Fastapi
Monthly
Unauthenticated remote clients can enumerate the agents deployed on PraisonAI's AgentOS FastAPI surface and invoke them directly, because GET /api/agents and POST /api/chat are registered with no authentication and AgentOSConfig defaults the bind host to 0.0.0.0. This is an incomplete-fix exposure: the previously published patch for GHSA-pm96-6xpr-978x / CVE-2026-40151 (4.5.128) still accepts both no-credential and wrong-bearer requests, as do releases through 4.6.57 and current main, with the advisory's reproducer showing the chat route executing agent.chat() as an observable side effect. PraisonAI 4.6.59 is the version that closes the gap, and the issue is rated act_now because the default configuration puts an agent-control endpoint in reach of any network client, with consequences scaling to whatever tools, memory, private context, API integrations or paid model calls the deployed agents have. A public PoC reference exists in the advisory but is not verified as working exploit code, and no confirmed active exploitation is indicated in the available intelligence.
Missing authentication in the HKUDS Vibe-Trading FastAPI server (pip package vibe-trading-ai 0.1.0 through 0.1.6) lets unauthenticated remote attackers reach every endpoint guarded by Depends(require_auth), because require_auth() returns immediately when API_AUTH_KEY is unset - which is the shipped default in agent/.env.example. Attackers can POST to /sessions/{id}/messages to drive the agent's BashTool toward shell command execution, upload .py/.sh/.yaml files via /upload, read other users' session histories, and recover partial API keys via _mask_secret(); because the shipped Dockerfile has no USER directive and docker-compose publishes 0.0.0.0:8899, any command executed lands as root inside the container. Exploitation matches the assessed vector AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact; the full chained RCE demonstration additionally requires the operator to have configured a working LLM API key so the tool-call loop can complete, while the unauthenticated API surface, file upload, history read and partial key disclosure work without it. No CISA KEV listing and no public exploit code identified at time of analysis, though the vendor advisory publishes detailed reproduction steps; fix in 0.1.7.
Missing authentication in the FastAPI backend of Forget-C Jellyfish AI Short Drama Studio (versions 0.1.0-alpha, 0.2.0, 0.3.0, 0.3.1 and 0.3.2) lets unauthenticated remote attackers reach API endpoints that should require credentials, because the dependency logic in backend/app/dependencies.py does not enforce an authentication check. The CVSS 4.0 base score is 6.9, and the vector (AV:N/AC:L/AT:N/PR:N/UI:N, LOW confidentiality/integrity/availability) indicates no credentials, no user interaction and no special conditions are needed; no public exploit code is identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status. Real-world priority remains low because the software is an obscure self-hosted hobby project, so exposure depends on someone operating a publicly reachable instance, and a successful bypass yields only LOW impact across all three security objectives.
n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function within api_server.py. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FastAPI is a web framework for building APIs with Python 3.6+ based on standard Python type hints. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Unauthenticated remote clients can enumerate the agents deployed on PraisonAI's AgentOS FastAPI surface and invoke them directly, because GET /api/agents and POST /api/chat are registered with no authentication and AgentOSConfig defaults the bind host to 0.0.0.0. This is an incomplete-fix exposure: the previously published patch for GHSA-pm96-6xpr-978x / CVE-2026-40151 (4.5.128) still accepts both no-credential and wrong-bearer requests, as do releases through 4.6.57 and current main, with the advisory's reproducer showing the chat route executing agent.chat() as an observable side effect. PraisonAI 4.6.59 is the version that closes the gap, and the issue is rated act_now because the default configuration puts an agent-control endpoint in reach of any network client, with consequences scaling to whatever tools, memory, private context, API integrations or paid model calls the deployed agents have. A public PoC reference exists in the advisory but is not verified as working exploit code, and no confirmed active exploitation is indicated in the available intelligence.
Missing authentication in the HKUDS Vibe-Trading FastAPI server (pip package vibe-trading-ai 0.1.0 through 0.1.6) lets unauthenticated remote attackers reach every endpoint guarded by Depends(require_auth), because require_auth() returns immediately when API_AUTH_KEY is unset - which is the shipped default in agent/.env.example. Attackers can POST to /sessions/{id}/messages to drive the agent's BashTool toward shell command execution, upload .py/.sh/.yaml files via /upload, read other users' session histories, and recover partial API keys via _mask_secret(); because the shipped Dockerfile has no USER directive and docker-compose publishes 0.0.0.0:8899, any command executed lands as root inside the container. Exploitation matches the assessed vector AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact; the full chained RCE demonstration additionally requires the operator to have configured a working LLM API key so the tool-call loop can complete, while the unauthenticated API surface, file upload, history read and partial key disclosure work without it. No CISA KEV listing and no public exploit code identified at time of analysis, though the vendor advisory publishes detailed reproduction steps; fix in 0.1.7.
Missing authentication in the FastAPI backend of Forget-C Jellyfish AI Short Drama Studio (versions 0.1.0-alpha, 0.2.0, 0.3.0, 0.3.1 and 0.3.2) lets unauthenticated remote attackers reach API endpoints that should require credentials, because the dependency logic in backend/app/dependencies.py does not enforce an authentication check. The CVSS 4.0 base score is 6.9, and the vector (AV:N/AC:L/AT:N/PR:N/UI:N, LOW confidentiality/integrity/availability) indicates no credentials, no user interaction and no special conditions are needed; no public exploit code is identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status. Real-world priority remains low because the software is an obscure self-hosted hobby project, so exposure depends on someone operating a publicly reachable instance, and a successful bypass yields only LOW impact across all three security objectives.
n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function within api_server.py. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FastAPI is a web framework for building APIs with Python 3.6+ based on standard Python type hints. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.