CWE-863

{
  "affected": [],
  "aliases": [
    "CVE-2019-13386"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-07-26T13:15:00Z",
    "severity": "HIGH"
  },
  "details": "In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, a hidden action=9 feature in filemanager2.php allows attackers to execute a shell command, i.e., obtain a reverse shell with user privilege.",
  "id": "GHSA-ff37-hv4q-764f",
  "modified": "2023-02-28T15:30:23Z",
  "published": "2022-05-24T16:51:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13386"
    },
    {
      "type": "WEB",
      "url": "https://centos-webpanel.com/changelog-cwp7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13386.md"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/153876/CentOS-Control-Web-Panel-0.9.8.836-Remote-Command-Execution.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.ozone:ozone-main"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-39232"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-11-22T19:05:02Z",
    "nvd_published_at": "2021-11-19T10:15:00Z",
    "severity": "HIGH"
  },
  "details": "In Apache Ozone versions prior to 1.2.0, certain admin related SCM commands can be executed by any authenticated users, not just by admins.",
  "id": "GHSA-ff84-84q5-fq4f",
  "modified": "2023-11-14T21:49:08Z",
  "published": "2021-11-23T17:56:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39232"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/ozone"
    },
    {
      "type": "WEB",
      "url": "https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C3c30a7f2-13a4-345e-6c8a-c23a2b937041%40apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2021/11/19/3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Incorrect Authorization in Apache Ozone"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-33881"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-06-06T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "On NXP MIFARE Ultralight and NTAG cards, an attacker can interrupt a write operation (aka conduct a \"tear off\" attack) over RFID to bypass a Monotonic Counter protection mechanism. The impact depends on how the anti tear-off feature is used in specific applications such as public transportation, physical access control, etc.",
  "id": "GHSA-ff8p-pfwc-wjf2",
  "modified": "2022-05-24T19:04:09Z",
  "published": "2022-05-24T19:04:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33881"
    },
    {
      "type": "WEB",
      "url": "https://blog.quarkslab.com/rfid-monotonic-counter-anti-tearing-defeated.html"
    },
    {
      "type": "WEB",
      "url": "https://www.nxp.com/docs/en/application-note/AN11340.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.nxp.com/docs/en/application-note/AN13089.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.sstic.org/2021/presentation/eeprom_it_will_all_end_in_tears"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-25774"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-02-03T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In JetBrains TeamCity before 2020.2.1, a user could get access to the GitHub access token of another user.",
  "id": "GHSA-fffm-3rfw-h6pc",
  "modified": "2022-05-24T17:40:53Z",
  "published": "2022-05-24T17:40:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25774"
    },
    {
      "type": "WEB",
      "url": "https://blog.jetbrains.com"
    },
    {
      "type": "WEB",
      "url": "https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-28715"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-06T00:16:12Z",
    "severity": "MODERATE"
  },
  "details": "Sensitive information disclosure due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.",
  "id": "GHSA-ffgg-g824-6mxj",
  "modified": "2026-03-06T00:31:35Z",
  "published": "2026-03-06T00:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28715"
    },
    {
      "type": "WEB",
      "url": "https://security-advisory.acronis.com/advisories/SEC-5910"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-3027"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-06-05T22:15:12Z",
    "severity": "HIGH"
  },
  "details": "The grc-policy-propagator allows security escalation within the cluster. The propagator allows policies which contain some dynamically obtained values (instead of the policy apply a static manifest on a managed cluster) of taking advantage of cluster scoped access in a created policy. This feature does not restrict properly to lookup content from the namespace where the policy was created.",
  "id": "GHSA-ffmc-4rrr-xm85",
  "modified": "2024-04-04T04:32:36Z",
  "published": "2023-06-06T00:30:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3027"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2211468#c0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonaiagents"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.5.128"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-56074"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-10T19:28:38Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe approval system in PraisonAI Agents caches tool approval decisions by tool name only, not by invocation arguments. Once a user approves `execute_command` for any command (e.g., `ls -la`), all subsequent `execute_command` calls in that execution context bypass the approval prompt entirely. Combined with `os.environ.copy()` passing all process environment variables to subprocesses, this allows an LLM agent (potentially via prompt injection) to silently exfiltrate API keys and credentials without further user consent.\n\n## Details\n\nThe `require_approval` decorator in `src/praisonai-agents/praisonaiagents/approval/__init__.py:176-178` checks approval status by tool name only:\n\n```python\n@wraps(func)\ndef wrapper(*args, **kwargs):\n    if is_already_approved(tool_name):   # line 177 \u2014 checks only tool_name\n        return func(*args, **kwargs)     # line 178 \u2014 bypasses ALL approval\n```\n\nThe `mark_approved` function in `registry.py:144-147` stores only the tool name string:\n\n```python\ndef mark_approved(self, tool_name: str) -\u003e None:\n    approved = self._approved_context.get(set())\n    approved.add(tool_name)              # stores \"execute_command\", not args\n    self._approved_context.set(approved)\n```\n\nThe approval context is never cleared during agent execution \u2014 `clear_approved()` exists (`registry.py:152`) but is never called in the agent\u0027s tool execution path (`agent/tool_execution.py`).\n\nMeanwhile, the `ConsoleBackend` UI at `backends.py:95-96` misleads the user:\n\n```python\nreturn Confirm.ask(\n    f\"Do you want to execute this {request.risk_level} risk tool?\",\n    # \"this\" implies per-invocation approval\n)\n```\n\nThe UI displays the specific command arguments (lines 81-85), creating a reasonable expectation that the user is approving only that specific invocation.\n\nAdditionally, `shell_tools.py:77` passes the full process environment to every subprocess:\n\n```python\nprocess_env = os.environ.copy()  # includes OPENAI_API_KEY, etc.\n```\n\nThere is no command filtering, blocklist, or environment variable sanitization in the shell tools module.\n\n## PoC\n\n```python\nfrom praisonaiagents import Agent\nfrom praisonaiagents.tools.shell_tools import execute_command\n\n# Step 1: Create agent with shell tool\nagent = Agent(\n    name=\"worker\",\n    instructions=\"You are a helpful assistant.\",\n    tools=[execute_command]\n)\n\n# Step 2: Agent requests benign command \u2014 user sees Rich panel:\n#   Function: execute_command\n#   Risk Level: CRITICAL\n#   Arguments:\n#     command: ls -la\n#   \"Do you want to execute this critical risk tool?\" [y/N]\n# User approves \u2192 mark_approved(\"execute_command\") is called\n\n# Step 3: All subsequent execute_command calls bypass approval silently:\n# execute_command(command=\"env\")\n#   \u2192 returns ALL environment variables (OPENAI_API_KEY, AWS_SECRET_ACCESS_KEY, etc.)\n#   \u2192 NO approval prompt shown\n\n# Step 4: Targeted extraction also bypasses approval:\n# execute_command(command=\"printenv OPENAI_API_KEY\")\n#   \u2192 returns the specific API key\n#   \u2192 NO approval prompt shown\n\n# Verification: check the approval cache\nfrom praisonaiagents.approval import is_already_approved\n# After approving \"ls -la\":\n# is_already_approved(\"execute_command\") \u2192 True\n# Any execute_command call now returns immediately at __init__.py:177-178\n```\n\n## Impact\n\n- **Secret exfiltration**: An LLM agent (or one subjected to prompt injection) can dump all process environment variables after a single benign command approval. Common secrets include `OPENAI_API_KEY`, `AWS_SECRET_ACCESS_KEY`, `DATABASE_URL`, and any other credentials passed via environment.\n- **Misleading consent UI**: The console prompt displays specific arguments and uses language (\"this tool\") that implies per-invocation consent, but the system grants session-wide blanket approval.\n- **No expiration or scope**: The approval cache uses a `ContextVar` that persists for the entire agent execution context with no timeout, no command-count limit, and no clearing between tool calls.\n- **No environment filtering**: `os.environ.copy()` passes every environment variable to subprocesses without filtering sensitive patterns.\n\n## Recommended Fix\n\n1. **Per-invocation approval for critical tools** \u2014 store a hash of `(tool_name, arguments)` instead of just `tool_name`, or require re-approval for each invocation of critical-risk tools:\n\n```python\n# In registry.py \u2014 change mark_approved/is_already_approved:\nimport hashlib, json\n\ndef mark_approved(self, tool_name: str, arguments: dict = None) -\u003e None:\n    approved = self._approved_context.get(set())\n    risk = self._risk_levels.get(tool_name)\n    if risk == \"critical\" and arguments:\n        key = f\"{tool_name}:{hashlib.sha256(json.dumps(arguments, sort_keys=True).encode()).hexdigest()}\"\n    else:\n        key = tool_name\n    approved.add(key)\n    self._approved_context.set(approved)\n\ndef is_already_approved(self, tool_name: str, arguments: dict = None) -\u003e bool:\n    approved = self._approved_context.get(set())\n    risk = self._risk_levels.get(tool_name)\n    if risk == \"critical\" and arguments:\n        key = f\"{tool_name}:{hashlib.sha256(json.dumps(arguments, sort_keys=True).encode()).hexdigest()}\"\n        return key in approved\n    return tool_name in approved\n```\n\n2. **Filter environment variables** in `shell_tools.py`:\n\n```python\nSENSITIVE_PATTERNS = (\u0027_KEY\u0027, \u0027_SECRET\u0027, \u0027_TOKEN\u0027, \u0027_PASSWORD\u0027, \u0027_CREDENTIAL\u0027)\n\nprocess_env = {\n    k: v for k, v in os.environ.items()\n    if not any(p in k.upper() for p in SENSITIVE_PATTERNS)\n}\nif env:\n    process_env.update(env)\n```",
  "id": "GHSA-ffp3-3562-8cv3",
  "modified": "2026-06-19T21:33:09Z",
  "published": "2026-04-10T19:28:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-ffp3-3562-8cv3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56074"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.5.128"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/praisonai-tool-approval-cache-bypass-via-coarse-grained-caching"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI: Coarse-Grained Tool Approval Cache Bypasses Per-Invocation Consent for Shell Commands"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-1746"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-266",
      "CWE-269",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-24T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "The authentication mechanism used by poll workers to administer voting using the tested version of Dominion Voting Systems ImageCast X can expose cryptographic secrets used to protect election information. An attacker could leverage this vulnerability to gain access to sensitive information and perform privileged actions, potentially affecting other election equipment.",
  "id": "GHSA-ffqc-r4j7-pvvm",
  "modified": "2022-07-07T00:00:29Z",
  "published": "2022-06-25T00:00:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1746"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-154-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-23054"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-28T18:15:39Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticated low privilege operator user to perform operations not allowed by their privilege level. Successful exploitation could allow an attacker to manipulate user generated files, potentially leading to unauthorized changes in critical system configurations.",
  "id": "GHSA-fg8c-8f5r-r5m9",
  "modified": "2025-01-28T18:31:28Z",
  "published": "2025-01-28T18:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23054"
    },
    {
      "type": "WEB",
      "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04775en_us\u0026docLocale=en_US"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-24966"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-14T17:15:15Z",
    "severity": "MODERATE"
  },
  "details": "\nWhen LDAP remote authentication is configured on F5OS, a remote user without an assigned role will be incorrectly authorized.\u00a0 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
  "id": "GHSA-fgh6-x5w4-82cg",
  "modified": "2025-01-24T18:31:07Z",
  "published": "2024-02-14T18:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24966"
    },
    {
      "type": "WEB",
      "url": "https://my.f5.com/manage/s/article/K000133111"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}