Findings

Audit findings.

Real bugs, not vibes — the security regressions Sebastion catches in live open-source code. Every finding maps to a CWE and is ranked by severity, then published in the open so you can see exactly what a security-first review surfaces before code ships.

1001 findings across 288 repositories — 80 critical, 364 high, 522 medium, 35 low.

Findings come from automated audit runs across public repositories, grouped by scanner severity. They have not all been individually triaged or acknowledged by maintainers; CVE numbers are assigned only after coordinated disclosure where applicable.

Critical

30 on this page

kernel/kernel-images

Arbitrary code execution via Unix socket in playwright-daemon

CWE-94server/runtime/playwright-daemon.ts

2026-04-04

strands-agents/tools

Shell command injection via agent-controlled input to shell tool

CWE-78src/strands_tools/shell.py

2026-04-03

strands-agents/tools

Arbitrary Python code execution via agent-controlled input to python_repl tool

CWE-94src/strands_tools/python_repl.py

2026-04-03

test-zeus-ai/testzeus-hercules

Arbitrary code execution via exec() in sandbox with attacker-controlled code from file

CWE-94testzeus_hercules/core/tools/execute_python_sandbox.py

2026-04-03

test-zeus-ai/testzeus-hercules

Arbitrary code execution via exec() in _parse_custom_injections from environment variable

CWE-94testzeus_hercules/core/tools/execute_python_sandbox.py

2026-04-03

Flux159/mcp-server-kubernetes

Command injection via shell splitting in port_forward.ts

CWE-78src/tools/port_forward.ts

2026-04-01

microsoft/azure-devops-mcp

Command injection via AI response in GitHub Actions workflow

CWE-78.github/workflows/ai-issue-processing.yml

2026-04-01

cloudflare/mcp-server-cloudflare

Arbitrary command execution via container_exec tool

CWE-78apps/sandbox-container/container/sandbox.container.app.ts

2026-03-30

HolmesGPT/holmesgpt

LLM-directed arbitrary command execution via bash toolset with BASH_TOOL_UNSAFE_ALLOW_ALL

CWE-78holmes/plugins/toolsets/bash/common/bash.py

2026-03-28

langbot-app/LangBot

Authenticated Remote Code Execution via exec() on user-supplied Python code

CWE-94src/langbot/pkg/api/http/controller/groups/system.py

2026-03-27

openlit/openlit

OS Command Injection via cron job manipulation

CWE-78src/client/src/helpers/server/cron.ts

2026-03-27

ruc-datalab/DeepAnalyze

OS Command Injection via unsanitized JSON data in score4each_com.py

CWE-78playground/DSBench/data_modeling/score4each_com.py

2026-03-27

FoundationAgents/MetaGPT

Arbitrary code execution via exec() in RunCode.run_text

CWE-95metagpt/actions/run_code.py

2026-03-26

FoundationAgents/MetaGPT

Arbitrary code execution via exec() in aflow operator run_code and benchmarks

CWE-95metagpt/ext/aflow/scripts/operator.py

2026-03-26

OpenHands/OpenHands

Unsafe pickle deserialization of base64-encoded content from remote runtime

CWE-502enterprise/server/utils/conversation_callback_utils.py

2026-03-26

OpenHands/OpenHands

Unsafe pickle deserialization of metrics from file store in ConversationStats

CWE-502openhands/server/services/conversation_stats.py

2026-03-26

browser-use/browser-use

Arbitrary code execution via cloudpickle deserialization in sandbox decorator

CWE-502browser_use/sandbox/sandbox.py

2026-03-26

open-webui/open-webui

Arbitrary code execution via admin-controlled tool/function content stored in DB

CWE-94backend/open_webui/utils/plugin.py

2026-03-25

1Panel-dev/MaxKB

Unsafe pickle deserialization of user-uploaded files allows arbitrary code execution

CWE-502apps/common/utils/common.py

2026-03-24

1Panel-dev/MaxKB

Server-Side Request Forgery (SSRF) via unrestricted URL fetch in template workflow and resource proxy

CWE-918apps/application/serializers/application.py

2026-03-24

QwenLM/Qwen-Agent

Unsandboxed arbitrary code execution via exec() in PythonExecutor

CWE-94qwen_agent/tools/python_executor.py

2026-03-24

ntegrals/openbrowser

Arbitrary command execution via MCP client spawn

CWE-78packages/core/src/bridge/client.ts

2026-03-24

0x4m4/hexstrike-ai

OS Command Injection via Flask API endpoints passing user input to subprocess

CWE-78hexstrike_server.py

Klavis-AI/klavis

SQL Injection in Snowflake MCP server via unparameterized user input in multiple handlers

CWE-89mcp_servers/snowflake_toolathlon/src/mcp_snowflake_server/server.py

MemTensor/MemOS

SQL Injection via string interpolation in Cypher/SQL queries throughout PolarDB graph database