NEWSkillSec — elevating AI Skills security from malware detection to capability auditingSkillSecLearn more →
← Back to Intel Center
SECURITY INTEL · DAILY
Link copiedRSS

2026-07-24 ~ 07-26 Daily Security Intelligence

6 itemsTop severity 10.0 (Critical)CSSA 2 · CVE 2 · Poisoning 2

CSSA Exclusive Early Warning2

CSSA Exclusive Early Warning10.0 Critical

DeepSeek-Reasonix command substitution bypasses permission checks enabling arbitrary execution and system compromise

This flaw stems from the permission decision module performing string prefix matching when parsing a request without first stripping nested execution structures. An attacker can trigger the logic flaw by crafting compound instructions containing dollar-sign parentheses or backticks. When a wildcard allow rule exists in the configuration file, the malicious payload directly inherits the approval status of the outer legitimate tool, skips the secondary authorization step and executes the embedded code first in the host shell environment. This attack path is network-reachable and breaks the access control boundary without any initial credentials, ultimately causing comprehensive damage to data confidentiality, system integrity and business availability on the target host.

Component
DeepSeek-Reasonix is an automated task scheduling framework for agent workflows. Its core architecture uses a Go-rewritten middleware layer and a stru…
Type
OS Command Injection (CWE-78)
Repo
github.com/esengine/DeepSeek-Reasonix · Stars 27832
Remediation
  • It is recommended that development teams introduce strict input sanitization and context isolation into the command execution path, prohibit direct concatenation of user-controllable parameters into the shell interpreter, prefer parameterized invocation over dynamic string assembly, apply recursive parsing and independent policy evaluation to all nested execution blocks, and follow least privilege to restrict the range of executable programs and block privilege-exceeding calls.
CSSA Exclusive Early Warning10.0 Critical

Camel secure interpreter attribute traversal bypass leading to arbitrary code execution and loss of system privileges

An attacker exploits the absence of dunder attribute filtering in the internal interpreter's abstract syntax tree node handler, crafting malicious expressions that call built-in functions directly to obtain unauthorized attributes, then traversing base classes and subclass collections step by step along the method resolution order chain. This ultimately breaks the import allowlist restriction and hijacks the built-in import module in the global namespace. The vulnerability is network-reachable and requires no complex preconditions; submitting a crafted payload alone triggers sandbox escape. Affected systems face the full range of risks including sensitive data disclosure, arbitrary operating system command execution and malicious consumption of compute resources.

Component
Camel is an integrated framework for AI agent development. Its core architecture uses a modular design with a built-in sandboxed code execution engine…
Type
Protection Mechanism Failure (CWE-693)
Repo
github.com/camel-ai/camel · Stars 17495
Remediation
  • It is recommended that developers enforce strict attribute access control during abstract syntax tree parsing, intercept direct reads of dangerous magic methods, validate the scope legitimacy of returned callable objects before executing callbacks, and rebuild the runtime environment around deep sandbox isolation and least privilege to cut off paths for unintended behavior to propagate.

CVE Intelligence2

CVE-2026-66013CVSS 9.8 Critical2026-07-25

OpenRemote Console Registration API Authorization Bypass Leading to Notification Redirection

In OpenRemote prior to version 1.26.2, the console registration API lacks ownership verification, resulting in authorization bypass through a user-controlled key (CWE-639). An attacker who supplies a known asset identifier can update an existing console asset without authentication. The attacker can overwrite push notification tokens and console metadata, thereby redirecting notifications or preventing legitimate consoles from receiving them. The vulnerability affects all OpenRemote users who have not updated to 1.26.2. An attacker only needs to know an asset identifier to exploit it remotely, requiring no authentication while being able to tamper with critical communication data.

Component
OpenRemote is an open-source Internet of Things (IoT) platform used to connect, monitor and control devices and assets, supporting asset management and notification delivery through a console.
Risks
  • Notification hijacking and redirection: An attacker can overwrite push notification tokens and redirect sensitive notifications intended for legitimate consoles to attacker-controlled devices
  • Denial of service: An attacker can tamper with console metadata so that legitimate consoles no longer receive notifications, creating monitoring blind spots or business disruption
  • Unauthenticated data tampering: An attacker can modify critical asset configuration without any credentials, undermining the integrity of system data
Source
NVD · CVE-2026-66013
Remediation
  • Immediately upgrade OpenRemote to version 1.26.2 or later
  • Monitor logs for anomalous changes to console asset metadata and notification tokens
  • Apply network-layer access control to restrict the sources permitted to reach the console registration API
CVE-2026-66012CVSS 10.0 Critical2026-07-25

SiYuan MCP Endpoint Missing Authorization Leading to Administrator Takeover

In SiYuan versions prior to v3.7.2, the POST /mcp kernel endpoint contains a missing authorization (CWE-862) security flaw. The endpoint is protected only by a generic authentication check, without enforced restrictions for administrator roles or read-only permissions, exposing 31 MCP tools including file operations. When the publishing server is enabled in anonymous mode, a remote unauthenticated attacker can use the anonymous JWT attached to proxied requests to reach the endpoint, read sensitive configuration files, write arbitrary files and plant malicious plugins, ultimately achieving administrator takeover. The vulnerability affects all SiYuan users who have not updated to v3.7.2, particularly deployments with anonymous publishing enabled. An attacker can exploit it remotely without user interaction and obtain the highest level of system control.

Component
SiYuan is a local-first, privacy-first personal knowledge management application supporting Markdown and block-level references, providing note taking, document management and plugin extension capabilities.
Risks
  • Sensitive information disclosure: An attacker can read conf/conf.json and extract critical credentials such as accessAuthCode, api.token and cookieKey in plaintext
  • Arbitrary file read and write: An attacker can perform list/read/write/delete/rename/copy operations across the entire workspace, damaging data integrity or planting backdoors
  • Administrator takeover: By planting a malicious plugin that executes with nodeIntegration:true and without contextIsolation, an attacker can gain administrator privileges when the desktop client starts
  • Unauthenticated remote attack: In anonymous publishing mode, an attacker can reach the protected endpoint directly without credentials and achieve remote code execution
Source
NVD · CVE-2026-66012
Remediation
  • Immediately upgrade SiYuan to v3.7.2 or later to fix the authorization logic flaw
  • Avoid enabling anonymous publishing mode in production (Conf.Publish.Auth.Enable=false)
  • Regularly monitor the data/plugins/ and conf/ directories for anomalous file changes
  • Apply network access control to the SiYuan service and restrict source IPs allowed to reach the /mcp endpoint

Package Poisoning2

Package Poisoningnpm2026-07-26

swiper_angular@5.9999.0 flagged as malicious

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5
ed12b4ed44fd40247c1f992dd708517c
Package Poisoningnpm2026-07-26

@ks-radar/radar@22.0.0 flagged as malicious

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5
22a22352f3516f0834fa75eb35c64fb8
← Back to Intel CenterRSSMonitor these risks automatically with CleanSource SCA →