https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 21:01:55 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-290474 EUVD-2026-290474 https://cve.radiocsirt.org/vuln/euvd-2026-290474 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40113 <p>PraisonAI is a multi-agent teams system. Prior to 4.5.128, deploy.py constructs a single comma-delimited string for the gcloud run deploy --set-env-vars argument by directly interpolating openai_model, openai_key, and openai_base without validating that these values do not contain commas. gcloud uses a comma as the key-value pair separator for --set-env-vars. A comma in any of the three values causes gcloud to parse the trailing text as additional KEY=VALUE definitions, injecting arbitrary environment variables into the deployed Cloud Run service. This vulnerability is fixed in 4.5.128.</p> <p>PraisonAI is a multi-agent teams system. Prior to 4.5.128, deploy.py constructs a single comma-delimited string for the gcloud run deploy --set-env-vars argument by directly interpolating openai_model, openai_key, and openai_base without validating that these values do not contain commas. gcloud uses a comma as the key-value pair separator for --set-env-vars. A comma in any of the three values causes gcloud to parse the trailing text as additional KEY=VALUE definitions, injecting arbitrary environment variables into the deployed Cloud Run service. This vulnerability is fixed in 4.5.128.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-40113 https://cve.radiocsirt.org/vuln/ghsa-fvxx-ggmx-3cjg <p><strong>Affected:</strong> PyPI: PraisonAI</p> <p>**Summary**</p> <p>deploy.py constructs a single comma-delimited string for the gcloud run deploy --set-env-vars argument by directly interpolating openai_model, openai_key, and openai_base without validating that these values do not contain commas. gcloud uses a comma as the key-value pair separator for --set-env-vars. A comma in any of the three values causes gcloud to parse the trailing text as additional KEY=VALUE definitions, injecting arbitrary environment variables into the deployed Cloud Run service.</p> <p>Grep Commands and Evidence</p> <p>Step 1. Confirm the vulnerable string construction at line 150 ``` grep -n &#34;set-env-vars\|openai_key\|openai_base\|openai_model&#34; \ src/praisonai/praisonai/deploy.py ``` Expected output showing unsanitized interpolation: 150: &#39;--set-env-vars&#39;, f&#39;OPENAI_MODEL_NAME={openai_model},OPENAI_API_KEY={openai_key},OPENAI_API_BASE={openai_base}&#39;</p> <p>Step 2. Confirm no comma validation exists before this line ``` grep -n &#34;comma\|assertNotIn\|ValueError\|sanitize\|strip\|replace&#34; \ src/praisonai/praisonai/deploy.py ``` Expected output: no results related to input validation</p> <p>Step 3. View the full context of the vulnerable construction ``` sed -n &#39;140,165p&#39; \ src/praisonai/praisonai/deploy.py ``` This block shows the gcloud command list where the three values are joined into one comma-separated string passed as a single argument element. gcloud receives this string and applies its own comma-based parsing,…</p> <p><strong>Affected:</strong> PyPI: PraisonAI</p> <p>**Summary**</p> <p>deploy.py constructs a single comma-delimited string for the gcloud run deploy --set-env-vars argument by directly interpolating openai_model, openai_key, and openai_base without validating that these values do not contain commas. gcloud uses a comma as the key-value pair separator for --set-env-vars. A comma in any of the three values causes gcloud to parse the trailing text as additional KEY=VALUE definitions, injecting arbitrary environment variables into the deployed Cloud Run service.</p> <p>Grep Commands and Evidence</p> <p>Step 1. Confirm the vulnerable string construction at line 150 ``` grep -n &#34;set-env-vars\|openai_key\|openai_base\|openai_model&#34; \ src/praisonai/praisonai/deploy.py ``` Expected output showing unsanitized interpolation: 150: &#39;--set-env-vars&#39;, f&#39;OPENAI_MODEL_NAME={openai_model},OPENAI_API_KEY={openai_key},OPENAI_API_BASE={openai_base}&#39;</p> <p>Step 2. Confirm no comma validation exists before this line ``` grep -n &#34;comma\|assertNotIn\|ValueError\|sanitize\|strip\|replace&#34; \ src/praisonai/praisonai/deploy.py ``` Expected output: no results related to input validation</p> <p>Step 3. View the full context of the vulnerable construction ``` sed -n &#39;140,165p&#39; \ src/praisonai/praisonai/deploy.py ``` This block shows the gcloud command list where the three values are joined into one comma-separated string passed as a single argument element. gcloud receives this string and applies its own comma-based parsing,…</p> https://cve.radiocsirt.org/vuln/ghsa-fvxx-ggmx-3cjg https://cve.radiocsirt.org/vuln/pysec-2026-2913 <p><strong>Affected:</strong> PyPI: praisonai</p> <p>**Summary**</p> <p>deploy.py constructs a single comma-delimited string for the gcloud run deploy --set-env-vars argument by directly interpolating openai_model, openai_key, and openai_base without validating that these values do not contain commas. gcloud uses a comma as the key-value pair separator for --set-env-vars. A comma in any of the three values causes gcloud to parse the trailing text as additional KEY=VALUE definitions, injecting arbitrary environment variables into the deployed Cloud Run service.</p> <p>Grep Commands and Evidence</p> <p>Step 1. Confirm the vulnerable string construction at line 150 ``` grep -n &#34;set-env-vars\|openai_key\|openai_base\|openai_model&#34; \ src/praisonai/praisonai/deploy.py ``` Expected output showing unsanitized interpolation: 150: &#39;--set-env-vars&#39;, f&#39;OPENAI_MODEL_NAME={openai_model},OPENAI_API_KEY={openai_key},OPENAI_API_BASE={openai_base}&#39;</p> <p>Step 2. Confirm no comma validation exists before this line ``` grep -n &#34;comma\|assertNotIn\|ValueError\|sanitize\|strip\|replace&#34; \ src/praisonai/praisonai/deploy.py ``` Expected output: no results related to input validation</p> <p>Step 3. View the full context of the vulnerable construction ``` sed -n &#39;140,165p&#39; \ src/praisonai/praisonai/deploy.py ``` This block shows the gcloud command list where the three values are joined into one comma-separated string passed as a single argument element. gcloud receives this string and applies its own comma-based parsing,…</p> <p><strong>Affected:</strong> PyPI: praisonai</p> <p>**Summary**</p> <p>deploy.py constructs a single comma-delimited string for the gcloud run deploy --set-env-vars argument by directly interpolating openai_model, openai_key, and openai_base without validating that these values do not contain commas. gcloud uses a comma as the key-value pair separator for --set-env-vars. A comma in any of the three values causes gcloud to parse the trailing text as additional KEY=VALUE definitions, injecting arbitrary environment variables into the deployed Cloud Run service.</p> <p>Grep Commands and Evidence</p> <p>Step 1. Confirm the vulnerable string construction at line 150 ``` grep -n &#34;set-env-vars\|openai_key\|openai_base\|openai_model&#34; \ src/praisonai/praisonai/deploy.py ``` Expected output showing unsanitized interpolation: 150: &#39;--set-env-vars&#39;, f&#39;OPENAI_MODEL_NAME={openai_model},OPENAI_API_KEY={openai_key},OPENAI_API_BASE={openai_base}&#39;</p> <p>Step 2. Confirm no comma validation exists before this line ``` grep -n &#34;comma\|assertNotIn\|ValueError\|sanitize\|strip\|replace&#34; \ src/praisonai/praisonai/deploy.py ``` Expected output: no results related to input validation</p> <p>Step 3. View the full context of the vulnerable construction ``` sed -n &#39;140,165p&#39; \ src/praisonai/praisonai/deploy.py ``` This block shows the gcloud command list where the three values are joined into one comma-separated string passed as a single argument element. gcloud receives this string and applies its own comma-based parsing,…</p> https://cve.radiocsirt.org/vuln/pysec-2026-2913