PraisonAIAgents: Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False

mcp-atlassian: Arbitrary file read via missing path validation in

requires critical-level approval, read_skill_file has neither protection. An agent influenced by prompt injection can exfiltrate sensitive files without triggering any approval prompt

SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary

@zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only

PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web

PraisonAIAgents: Path Traversal via Unvalidated Glob Pattern in list_files

Strands Agents: Local Privilege Escalation via Symlink Attack in Default

from the lack of proper sandboxing when evaluating an LLM generated python script. Using prompt injection techniques, an unauthenticated attacker with the ability to send prompts to a chatflow using

AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator

@mobilenext/mobile-mcp: Arbitrary Android Intent Execution via mobile_open_url

Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks

auth-fetch-mcp: SSRF and disk exfiltration via unvalidated auth

Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious paths like '../../.bashrc' to overwrite sensitive files and achieve persistent code execution

sandbox escape, denial of service by crashing the server, server-side request forgery, prompt injection, and server

Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding

Open WebUI Vulnerable to IDOR: Retrieval API Bypasses Knowledge Base

PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters

LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec method