PraisonAI before 4.6.78 contains a prompt injection defense bypass vulnerability where the injection defense only blocks threats classified as CRITICAL, requiring three or more detector families to match simultaneously. Attackers

requires critical-level approval, read_skill_file has neither protection. An agent influenced by prompt injection can exfiltrate sensitive files without triggering any approval prompt

SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary

PraisonAIAgents: Path Traversal via Unvalidated Glob Pattern in list_files

injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious paths like '../../.bashrc' to overwrite sensitive files and achieve persistent code execution

PraisonAI: Coarse-Grained Tool Approval Cache Bypasses Per-Invocation Consent

CKAN MCP Server: Cache-key canonicalization collision enables cache confusion

nested tool calls dispatched from run_code in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via run_nested_call() without check_before

remote images from Markdown in model responses. An attacker who could place an indirect prompt injection in content processed by Codex, such as a connected-tool result or another untrusted

from AI responses, triggering HTTP requests to arbitrary external URLs without restriction. Combined with prompt injection in a malicious workspace, an attacker could induce the AI agent to construct image

prefix check that did not append a trailing path separator. A model steered by prompt injection could supply a crafted path that resolved to a sibling directory sharing the memory

/pinclaw/send. Unauthenticated attackers reaching port 18790, which binds all interfaces by default, can inject blind prompts into the user's main OpenClaw agent session as user instructions

PraisonAI is a multi-agent teams system. Prior to 4.5.128

OpenClaw versions 2026.2.13 through 2026.3.24 contain an ANSI escape sequence injection vulnerability in approval prompts that allows attackers to spoof terminal output. Untrusted tool metadata can carry ANSI control sequences

Open WebUI: Sharing models for others to use (read permission

@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not

@dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create

TaskWeaver has Protection Mechanism Failure and Server-Side Request Forgery

PraisonAI: Unauthenticated Information Disclosure of Agent Instructions via /api/agents in

DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL