caches roles and permissions at login and does not re-check them on each request. The API key authentication branch is unaffected. Sessions can remain valid for about a month due to the default session lifetime.
pyLoad-ng contains a vulnerability where an admin revoking or downgrading a non-admin user's permissions via the documented API does not invalidate the user's existing Flask session cookie. As a result, the demoted user retains their previous elevated permissions in their session for up to the session lifetime (~31 days) or until they log out. This stale session issue occurs because the API method that changes permissions does not clear or refresh user sessions, and no mechanism exists to update session data after login. The vulnerability affects versions from 0.5.0b3.dev98 through 0.5.0b3.dev101 and has a CVSS score of 7.5 (high severity).
pyLoad-ng's WindowsPhoneNotify addon allows an authenticated user with non-admin SETTINGS permission to configure the addon to send HTTP POST requests to arbitrary internal hosts. This occurs because the addon uses Python's http.client.HTTPConnection without outbound address validation, bypassing pyLoad's usual SSRF protections. The attacker can control the destination host, port, request path, and part of the request body. This can lead to blind SSRF attacks enabling internal service probing and potential state changes on internal HTTP endpoints. The vulnerability affects pyLoad-ng versions up to 0.5.0b3.dev101 and has a CVSS score of 6.4 (medium severity).
pyLoad-ng versions up to 0.5.0b3.dev101 contain a vulnerability in the UnTar extractor where tar archive member types are not properly validated during extraction. This allows crafted tar archives containing device nodes or FIFOs to be created on disk. When pyLoad runs as root, such as in the official Docker deployment, this can lead to raw disk access and full host compromise. The vulnerability arises because the extraction function calls tarfile.extractall without a filter, and only validates member names and link targets, not member types. This issue affects Python versions prior to 3.14, which default to a fully trusted extraction filter.
pyLoad-ng contains a critical authentication bypass vulnerability in its API key validation cache. The cache mechanism in check_apikey() uses only the key_id to validate requests, skipping secret verification on cache hits within a 300-second window. Since key_id values are sequential and easily guessable, an attacker can forge an API key with a known key_id that was recently used legitimately and gain full access without knowing the secret. This results in a complete remote authentication bypass with high impact on confidentiality, integrity, and availability. A patch is available to fix this issue.
pyLoad-ng versions prior to 0.5.0b3.dev101 have an unauthenticated access vulnerability in the /web/<path:filename> route, which allows rendering of sensitive Jinja2 templates without authentication. This bypasses the access control enforced on other direct routes. Additionally, an exception handling bug leaks internal error details, including Jinja2 variable names, in HTTP 500 responses to unauthenticated users. This enables attackers to enumerate valid templates and gain insight into internal application structure and system information.
The PyPI package ig-gox version 1.0.0 contains malicious code that executes a concealed payload upon import. This payload is base64-decoded, XOR-decrypted, decompressed, HMAC-verified, and then executed dynamically. The package employs anti-analysis techniques to detect debugging, decompilation, and sandbox environments, exiting if such conditions are detected. It downloads and executes remote malicious scripts designed to abuse Instagram services for mass fake account registration.
CVE-2026-107378 is a high-severity vulnerability in Kozea CairoSVG versions prior to 2.9.1 caused by inefficient algorithmic complexity in SVG path rendering. The vulnerability arises from two independent O(n²) operations in the path parser and marker handling code, leading to excessive CPU usage when rendering SVGs with many path segments. An attacker can exploit this by submitting a crafted SVG with a large number of path segments, causing denial of service due to high CPU consumption during rendering.
A path traversal vulnerability in datamodel-code-generator versions >=0.59.0 and <0.81.0 allows attacker-controlled Protobuf schemas to write files outside the intended temporary directory. The vulnerability arises from improper handling of absolute and relative import paths during weak-import stub generation, enabling creation or overwriting of files in arbitrary writable locations. The written content is limited to a fixed Protobuf syntax declaration, and no direct arbitrary code execution has been demonstrated. The issue occurs before the Protobuf compiler runs and persists despite compilation errors. A fix is available in version 0.81.0.
### Summary
The Pydantic AI development web chat UI (`Agent.to_web()`, `clai web`) did not check the content type of requests to its chat endpoint. This allowed a website visited by a developer to submit a request to a chat UI running on that developer's machine, causing the served agent to run and to execute its tools with the privileges and credentials of the local process.
Binding the web UI to localhost — the default — does not prevent this, because a page open in the developer's browser can reach the loopback address.
### Impact
Applications and developers serving an agent through `Agent.to_web()` or `clai web`. The consequences depend on the tools the served agent exposes, and can include data disclosure as well as unwanted tool side effects. Tools marked `requires_approval=True` were not protected either, because the endpoint trusts approval decisions relayed by the client.
### Mitigation
Upgrade to a patched version. The chat endpoint now requires `Content-Type: application/json` and rejects other requests before the request body is parsed and before the agent runs. The bundled chat UI already sends this header; scripts and other non-browser clients that call the endpoint directly may need to be updated to send it.
If you cannot upgrade, don't run the web UI while browsing untrusted sites, stop it when you aren't using it, and don't serve an agent with side-effecting tools through it.
### Credits
- Thai Son Dinh from VinSOC Labs (R&D)
CVE-2026-107294 is a medium severity vulnerability in pydantic-ai, a Python agent framework for Generative AI applications. Versions from 1.77.0 up to but not including 1.107.2, and from 2.0.0b1 up to but not including 2.24.0, are affected. The issue involves uncontrolled resource consumption due to buffering the entire HTTP response body before applying content-size controls in certain media download components. This can allow an attacker to cause a denial of service by exhausting process memory and crashing the worker. The vulnerability affects media types such as ImageUrl, DocumentUrl, VideoUrl, and AudioUrl. SSRF protections remain effective, limiting the impact to availability. The issue is fixed in versions 1.107.2 and 2.24.0.
### Summary
Pydantic AI's OpenTelemetry instrumentation supports `InstrumentationSettings(include_content=False)` to exclude message content — user prompts, model completions, tool call arguments and responses — from exported telemetry, so that agents can be monitored without sending sensitive content to the observability backend.
Retry prompts — the feedback messages Pydantic AI sends back to the model when its output fails validation or an output validator raises `ModelRetry` — were not covered by this setting when they were not associated with a tool call, as with structured output modes that don't use tool calls (e.g. `NativeOutput` or `PromptedOutput`) and output validators applied to text output. Their full content was recorded on model request spans even with `include_content=False`. Since validation feedback can quote invalid values from the model's response, message content that the setting was configured to withhold could reach the telemetry backend.
### Details
Retry prompts without an associated tool call were serialized into span message attributes (such as `gen_ai.input.messages` and `pydantic_ai.all_messages`) as regular text parts, and this path did not apply the `include_content` check that every other message part applies. Retry prompts tied to a tool call, and all other message content, were redacted correctly.
### Impact
This does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario `include_content=False` exists for. The disclosed content is limited to retry feedback: validation error details, which can quote invalid values from the model's output, or output-validator `ModelRetry` messages.
### Who Is Affected
You are affected if you enabled instrumentation with `include_content=False` and your agent can produce retry prompts outside of tool calls: it uses a structured output mode that doesn't rely on tool calls (such as `NativeOutput` or `PromptedOutput`), or output validators on text output. You are not affected if you don't set `include_content=False`, or if all of your agent's retries come from tool calls (including the default tool-based structured output mode), which were redacted correctly.
### Remediation
Upgrade to a patched version; retry prompt content now honors `include_content=False` like all other message content. If you rely on this setting, consider reviewing previously exported traces for retry prompt content that should not have been recorded.
### Workaround for Unpatched Versions
If you cannot upgrade, scrub or drop the message attributes (`gen_ai.input.messages`, `gen_ai.output.messages`, `pydantic_ai.all_messages`) in your telemetry pipeline (for example with an OpenTelemetry Collector processor), or use tool-based structured output modes, whose retry feedback honors `include_content=False`.
### Credits
Reported privately by the University of Sydney Security Research Team (Liyi Zhou, Ziyue Wang, Strick, Maurice, Chenchen Yu), and later independently discovered and reported publicly, with a fix, by @sean-kim05.
CVE-2026-107292 is an origin validation error in pydantic-ai affecting versions from 1.34.0 up to but not including 2.30.0. The vulnerability allows DNS rebinding attacks via the Host header in the Agent.to_web() and clai web chat server, enabling a malicious website to interact with a loopback-hosted agent as a same-origin service. This can lead to unauthorized execution of agent tools with local process privileges, causing data disclosure and unwanted side effects. The issue is fixed in versions 1.107.5 and 2.30.0.