Vulnerabilidades de OpenBMB
CVEs publicadas que afetam produtos de OpenBMB: 5 registro(s), com severidade, exploração e correções.
CVE-2026-58166
Crítica · 9.1
CWE-22 30/06/2026
OpenBMB ChatDev: path traversal sem autenticação no upload de arquivos
O OpenBMB ChatDev até a versão 2.2.0, corrigido no commit 4fd4da6, contém uma vulnerabilidade de path traversal que permite a atacantes remotos não autenticados gravar ou excluir arquivos arbitrários ao fornecer um nome de arquivo multipart malicioso no endpoint de upload de arquivos. Atacantes podem enviar um nome de arquivo elaborado contendo sequências de path traversal ou um caminho absoluto para o endpoint POST de sessão de uploads, que constrói o caminho de destino sem sanitização em save_upload_file, fazendo com que as operações de gravação e limpeza de arquivos tenham como alvo caminhos escolhidos pelo atacante no sistema de arquivos do servidor.
CVE-2026-4959
Alta · 7.5
CWE-287 27/03/2026
OpenBMB XAgent ShareServer WebSocket Endpoint share.py check_user missing authentication
A vulnerability was found in OpenBMB XAgent 1.0.0. This impacts the function check_user of the file XAgentServer/application/websockets/share.py of the component ShareServer WebSocket Endpoint. Performing a manipulation of the argument interaction_id results in missing authentication. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-4958
Média · 6.5
CWE-285 27/03/2026
OpenBMB XAgent WebSocket Endpoint replayer.py ReplayServer.send_data authorization
A vulnerability has been found in OpenBMB XAgent 1.0.0. This affects the function ReplayServer.on_connect/ReplayServer.send_data of the file XAgentServer/application/websockets/replayer.py of the component WebSocket Endpoint. Such manipulation of the argument interaction_id leads to authorization bypass. The attack may be launched remotely. Attacks of this nature are highly complex. The exploitability is reported as difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-4957
Baixa · 2.7
CWE-532 27/03/2026
OpenBMB XAgent API Key function_handler.py FunctionHandler.handle_tool_call log file
A flaw has been found in OpenBMB XAgent 1.0.0. The impacted element is the function FunctionHandler.handle_tool_call of the file XAgent/function_handler.py of the component API Key Handler. This manipulation of the argument api_key causes sensitive information in log files. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-3954
Média · 6.5
CWE-22 11/03/2026
OpenBMB XAgent workspace.py workspace path traversal
A weakness has been identified in OpenBMB XAgent 1.0.0. Affected by this vulnerability is the function workspace of the file XAgentServer/application/routers/workspace.py. This manipulation of the argument file_name causes path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.