Threats tagged 'ghsa-gmjg-hv98-qggq'

The praisonaiagents package contains a vulnerability in its tool execution mechanism where undeclared tool names are resolved against global and __main__ module callables without proper permission checks. By default, the agent's permission allowlist is disabled, allowing attackers who can influence tool-call names to invoke unintended application functions that were never declared as tools. This can lead to unauthorized code execution.